Lint two OpenAPI specs for breaking changes and policy violations.

When to use: as the primary CI gate before merging API spec changes — combines diff + policy into a pass/fail verdict. When NOT to use: for raw change data (use delimit_diff) or quality scoring (delimit_spec_health).

Sibling contrast: delimit_diff returns changes only; delimit_diff_report renders HTML; this enforces policy.

Side effects: writes evidence on breaking findings; auto-chains semver classification and governance evaluation. dry_run=True suppresses evidence, notifications, and governance — returns violations + semver only.

Spec args accept local paths or http(s) URLs. URLs are fetched once into a tempfile (size cap, SSRF guard).

Diff two OpenAPI specs and list all changes (pure diff, no policy).

When to use: when you only need the structural change set (added / removed / modified endpoints, schemas, parameters) without any policy verdict. When NOT to use: as a CI gate — for pass/fail use delimit_lint, for a shareable HTML report use delimit_diff_report.

Sibling contrast: delimit_lint adds policy + governance; this is the underlying change list. delimit_diff_report wraps both in a presentable report.

Side effects: read-only. Calls backends.gateway_core.run_diff.

Generate a shareable API diff report with full analysis.

When to use: when a team needs a shareable artifact (API review, PR comment, compliance record) — runs diff + policy + semver + spec health + migration guide. When NOT to use: for a CI gate verdict (use delimit_lint) or raw diff data (delimit_diff).

Sibling contrast: delimit_lint enforces; delimit_diff is raw; this is the presentable composite report.

Side effects: read-only on inputs. When output_file is provided, writes the rendered HTML/JSON to disk. The HTML has inline CSS — no external dependencies, opens in any browser.

Score an OpenAPI spec on quality dimensions (0-100, A-F grade).

When to use: for quick spec quality checks during onboarding or review — completeness, security, consistency, documentation, best practices. When NOT to use: as a breaking-change gate (use delimit_lint) or raw diff (delimit_diff).

Sibling contrast: delimit_lint compares two specs; this scores one spec on its own merits.

Side effects: read-only. Calls backends.gateway_core.run_spec_health. Works on any valid OpenAPI 3.x or Swagger 2.0 spec.

Inspect or simulate governance policy configuration.

When to use: to inspect the active policy or dry-run lint+policy against several presets to preview what would block. When NOT to use: for an actual gate decision (use delimit_lint) or to manage the policy file itself (delimit_gov_policy).

Sibling contrast: delimit_gov_policy reads the live policy; delimit_lint enforces; this lets you simulate / inspect.

Side effects: read-only on policy + spec files. action="simulate" runs lint internally without writing evidence.

Query the append-only contract ledger (hash-chained JSONL).

When to use: to read or audit the cryptographically-chained contract ledger that records signed governance events. When NOT to use: for the project work ledger (use delimit_ledger_list / delimit_ledger_query) — the contract ledger is a different, hash-chained store.

Sibling contrast: delimit_ledger_list reads work items; delimit_audit reads audit logs; this reads the hash-chained contract ledger and can verify integrity.

Side effects: read-only. Calls backends.gateway_core.query_ledger.

Analyze downstream impact of an API change (informational only).

When to use: when assessing blast radius for a planned API change, by inspecting a dependency manifest for callers of the named API. When NOT to use: to make a gate decision (use delimit_lint or delimit_gov_evaluate for pass/fail) — this returns information.

Sibling contrast: delimit_lint returns pass/fail; this returns a blast-radius report.

Side effects: read-only. Calls backends.gateway_core.run_impact.

Classify a spec change's semver bump (MAJOR/MINOR/PATCH/NONE).

When to use: to deterministically pick the version bump for an API spec change, optionally computing the next version string. When NOT to use: for full lint with policy (use delimit_lint) or a plain change list (delimit_diff).

Sibling contrast: delimit_diff lists changes; delimit_lint adds policy; this maps the diff to a semver verdict only.

Side effects: read-only. Calls backends.gateway_core.run_semver (deterministic classification on top of the diff engine output).

Render a human-readable explanation of API changes (7 templates).

When to use: to produce migration notes, PR comments, changelog entries, or Slack-friendly summaries from a spec diff. When NOT to use: for raw change data (use delimit_diff) or a shareable HTML report (delimit_diff_report).

Sibling contrast: delimit_diff returns structured change data; delimit_diff_report renders an HTML report; this renders a template-driven text explanation.

Side effects: read-only. Calls backends.gateway_core.run_explain.

Extract OpenAPI spec from framework source code (no spec file needed).

When to use: when a project has no checked-in OpenAPI spec but uses a framework Delimit can introspect (FastAPI today; Express, NestJS planned). When NOT to use: when a spec file already exists — pass it directly to delimit_lint or delimit_diff.

Sibling contrast: delimit_lint operates on existing spec files; this generates one from source.

Side effects: read-only on the project source. Calls backends.gateway_core.run_zero_spec which may invoke a Python subprocess to introspect FastAPI routes.

Initialize Delimit governance scaffolding for a project.

When to use: once per project, the first time you adopt Delimit — creates .delimit/policies.yml, ledger directory, and (optionally) a project .claude/settings.json with a reasonable allowlist. When NOT to use: to load an existing config (use delimit_project_config action="load") or to discover Delimit's capabilities for a project (delimit_scan).

Sibling contrast: delimit_project_config manages the config after init; delimit_scan inspects what could be governed; this is the one-time initializer.

Side effects: creates .delimit/policies.yml + ledger dir; chmod 755 on .delimit/, chmod 600 on .delimit/secrets/*; writes a project .claude/settings.json with an Edit/Write/Bash allowlist if missing. Pass no_permissions=True to skip the permission step.

Mint an OS-level execution plan against a target component (Pro).

When to use: to draft a structured plan (deploy, migrate, rotation, rollback) that the governance kernel can later inspect via delimit_os_gates and human reviewers can approve before any side-effecting execution. The pattern is plan -> approval check via gates -> separate execution call. When NOT to use: for aggregate OS counts (delimit_os_status), to check gate state on an existing plan (delimit_os_gates), or to actually execute a deploy (delimit_deploy_* / delimit_deploy_build). Also do not use this as an audit-trail surrogate for free-form work; that is delimit_ledger_add territory.

Sibling contrast: delimit_os_gates checks gates on an existing plan; delimit_os_status reports portfolio-wide counts; this is the only OS surface that mints a new plan. Compared to delimit_gov_new_task (governance-classed task), this records an OS-level operation (deploy/migrate/rotation) rather than a policy-scoped task.

Side effects: gated by require_premium — unlicensed callers receive a license payload and no plan is created. On a licensed call, parameters is first coerced (string -> dict via _coerce_dict_arg); a malformed payload short-circuits with an error response. On success, invokes backends.os_bridge.create_plan which writes a new plan record to the OS plan store keyed by a generated plan_id. Result is wrapped via _with_next_steps. No deploy is executed by this call.

Report overall Delimit platform status (plans, tasks, tokens) (Pro).

When to use: at session start or in a status dashboard, to read aggregate OS-level counts and active plan IDs. When NOT to use: for governance health (use delimit_gov_health) or per-plan gates (use delimit_os_gates).

Sibling contrast: delimit_gov_health reports governance engine; delimit_os_gates reports a specific plan's gate state; this reports overall OS counts.

Side effects: read-only on the OS backend; gated by require_premium. Calls backends.os_bridge.get_status.

Prerequisite: requires Delimit Pro. An unlicensed call returns {"error": ..., "upgrade": "https://delimit.ai/pricing"} without running.

Args: None.

Returns: Dict with plan/task/token counts and next_steps.

Check governance gates for an OS plan (Pro).

When to use: to check whether a specific plan is currently blocked by a governance gate before proceeding. When NOT to use: for general OS counts (use delimit_os_status) or governance engine health (delimit_gov_health).

Sibling contrast: delimit_os_status returns aggregate counts; delimit_gov_health reports the engine; this returns gate state for one plan.

Side effects: read-only on the OS backend; gated by require_premium. Calls backends.os_bridge.check_gates.

Unified governance entry point — dispatches to one of seven actions.

When to use: as the single MCP-registered governance surface (delimit_gov) when the caller wants to pick the action by name in one call rather than choosing a specific delimit_gov_* alias. When NOT to use: from internal code paths — prefer the specific alias (delimit_gov_health, delimit_gov_evaluate, etc.) for clarity and so docstrings and license gates show up at the right call site.

Sibling contrast: each delimit_gov_ wrapper above is a thin alias over this implementation; they exist so the action's docstring lives at the right name. This is the dispatch core.

Side effects: action="health" / "status" are read-only and not gated. action="policy" / "evaluate" / "new_task" / "run" / "verify" are gated by require_premium — unlicensed callers receive a license payload and no backend call is made. Each gated action routes to a distinct backends.governance_bridge function (health, status, policy, evaluate_trigger, new_task, run_task, verify) and the result is wrapped via _with_next_steps for orchestrator hints. Errors are deterministic ({"error": ...}); inputs that cannot be coerced (e.g. malformed context for evaluate) short-circuit before the backend call.

Report whether the governance kernel and policy are reachable.

When to use: at session start as part of the standard orchestrator ritual (delimit_revive + delimit_ledger_context + this + inbox daemon), or as a CI smoke check before a gated deploy. Confirms the governance backend is reachable and the policy kernel is loaded so downstream gates will fail-closed correctly rather than silently no-op. When NOT to use: to evaluate whether a specific candidate action requires gating (use delimit_gov_evaluate), to read the rules themselves (delimit_gov_policy), or to check per-repo task state (delimit_gov_status).

Sibling contrast: delimit_gov_status reports per-repo workload (open tasks, recent decisions); this reports the engine layer itself (kernel boot status, policy load, backend integration). If a deploy gate is failing, run this first to rule out "engine down" before debugging policy logic.

Side effects: read-only and not license-gated. Invokes backends.governance_bridge.health and wraps the response through _with_next_steps. No ledger write, no notification, no evidence file. Safe to call on every session start without rate concern.

Report governance state (open tasks, decisions) for a repo.

When to use: when you need a snapshot of governance activity for a given repo — what tasks are open, what was recently decided. When NOT to use: for engine-level health (use delimit_gov_health) or to evaluate a new action (use delimit_gov_evaluate).

Sibling contrast: delimit_gov_health reports the engine; this reports the workload (per-repo task and decision state).

Side effects: read-only. Calls backends.governance_bridge.status.

Read the active governance policy for a repository (Pro).

When to use: when an agent or operator needs to inspect the live policy rules being enforced for a repo (risk thresholds, gates). When NOT to use: to mutate policy — this tool is read-only.

Sibling contrast: delimit_gov_evaluate runs an action against the policy; this returns the policy itself.

Side effects: read-only on policy storage; gated by require_premium (returns a license payload if the caller is unlicensed).

Prerequisite: requires Delimit Pro. An unlicensed call returns {"error": ..., "upgrade": "https://delimit.ai/pricing"} without running.

Evaluate whether a proposed action triggers governance gating (Pro).

When to use: BEFORE performing any action whose policy class is uncertain — deploy, external PR submission, schema change, npm publish, force-push, force-update of a floating tag, account switch, ruleset edit. This is the canonical pre-action check the orchestrator and CI hooks call; the response is the gate verdict. When NOT to use: to read the policy rules themselves (use delimit_gov_policy), to materialize a tracked task from a "gating required" verdict (delimit_gov_new_task), or to check engine health (delimit_gov_health). Also: do not call after starting the action — the verdict is decision-time and a retroactive call has no gating effect.

Sibling contrast: delimit_gov_policy returns the rules; this evaluates a candidate action against them. delimit_external_pr_check handles the specialised external-PR duplicate path; this is the general action evaluator. delimit_gov_new_task is what you call AFTER this returns "gating required" to mint a tracked task.

Side effects: read-only on policy storage and gated by require_premium — unlicensed callers receive a license payload and no evaluation runs. On a licensed call, invokes backends.governance_bridge.evaluate_trigger which loads the active policy and returns a verdict; no task is created, no ledger write, no evidence file. Inputs are coerced before the backend call: a string context is wrapped as {"text": ...} via _coerce_dict_arg; a malformed context short-circuits with an error response.

Create a governance-classed task with risk tier and scope (Pro).

When to use: immediately after delimit_gov_evaluate returns a "gating required" verdict and you need a tracked, audit-bearing record before performing the gated work. The three-step pipeline is delimit_gov_new_task -> delimit_gov_run -> delimit_gov_verify; this is step one. When NOT to use: for free-form work tracking (use delimit_ledger_add), to perform the work itself (delimit_gov_run), or to verify a completed task (delimit_gov_verify).

Sibling contrast: delimit_ledger_add tracks general work items with no policy gating; this creates a governance-classed task with a risk tier and scope record that the run/verify steps operate on. delimit_gov_evaluate returns a verdict only; this materializes that verdict into a tracked task.

Side effects: gated by require_premium — unlicensed callers receive a license payload, no task created. On a licensed call, invokes backends.governance_bridge.new_task which writes a new task record keyed by a generated task_id into the governance task store; the record carries title, scope, risk_level, repo path, and creation timestamp. The response is routed through _with_next_steps so the returned dict carries orchestrator hints.

Execute a previously created governance task under policy (Pro).

When to use: as step two of the three-step governance pipeline, after delimit_gov_new_task has minted a task_id and before delimit_gov_verify closes it out. Call when you are ready to perform the gated work and want the policy engine to record the execution. When NOT to use: to evaluate a candidate action (use delimit_gov_evaluate), to mint a task (delimit_gov_new_task), or to attest a completed task (delimit_gov_verify).

Sibling contrast: delimit_gov_new_task creates the task record but does no work; this records the execution against an existing task_id; delimit_gov_verify attests the run output afterwards. The full pipeline is new_task -> run -> verify.

Side effects: gated by require_premium — unlicensed callers receive a license payload, no execution recorded. On a licensed call, invokes backends.governance_bridge.run_task which appends a run record to the task identified by task_id (status transition, timestamp, repo). The response is routed through _with_next_steps so the returned dict carries orchestrator hints. Note this tool records the run event; it does NOT itself perform the underlying work — the caller is expected to do that.

Attest that a governance task completed under policy (Pro).

When to use: as step three (closing step) of the governance pipeline, immediately after delimit_gov_run has recorded the execution. This is the call that flips a task from "ran" to "verified" and produces the attestation entry used by downstream audit consumers. When NOT to use: to mint a task (delimit_gov_new_task) or to record the execution itself (delimit_gov_run). Verify is closing only — it does not run work and does not create tasks.

Sibling contrast: delimit_gov_new_task creates; delimit_gov_run records execution; this attests the outputs satisfy policy. Compared to delimit_evidence_verify (which checks an evidence file), this attests against the policy engine, not a static file.

Side effects: gated by require_premium — unlicensed callers receive a license payload, no verification recorded. On a licensed call, invokes backends.governance_bridge.verify which writes a verification record against the task_id (verdict, timestamp, repo, policy snapshot). The response is routed through _with_next_steps. Does not perform additional work — only validates and records the verdict.

Prerequisite: requires Delimit Pro. An unlicensed call returns {"error": ..., "upgrade": "https://delimit.ai/pricing"} without running.

Pre-PR duplicate guard for external repos — call BEFORE drafting.

When to use: as the first step before drafting any PR against a repo you don't own. Fail-closed by design. When NOT to use: for internal repos or to evaluate a non-PR action (use delimit_gov_evaluate).

Sibling contrast: delimit_gov_evaluate(action="external_pr") wraps this with policy evaluation; this is the underlying duplicate check.

Side effects: read-only network call. Calls backends.governance_bridge.external_pr_check which shells out to gh CLI. Any open PR or PR merged in the last 30 days yields verdict="duplicate" — caller stops drafting.

Pre-submit gate for autonomous github outreach (LED-2214b).

When to use: as the LAST step before any agent submits a comment, issue body, or PR description to a third-party github repo via the outreach_substantive task path. Mandatory under CLAUDE.md SHIFT-1; bypass requires explicit founder approval. When NOT to use: for internal repo content, for posts on platforms other than github, or for non-outreach submissions (use the surface's own validators instead).

Sibling contrast: delimit_external_pr_check guards PR duplication; this guards the substantive-content boundary itself. For a PR submission the agent calls BOTH — this one first to refuse covert-commercial drafts, then external_pr_check to refuse duplicates.

Side effects: read-only. Pure validator over the body string and target metadata; no network, no ledger writes, no notifications.

The gate runs in two stages:

1. Target-side veto — if repo / repo_description / repo_topics contain a banking / fintech / regulator-adjacent keyword, the gate blocks regardless of content quality (SHIFT-1 hard veto; KYC would deanonymize the operating account).

2. Content shape — bans forbidden phrases (incl. our own product names), requires at least one technical anchor (commit hash, issue number, CVE, spec path, source file path), enforces minimum body length.

Run one tick of the autonomous github-outreach loop (LED-2214b).

When to use: from an external scheduler (cron, loop_daemon) or for an ad-hoc manual cycle. The tick monitors existing outreach LEDs for new activity AND scans for new substantive candidates. When NOT to use: as a backfill for thousands of stale items — the per-tick caps are intentional. Multiple ticks at the scheduler interval is the right pattern.

Sibling contrast: delimit_social_target scans a broader platform set; this is github-only and dispatches via the substantive- outreach path (with the SHIFT-1 gates). delimit_sensor_github_ issue watches a single issue; this orchestrates the sensor over every open outreach LED.

Side effects: reads ledger, network reads (gh CLI) for the monitor phase, writes new intel-class LEDs + dispatches new substantive tasks for the scan phase. Honours the DELIMIT_GITHUB_OUTREACH_DISABLED env var and the ~/.delimit/outreach_pause sentinel file as kill switches.

Score MCP tool docstrings against the 6 TDQS dimensions (LED-2108).

When to use: as a CI gate before publishing the MCP server, to catch low-quality tool descriptions. Operates on any Python file with @mcp.tool()-decorated functions.

When NOT to use: for runtime tool selection or policy decisions — TDQS grades documentation, not behaviour. Use delimit_lint for OpenAPI specs and delimit_gov_evaluate for policy-class decisions.

Sibling contrast: unlike delimit_lint (OpenAPI specs) and delimit_spec_health (spec quality scoring), this scores Python source against Glama's Tool Definition Quality Score rubric.

Side effects: none. Pure read-only static analysis via ast (no import, no execution). Does not write ledger, evidence, or notify.

Search conversation memory semantically (Pro).

When to use: to recall prior context by meaning rather than recency — e.g. "what did we decide about deploys?" finds relevant entries across sessions. When NOT to use: for the chronological tail (use delimit_memory_recent) or to write a memory (delimit_memory_store).

Sibling contrast: delimit_memory_recent is the free chronological tail; this is the Pro semantic search.

Side effects: read-only on the memory backend; gated by require_premium. Calls backends.memory_bridge.search.

Prerequisite: requires Delimit Pro. An unlicensed call returns {"error": ..., "upgrade": "https://delimit.ai/pricing"} without running.

Store a memory entry for future cross-session retrieval (Free tier).

When to use: per the orchestrator's memory rules — to capture failed approaches, architecture decisions, key context, or setup gotchas that git would not surface. When NOT to use: for routine code changes (git is the source of truth) or for venture-scoped artifacts (use delimit_context_write).

Sibling contrast: delimit_memory_search retrieves; delimit_memory_recent reads the tail; this writes.

Side effects: writes a memory entry via backends.memory_bridge.store. Free tier — no license gate. hot_load=True marks the entry for projection into the Claude Code auto-memory MEMORY.md hot-load index (PR-B writer projects on next sync).

Return the most recent memory entries (Free tier).

When to use: at session start to recall what the previous session was working on, or to scan for the last N memory captures. When NOT to use: for semantic / structured search (use delimit_memory_search) or to write a memory (delimit_memory_store).

Sibling contrast: delimit_memory_search does Pro semantic search; this is the free chronological tail.

Side effects: read-only. Calls backends.memory_bridge.get_recent. Free tier — no license gate.

Project delimit_memory hot entries into Claude Code's MEMORY.md.

When to use: to surface hot delimit_memory entries (flagged hot_load=True) into Claude Code's MEMORY.md so they load on session start without making delimit_memory dependent on Anthropic's auto-memory format. When NOT to use: to add a new memory (use delimit_memory_store) or search existing memories (delimit_memory_search, delimit_memory_recent).

Sibling contrast: delimit_memory_store writes a new entry; delimit_memory_search queries; delimit_memory_recent returns the tail; this is the one-way projection into MEMORY.md.

Side effects: writes to target_path (default ~/.claude/projects/-root/memory/MEMORY.md). If the file already has <!-- delimit:start --> / <!-- delimit:end --> markers, ONLY the content between them is replaced; anything outside is preserved. If markers are missing, the managed section is APPENDED to the end of the file (existing content is never touched). If the file does not exist, it is created with just the section. One-way projection only — MEMORY.md is never read back into delimit_memory (Anthropic owns the auto-memory format; format-drift risk).

LED-1165 Phase 2 #5 PR-B.

Search vault entries by query string (Pro).

When to use: to retrieve stored vault content matching a search string. The vault holds long-lived knowledge artifacts. When NOT to use: for conversation memory (use delimit_memory_search) or to capture state (delimit_vault_snapshot).

Sibling contrast: delimit_memory_search hits the conversation memory store; this hits the vault — different storage, different semantics.

Side effects: read-only on the vault backend; gated by require_premium. Calls backends.vault_bridge.search.

Prerequisite: requires Delimit Pro. An unlicensed call returns {"error": ..., "upgrade": "https://delimit.ai/pricing"} without running.

Report vault subsystem health (Pro).

When to use: at session start or as a CI smoke test to confirm the vault backend is reachable and indexes are intact. When NOT to use: to query content (use delimit_vault_search) or to capture state (delimit_vault_snapshot).

Sibling contrast: delimit_vault_search reads content; delimit_vault_snapshot captures state; this reports the engine's own health.

Side effects: read-only on the vault backend; gated by require_premium. Calls backends.vault_bridge.health.

Prerequisite: requires Delimit Pro. An unlicensed call returns {"error": ..., "upgrade": "https://delimit.ai/pricing"} without running.

Args: None.

Returns: Dict with health status and next_steps.

Capture a snapshot of vault state (Pro).

When to use: before a risky vault edit, to have a rollback point for content recovery. When NOT to use: for searching content (use delimit_vault_search) or checking health only (delimit_vault_health).

Sibling contrast: delimit_vault_health reports up/down only; this returns a structured snapshot of state.

Side effects: gated by require_premium. Calls backends.vault_bridge.snapshot, which writes a snapshot record on the vault backend.

Args: None.

Returns: Dict with snapshot data and next_steps.

Unified deployment entry point — dispatches to one of eight actions (Pro).

When to use: as the single MCP-registered deploy surface (delimit_deploy) when the caller wants to pick the deploy operation by name in one call rather than choosing a specific delimit_deploy_* alias. Covers the full container chain (plan -> build -> publish -> verify -> rollback), the deploy-state read (status), and the two non-container ship paths (site / npm). When NOT to use: from internal code paths or when you want the operation's behavior and gate to surface at the right name — prefer the specific alias (delimit_deploy_plan, delimit_deploy_build, delimit_deploy_publish, delimit_deploy_verify, delimit_deploy_rollback, delimit_deploy_status, delimit_deploy_site, delimit_deploy_npm). For a pure runtime health check use delimit_obs_status; for a pre-deploy smoke test use delimit_test_smoke; for release-tracking metadata use delimit_release_status.

Sibling contrast: each delimit_deploy_ wrapper is a thin alias over this implementation (they exist so the action's docstring lives at the right name). This is the dispatch core. The "plan" action additionally shares logic with delimit_deploy_plan via the internal _deploy_plan_chain helper.

Side effects: ALL actions are gated by require_premium — unlicensed callers receive a license payload and no backend call is made. Errors are deterministic: an unrecognized action returns {"error": "Unknown action ''. Valid: ..."} before any gate or backend call. Per action:

• "plan": delegates to _deploy_plan_chain (gate key "deploy_plan"). Read-mostly but ORCHESTRATES a chain: a worktree-sanity precheck, then delimit_security_audit (FAIL-CLOSED — halts with status="blocked" on audit error or any critical finding without producing a plan), then the deploy-bridge plan, then a best-effort delimit_gov_evaluate. Produces no deploy artifact itself.

• "build": gate "deploy_build". WRITES locally — shells out to the container builder (consumes local disk/CPU for image layers). No network push at this step.

• "publish": gate "deploy_publish". NETWORK WRITE — pushes previously built images to the configured container registry.

• "verify": gate "deploy_verify". Read-only network PROBES (HTTP health checks, container/dependency inspection) of a deployed revision. May return partial results on backends without health endpoints.

• "rollback": gate "deploy_rollback". MUTATES the running environment to point at to_sha (reversal-only).

• "status": gate "deploy_status". READ-ONLY query of the deploy state store. No write, no probe.

• "site": repo_path is required and project_path resolves inside it. gate "deploy_site". LOCAL scoped git ops + a NETWORK Vercel build. The default uses only pre-staged changes; explicit paths are the only way the tool stages files. A post-push Vercel timeout returns pending with continuation identifiers instead of closing the transport.

• "npm": gate "deploy_npm". A PRODUCTION DEPLOY — bumps package.json (LOCAL write), runs prepublishOnly, npm pack, then npm publish (a publicly-visible NETWORK write, effectively not undoable). dry_run=True suppresses only the final publish; the bump and pack still run. Every result is wrapped via _with_next_steps for orchestrator hints.

Generate a deploy plan with security preflight (Pro).

When to use: as the first step in the deploy chain. The plan enumerates build steps and bakes in a security audit + governance evaluation before any artifact is produced. When NOT to use: to actually build images (use delimit_deploy_build) or to ship code (use delimit_deploy_publish).

Sibling contrast: this is the planning gate; delimit_deploy_build and delimit_deploy_publish are the execution steps that follow.

Side effects: auto-chains delimit_security_audit (fail-closed on critical findings), then delimit_gov_evaluate, then the underlying deploy_plan handler. Halts and returns status="blocked" on any critical security finding without producing a plan.

Build container images for an app at a specific git ref (Pro).

When to use: as the second step of the deploy chain after delimit_deploy_plan has succeeded and you need SHA-tagged container images locally before delimit_deploy_publish pushes them to the registry. The full chain is plan -> build -> publish -> verify -> (rollback on failure). When NOT to use: to push existing images to a registry (use delimit_deploy_publish), to deploy a site (delimit_deploy_site), to publish an npm package (delimit_deploy_npm), or to start the full chain (delimit_deploy_plan).

Sibling contrast: deploy_plan plans, this builds local images, deploy_publish pushes to the registry, deploy_verify checks rollout health, deploy_rollback reverts. Compared to delimit_deploy_site (static-site deploy) and delimit_deploy_npm (npm publish), this is the container path.

Side effects: gated by require_premium — unlicensed callers receive a license payload and no build runs. On a licensed call, invokes backends.deploy_bridge.build which shells out to the local container builder (e.g. docker buildx) — this consumes local disk for image layers and CPU for the build. No network push at this step (that is delivery_publish). The response is routed through _with_next_steps.

Publish previously built images to the registry (Pro).

When to use: after delimit_deploy_build has produced images locally. When NOT to use: to build images (delimit_deploy_build) or to start the deploy chain (delimit_deploy_plan).

Sibling contrast: deploy_build produces local images; this pushes them to the registry; deploy_verify confirms rollout health.

Side effects: gated by require_premium. Calls backends.deploy_bridge.publish, which performs network writes to the configured container registry.

Prerequisite: requires Delimit Pro. An unlicensed call returns {"error": ..., "upgrade": "https://delimit.ai/pricing"} without running.

Probe a freshly-deployed revision's health — experimental (Pro).

When to use: immediately after delimit_deploy_publish has rolled out a new revision, to confirm the new SHA is actually healthy before declaring the deploy done and closing out the chain (delimit_deploy_verify -> delimit_evidence_collect -> delimit_ledger_done -> delimit_notify). If this returns unhealthy, the next step is delimit_deploy_rollback. When NOT to use: for steady-state runtime health checks (use delimit_obs_status / delimit_obs_metrics), to read deploy-system metadata only (delimit_deploy_status), or for a smoke test before deploy (delimit_test_smoke).

Sibling contrast: delimit_deploy_status reads deploy-system metadata only; this actively probes the running deployment. delimit_obs_status is the steady-state observability surface; this is post-deploy-only.

Side effects: gated by require_premium — unlicensed callers receive a license payload and no probe runs. On a licensed call, invokes backends.deploy_bridge.verify which performs network health checks against the deployed app (HTTP probes, container inspection, dependency reachability). No write. Marked EXPERIMENTAL — health logic may return partial results on backends without health endpoints; do not treat as authoritative for runtime SLOs.

Roll back an environment to a previous SHA (Pro).

When to use: when delimit_deploy_verify shows a regression and you need to revert the running deployment to a known-good revision. When NOT to use: to deploy a new version forward (delimit_deploy_plan -> _build -> _publish) — rollback is reversal-only.

Sibling contrast: delimit_deploy_publish moves an env forward; this moves it back to a prior to_sha.

Side effects: gated by require_premium. Calls backends.deploy_bridge.rollback which mutates the running environment to point at to_sha.

Prerequisite: requires Delimit Pro. An unlicensed call returns {"error": ..., "upgrade": "https://delimit.ai/pricing"} without running.

Read the current rollout metadata for an app/env (Pro).

When to use: to inspect the currently deployed SHA, rollout state, and any in-progress deploy without actually probing the running app. Useful for "what is live right now?" questions and for the deploy dashboard. When NOT to use: for active runtime health probes (use delimit_deploy_verify), for steady-state observability metrics (delimit_obs_metrics / delimit_obs_status), or to deploy a change (delimit_deploy_plan / delimit_deploy_build).

Sibling contrast: delimit_deploy_verify exercises the running app via probes; this reads deploy-system metadata only. delimit_release_status is the sibling on the release-tracking side (versions, history). Compared to a registry inspection, this reports rollout state, not just image presence.

Side effects: read-only against the deploy backend and gated by require_premium — unlicensed callers receive a license payload and no query runs. On a licensed call, invokes backends.deploy_bridge.status which queries the deploy state store. No write, no probe, no notification. Response routed through _with_next_steps.

Prerequisite: requires Delimit Pro. An unlicensed call returns {"error": ..., "upgrade": "https://delimit.ai/pricing"} without running.

Register a new dataset in the file-based intel registry.

When to use: at the start of an intel collection effort, to declare a named dataset that future ingest calls will write to. When NOT to use: to write data into an existing dataset (use delimit_intel_snapshot_ingest) or to inventory datasets (delimit_intel_dataset_list).

Sibling contrast: delimit_intel_dataset_list inventories; delimit_intel_dataset_freeze locks; this creates.

Side effects: writes a registry entry via backends.tools_data.intel_dataset_register. Coerces schema from a JSON string to a dict via _coerce_dict_arg.

List all datasets in the intel registry.

When to use: to inventory datasets currently registered for intel queries. When NOT to use: to register a new dataset (use delimit_intel_dataset_register) or to freeze one (delimit_intel_dataset_freeze).

Sibling contrast: delimit_intel_dataset_register writes; delimit_intel_dataset_freeze locks; this reads metadata.

Side effects: read-only. Calls backends.tools_data.intel_dataset_list.

Args: None.

Returns: Dict with the dataset registry and next_steps.

Freeze a dataset to make it immutable for replay integrity.

When to use: when a dataset is about to be referenced as evidence or signed attestation, and you want to lock its content forever. When NOT to use: to delete a dataset (the registry is append-only) or to inspect what's frozen (use delimit_intel_dataset_list).

Sibling contrast: delimit_intel_dataset_list inventories; delimit_intel_dataset_register writes; this locks against further writes.

Side effects: writes a frozen marker to the registry via backends.tools_data.intel_dataset_freeze. Subsequent writes to this dataset id will be rejected.

Store a research snapshot with provenance in the intel store.

When to use: to ingest research / signal data with provenance (source, author) for later replay or attestation. When NOT to use: to register a dataset (use delimit_intel_dataset_register) or query existing snapshots (delimit_intel_query).

Sibling contrast: delimit_intel_dataset_register declares; delimit_intel_query reads; this writes new snapshots.

Side effects: writes a snapshot record via backends.tools_data.intel_snapshot_ingest. Coerces data and provenance from JSON strings to dicts via _coerce_dict_arg.

Search saved intel snapshots by keyword, date, or dataset.

When to use: to surface ingested intel matching a query, optionally scoped to one dataset. When NOT to use: to ingest new data (use delimit_intel_snapshot_ingest) or list datasets (delimit_intel_dataset_list).

Sibling contrast: delimit_intel_snapshot_ingest writes; this reads back filtered snapshots.

Side effects: read-only. Calls backends.tools_data.intel_query. Coerces parameters from JSON string to dict via _coerce_dict_arg.

Generate a structured daily digest of loop activity (LED-966).

When to use: for the founder daily summary — signals, deliberations, ledger movement, swarm dispatch, health. When NOT to use: for raw notifications (use delimit_notify) or inbox routing (delimit_notify_inbox).

Sibling contrast: delimit_notify is per-event; this is a windowed rollup digest.

Side effects: action="run" always writes markdown + json to ~/.delimit/digest/ (the founder can read directly, no email dependency). When send_email=True, emails via the notify pipeline, BUT delivery requires DELIMIT_DIGEST_EMAIL=true in the env (pipeline gate). action="latest" is read-only.

Manage work orders — structured task artifacts for the founder (STR-177).

When to use: to list, read, or close work orders that bridge strategy deliberations and interactive execution. When NOT to use: for ledger items (use delimit_ledger_*) or governance tasks (delimit_gov_new_task / run / verify).

Sibling contrast: delimit_ledger_add tracks general work; delimit_gov_new_task is governance-classed; this is the founder work-order surface — copy-pasteable markdown artifacts.

Side effects: action="list" / "show" are read-only. action="complete" writes to the work-order store via ai.work_order.complete_work_order.

Run approved work orders from the dashboard inbox (Pro) (Worker Pool v2).

When to use: as the autonomous executor for human-approved work orders, or to inspect/pause the executor. When NOT to use: to dispatch new agent work (use delimit_agent_dispatch) or close out a work order (delimit_work_orders complete).

Sibling contrast: delimit_work_orders reads/closes the work order artifact; this is the run surface that turns approved orders into real GitHub side effects.

Side effects: action="run" / "poll" with live=True fire whitelisted state-changing actions: gh_issue_create, gh_pr_comment, gh_issue_comment. Every invocation is logged to ~/.delimit/workers/audit/executor.jsonl. Touch ~/.delimit/pause_executor to halt the autonomous path at the next tick.

Prerequisite: requires Delimit Pro. An unlicensed call returns {"error": ..., "upgrade": "https://delimit.ai/pricing"} without running.

Review and manage the signal corpus (LED-877).

When to use: to inspect, cluster, or explicitly promote sensed signals into ledger items. Signals live separately from the ledger so noise doesn't pollute it. When NOT to use: to fetch new signals (use the platform-specific sensors like delimit_reddit_scan / delimit_github_scan) or write ledger items directly (delimit_ledger_add).

Sibling contrast: platform sensors capture; this manages the captured corpus and bridges it into the ledger.

Side effects: "promote" writes a new ledger item (via the ledger manager). "freeze" cold-archives a month of signals. "query", "digest", "show", "status" are read-only against ~/.delimit/intel/signals/.

Write a single file from a code template into an existing project.

When to use: when an existing project needs one more piece — a component, a page, an API handler — and you want the framework-conformant skeleton (imports, exports, default structure) rather than hand-writing the boilerplate. Pair with delimit_test_generate to scaffold the matching test file. When NOT to use: to lay out a fresh project (use delimit_generate_scaffold), to design a UI component with tokens (delimit_design_generate_component), or to bulk-generate many files (call this once per file, or write a custom script).

Sibling contrast: delimit_generate_scaffold lays out a complete project tree; this writes a single file. Compared to delimit_design_generate_component, this is framework-only and does not consume design tokens. Compared to delimit_test_generate, this writes source, not tests.

Side effects: writes ONE file to disk under target/ via backends.generate_bridge.template. target is sanitised via _sanitize_path — paths escaping the workspace short-circuit with an error. features is coerced from a comma string to a list via _coerce_list_arg. No license gate, no ledger write, no notification. If a file with the same name already exists, the backend determines overwrite vs. error — call with care on populated directories.

Lay out a fresh project tree with framework-conformant skeleton.

When to use: at project zero, when starting a new Next.js app, API service, or library and you want the standard directory tree, package.json/pyproject.toml, lint config, and entry-point files all written in one call. Typical follow-up is delimit_init to set up governance scaffolding in the new project root. When NOT to use: to add files to an existing project (use delimit_generate_template for single-file scaffolds), to duplicate an existing project (use the shell), or to add a package to an existing project (use the project's own package manager directly).

Sibling contrast: delimit_generate_template writes a single file into an existing project; this writes a NEW project tree. Compared to create-next-app / cookiecutter, this routes the scaffold through the Delimit bridge so the resulting project can later be wired into delimit_init governance with no manual cleanup.

Side effects: writes MANY new files and directories under a new name/ root via backends.generate_bridge.scaffold. packages is coerced from a comma string to a list via _coerce_list_arg (malformed values short-circuit). No license gate. No ledger write, no notification. The backend determines collision behaviour if name/ already exists — call against a fresh target.

Diagnose repository health issues (experimental) (Pro).

When to use: before a commit or push to surface common repo problems — broken hooks, missing config, dirty working tree. When NOT to use: for full quality analysis (use delimit_repo_analyze) or per-file config validation (delimit_repo_config_validate).

Sibling contrast: delimit_repo_analyze is a deeper structural audit; this is a quick health-check pass.

Side effects: read-only on the repo; gated by require_premium. Calls backends.repo_bridge.diagnose. Marked experimental — output schema may evolve.

Analyze repository structure and quality (experimental).

When to use: for a deep audit of a repo (local or remote) — code structure, language mix, quality signals. When NOT to use: for a fast health pass (use delimit_repo_diagnose) or config-only audit (delimit_repo_config_audit).

Sibling contrast: delimit_repo_diagnose is a quick smoke test; this is the deeper structural audit.

Side effects: read-only on the resolved local path. Accepts local path, "owner/repo" shorthand, or GitHub URL — remote inputs are shallow-cloned into a tempdir for the call. Calls backends.repo_bridge.analyze through _run_repo_tool_with_remote.

Validate repository configuration files (experimental).

When to use: as a pre-merge check that .github/, package.json, pyproject.toml, etc. are well-formed and self-consistent. When NOT to use: for compliance vs an external standard (use delimit_repo_config_audit) or full repo analysis (delimit_repo_analyze).

Sibling contrast: delimit_repo_config_audit reports policy compliance; this checks structural validity.

Side effects: read-only on the resolved local path. Accepts local path, "owner/repo" shorthand, or GitHub URL — remote inputs are shallow-cloned into a tempdir. Calls backends.repo_bridge.config_validate via _run_repo_tool_with_remote.

Audit repository configuration for compliance (experimental).

When to use: when checking a repo's config against a compliance standard — required files, branch protection, license header. When NOT to use: for structural validity (use delimit_repo_config_validate) or full quality analysis (delimit_repo_analyze).

Sibling contrast: delimit_repo_config_validate checks well-formedness; this checks compliance.

Side effects: read-only on the resolved local path. Accepts local path, "owner/repo" shorthand, or GitHub URL — remote inputs are shallow-cloned. Calls backends.repo_bridge.config_audit via _run_repo_tool_with_remote.

Scan a repository for security vulnerabilities.

When to use: as a baseline security pass over a repo, before a deploy or a release. When NOT to use: to ingest external scan results (use delimit_security_ingest) or to triage findings (delimit_security_deliberate).

Sibling contrast: delimit_security_ingest accepts external scanner output; delimit_security_deliberate triages findings; this is the built-in scan.

Side effects: read-only on the target. Calls backends.repo_bridge.security_scan.

Ingest external security scan output and normalize into ledger findings (Pro).

When to use: after running a scanner externally — Trivy, Semgrep, npm-audit, pip-audit, Snyk, CodeQL — to feed its JSON output into Delimit's canonical schema and gate deploys on unresolved criticals. When NOT to use: to run a scan from scratch (use delimit_security_scan) or to triage findings (delimit_security_deliberate).

Sibling contrast: delimit_security_scan runs the built-in scan; delimit_security_deliberate triages findings; this is the bridge that pulls external scanner output into the same ledger.

Side effects: gated by require_premium. Writes findings to the ledger (creates new items, optionally closes resolved ones). Computes a stable fingerprint per finding to enable diffing.

Prerequisite: requires Delimit Pro. An unlicensed call returns {"error": ..., "upgrade": "https://delimit.ai/pricing"} without running.

Multi-model triage of security findings (Pro).

When to use: after delimit_security_ingest has loaded findings, to classify each as real risk / false positive / accepted risk / needs immediate action. When NOT to use: to ingest the findings (use delimit_security_ingest) or to scan from scratch (delimit_security_scan).

Sibling contrast: delimit_deliberate is general-purpose multi-model consensus; this is the security-class variant scoped to findings.

Side effects: gated by require_premium. Calls multiple models via the deliberation panel. Updates ledger items with triage verdicts.

Prerequisite: requires Delimit Pro. An unlicensed call returns {"error": ..., "upgrade": "https://delimit.ai/pricing"} without running.

Manage SIEM streaming for audit-event forwarding (Splunk/Datadog/etc.).

When to use: to inspect or configure where Delimit's audit events stream — Splunk, Datadog, EventBridge, generic webhooks. When NOT to use: for one-shot notifications (use delimit_notify) or inbox handling (delimit_notify_inbox).

Sibling contrast: delimit_notify sends to humans; this configures structured-log streaming to SIEM endpoints.

Side effects: action="configure" / "forward" / "test" write to the configured SIEM endpoints (network calls). action="status" is read-only.

Audit security and auto-chain evidence + governance on critical findings.

When to use: as the deploy gate / pre-release security check — combines dependency vulnerability scanning, hardcoded-secret detection, dangerous-pattern checks, and .env-tracked-in-git checks, AND automatically opens a governance task + sends a notification when critical findings are present. When NOT to use: for a baseline scanner pass without auto-chained side effects (use delimit_security_scan), to ingest an external scanner's output (delimit_security_ingest), or to triage existing findings (delimit_security_deliberate).

Sibling contrast: delimit_security_scan is the read-only baseline scanner; delimit_security_ingest accepts external tool output; delimit_security_deliberate triages findings via multi-model panel; this one runs the audit AND auto-chains evidence collection, governance task creation, and notification on criticals.

LED-1278: by default the scanner skips test directories (tests/, tests/, spec/, fixtures/, *_test.py, *.test.tsx, etc.) and suppresses well-known dummy values (AWS canonical example, alphabet-pattern GitHub tokens, leading-1234567890 Slack tokens, trivial JWTs, generic placeholder dict values). Pass include_tests=True to scan test trees too — useful for repos that ship real secrets in fixture files (rare, but legitimate).

Side effects: writes an evidence bundle (always, best-effort). On critical findings, creates a governance task via the governance engine and sends a webhook notification. Optional: SNYK_TOKEN or Trivy in the environment enable enhanced scanning.

Collect evidence artifacts for governance (Pro).

When to use: after a deploy, security audit, test run, or other gate event — to capture an evidence bundle that delimit_evidence_verify can later attest. When NOT to use: to verify an existing bundle (use delimit_evidence_verify) or query the contract ledger (delimit_ledger).

Sibling contrast: delimit_evidence_verify verifies; delimit_ledger queries the chain; this collects new evidence.

Side effects: gated by require_premium. Writes a new evidence bundle via backends.repo_bridge.evidence_collect.

Prerequisite: requires Delimit Pro. An unlicensed call returns {"error": ..., "upgrade": "https://delimit.ai/pricing"} without running.

Verify the integrity of an evidence bundle (Pro).

When to use: to attest that a previously-collected evidence bundle has not been tampered with — typical use is during replay or audit. When NOT to use: to capture new evidence (use delimit_evidence_collect) or to query the contract ledger (delimit_ledger).

Sibling contrast: delimit_evidence_collect captures; this verifies a captured bundle's hash chain integrity.

Side effects: read-only on the evidence store; gated by require_premium. Calls backends.repo_bridge.evidence_verify.

Prerequisite: requires Delimit Pro. An unlicensed call returns {"error": ..., "upgrade": "https://delimit.ai/pricing"} without running.

Verify a Delimit Seal receipt against the bundled Layer-0 constitution (Free).

When to use: to check that a signed governed-output receipt has not been tampered with — content-pin to the published constitution, a valid Ed25519 signature, and a well-formed structure. Free tier. Pass mode='a1' to verify a hardened offline A1 bundle (schema_version >= 0.3) with subject binding + key-manifest crosscheck. When NOT to use: to verify an evidence bundle (use delimit_evidence_verify) or to query the ledger (delimit_ledger).

Sibling contrast: delimit_evidence_verify checks an evidence bundle's hash chain; this checks an open-core Seal receipt's signature + content-pin with no access to the engine or the signing key.

Side effects: read-only. Calls backends.repo_bridge.seal_verify. The 'cryptography' dependency is optional + lazy-imported: if absent, it returns verification_unavailable rather than failing. No license gate.

Unified release-management entry point — dispatches to one of six actions.

When to use: as the single MCP-registered release surface (delimit_release) when the caller wants to pick the release operation by name in one call rather than choosing a specific delimit_release_* alias. Release-tier means whole-environment, multi-service versions (the rollup across apps), as opposed to the deploy-tier (per-app SHA) covered by the delimit_deploy_* tools. When NOT to use: from internal code paths — prefer the specific alias (delimit_release_plan, delimit_release_validate, delimit_release_status, delimit_release_rollback, delimit_release_history, delimit_release_sync) for clarity and so each action's docstring and license gate show up at the right call site. For per-app rollout state use delimit_deploy_status; to ship code use delimit_deploy_publish; for OpenAPI spec linting use delimit_lint.

Sibling contrast: each delimit_release_ wrapper is a thin alias over this implementation; they exist so the action's docstring lives at the right name. This is the dispatch core. delimit_release_validate routes through a shared _release_validate chain, and the public delimit_release_sync exposes its sub-action as a param named action, which this function receives as sync_action.

Generate a release plan from git history (Pro).

When to use: ahead of cutting a release, to enumerate the services and changes that will ship and surface the version to bump. When NOT to use: to validate readiness (use delimit_release_validate) or to ship code (use delimit_deploy_publish).

Sibling contrast: delimit_deploy_plan plans a deploy of one app; this plans a multi-service release across an environment.

Side effects: read-only on git/repo state; gated by require_premium. Calls backends.tools_infra.release_plan.

Prerequisite: requires Delimit Pro. An unlicensed call returns {"error": ..., "upgrade": "https://delimit.ai/pricing"} without running.

Validate that a release is safe to ship.

When to use: as the gate between delimit_release_plan and the actual rollout — confirms the release passes preflight checks. When NOT to use: for OpenAPI spec linting (delimit_lint) or for runtime health (delimit_obs_status).

Sibling contrast: delimit_release_plan describes what would ship; this attests it is safe to ship.

Side effects: on success, returns a passed verdict (no side effects). On failure, auto-chains:

1. backends.repo_bridge.evidence_collect (records failure evidence)

2. ai.notify.send_notification (webhook event release_validation_failed)

3. ai.ledger_manager.add_item (creates ops-ledger fix item, P1)

Report the active release version for a whole environment (Pro).

When to use: to inspect which release version is currently live across all services in an environment — the "what is shipped right now?" check at the release-tier (versions across services) rather than the deploy-tier (per-app SHA). Useful for incident pages and pre-deploy "what are we coming from?" snapshots. When NOT to use: for per-app rollout state (use delimit_deploy_status), for past releases on the same env (use delimit_release_history), or to plan a new release (delimit_release_plan).

Sibling contrast: delimit_deploy_status reports a single app's SHA rollout; this reports the environment's release version overall (the rollup across apps). delimit_release_history is the time-axis sibling; this is the point-in-time snapshot.

Side effects: read-only against the ops backend and gated by require_premium — unlicensed callers receive a license payload and no query runs. On a licensed call, invokes backends.tools_infra.release_status which reads the release manifest for the environment. No write, no probe, no notification. Response routed through _with_next_steps.

Prerequisite: requires Delimit Pro. An unlicensed call returns {"error": ..., "upgrade": "https://delimit.ai/pricing"} without running.

Revert a whole environment to a prior release version (experimental).

When to use: when delimit_release_validate or delimit_obs_alerts indicate a regression that spans services and you need to revert the WHOLE environment to a known-good release, not just one app. Typical sequence: alert fires -> delimit_release_history to pick a target -> this -> delimit_release_status to confirm. When NOT to use: to roll back a single app at the SHA level (use delimit_deploy_rollback), to roll back an npm publish (npm publish history is largely append-only — there is no clean rollback), or to roll forward (delimit_release_plan).

Sibling contrast: delimit_deploy_rollback reverts one app at the SHA level; this reverts a release version across services in lockstep. delimit_release_history is how you pick the to_version.

Side effects: invokes backends.ops_bridge.release_rollback which MUTATES the live environment — services are flipped to the to_version artifacts. No license gate at this level (handled by the backend's own admin checks). Marked EXPERIMENTAL — handler may return partial results on backends without rollback automation; verify with delimit_release_status afterwards. No automatic ledger write, no automatic notification — pair with delimit_evidence_collect + delimit_notify per the deploy-gate chain.

Return the recent release timeline for an environment (experimental).

When to use: during incident investigation when you need to see what shipped and when ("what changed in the last 10 releases?"), or when picking a known-good to_version for delimit_release_rollback. The output is the release-tier equivalent of git log for a deploy environment. When NOT to use: to inspect only the current release (use delimit_release_status) or for per-app deploy timeline (delimit_deploy_status / SHA-level history). Also: for audit-trail evidence collection use delimit_evidence_collect.

Sibling contrast: delimit_release_status is the point-in-time snapshot; this is the time-axis sibling. delimit_release_rollback consumes the output of this tool when picking a target version.

Side effects: read-only against the ops backend. No license gate at this level. Calls backends.ops_bridge.release_history which reads the release timeline store. No write, no probe, no notification. Marked EXPERIMENTAL — output schema may evolve.

Analyze a project for cost drivers (Dockerfile, deps, cloud) (Pro).

When to use: when investigating spend on a project — scans Dockerfile, dependency manifests, and cloud configs for cost signals. When NOT to use: to enact cost reductions (use delimit_cost_optimize) or to manage alert rules (delimit_cost_alert).

Sibling contrast: delimit_cost_optimize finds reduction opportunities; this surfaces drivers (where the cost is).

Side effects: read-only on the target. Gated by require_premium. Calls backends.tools_data.cost_analyze.

Prerequisite: requires Delimit Pro. An unlicensed call returns {"error": ..., "upgrade": "https://delimit.ai/pricing"} without running.

Find cost optimization opportunities in a project (Pro).

When to use: after delimit_cost_analyze surfaces drivers, to get concrete suggestions: unused deps, oversized images, uncompressed assets. When NOT to use: to inventory current spend (delimit_cost_analyze) or manage threshold alerts (delimit_cost_alert).

Sibling contrast: delimit_cost_analyze identifies sources of cost; this proposes reductions.

Side effects: read-only on the target. Gated by require_premium. Calls backends.tools_data.cost_optimize.

Prerequisite: requires Delimit Pro. An unlicensed call returns {"error": ..., "upgrade": "https://delimit.ai/pricing"} without running.

Manage cost alert rules (CRUD on spending thresholds) (Pro).

When to use: to configure ongoing spend thresholds and notifications that fire when costs exceed a configured ceiling. When NOT to use: for one-shot cost analysis (use delimit_cost_analyze) or finding optimisations (delimit_cost_optimize).

Sibling contrast: delimit_cost_analyze finds drivers; delimit_cost_optimize finds reductions; this manages the alerting layer.

Side effects: action="create"/"delete"/"toggle" write to the file-based alert store. action="list" is read-only.

Prerequisite: requires Delimit Pro. An unlicensed call returns {"error": ..., "upgrade": "https://delimit.ai/pricing"} without running.

Manage MCP rate limits and session cost controls.

When to use: to inspect or adjust per-tool hourly rate limits and the session cost cap that throttle Delimit's call surface. When NOT to use: for project-cost analysis (use delimit_cost_analyze) or alert configuration (delimit_cost_alert).

Sibling contrast: delimit_cost_analyze inspects spend in your project; this manages our own per-session call quotas.

Side effects: action="set" / "reset" mutate the rate-limiter state. action="status" / "quota" are read-only.

Validate data files: JSON parse, CSV shape, SQLite integrity.

When to use: as a smoke check before relying on data files (CI pipelines, before migrations) to catch corruption early. When NOT to use: for migration status (use delimit_data_migrate) or backups (delimit_data_backup).

Sibling contrast: delimit_data_migrate inspects migration files; this exercises the data files themselves.

Side effects: read-only on the target. Calls backends.tools_data.data_validate.

Inspect migration files (alembic / Django / Prisma / Knex) for status.

When to use: to audit pending and applied migrations before a deploy, or as a CI gate. When NOT to use: to actually apply migrations (this tool only inspects status) or back up data first (delimit_data_backup).

Sibling contrast: delimit_data_validate exercises data files; delimit_data_backup captures restore points; this reads migration status only.

Side effects: read-only inspection. Calls backends.tools_data.data_migrate.

Back up SQLite and JSON data files to ~/.delimit/backups/.

When to use: before a risky migration or refactor that touches SQLite or JSON data, to capture a timestamped restore point. When NOT to use: to validate data integrity (use delimit_data_validate) or apply migrations (delimit_data_migrate).

Sibling contrast: delimit_data_validate inspects integrity; delimit_data_migrate runs migrations; this captures a backup.

Side effects: writes timestamped copies of SQLite + JSON files under ~/.delimit/backups/ via backends.tools_data.data_backup.

Unified observability entry point — dispatches to one of four actions.

When to use: as the single MCP-registered observability surface (delimit_obs) when the caller wants to pick the action by name in one call rather than choosing a specific delimit_obs_* alias. Covers runtime metrics, log search, alert-rule management, and the at-a-glance health rollup. When NOT to use: from internal code paths — prefer the specific alias (delimit_obs_metrics, delimit_obs_logs, delimit_obs_alerts, delimit_obs_status) for clarity and so docstrings and license gates show up at the right call site. For the governance-kernel layer use delimit_gov_health, not this runtime-observability surface.

Sibling contrast: each delimit_obs_ wrapper below is a thin alias over this implementation; they exist so the action's docstring lives at the right name. This is the dispatch core. Within the actions: "metrics" returns numeric series, "logs" returns text matches over the same backend, "status" returns a synthesised health rollup, and "alerts" configures thresholds against the metric series rather than querying data.

Side effects: action="metrics" / "logs" / "status" are READ-ONLY and gated by require_premium (keys "obs_metrics", "obs_logs", "obs_status") — unlicensed callers receive a license payload and no backend call is made; licensed calls route to a distinct observability backend function and are wrapped via _with_next_steps for orchestrator hints. action="alerts" is the only WRITE-capable path: its sub-action ("create" / "update" / "delete") mutates alert configuration while "list" is read-only; it routes through the ops bridge and is EXPERIMENTAL — the alert_rule schema is backend- specific and may evolve. None of the read actions write data, append to the ledger, or send notifications. Errors are deterministic ({"error": ...}): an unknown action short-circuits before any backend call with the valid-action list.

Pull numeric metric series from the observability backend (Pro).

When to use: during runtime health investigation when you need numeric series (CPU, memory, request rate, error rate, latency percentiles) over a named time window. Pair with delimit_obs_logs to correlate a numeric anomaly with the underlying log lines. When NOT to use: for free-text search of log lines (use delimit_obs_logs), to read or configure alert rules (delimit_obs_alerts), or for a quick at-a-glance health rollup (delimit_obs_status).

Sibling contrast: delimit_obs_logs returns text matches; this returns numeric time series. delimit_obs_status is the rollup-summary surface; this is the raw-series surface. delimit_obs_alerts configures thresholds against these same series.

Side effects: read-only on the metrics backend and gated by require_premium — unlicensed callers receive a license payload and no query runs. On a licensed call, invokes backends.tools_infra.obs_metrics which queries the backing metrics store; no data is written, no ledger entry, no notification. The response is routed through _with_next_steps.

Prerequisite: requires Delimit Pro. An unlicensed call returns {"error": ..., "upgrade": "https://delimit.ai/pricing"} without running.

Search application and system logs across configured sources (Pro).

When to use: during incident investigation when you have a symptom (error string, trace id, user id, request id) and need to find every log line mentioning it across the configured sources over a time window. The typical pattern is: delimit_obs_metrics flags a numeric anomaly, then this tool finds the offending log lines. When NOT to use: for numeric series (use delimit_obs_metrics), for the at-a-glance health rollup (delimit_obs_status), or to configure ongoing alerts (delimit_obs_alerts). Also: do not use this as a tail-follow surface — it is a windowed search, not a streaming subscription.

Sibling contrast: delimit_obs_metrics returns numeric series for the same backend; this returns text matches. Compared to grepping the local filesystem, this queries the centralised log store across services / hosts.

Side effects: read-only on the log backend and gated by require_premium — unlicensed callers receive a license payload and no query runs. On a licensed call, invokes backends.tools_infra.obs_logs which queries the backing log store; no data is written, no ledger entry, no notification. The response is routed through _with_next_steps.

Prerequisite: requires Delimit Pro. An unlicensed call returns {"error": ..., "upgrade": "https://delimit.ai/pricing"} without running.

Manage alerting rules — list, create, update, delete (experimental).

When to use: to configure ongoing alerts for production thresholds (latency, error rate, saturation, queue depth) against the same metric series visible via delimit_obs_metrics. Sub-actions: "list" inventories existing rules, "create" mints one, "update" edits, "delete" removes. When NOT to use: for one-shot metric queries (delimit_obs_metrics), log search (delimit_obs_logs), or the health rollup (delimit_obs_status). Also: do not call "create" repeatedly to retry a failed alert delivery — alerting is configuration, not delivery.

Sibling contrast: delimit_obs_metrics queries data; this configures automated thresholds against that data. Compared to cloud-provider alerting consoles, this routes through the ops bridge so the rule set is recorded in the same observability layer as the metric source.

Side effects: WRITES to the alert configuration on the ops backend for action in ("create", "update", "delete"); reads only for "list". Routes through backends.ops_bridge.obs_alerts. Marked EXPERIMENTAL — the schema for alert_rule is backend-specific and may evolve; pin tested rule shapes if depending on this in production. No license gate at this level (gating handled by the backend's own admin checks).

Return a high-level health rollup from the observability layer (Pro).

When to use: for the "are we green?" check at session start, in a status dashboard, or as a single-call smoke test before a deploy. The orchestrator's session-start ritual calls this only if delimit_agent_dashboard or delimit_gov_health flag anomalies — it is the second-tier health surface, not the first. When NOT to use: for detailed numeric series (delimit_obs_metrics), for log investigation (delimit_obs_logs), or for alerting rule management (delimit_obs_alerts). Also do not use as the only deploy gate — pair with delimit_security_audit + delimit_test_smoke per the deploy chain.

Sibling contrast: delimit_obs_metrics returns raw numeric series; this returns a synthesised rollup (typically per-service status + a few key indicators). Compared to delimit_gov_health, this reports the runtime observability layer rather than the governance kernel.

Side effects: read-only on the observability backend and gated by require_premium — unlicensed callers receive a license payload and no query runs. On a licensed call, invokes backends.tools_infra.obs_status which composes a health summary from the backing data sources. No write, no ledger entry, no notification. Response is wrapped through _with_next_steps.

Args: None.

Returns: Dict with keys: overall (green/yellow/red), services (list of {name, status, indicators}), checked_at timestamp, plus a next_steps field from _with_next_steps. Returns a license-gate payload if the caller lacks Premium, or {"error": "..."} on backend failure (does not raise).

Validate cross-agent handoff invariants before switching coding agents (LED-1710).

When to use: before a session hands off to a different coding agent (claude -> antigravity -> codex -> gemini) or an Auto-Phoenix revive, to confirm the next agent will NOT inherit corrupted state — a core.bare=true repo, a junk test@*/empty git identity, leaked GIT_* env vars that misdirect git subprocesses, a stale <gitdir>/index.lock, or a missing/stale ~/.delimit/.last_capture stamp (next agent starts blind). When NOT to use: to capture or restore session context (use delimit_soul_capture / delimit_revive — this only INSPECTS), or for general repo health (delimit_repo_diagnose).

Sibling contrast: delimit_revive restores prior context (read+write); delimit_gov_health reports the policy-kernel layer; this is a narrow read-only pre-handoff gate over git + env + capture stamp returning a fail-closed verdict. Phase-1 VALIDATOR only: NOT wired into any live handoff path; auto-remediation is held for a later phase.

Side effects: READ-ONLY — inspects git config + the process env + the .last_capture file via a hermetic git env. NO writes, env mutation, git config changes, network, ledger, or notification; it cannot itself corrupt the state it checks.

Verdict: ok=False if ANY critical check fails (fail-closed). Critical: git_identity, not_bare. Warn: no_git_env_leak, no_stale_index_lock, handoff_freshness. Each check is {name, ok, severity, detail, remediation}.

Walk the heartbeat directory and report which scheduled services are stale (LED-1412).

When to use: as part of the session-start ritual to surface silent daemon staleness before it becomes a customer-visible incident. The 2026-05-15 incident — delimit-reddit-proxy.service inactive for 13 days, all reddit scans 429-failing silently, founder noticing only via "3 day old posts" — is the failure mode this prevents. Each scheduled task writes ~/.delimit/heartbeats/<service>.json after every run; this tool walks the dir and classifies each service. When NOT to use: for one-off liveness checks (just read the file yourself) or for full-host metrics (delimit_obs_status). Phase 2 will add an external deadman ping for full-host outages — heartbeats here are local-only.

Sibling contrast: delimit_obs_status reports composed runtime observability metrics; this reports per-service liveness based on last_run timestamps written by each daemon. delimit_gov_health reports the kernel layer.

Side effects: read-only on the heartbeat directory. No network, no write, no ledger, no notification.

Classification (most-severe-first):

• parse_error: heartbeat file unreadable

• failed: status='failed' in the record

• stale: last_run older than service-specific threshold

• degraded: status='degraded' in the record

• never_seen: configured service has no heartbeat file yet

• unknown_age: heartbeat exists but timestamp won't parse

• ok: status='ok' AND last_run within threshold

Per-service thresholds default to sensible values (reddit/social-loop 2h, inbox 30min, daily timers 36h). Override via <dir>/_thresholds.json — JSON map of {service_name: seconds}.

Extract design tokens from a project's CSS/SCSS/Tailwind config.

When to use: to inventory or generate design tokens before creating a Tailwind config or component scaffold. When NOT to use: to scaffold a component (use delimit_design_generate_component) or generate tailwind config (delimit_design_generate_tailwind).

Sibling contrast: delimit_design_generate_tailwind builds a config from these tokens; this extracts them.

Side effects: read-only scan of local CSS/Tailwind. Figma API integration auto-activates when a Figma token is found in FIGMA_TOKEN env var, ~/.delimit/secrets/figma.json, or via delimit_secret_store. Calls backends.ui_bridge.design_extract_tokens. Coerces token_types via _coerce_list_arg.

Generate a React/Next.js component skeleton with Tailwind support.

When to use: to scaffold a new component (.tsx) with props interface and Tailwind class structure. When NOT to use: to generate stories for an existing component (use delimit_story_generate) or extract design tokens (delimit_design_extract_tokens).

Sibling contrast: delimit_story_generate adds stories to a component; this creates the component itself.

Side effects: writes a new component file (.tsx) under output_path or components//.tsx via backends.ui_bridge.design_generate_component. Detects Tailwind config inside project_path.

Read an existing tailwind.config or generate one from detected CSS tokens.

When to use: to bootstrap a Tailwind config from existing CSS tokens, or to inspect an existing config in a project. When NOT to use: to extract general design tokens (use delimit_design_extract_tokens) or generate a component (delimit_design_generate_component).

Sibling contrast: delimit_design_extract_tokens scans CSS; this writes a tailwind config from those tokens.

Side effects: writes tailwind.config.js if missing, otherwise reads the existing one. Calls backends.ui_bridge.design_generate_tailwind.

Validate responsive design patterns via static CSS analysis and optional dynamic Playwright testing.

When to use: as a CI check after editing UI/CSS, to flag missing media queries, fixed widths, or non-mobile-first patterns. When NOT to use: for accessibility audits (use delimit_story_accessibility) or component scaffolding (delimit_design_generate_component).

Sibling contrast: delimit_story_accessibility checks WCAG; this checks responsive patterns.

Side effects: read-only static analysis of CSS files and dynamic browser check if URL is provided. Calls backends.ui_bridge.design_validate_responsive. Coerces check_types from comma string to list via _coerce_list_arg.

Scan a project for React/Vue/Svelte components and emit a catalog.

When to use: to inventory a project's UI components for review, docs, or design-system curation. When NOT to use: to generate a single component (delimit_design_generate_component) or stories (delimit_story_generate).

Sibling contrast: delimit_design_generate_component creates one; this lists what already exists.

Side effects: read-only scan via backends.ui_bridge.design_component_library. Writes nothing.

Generate a .stories.tsx file for a UI component (no Storybook required).

When to use: to scaffold per-variant stories for a React/TSX component without installing the full Storybook toolchain. When NOT to use: for accessibility checks (use delimit_story_accessibility) or component scaffolding from scratch (delimit_design_generate_component).

Sibling contrast: delimit_design_generate_component creates the component; this generates its stories file. Together they form a component-first authoring path.

Side effects: writes a new .stories.tsx file next to the component. Coerces variants from a comma string to a list via _coerce_list_arg.

Run visual regression test — screenshot vs stored baseline.

When to use: as a CI gate after UI changes, to catch unintended visual regressions vs a stored baseline. Auto-creates the baseline on first run. When NOT to use: for a11y checks (use delimit_story_accessibility) or one-off screenshots (delimit_screenshot).

Sibling contrast: delimit_screenshot is one image without baseline; delimit_story_accessibility audits HTML; this compares against a stored baseline.

Side effects: writes baseline images on first run; subsequent runs are read-only against the baseline. Falls back to Puppeteer (screenshot only) when Playwright is not installed.

Build a Storybook static site (or return setup guidance).

When to use: to build the Storybook static site for an existing project, e.g. for hosting on a docs site. When NOT to use: to write stories (use delimit_story_generate) or run a11y checks (delimit_story_accessibility).

Sibling contrast: delimit_story_generate writes stories; delimit_story_accessibility audits; this builds the static site.

Side effects: when Storybook is configured, invokes the build via backends.ui_bridge.story_build (subprocess writes the static site under output_dir). When not configured, returns setup guidance instead.

Scan HTML/JSX/TSX for WCAG accessibility issues.

When to use: as a CI gate or pre-merge check on UI changes for common a11y problems — missing alt, missing labels, empty buttons, heading order, aria-hidden on focusable elements. When NOT to use: for responsive layout (use delimit_design_validate_responsive) or visual regression (delimit_story_visual_test).

Sibling contrast: delimit_design_validate_responsive checks layout; this checks WCAG.

Side effects: read-only static analysis. Calls backends.ui_bridge.story_accessibility_test.

Generate test skeletons for source code (Jest / pytest / vitest).

When to use: to scaffold new test stubs for public functions when starting tests on a previously-untested module. When NOT to use: to measure coverage of existing tests (use delimit_test_coverage) or run a smoke test (delimit_test_smoke).

Sibling contrast: delimit_test_coverage measures; delimit_test_smoke runs; this writes new test scaffolds.

Side effects: writes new test files alongside the source. Uses AST parsing for Python and regex for JS/TS via backends.ui_bridge.test_generate.

Analyze test coverage for a project (experimental) (Pro).

When to use: to surface coverage by file/folder against a threshold when you need a pass/fail signal for CI. When NOT to use: to scaffold new test stubs (use delimit_test_generate) or run a smoke run (delimit_test_smoke).

Sibling contrast: delimit_test_smoke validates that tests run at all; delimit_test_generate writes test scaffolds; this measures coverage of existing tests.

Side effects: read-only inspection. Gated by require_premium. Calls backends.ui_bridge.test_coverage. Marked experimental — coverage runner detection is heuristic.

Run smoke tests for a project.

When to use: as a pre-commit / pre-deploy gate to confirm tests pass. Auto-detects framework (pytest / jest / vitest / mocha) from project config. When NOT to use: to scaffold new tests (use delimit_test_generate) or measure coverage (delimit_test_coverage).

Sibling contrast: delimit_test_generate writes; delimit_test_coverage measures; this runs and parses.

Side effects: invokes the project's test runner via backends.ui_bridge.test_smoke (subprocess). Read-only on filesystem apart from the test runner's own outputs.

Generate a markdown API reference from source docstrings/JSDoc.

When to use: to produce a starter API reference doc from existing in-source documentation, organized per source file. When NOT to use: for doc-quality validation (use delimit_docs_validate) — generation does not validate.

Sibling contrast: delimit_docs_validate inspects existing docs; this writes a fresh API reference.

Side effects: writes a markdown reference file via backends.ui_bridge.docs_generate.

Validate documentation quality and completeness.

When to use: as a CI gate to surface missing READMEs, undocumented public functions, and broken internal markdown links. When NOT to use: to generate fresh API reference (use delimit_docs_generate).

Sibling contrast: delimit_docs_generate writes; this validates existing docs.

Side effects: read-only inspection. Calls backends.ui_bridge.docs_validate.

Check a GitHub issue for new comments since the last sensor tick.

When to use: to monitor a specific outreach / tracking issue for new activity, returning a structured signal for routing. When NOT to use: for repo-wide scans (use delimit_github_scan) or one-shot fetch (delimit_resource_get).

Sibling contrast: delimit_github_scan scans many repos for migrations; this watches one issue for new comments.

Side effects: read-only network call via gh CLI. Validates repo format with regex (defense-in-depth). Subject to the confused-deputy guard (_check_repo_allowlist) before fetching.

Scan GitHub issues/PRs for migration patterns across target repos.

When to use: for competitive intelligence — surface where target repos are migrating between tools (e.g. "switched from X to Y", "replaced X with Y") so the sensing function can act on the signal. When NOT to use: for general sensing/outreach research (use delimit_sense), to pull single-issue intel (delimit_sensor_github_issue), or for broad public-repo polling (delimit_github_scan).

Sibling contrast: delimit_sensor_github_issue tracks a specific issue's state; delimit_github_scan does broad public-repo polling; delimit_sense is the high-level sensing entrypoint; this one detects migration-pattern language specifically.

Side effects: read-only on the target repos via GitHub API. Enforces the per-repo allowlist (LED-881 confused-deputy guard) — refuses non-allowlisted repos. Calls ai.social_target.scan_github_migrations.

Return Delimit server version, tool count, and environment status.

When to use: at session start, in a dashboard, or as a diagnostic when investigating capability availability. When NOT to use: for governance health (use delimit_gov_health) or OS status (delimit_os_status).

Sibling contrast: delimit_help describes individual tools; this reports server-wide version and detected environment.

Side effects: read-only. Counts registered tools and detects API keys / CLIs / security tools in the environment so callers know what's available without manual config.

Args: None.

Returns: Dict with version, total_tools, adapter_contract, authority, environment-detection results, plus next_steps.

Manage the cross-venture agent swarm (personas + namespace isolation).

When to use: to inspect or mutate the swarm — register a venture with its 5 agent roles, create custom tools, hot-reload modules, check namespace access. When NOT to use: to dispatch a single task (use delimit_agent_dispatch) or read agent state (delimit_agent_status / dashboard).

Sibling contrast: delimit_agent_dispatch is per-task; this manages the multi-venture / multi-persona swarm overall (Agent Swarm Standard v1.2).

Side effects: action="register" / "create_tool" / "create_agent" / "approve_agent" / "reload" mutate state. status / venture / agent / list_* / check / approve / guide / rules are read-only.

Each venture gets 5 AI agent roles (Architect, Senior Dev, Reviewer, QA, Ops) with namespace isolation and model binding.

Run a multi-model code review on a diff or file.

When to use: to get cross-model feedback on a code change before merging, optionally posted as a PR comment. When NOT to use: for structured cross-lens audit (use delimit_audit) or full multi-round debate (delimit_deliberate).

Sibling contrast: delimit_audit is structured (security / correctness / governance lenses); delimit_deliberate is full debate; this is single-prompt multi-model review.

Side effects: calls multiple models via ai.multi_review. May write a saved review record. When pr_url is provided, the review can be posted as a PR comment by the caller (this tool returns the comment body, it does not auto-post).

Scan or redact sensitive data (API keys, secrets, PII) from text.

When to use: before sending text to external LLMs or publishing output, to prevent leaking credentials or PII. When NOT to use: to manage stored secrets (use delimit_secret_store family) — this is in-memory text redaction.

Sibling contrast: delimit_secret_* manages credentials at rest; this scrubs them out of arbitrary text.

Side effects: read-only on input text — produces a sanitized copy in action="redact". Calls ai.pii_redact.scan / redact. Detects: API keys (OpenAI, xAI, Google, GitHub, npm), passwords, bearer tokens, emails, phone numbers, SSNs, credit cards, IPs, database URLs.

The internal token map is intentionally NOT exposed via MCP — it stays local. action="redact" returns only the redacted text and counts; the original cannot be recovered through this tool.

Detect prompt drift across Claude / Codex / Gemini for the same task.

When to use: to track per-model prompt performance over time, or to rank models for specific task categories on your codebase. When NOT to use: to run a multi-model deliberation (use delimit_deliberate) — drift tracks single-model behaviour.

Sibling contrast: delimit_deliberate runs cross-model on a question; this tracks how a known prompt drifts per model.

Side effects: action="record" writes a result to the prompt-drift store via ai.prompt_drift.record_result. "check" and "rank" are read-only.

Detect / prevent multi-model file edit collisions (LED-129).

When to use: in cross-model workflows — claim a file before editing, release after committing — to prevent simultaneous conflicting edits between Claude / Codex / Gemini. When NOT to use: for single-model sessions or general filesystem locking outside the multi-model swarm.

Sibling contrast: delimit_swarm tracks ventures and personas; this tracks per-file edit ownership.

Side effects: action="claim" / "release" mutate the lock state. action="check" is read-only.

Manage delimit.yml project configuration (load / init / model).

When to use: to inspect, create, or query the project's delimit.yml AI configuration. When NOT to use: for governance state (use delimit_gov_status) or to manage prompts (use delimit_playbook).

Sibling contrast: delimit_gov_status reports governance runtime state; this manages the static config file.

Side effects: action="init" writes a new delimit.yml at project_path via ai.project_config.init_project_config. "load" and "model" are read-only.

Manage reusable prompt templates — save / run / list / delete.

When to use: to save your best prompts as named commands and run them later with variable substitution. Shared across AI assistants. When NOT to use: to manage project config (use delimit_project_config) or memories (delimit_memory_store).

Sibling contrast: delimit_memory_store records info; this stores executable prompt templates with {{variable}} substitution.

Side effects: action="save" / "delete" mutate ~/.delimit/playbooks/. action="run" calls the configured model with substituted prompt. action="list" is read-only.

Get help for a Delimit tool — purpose, parameters, examples.

When to use: when an agent or operator needs a quick reminder of a tool's interface, or wants the workflow overview. When NOT to use: for the full version/environment status (use delimit_version) or governance health (delimit_gov_health).

Sibling contrast: delimit_version reports server info; this returns per-tool descriptions from the TOOL_HELP table.

Side effects: read-only. Looks up an in-memory help table.

Comprehensive health check of the Delimit installation (delimit doctor).

When to use: as the universal first-step diagnostic when something isn't working — covers MCP connectivity, deps, governance state, AI assistants, permissions, API keys, network, version, daemons, disk. When NOT to use: for repo-level health (use delimit_repo_diagnose) or first-run discovery (delimit_quickstart).

Sibling contrast: delimit_repo_diagnose checks one repo; this checks the Delimit installation as a whole.

Side effects: in normal mode, fixes some configuration drift (writes a doctor-manifest.json so later --undo can revert). dry_run=True is read-only and previews changes. undo=True reverts changes from the last doctor run using the saved manifest.

Activate Delimit and run a readiness checklist.

When to use: as the post-install confirmation that everything is wired up — license, MCP, governance, tests, permissions, premium. When NOT to use: for diagnostic-style debugging of an already activated install (use delimit_diagnose) or first-run discovery (delimit_quickstart).

Sibling contrast: delimit_diagnose investigates issues; delimit_quickstart is the 60-second guided first run; this is the activation + readiness checklist.

Side effects: applies the license key when provided; auto-configures AI-assistant permissions when auto_permissions=True (writes .claude/settings.json). Skipped checks (premium on free tier, no test framework) do not count against the score.

Report the current Delimit license tier, validity, and expiry.

When to use: to inspect the active license before invoking gated tools, or as a diagnostic when require_premium is rejecting calls. When NOT to use: to install or rotate a license — this is a read.

Sibling contrast: this reads license state; gated tools (e.g. delimit_gov_evaluate, delimit_secret_get) call require_premium internally.

Side effects: read-only. Calls ai.license.get_license.

Args: None.

Returns: Dict with tier, validity, expiry, plus next_steps.

Ship a static / Next.js site via git push to the Vercel pipeline (Pro).

When to use: to deploy UI / site changes (typically delimit-ui or a venture marketing site) — this performs the commit, push, and triggers the Vercel build that produces the production deployment. Pair with delimit_deploy_verify on the resulting deploy URL to confirm rollout health. When NOT to use: to publish an npm package (use delimit_deploy_npm), to push container images (delimit_deploy_publish / delimit_deploy_build), or to roll back (delimit_deploy_rollback).

Sibling contrast: delimit_deploy_publish ships container images; delimit_deploy_npm publishes packages; this is the static-site / Vercel flavour. Compared to running git push by hand, this wraps the push with sanitisation, governance hooks, and (for delimit-ui) automatic ChatOps env-var injection from CHATOPS_AUTH_TOKEN.

Side effects: requires repo_path and is gated by require_premium. project_path must remain inside repo_path. The safe default commits only the existing index; staged_only=false requires explicit repo-relative paths and never uses git add -A. Vercel binding is pulled/validated before Git mutation. A timeout after push returns status=pending, commit SHA, and a delimit_deploy_verify continuation rather than raising. On success this performs LOCAL git operations and triggers a NETWORK deploy (Vercel build webhook). For the delimit-ui project, automatically injects ChatOps env vars from the CHATOPS_AUTH_TOKEN environment variable into the build context. No rollback — use delimit_deploy_rollback if the deploy regresses.

Publish an npm package: version bump, pack, and push to registry (Pro).

When to use: to ship a new version of an npm-published package (delimit-cli, a venture SDK, etc.). This is a PRODUCTION DEPLOY — every successful publish reaches real users, so it must be preceded by the deploy gate chain (delimit_security_audit -> delimit_test_smoke -> delimit_changelog -> delimit_deploy_plan) and explicit founder approval per the customer-protection rule. When NOT to use: to deploy a site (use delimit_deploy_site), to push container images (delimit_deploy_publish), to dry-run locally (npm pack --dry-run is faster), or to test the chain without publishing — for that, pass dry_run=True here.

Sibling contrast: delimit_deploy_site ships UI / static; this ships npm tarballs to the registry. Compared to running npm publish by hand, this wraps the chain with a bump, governance gate, and is the auditable surface that other tools can chain against.

Side effects: gated by require_premium — unlicensed callers receive a license payload and no publish runs. On a licensed call, invokes backends.tools_infra.deploy_npm which runs the npm publish chain: (1) bumps the version in package.json (LOCAL write to the source tree), (2) runs the project's prepublishOnly hook if present (which may build or sync artifacts — note the 2026-05-08 v4.5.12 prepublish regression), (3) runs npm pack and (4) npm publish to the configured registry — a NETWORK write that is publicly visible and NOT undoable except by an unpublish (heavily restricted by npm). dry_run=True suppresses step (4) only — the version bump and pack still happen so the chain can be exercised.

Prerequisite: requires Delimit Pro. An unlicensed call returns {"error": ..., "upgrade": "https://delimit.ai/pricing"} without running.

Add a new item to a project's ledger.

When to use: to capture work that should outlive the current session — tasks, bugs, features, decisions, strategy items. When NOT to use: for governance-classed work (use delimit_gov_new_task) or quick conversation memory (delimit_memory_store).

Sibling contrast: delimit_ledger_update changes; delimit_ledger_done closes; this creates.

Side effects: writes a new ledger entry via ai.ledger_manager.add_item. Coerces tags / acceptance_criteria / tools_needed from comma strings to lists via _coerce_list_arg.

Update any field on an existing ledger item.

When to use: to change state on a ledger item (status, priority, assignee, links, labels). Pass only the fields you want to change. When NOT to use: to create a new item (use delimit_ledger_add) or to mark one done (delimit_ledger_done is the convenience wrapper).

Sibling contrast: delimit_ledger_add creates; delimit_ledger_done closes; this is the general-purpose updater.

Side effects: writes to the ledger via ai.ledger_manager. Coerces string list inputs (labels) through _coerce_list_arg.

Mark a ledger item as done (convenience wrapper).

When to use: to close out a ledger item with one call instead of using delimit_ledger_update with status="done". When NOT to use: to change other fields (use delimit_ledger_update) or create new items (delimit_ledger_add).

Sibling contrast: delimit_ledger_update changes any field; this is the close-out shortcut.

Side effects: writes status="done" + optional note via ai.ledger_manager.update_item. LED-1408 Phase 1: when commit_sha or pr_url is provided (or a PR URL is detected in the note), attaches a ship_proof block to the event with verified=True. Future audits use this flag to distinguish trustworthy-done from marked-done-but-never-verified. Phase 2 will tighten enforcement.

Apply one action to many ledger items in a single call (LED-1145 Phase 1 PR-B).

When to use: after delimit_ledger_groom or another tool surfaces a list of item ids that should all receive the same change. When NOT to use: for a single item (use delimit_ledger_update or delimit_ledger_done).

Sibling contrast: delimit_ledger_update is one item; delimit_ledger_groom proposes; this applies bulk.

Side effects: when dry_run=False, writes status/priority/tag changes via the ledger manager. Per-item failures don't block the batch. Default dry_run=True returns what would change without writing — callers MUST explicitly pass dry_run=False to apply.

Auto-close ledger items whose linked GitHub issue/PR already resolved.

When to use: as periodic maintenance to keep the ledger in sync with external reality — LEDs whose tracked GitHub issue/PR is closed/merged should not stay open. When NOT to use: to close one item by hand (use delimit_ledger_done) or to read external state (delimit_resource_get).

Sibling contrast: delimit_ledger_done is per-item; this auto-detects across many items.

Side effects: when dry_run=False, marks/archives via delimit_ledger_bulk under the hood. Default dry_run=True returns a plan only. Detection scans description/context/last_note/tags for github links / shorthand / gh: tag form.

Detection scans description / context / last_note / tags for:

• https://github.com///(issues|pull)/

• /# (short form)

• gh:// (explicit tag form)

Action map (per LED-1146 deliberation):

• PR with merged=true → mark_done with merge SHA in note

• issue/PR closed with state_reason="completed" → mark_done with closed_at

• issue/PR closed with state_reason="not_planned" or no reason → archive

• state="open" → leave alone

• gh API error / 404 → leave alone, recorded in errors

Implementation re-uses bulk_action() under the hood; nothing new on the write path. dry_run=True (default) returns a plan; dry_run=False applies.

Read-only grooming proposal — flags stale / duplicate / garbage items.

When to use: as a periodic review tool to surface items that likely should be archived (stale, duplicate, garbage venture). When NOT to use: to apply the changes — use delimit_ledger_bulk after reviewing the proposal.

Sibling contrast: delimit_ledger_bulk applies; delimit_ledger_health composes this with other checks; this is the read-only proposer.

Side effects: read-only on the ledger. Returns proposals only — risky operations (mass-cancel, dedup-merge) MUST go through delimit_ledger_bulk after founder review. Each proposal includes a copy-pasteable ready_to_apply invocation.

LED-1145 Phase 2 #2. Risky operations (mass-cancellation, dedup-merge) must NOT be a single atomic action — this tool only PROPOSES; the founder applies via delimit_ledger_bulk after review. Each proposal in the response includes a copy-pasteable ready_to_apply invocation.

Auto-archive open ledger items dormant past the stale-TTL threshold.

When to use: as nightly automation / scripted cleanup to retire items that have gone quiet past a strict threshold (default 60 days). When NOT to use: to merely surface stale candidates without applying (use delimit_ledger_groom which is propose-only and uses a softer 30-day default), to inspect ledger health (use delimit_ledger_health), or to auto-close items mirrored from external repos (delimit_ledger_auto_close_external).

Sibling contrast: delimit_ledger_groom proposes archives with a softer threshold and never applies; delimit_ledger_auto_close_external targets externally-mirrored items; delimit_ledger_bulk is the underlying bulk-action surface; this composes the stale-detector with bulk_action(archive) on a stricter dormancy threshold.

Side effects: with dry_run=False, archives matching items via bulk_action(archive). Items are never hard-deleted — the JSONL append-only log retains the full record. With dry_run=True (default), returns the plan only.

LED-1145 Phase 2 #4.

One-shot ledger health check — totals + P0 + stale + duplicates + garbage.

When to use: at session start (orchestrator session ritual) or nightly review to get a traffic-light verdict on the ledger. When NOT to use: to apply changes (use delimit_ledger_bulk) or inspect a single item (delimit_ledger_query).

Sibling contrast: delimit_ledger_groom proposes archives; delimit_ledger_context returns top-5 open; this composes them into a one-shot health verdict with pre-formatted next_actions.

Side effects: read-only. Internally calls list_items + groom + P0 quota helpers.

LED-1145 capstone — closes the loop on the entire ledger-tooling refactor. Designed for nightly/weekly review or session-start status snapshot. Returns:

• totals (unresolved / open / in_progress / blocked)

• p0 (count vs quota + health)

• stale (count >stale_days + health)

• duplicates (group count + total items + health)

• garbage_venture (count + health)

• overall_health (worst-of: green / yellow / red)

• next_actions: pre-formatted list of {reason, tool, args, follow_up}

All Phase 1+2 tools are referenced in the suggested actions, so the response is self-contained for an AI agent that wants to act on it.

List ledger items with rich filters, sort, and pagination (LED-1145).

When to use: to query a venture's ledger with filters — by status, priority, tags, text, time window, or external link. When NOT to use: for a top-N summary (use delimit_ledger_context) or to fetch a single item (delimit_ledger_query).

Sibling contrast: delimit_ledger_context is the top-5 summary; delimit_ledger_query fetches one; this is the powerful list call.

Side effects: read-only. Calls ai.ledger_manager.list_items. Single-value status / priority are kept for back-compat.

Quick summary of what's open in the ledger (top 5 by priority).

When to use: at session start as part of the orchestrator session ritual, to see the highest-priority open items. When NOT to use: for the full list (use delimit_ledger_list) or to fetch a specific item (delimit_ledger_query).

Sibling contrast: delimit_ledger_list returns the full list; this returns a top-5 summary.

Side effects: read-only. Calls ai.ledger_manager.get_context.

Ask natural-language questions about the ledger (ChatOps 2.0).

When to use: when an operator wants a free-form answer ("what shipped this week?", "what's blocked?", "show all P0s") rather than a structured filter query. When NOT to use: for structured listing (use delimit_ledger_list) or top-N summary (delimit_ledger_context).

Sibling contrast: delimit_ledger_list takes structured filters; this maps natural language to those filters internally.

Side effects: read-only. Internally calls list / context queries.

Create a typed relationship between two ledger items.

When to use: to track dependencies and structure (blocks, parent/child, duplicates) between ledger items. When NOT to use: to read existing links (use delimit_ledger_links) or update other fields (delimit_ledger_update).

Sibling contrast: delimit_ledger_links reads; delimit_ledger_update changes simple fields; this writes a relationship.

Side effects: writes the link via ai.ledger_manager.link_items. "blocks" / "blocked_by" auto-create the reverse direction so both items see the relationship.

List relationships / dependencies for a ledger item.

When to use: to inspect what an item blocks, what it depends on, its parent/child, related items, and duplicates. When NOT to use: to add a link (use delimit_ledger_link) or update fields (delimit_ledger_update).

Sibling contrast: delimit_ledger_link adds links; this reads existing ones.

Side effects: read-only. Calls ai.ledger_manager.get_links.

Save a session summary for cross-session continuity.

When to use: at the end of a productive session, to leave a structured record the next session can recover. When NOT to use: for richer cross-model state (use delimit_soul_capture, which auto-detects more) or single-line memory (delimit_memory_store).

Sibling contrast: delimit_soul_capture writes a richer "soul" with git state; this writes a structured handoff with explicit fields.

Side effects: writes a handoff record via ai.ledger_manager.session_handoff. Coerces list inputs from comma strings via _coerce_list_arg. LED-3731: also refreshes a lightweight pointer-soul for project_path (default = cwd) so the NEXT delimit_revive for that project returns THIS handoff's state rather than a stale older soul.

Load recent session handoffs for context recovery.

When to use: at session start to see what previous sessions left — items completed, key decisions, blockers from the last N runs. When NOT to use: to write a handoff (use delimit_session_handoff) or for richer cross-model state (delimit_revive).

Sibling contrast: delimit_session_handoff writes; delimit_revive reads soul state; this reads structured handoffs.

Side effects: read-only. Calls ai.ledger_manager.session_history.

List all registered ventures (auto-registered project directories).

When to use: to inventory which projects Delimit has tracked, before routing a ledger query or context operation. When NOT to use: to read venture-scoped context (use delimit_context_list) or memory (delimit_memory_recent).

Sibling contrast: delimit_context_list inventories artifacts inside one venture; this lists the ventures themselves.

Side effects: read-only. Calls ai.ledger_manager.list_ventures. Note: ventures are auto-registered when any Delimit tool is run in a project directory.

Args: None.

Returns: Dict with the venture list (each entry has name, path, etc.).

Capture session state as a 'soul' for cross-model resurrection.

When to use: at session end or when context gets full, to save what you're working on so the next session in any model can pick up where you left off. When NOT to use: for general memory writes (use delimit_memory_store) or full handoff orchestration (delimit_session_handoff).

Sibling contrast: delimit_session_handoff writes a structured handoff for the next session; this writes a richer "soul" with git state and active task pointers, used by delimit_revive.

Side effects: writes a soul record via ai.session_phoenix.capture_soul. Auto-detects git state and the current model. Splits comma-string inputs into lists internally.

Revive the last session's captured soul in any model.

When to use: at session start, to load the prior session's soul (active task, decisions, blockers, next steps). When NOT to use: to capture a soul (delimit_soul_capture) or read recent memories (delimit_memory_recent).

Sibling contrast: delimit_soul_capture writes the soul; this reads and applies it (cross-model: Claude, Codex, Gemini, Cursor).

Side effects: read-only; calls ai.session_phoenix.revive.

View and configure AI models for multi-model deliberation (Pro).

When to use: to inventory configured providers, auto-detect new keys, or register/remove a provider for delimit_deliberate. When NOT to use: to actually run a deliberation (use delimit_deliberate) or to inspect deliberation history.

Sibling contrast: delimit_deliberate runs the panel; this manages which models the panel can call.

Side effects: gated by require_premium. action="add" / "remove" write provider config; "list" / "detect" are read-only.

Prerequisite: requires Delimit Pro. An unlicensed call returns {"error": ..., "upgrade": "https://delimit.ai/pricing"} without running.

Check deliberation usage and mode (hosted free tier vs BYOK).

When to use: before invoking delimit_deliberate, to confirm whether you are still inside the hosted free-tier quota or running BYOK (bring-your-own-keys), and to read the signed-in OAuth state. When NOT to use: to run an actual panel (use delimit_deliberate) or to manage provider keys (delimit_models).

Sibling contrast: delimit_deliberate runs the panel; delimit_models manages provider keys; this is the lightweight pre-flight status check.

Side effects: read-only. Calls ai.deliberation.get_deliberation_status which reads ~/.delimit state.

LED-2092: hosted access now requires a delimit.ai account.

Args: None.

Returns: Dict with: oauth_required, oauth_signed_in, lifetime_used, lifetime_remaining, daily_cap_remaining, signin_url, plus the legacy hosted_used / hosted_remaining / hosted_limit fields retained for backward compatibility with scripted callers.

Run multi-model consensus via AI-to-AI deliberation (Pro).

When to use: for foundational decisions (pricing, naming, public-facing copy framing, doctrine edits), external PR diffs, or any decision where cross-model contradiction-detection adds value. When NOT to use: for routine implementation choices (orchestrate in-thread or via subagent dispatch) — deliberation is for cross-checked confabulation, not capability.

Sibling contrast: delimit_models manages which providers can be called; this runs the actual panel. delimit_security_deliberate is the security-class variant.

Side effects: writes transcripts under save_path when provided. Models are called via configured providers; Free tier uses 3 builtin slots, Pro/Premium uses BYOK from ~/.delimit/models.json. Strategic / social scopes enforce a 3-model minimum and may invoke Grok as a tiebreaker.

Cross-model code audit — 3 models, 3 lenses, synthesized (Pro).

When to use: for high-confidence review of a code change, where agreement across models is the signal and disagreements surface tradeoffs. When NOT to use: for raw multi-model debate (use delimit_deliberate) or single-model review (delimit_review).

Sibling contrast: delimit_review is single-prompt multi-model; delimit_deliberate is full debate; this is structured cross-lens audit (security / correctness / governance).

Side effects: gated by require_premium. Calls models via ai.cross_model_audit.audit. No ledger write — caller decides what to do with findings.

Audit or report config of public surfaces for consistency (Pro).

When to use: to confirm that all public surfaces (CLI, action, npm, site) reference the same release version and configuration. When NOT to use: to actually deploy or sync content — this is a read/audit tool only.

Sibling contrast: delimit_release_status reports the deployed state; this audits the public surface configuration for drift.

Side effects: gated by require_premium. Calls ai.release_sync.audit (read-only audit) or ai.release_sync.get_release_config when action="config".

Prerequisite: requires Delimit Pro. An unlicensed call returns {"error": ..., "upgrade": "https://delimit.ai/pricing"} without running.

Check for API spec drift since last governance review.

When to use: as a scheduled (cron) compliance monitor — detects spec changes without lint, stale baseline, or missing policy. When NOT to use: for one-shot lint (use delimit_lint) or to read historical drift (delimit_drift_history).

Sibling contrast: delimit_lint is enforcement; delimit_drift_history reads past drift records; this is the periodic monitor.

Side effects: read-only on spec + governance state. Calls ai.drift_monitor.check_drift.

List recent drift-check results from the drift monitor.

When to use: to investigate when API spec drift was last detected and what changed. When NOT to use: to perform a fresh drift check (use delimit_drift_check).

Sibling contrast: delimit_drift_check runs a check; this reads historical results.

Side effects: read-only. Calls ai.drift_monitor.get_drift_history.

Scan a project and report what Delimit can do for it.

When to use: as a first-run discovery on a new project — finds OpenAPI specs, checks for security issues, detects frameworks, suggests what to track. When NOT to use: to initialize governance (use delimit_init) or run the 60-second quickstart (delimit_quickstart).

Sibling contrast: delimit_quickstart is a guided first-run flow; delimit_init creates the governance scaffolding; this is read-only discovery.

Side effects: read-only scan via filesystem globs. Does not write to project files.

60-second guided quickstart for a new install.

When to use: immediately after installing Delimit, as the minimum-effort path to prove value — combines init + scan + environment detection. When NOT to use: for activation/license confirmation (use delimit_activate) or full diagnostics (delimit_diagnose).

Sibling contrast: delimit_init only writes scaffolding; delimit_scan only inspects; delimit_activate is post-license; this is the unified first-run flow.

Side effects: triggers init (writes .delimit/) and runs scan (read-only). Detects environment in passing.

Unified secrets-broker entry point — dispatches to one of five actions.

Manages just-in-time credential access through the local Delimit secrets broker (ai.secrets_broker) instead of bare environment variables or .env files: store a credential once with an access scope, fetch it at execution time with every read recorded to an audit trail, inventory credential metadata without exposing values, revoke on rotation/leak, and read the access log.

When to use: as the single MCP-registered secrets surface (delimit_secret) when the caller wants to pick the operation by name in one call rather than choosing a specific delimit_secret_* alias. When NOT to use: from internal code paths — prefer the specific alias (delimit_secret_store, delimit_secret_get, delimit_secret_list, delimit_secret_revoke, delimit_secret_access_log) so each operation's docstring and arg schema show up at the right call site. Do not use the broker as a general key/value store — it is credential-scoped and every read is audited.

Sibling contrast: each delimit_secret_ wrapper below is a thin alias over this implementation; they exist so the action's docstring lives at the right name. This is the dispatch core. Versus delimit_context_* / delimit_memory_*: those persist plans and notes; this persists access-controlled credentials with a read audit trail.

Storage & access model: credentials are persisted to the local broker store under ~/.delimit/secrets/ (encoded at rest) and returned in cleartext to an authorized caller — the host filesystem is the trust boundary, so protect it accordingly. Scope is enforced at READ time: scope="all" permits any caller; otherwise the requester's agent_type or tool must appear in the credential's comma-separated allow-list. The access log records who/what/when and whether access was granted — it never stores the credential value, and "list" returns metadata only, never values.

Side effects (per action):

• "store": WRITES/overwrites the credential under ~/.delimit/secrets/ with its scope and description. A same-name store overwrites silently; there is no version history.

• "get": returns the credential value to an authorized requester and appends an access-log entry (granted true/false); on success it updates the credential's access counter / last-accessed timestamp. A scope denial, a missing name, or a revoked credential is logged and returns without a value.

• "list": READ-ONLY. Returns credential metadata (name, scope, description, created_by, access_count, revoked, timestamps) — never values. Wrapped via _with_next_steps.

• "revoke": WRITES a revoked flag + timestamp and appends a revoke entry to the access log; subsequent "get" calls are denied. Does NOT hard-delete the stored file.

• "access_log": READ-ONLY. Returns the access trail (newest first), optionally filtered to one credential name. Wrapped via _with_next_steps. No action is license-gated. Errors are deterministic ({"error": "..."}): a missing required argument or an unknown action short-circuits before the backend call.

Write a credential into the Delimit secrets broker store.

When to use: when onboarding an API key, OAuth token, or other credential that one or more agents/tools will need at execution time, and you want the access scoped + audit-logged rather than sitting in an environment variable or .env file. Typical pairing: call this once at setup, then call delimit_secret_get from the consuming tool at runtime. When NOT to use: to fetch the value (use delimit_secret_get for just-in-time access with audit), to inspect which secrets exist without revealing values (delimit_secret_list), to disable an existing secret (delimit_secret_revoke), or to read the access audit trail (delimit_secret_access_log). Also: do not use this as a general-purpose key/value store — the broker is credential- scoped and the audit log will fill up with non-credential noise.

Sibling contrast: delimit_secret_store writes; delimit_secret_get reads with JIT access logging; delimit_secret_list shows metadata only (never values); delimit_secret_revoke disables; together they form the broker surface. Compared to writing a value directly to .env, this routes through a scoped, audited broker.

Side effects: invokes ai.secrets_broker.store_secret which persists the value to the broker's at-rest store. The scope field is also persisted and is enforced on every subsequent delimit_secret_get call. There is no append-only history of stored values — a re-store with the same name overwrites. No network egress and no ledger write; the audit trail is the broker's own access log (visible via delimit_secret_access_log), which records the WRITE event as well as later reads.

Request just-in-time access to a stored secret.

When to use: when a tool or agent needs a credential at execution time. The broker logs every access for audit. When NOT to use: to add a secret (use delimit_secret_store) or to examine the audit log (use delimit_secret_access_log).

Sibling contrast: delimit_secret_store writes; this reads with audit; delimit_secret_access_log shows the resulting access trail.

Side effects: appends an access log entry via ai.secrets_broker.get_secret. Does not return secrets to scopes that were not authorised at store time.

List secrets in the broker (metadata only — never values).

When to use: to inventory what credentials are stored without exposing the values themselves. When NOT to use: to retrieve a value (use delimit_secret_get) or to add one (delimit_secret_store).

Sibling contrast: delimit_secret_get returns values (audited); this returns only metadata (name, scope, description).

Side effects: read-only. Calls ai.secrets_broker.list_secrets.

Args: None.

Returns: Dict with key "secrets" containing a list of metadata records, plus next_steps suggestions.

Revoke a secret to prevent any future access.

When to use: after a credential leak or when rotating away from an old secret name. When NOT to use: to delete metadata only — revocation also blocks delimit_secret_get from succeeding.

Sibling contrast: delimit_secret_store creates; this disables.

Side effects: writes a revocation record via ai.secrets_broker.revoke_secret. Subsequent get calls will be denied; the access log is preserved.

Show the audit log of secret accesses.

When to use: for compliance review, incident investigation, or to see who/what fetched a credential. When NOT to use: to read a secret value (delimit_secret_get) or to inventory secrets (delimit_secret_list).

Sibling contrast: delimit_secret_get appends to this log; this reads it back.

Side effects: read-only. Calls ai.secrets_broker.get_access_log.

Unified context-filesystem entry point — dispatches to one of six actions.

Manages a venture-scoped, versioned context filesystem under ~/.delimit/context// so plans, decisions, and artifacts survive across sessions and across models. This is the cross-model- continuity store: write once, read from any later session or any other assistant.

When to use: as the single MCP-registered context surface (delimit_context) when the caller wants to pick the action by name in one call rather than choosing a specific delimit_context_* alias. When NOT to use: from internal code paths — prefer the specific alias (delimit_context_read, delimit_context_write, delimit_context_snapshot, etc.) so each action's docstring, args, and side-effect notes show up at the right call site. For ephemeral, conversation-scoped memory use delimit_memory_store / delimit_memory_search instead — those are NOT venture-namespaced or versioned.

Sibling contrast: each delimit_context_ wrapper below is a thin alias over this implementation; they exist so the action's docstring lives at the right name. This is the dispatch core. The context FS is venture-scoped and versioned (snapshot/branch); delimit_memory_* is conversation-scoped and unversioned. Snapshot vs branch: snapshot is an immutable point-in-time copy (history/ rollback), branch is a mutable write-isolated fork that can be merged back into main. Neither touches git or any code repository.

Side effects: all six actions are free-tier (no require_premium gate in this dispatcher). Each routes to a distinct context-FS backend function and is wrapped via _with_next_steps for orchestrator hints. Per action:

• "list" — read-only enumeration of /artifacts/*. Returns [] (no error) if the venture or artifacts dir does not exist.

• "read" — read-only load of one artifact. Returns {"error": ...} if the named artifact is absent.

• "init" — WRITES. Creates the venture directory, the memory/plans/artifacts/snapshots/branches subdirs, and manifest.json if absent. Idempotent.

• "write" — WRITES/overwrites /artifacts/.json and bumps the manifest version counter. Overwrites silently if the artifact name already exists.

• "snapshot" — WRITES. Copies the venture's artifacts/ and memory/ into a timestamped (optionally labeled) snapshot dir plus a snapshot manifest. Does NOT bump the version counter.

• "branch" — depends on branch_action. "list" is read-only. "create" WRITES a new branch fork (copy of artifacts/ + memory/) and errors if the branch already exists. "merge" MUTATES the venture's main artifacts/ and memory/ with the branch's files, then DELETES the branch dir and bumps the version counter; errors if the branch is not found. Errors are deterministic ({"error": "..."}): an unknown top-level action, an unknown branch_action, or a missing branch_name on create/merge all short-circuit before the backend call.

Initialize a context filesystem namespace for a venture (STR-048).

When to use: once per venture, the first time you want to persist cross-session/cross-model context (plans, decisions, code snippets). When NOT to use: for single-session memory (use delimit_memory_store) or to read existing artifacts (use delimit_context_read).

Sibling contrast: delimit_memory_* is conversation-scoped; the context FS is venture-scoped and versioned (snapshot/branch).

Side effects: creates the venture directory and metadata files via ai.context_fs.init_context. Idempotent — safe to call repeatedly.

Write an artifact to a venture's context filesystem (STR-048).

When to use: to persist a plan, decision record, or code artifact that other models or future sessions will need. When NOT to use: for ephemeral conversation context (use delimit_memory_store) or to snapshot all artifacts at once (use delimit_context_snapshot).

Sibling contrast: delimit_context_read fetches one artifact; delimit_context_list inventories the venture; this writes one.

Side effects: writes the artifact under the venture namespace via ai.context_fs (file creation under ~/.delimit/context//).

Read an artifact from a venture's context filesystem (STR-048).

When to use: to fetch a specific previously-written artifact by name within a venture namespace. When NOT to use: for venture-wide listing (use delimit_context_list) or memory search (delimit_memory_search).

Sibling contrast: delimit_context_list returns names only; this returns a single artifact's content.

Side effects: read-only. Calls ai.context_fs to load the artifact.

List all artifacts in a venture's context filesystem (STR-048).

When to use: to inventory what artifacts have been written for a venture before reading or branching. When NOT to use: to read an artifact's content (use delimit_context_read) or to scan memories (delimit_memory_recent).

Sibling contrast: delimit_context_read returns one artifact's content; this returns metadata for all of them.

Side effects: read-only. Calls ai.context_fs to enumerate artifacts.

Capture a point-in-time snapshot of a venture's context (STR-048).

When to use: before a risky model handoff, doctrine edit, or refactor — so you can roll back the context if it goes sideways. When NOT to use: for individual artifact persistence (use delimit_context_write) or one-time conversation memory (delimit_memory_store).

Sibling contrast: delimit_context_branch creates a divergent line of work; this captures the current state as an immutable point.

Side effects: writes a snapshot record under the venture namespace via ai.context_fs.

Manage mutable working branches of a venture's context (STR-048).

When to use: when exploring an alternative direction for a venture — a "what if we pivoted?" thread — and you want a write-isolated branch of the venture context rather than mutating the main line. Sub-actions: "list" inventories branches, "create" mints a new branch, "merge" folds a branch back into main. When NOT to use: for immutable point-in-time evidence (use delimit_context_snapshot — that creates a frozen capture; this is for mutable working areas), to read context data (use delimit_context_read), or for git branch operations on a code repo (use git directly).

Sibling contrast: delimit_context_snapshot is read-only history capture; this manages active, writeable branches. Compared to git branches, this operates on the venture context filesystem (ai.context_fs), not the code repo.

Side effects: depends on action. "list" is read-only. "create" writes a new branch namespace under the venture in ai.context_fs. "merge" mutates the venture's main namespace with the branch's contents, then closes the branch. None of these touch the code repository or any git state. No license gate, no notification, no ledger write.

List resources from a connected data-plane system.

When to use: to enumerate items via a driver — repos, PRs, issues, workflow runs. When NOT to use: to fetch a specific item (use delimit_resource_get) or inventory drivers (delimit_resource_drivers).

Sibling contrast: delimit_resource_drivers lists drivers; delimit_resource_get fetches one item; this lists items.

Side effects: read-only network calls via the chosen driver. Calls ai.data_plane.get_driver and the driver's list_* method.

Get a specific resource from a connected data-plane system.

When to use: to fetch a single item by identifier via a driver — a repo, PR, issue, or workflow run. When NOT to use: to list items (use delimit_resource_list) or inventory drivers (delimit_resource_drivers).

Sibling contrast: delimit_resource_list returns many; this returns one.

Side effects: read-only network call via the driver. Calls ai.data_plane.get_driver and the driver's get_* method.

List available data plane drivers and their resource schemas.

When to use: to inventory which external systems Delimit can read from (github, etc.) and what resources each driver exposes. When NOT to use: to read data from a driver (use delimit_resource_list / delimit_resource_get).

Sibling contrast: delimit_resource_list lists items via a driver; this lists the drivers themselves.

Side effects: read-only. Calls ai.data_plane.list_drivers.

Args: None.

Returns: Dict with key "drivers" (list of driver definitions and their resource schemas) and next_steps.

Pull open GitHub issues into the Delimit ledger as context (LED-188).

When to use: to enrich the ledger with external issue context from a GitHub repo so cross-references work. When NOT to use: to write back to GitHub (this is read-only) or to monitor a single issue (delimit_sensor_github_issue).

Sibling contrast: delimit_sensor_github_issue watches one issue; this syncs many into the ledger as context.

Side effects: read-only on GitHub (network calls via gh CLI). Writes context entries into the ledger but does not push back to GitHub.

Manage webhook notifications for governance events.

When to use: to register a Slack/Discord/HTTP webhook to receive governance alerts (deploy blocked, security finding, consensus). When NOT to use: for SIEM-class structured streaming (use delimit_siem) or one-shot notifications (delimit_notify).

Sibling contrast: delimit_siem streams structured audit events; this routes governance alerts to chat / HTTP endpoints.

Side effects: action="add" / "remove" mutate ~/.delimit/webhooks.json. action="test" sends a test notification to the configured webhooks. action="list" is read-only.

Post to social media (Twitter / Reddit) (Pro).

When to use: when the AI drafts a social post, it MUST call this immediately (auto-trigger rule). Email approval flow handles human review. When NOT to use: just to generate (use delimit_social_generate) or to inspect history (delimit_social_history).

Sibling contrast: delimit_social_generate is draft-only; delimit_social_approve manages the queue; this is the actual post path.

Side effects: when draft=True, queues for delimit_social_approve. Otherwise posts via the social backend. Subject to rate cap: 2 original posts per hour, 24 per day (founder-approved 2026-04-30). Override via DELIMIT_HOURLY_TWEETS / DELIMIT_DAILY_TWEETS env. Sends approval email with the registry_draft_id for inbox-daemon matching.

IMPORTANT - AUTO-TRIGGER RULE: When the AI drafts a social post, it MUST call this tool immediately. Never ask "want me to send this?" — just call the tool. The email-based approval flow handles human review.

Categories: tip, changelog, insight, engagement. Leave text empty to auto-generate from templates. Every post provides value - tips, insights, governance wisdom. Rate cap: 2 original posts per hour, 24 per day (founder-approved 2026-04-30). Override via DELIMIT_HOURLY_TWEETS / DELIMIT_DAILY_TWEETS.

IMPORTANT - Platform tone rules (these are DIFFERENT per platform):

• Twitter: confident technical brand. Direct, professional, ALWAYS POSITIVE. Celebrate wins and progress. Never complain or air gaps publicly. No em dashes or en dashes. Default to insight-first with no CTA unless source-grounded.

• Reddit: helpful builder voice. Grounded, concise, never salesy. Default to no Delimit mention unless directly necessary and source-grounded. NO bullet points/lists/bold/em dashes. 2-3 sentences max.

• LinkedIn: professional hook + insight + CTA

Generate a social media post draft (no posting) (Pro).

When to use: to draft a tweet for review before manual or automated posting. When NOT to use: to actually publish (use delimit_social_post or delimit_content_publish) or to manage targets (delimit_social_target_config).

Sibling contrast: delimit_social_post publishes a draft; this only generates one.

Side effects: read-only / draft. Calls ai.social.generate_post.

List configured social media accounts.

When to use: to inventory which Twitter/X accounts have credentials available before drafting or scheduling a post. When NOT to use: to draft content (use delimit_social_generate) or publish (delimit_social_post).

Sibling contrast: delimit_social_generate drafts; delimit_social_post publishes; this lists who can publish.

Side effects: read-only. Calls ai.social.list_twitter_accounts, which scans ~/.delimit/secrets/twitter-.json files.

Args: None.

Returns: Dict with "accounts" list and "count" plus next_steps.

Fetch tweets from X by id or URL via twttr241 RapidAPI (LED-825).

When to use: to surgically fetch one or many tweets by id/URL, sharing the cached path with delimit_social_target so repeats are free. When NOT to use: to scan for new content (use delimit_social_target) or fetch a Reddit thread (delimit_reddit_fetch_thread).

Sibling contrast: delimit_social_target scans for opportunities; delimit_reddit_fetch_thread is the Reddit equivalent; this is the X (Twitter) single/batch fetcher.

Side effects: read-only network call via twttr241 (RapidAPI). Inherits the LRU + SQLite cache + budget gate from the social-target scanner — repeated reads are free. No writes.

View recent social media post history (Pro).

When to use: to recall prior posts/comments for context when drafting follow-ups or DM replies — Reddit entries include thread context. When NOT to use: to draft new posts (use delimit_social_generate) or scan targets (delimit_social_target).

Sibling contrast: delimit_social_generate drafts; delimit_social_post publishes; this reads what was already posted.

Side effects: read-only. Calls ai.social.get_post_history.

Manage social media drafts — list, approve, reject (Pro).

When to use: to clear the social drafts queue created by delimit_social_post(draft=True). When NOT to use: to draft (use delimit_social_post(draft=True)) or inspect history (delimit_social_history).

Sibling contrast: delimit_social_post creates the draft; this lists / approves / rejects them.

Side effects: action="approve" actually posts via the social backend (network write). action="reject" discards. action="list" is read-only.

Scan platforms for demand signals / engagement opportunities (Pro).

When to use: mode="demand_signal" (recommended under SHIFT-1) to research which topics/repos show API-governance / breaking-change pain and feed the INTERNAL report-topic backlog — the input to choosing the next public worked-example report. mode="engagement" (legacy) finds posts a venture could engage with. When NOT to use: to fetch one X tweet (use delimit_x_fetch) or drafts (delimit_social_generate).

Sibling contrast: delimit_social_target_config configures which platforms to scan; delimit_x_fetch is single-tweet; this is the multi-platform scanner.

Side effects: read-only network scans by default. With mode="demand_signal" (LED-3729) scored results are written to the local report-topic backlog — an internal research list, NOT outbound; nothing is posted or contacted. With draft_replies=True, calls delimit_social_post(draft=True) for "reply" targets. With create_ledger=True, calls delimit_ledger_add for "strategic" targets. Deduplicates across runs.

SHIFT-1 NOTE (LED-3729): under the anonymity constitution, brand-account reply/DM prospecting is forbidden, so engagement targets are mostly un-actionable. Prefer mode="demand_signal": a "target" becomes a demonstrated public question/pain to answer with a BROADCAST report, not a person to contact. The produced artifact is a public report — squarely in-bounds. Do NOT chain scan results into outbound replies.

Scans X, Reddit (RapidAPI), HN, Dev.to, GitHub. NamePros flagged as manual_check_needed (no API). Run in a /loop for continuous discovery.

Configure social target scanning platforms.

When to use: to inspect / update which platforms the social-target scanner uses, or to add subreddits a venture should scan. When NOT to use: to run a scan (use delimit_social_target) or drafts (delimit_social_generate).

Sibling contrast: delimit_social_target runs scans; this configures which platforms to scan.

Side effects: action="update" / "add_subreddits" write to the target config. action="status" / "detect" are read-only.

Bulk scan 25+ subreddits for outreach targets (Pro).

When to use: as a venture-agnostic bulk Reddit scan — returns ranked, categorized targets ready for comment drafting. When NOT to use: for venture-scoped scan (use delimit_reddit_fetch_thread or delimit_social_target) or one specific thread.

Sibling contrast: delimit_reddit_fetch_thread is single thread; delimit_social_target is multi-platform venture scan; this is the broad Reddit pass.

Side effects: read-only network via residential proxy. Rate limited to 1 req / 2sec. The orchestrator must chain (per rule below).

IMPORTANT -- TOOL CHAINING RULE: After scanning, the AI MUST process high_priority targets:

1. Draft replies via delimit_social_post or delimit_notify

2. Create ledger items for strategic opportunities via delimit_ledger_add Never just return targets and stop. Always chain.

Scan GitHub for adoption leads, competitive intel, repo health (Pro).

When to use: at the configured cadence — pulse (own repo health), hunter (engagement signals, hourly), deep (full ecosystem, daily). When NOT to use: to monitor one issue (use delimit_sensor_github_issue) or pull issues (delimit_tracker_sync).

Sibling contrast: delimit_sensor_github_issue is single-issue; delimit_tracker_sync ingests issues to ledger; this is the broad GitHub corpus scanner.

Side effects: read-only network. With chain rule below, the orchestrator should call delimit_ledger_add for high-score findings and delimit_notify for pain threads.

IMPORTANT -- TOOL CHAINING RULE: After scanning, the AI MUST process high-score findings:

1. Auto-ledger high-score findings via delimit_ledger_add

2. Pain threads with existing_feature relevance via delimit_notify Never just return findings and stop. Always chain to the next action.

Scan watchlisted vendor accounts and auto-draft riffs (Pro) (LED-1253).

When to use: for ad-hoc execution of the vendor-news sensor (the cron is the normal autonomous path). When NOT to use: for a single tweet (use delimit_vendor_news_draft) or subsystem health (delimit_vendor_news_health).

Sibling contrast: delimit_vendor_news_draft is one tweet; delimit_vendor_news_health is health rollup; this is the full sensor + drafter pass.

Side effects: gated by require_premium. Wraps ai.vendor_news.sensor.scan_vendor_news + draft_vendor_riff. dry_run=True polls (cache-friendly) but skips JSONL log write AND skips the drafter entirely (no queue, no rate-cap consumption).

Health check for the vendor-news riff system (LED-1253).

When to use: to answer "is the cron firing? are drafts landing? what's getting rejected?" without grepping logs. When NOT to use: to draft a riff (use delimit_vendor_news_draft) or inspect the broader social daemon (delimit_social_daemon).

Sibling contrast: delimit_vendor_news_draft writes one riff; delimit_social_daemon controls the broader sensing daemon; this is the vendor-news subsystem health.

Side effects: read-only. Greps crontab for the cron entry, reads sensor JSONL log, tweet queue, rejected log, watchlist file.

Args: None.

Returns: Dict with cron_installed, last_run_ts, sensor stats, 24h queued/rejected entries, watchlist count, budget snapshot.

Draft a brand-voice Delimit-POV riff for a specific X tweet (Pro) (LED-1253).

When to use: when an operator/sensor surfaces a vendor-news tweet that warrants a Delimit-POV riff for the autonomous content queue. When NOT to use: to fetch the tweet without drafting (use delimit_x_fetch) or for general social drafting (delimit_social_generate).

Sibling contrast: delimit_x_fetch fetches; delimit_vendor_news_health inspects subsystem health; this drafts a riff into the queue.

Side effects: gated by require_premium. Runs the riff drafter end-to-end: rate cap, source-fit pre-filter, generator, capability validator, fit floor, queue insert. dry_run=True suppresses the queue insert but still runs validators (and still consults the 24h per-vendor rate cap to avoid log noise).

View the upcoming content schedule (queued + pending + recent).

When to use: to inspect what's queued (tweets, videos) and what has shipped recently before adding more or triggering a publish. When NOT to use: to actually publish (use delimit_content_publish) or to manage the content queue (delimit_content_queue).

Sibling contrast: delimit_content_queue mutates queue state; this reads the resulting schedule.

Side effects: read-only. Calls ai.content_engine.get_content_schedule.

Args: None.

Returns: Dict with queued tweets, pending videos, recent activity, the staged reports-distribution queue (LED-3729), and next_steps.

Manually trigger a content publish (tweet, YouTube video, or report) (Pro).

When to use: to fire off the next queued tweet or video on demand, or to STAGE distribution of the next mature report across owned broadcast surfaces (README / GitHub Release note / minimal X mirror). When NOT to use: to inspect the queue (use delimit_content_schedule) or modify it (delimit_content_queue).

Sibling contrast: delimit_content_schedule reads; delimit_content_queue mutates queue; this performs a single publish step.

Side effects: for tweet, posts the next queued tweet; for youtube, generates and uploads. For "report" (LED-3729) it is COMPOSE + STAGE ONLY — it writes composed distribution artifacts to a local staging queue and posts NOTHING to X and creates NO live GitHub Release.

Manage the tweet, video, and report content queues.

When to use: to view, seed, or add to the autonomous content queues that delimit_content_publish drains, or to STAGE a report for distribution (LED-3729). When NOT to use: to publish (use delimit_content_publish) or read upcoming schedule (delimit_content_schedule).

Sibling contrast: delimit_content_publish drains; delimit_content_schedule reads; this mutates the queue.

Side effects: action="seed" populates queue with defaults; action="add" appends tweet items; action="add_report" composes and STAGES report-distribution artifacts (README block / Release note / minimal X mirror) — compose-only, posts NOTHING. action="status" is read-only and now also reports the staged reports-distribution queue.

Report the autonomous daemon's status (loops, items, actions).

When to use: to inspect what the autonomous daemon has been doing recently and whether it's healthy. When NOT to use: to start a run (use delimit_daemon_run) or classify a pending item (delimit_daemon_classify).

Sibling contrast: delimit_daemon_run advances iterations; this reads runtime state.

Side effects: read-only. Calls ai.daemon.get_daemon_status.

Args: None.

Returns: Dict with loop counts, items processed, recent actions, next_steps.

Advance the autonomous daemon by N iterations (Pro).

When to use: to manually advance the daemon loop one or more iterations, e.g. for testing or scheduled cron-style execution. When NOT to use: for inspection only (use delimit_daemon_status) or to classify an item (delimit_daemon_classify).

Sibling contrast: delimit_daemon_status reads; delimit_daemon_classify decides; this drives the loop.

Side effects: in dry_run mode, logs actions without executing them. In live mode, executes the daemon's automatable actions. Calls ai.daemon.run_loop with a 5-second interval between iterations.

Execute one iteration of a governed continuous loop (LED-239).

When to use: to advance the autonomous build / social / deploy loop one step, either interactively or from a daemon. When NOT to use: for status only (use delimit_loop_status) or to configure (delimit_loop_config).

Sibling contrast: delimit_loop_status reads; delimit_loop_config sets policy; this drives one iteration.

Side effects: depends on loop_type. cycle/build dispatches swarm work; social drafts replies; deploy runs gates and publishes. All loops write to the loop_engine's session record.

Loop types:

• cycle (recommended): unified think -> build -> deploy in one call.

• build: picks feat/fix/task items from ledger, dispatches via swarm.

• social (think): scans Reddit/X/HN, drafts replies.

• deploy: runs deploy gates, publishes, verifies.

Background auto-pull daemon for governed build/social/deploy loops (Pro).

When to use: to spawn a long-running daemon that ticks the governed loop every N seconds — the orchestrating Claude session tails ~/.delimit/logs/loop_daemon_.jsonl for triage. When NOT to use: for one-shot iteration (use delimit_build_loop) or to read loop metrics (delimit_loop_status).

Sibling contrast: delimit_build_loop is one iteration; this is the long-running daemon.

Side effects: action="start" spawns a daemon thread that calls run_governed_iteration / run_social_iteration on a cadence. action="stop" halts. Each tick logs returned task_id to a JSONL. Respects delimit_loop_config safeguards (cost_cap, error_threshold, max_iterations, status=paused/stopped) via loop_status before each tick. Gated by require_premium.

Classify a ledger item's risk tier and suggested automation tool.

When to use: to preview what the autonomous daemon would do with a given ledger item (or the next automatable one). When NOT to use: to actually run an iteration (use delimit_daemon_run) or check daemon health (delimit_daemon_status).

Sibling contrast: delimit_daemon_status reads health; delimit_daemon_run executes; this previews the classification.

Side effects: read-only. Calls ai.daemon.classify_item / get_next_automatable_item / get_open_ledger_items.

Control the inbox polling daemon for email governance (Pro).

When to use: at session start (per orchestrator session ritual) to ensure the daemon is up; or to stop/inspect it. When NOT to use: to read inbound items (use delimit_notify_inbox) or send notifications (delimit_notify).

Sibling contrast: delimit_notify_inbox reads; this controls the daemon process that fills the inbox.

Side effects: action="start" / "stop" mutate daemon process state. The daemon polls pro@delimit.ai every 5 minutes, classifies emails, forwards owner-action items, and handles draft approvals via email replies. Auto-posting is disabled — approved drafts are emailed for manual posting. Backing module is gateway-only and surfaces a graceful "not_available" payload when called from the npm bundle.

Control the social sensing daemon (Pro).

When to use: to start, stop, or inspect the autonomous social discovery daemon that scans Reddit/X/HN every 15 min. When NOT to use: to run a one-shot scan (use delimit_social_target) or read the inbox (delimit_notify_inbox).

Sibling contrast: delimit_social_target is one-shot; this controls the long-running daemon.

Side effects: action="start" / "stop" mutate daemon state. The daemon scans, deduplicates, and emits HTML draft emails. Calls ai.social_daemon.{start_daemon, stop_daemon, get_daemon_status}.

Control the self-repair watcher daemon (LED-191, internal).

When to use: to start, stop, or inspect the watcher that polls function KPIs and emits founder alerts on breaches. When NOT to use: for general daemon status (use delimit_daemon_status) or inbox / social daemons (delimit_inbox_daemon, delimit_social_daemon).

Sibling contrast: delimit_daemon_status is the autonomous loop's daemon; this is the KPI-watcher daemon. Different processes.

Side effects: action="start" / "stop" mutate daemon state. Idempotent start. Circuit-breakered stop after 3 consecutive pass failures. Honors DELIMIT_SELF_REPAIR_PAUSE=1 at every pass without requiring a daemon restart. Higher modes (diagnose / deliberate / apply / verify) chain through the watcher when configured per function in ~/.delimit/self_repair.yaml.

One-call corp status — replaces the 6-call session-start ritual (LED-189).

When to use: at session start as the unified status snapshot — daemons, self-repair, social/inbox activity, ledger pending, agent queue, latest session, plus a synthesized one-line summary. When NOT to use: for a single subsystem's status (use delimit_daemon_status, delimit_obs_status, etc.) — those are finer-grained.

Sibling contrast: delimit_obs_status is system health; delimit_gov_health is governance engine; this is the corp-wide rollup that composes all of them.

Side effects: read-only across all subsystems. Each sub-section is failure-isolated — a partial failure returns {"error": "..."} for that key only and never crashes the whole call. Gateway-only — not shipped in the npm bundle.

Args: None.

Returns: Dict with daemon status, self_repair status, social/inbox activity, ledger_pending, agent_queue, latest_session, plus a synthesized one-line summary and next_steps. On npm-bundle installs returns {"status": "not_available", "error": ..., "hint": ...} instead.

Export the current governance config as a shareable JSON bundle.

When to use: to package a project's delimit.yml + GitHub Action workflow into a portable JSON config for sharing or import. When NOT to use: to read live policy (use delimit_gov_policy) or initialize a new project (delimit_init).

Sibling contrast: delimit_config_import is the round-trip counterpart; this exports.

Side effects: read-only on the project. Sanitizes project_path via _sanitize_path. Returns the bundle in the response — no file write.

Import a governance config from a JSON bundle into a project.

When to use: to apply a previously-exported config bundle from another project — the round-trip counterpart to delimit_config_export. When NOT to use: to initialize a fresh project (use delimit_init) or load an existing config (delimit_project_config action="load").

Sibling contrast: delimit_config_export produces; this consumes.

Side effects: writes the policy file under project_path. With write_workflow=True, also writes the GitHub Action workflow file if present in the bundle. Sanitizes project_path via _sanitize_path.

Record a screen capture (browser or terminal session) (Pro).

When to use: to capture a video for documentation, demo, or audit evidence over a fixed window. When NOT to use: for a single still (use delimit_screenshot).

Sibling contrast: delimit_screenshot is one frame; this is a duration-bound recording.

Side effects: launches headless Chromium (browser mode) or a terminal subprocess (terminal mode), writes MP4 (browser) or GIF

• MP4 (terminal) under ~/.delimit/recordings/. Gated by require_premium. Duration is capped at 120 seconds.

Prerequisite: requires Delimit Pro. An unlicensed call returns {"error": ..., "upgrade": "https://delimit.ai/pricing"} without running.

Take a screenshot of a URL using headless Chromium (Pro).

When to use: for audit evidence, visual regression baselines, or documentation captures. When NOT to use: for time-based recordings (use delimit_screen_record) or rendered HTML extraction.

Sibling contrast: delimit_screen_record captures over time (browser or terminal); this captures a single image.

Side effects: gated by require_premium. Launches headless Chromium via Playwright and writes a PNG file under ~/.delimit/screenshots/.

Prerequisite: requires Delimit Pro. An unlicensed call returns {"error": ..., "upgrade": "https://delimit.ai/pricing"} without running.

Generate a changelog from git + ledger (git mode) or spec diff (spec mode).

When to use: as part of the deploy gate chain to produce a release note, or to prepend a CHANGELOG.md entry for a tagged release. When NOT to use: for ad-hoc human prose explanation of a spec change (use delimit_explain) or release planning (delimit_release_plan).

Sibling contrast: delimit_explain renders human prose for one diff; delimit_release_plan plans services and versions; this generates a formal changelog entry.

Two modes:

1. Git mode (pass repo_path): reads git log since last tag, categorizes commits (feat/fix/refactor/docs/test/ci), pulls completed ledger items, formats as Markdown. Works for ANY repo.

2. Spec mode (pass old_spec + new_spec): compares two OpenAPI specs and produces an API changelog.

Side effects: read-only on git/spec inputs. Writes to output_file when provided. If output_file is "CHANGELOG.md", PREPENDS the entry rather than overwriting — preserving prior history.

Send a notification (webhook / Slack / email).

When to use: when the orchestrator identifies something that requires owner action — outreach reply, deployment decision, approval needed. Auto-trigger: call immediately, never ask. When NOT to use: for SIEM-class structured streaming (use delimit_siem) or multi-routing config (delimit_notify_routing).

Sibling contrast: delimit_notify_routing configures rules; delimit_notify_inbox reads inbound; this sends one outbound.

Side effects: sends a network message via webhook (JSON POST), Slack webhook, or email (SMTP). The founder reviews and replies via email — that reply is consumed by delimit_notify_inbox / delimit_inbox_daemon.

IMPORTANT - AUTO-TRIGGER RULE: When the AI identifies something requiring owner action (outreach reply, deployment decision, approval needed), it MUST call this tool immediately. Never ask "want me to notify you?" — just send. The founder reviews and acts via email. All tools must chain.

Channels: webhook (JSON POST), slack (webhook URL), email (SMTP). Use for: governance alerts, deployment notifications, breaking change warnings.

IMPORTANT - Email context rules: Every email must be self-contained and actionable. The recipient reads on mobile and needs to know exactly what to do without opening another app.

• Subject: lead with [ACTION TYPE] bracket, include enough context to triage from inbox

• Body: include WHAT happened, WHY it matters, WHAT to do next, and relevant links

• Never send bare IDs or technical state without human-readable context

Manage impact-based notification routing (LED-233).

When to use: to inspect or update the rules that route change alerts to email / webhook / digest by severity. When NOT to use: to read the inbox (use delimit_notify_inbox) or fire a single notification (use delimit_notify).

Sibling contrast: delimit_notify sends; delimit_notify_inbox reads inbound; this configures routing rules between them.

Side effects: action="configure" writes via ai.notify.save_routing_config; action="test" sends test notifications to the configured channels. action="status" is read-only.

Check inbound email inbox, classify, and route (Pro).

When to use: to poll the operator inbox and classify which emails require owner action (forwarded) vs which can stay queued. When NOT to use: to send notifications (use delimit_notify) or control the polling daemon (delimit_inbox_daemon).

Sibling contrast: delimit_inbox_daemon controls the long-running daemon; this is a one-shot poll. delimit_notify is the outbound counterpart.

Side effects: action="poll" with process=True forwards owner-action emails (network writes). action="poll" with process=False is dry-run. action="status" / "history" are read-only.

Manage the agent-task lifecycle — dispatches to one of four actions.

When to use: as the single MCP-registered agent surface (delimit_agent) when the caller wants to pick the lifecycle action by name in one call rather than choosing a specific delimit_agent_* alias. The lifecycle is dispatch (record intent) -> status (read) -> handoff (transfer to another model) -> complete (close). When NOT to use: from internal code paths — prefer the specific alias (delimit_agent_dispatch, delimit_agent_status, delimit_agent_complete, delimit_agent_handoff) so the action's docstring and arg schema show up at the right call site. Do NOT use action="dispatch" expecting a subagent to run — it RECORDS the dispatch, it does not execute it (see Side effects). The related delimit_agent_link / _policy / _check / _dashboard tools share the prefix but are SEPARATE tools, not actions here — passing their names as action= returns an "Unknown action" error.

Sibling contrast: delimit_agent_dispatch / _status / _complete / _handoff are thin aliases that call straight into this implementation with a fixed action; they exist so each action's docstring lives at the right name. This is the dispatch core for those four. Versus delimit_ledger_add: the ledger holds free-form work items; this surface carries engineering-dispatch schema (assignee, tools_needed, constraints) and a per-task audit trail.

Side effects: action="status" is READ-ONLY (loads the task store, no writes). action="dispatch" / "complete" / "handoff" WRITE to the agent task store and append to its audit log. CRITICAL: action="dispatch" records intent only — it persists a task plus a formatted agent_prompt and does NOT spawn or run a subagent. Per the operating model, actual execution is the caller's responsibility via the Agent tool (subagent_type=engineering); this is the planning + audit surface. Dispatch additionally enforces deterministic guards before writing: a kill switch (refuses if ~/.delimit/pause_dispatch exists), a dead- letter circuit breaker (auto-pauses once too many tasks remain un-acknowledged), a ghost-title reject, and a shipped-LED anti- duplicate gate (refuses + auto-closes a task whose LED is already merged to main). assignee="any" is resolved to a concrete model via the task-type router. Every return is wrapped via _with_next_steps. Errors are deterministic ({"error": ...}): an unknown action short- circuits before any backend call.

Record an engineering-task dispatch with full audit trail.

When to use: as the PLANNING + AUDIT surface when the orchestrator decides to delegate parallelizable engineering work to a subagent. Per the operating model (2026-05-01 revision), actual execution is performed by the Agent tool with subagent_type=engineering; this tool records the intent, assignee, constraints, and eventual outcome so the dispatch is replayable from the ledger. When NOT to use: as an autonomous queue processor expecting auto-execution — this records dispatch but does NOT run the work. Real autonomous queue execution is deferred to a future capability (LED-193 daemon) with strict sandboxing + founder- approval semantics. Also do not use for conversational tasks, sub-5-minute work, or work where no function exists yet.

Sibling contrast: delimit_agent_status reads dispatched task state; delimit_agent_handoff transfers a recorded task to a different model; delimit_agent_complete closes the task with results. Compared to delimit_ledger_add, this is the engineering- work surface with assignee, tools_needed, and constraints schema; ledger items are free-form.

Side effects: writes a new task record to disk via ai.agent_dispatch.dispatch_task (a JSON record in the agent tasks file plus an audit log entry). String list inputs (tools_needed, constraints) are coerced from comma strings to lists. NO subagent is spawned by this call — the caller is responsible for invoking the Agent tool separately. This lifecycle surface is not license-gated in the current build.

Check status of dispatched agent tasks.

When to use: to monitor open/closed agent tasks, either a single task_id or all tasks when task_id is empty. When NOT to use: to dispatch a new task (delimit_agent_dispatch) or to mark one done (delimit_agent_complete).

Sibling contrast: delimit_agent_dashboard surfaces an aggregate view; this returns raw status records.

Side effects: read-only. Calls ai.agent_dispatch.get_agent_status.

Close a dispatched agent task by recording the outcome.

When to use: at the end of an engineering subagent's work, to record the result summary and the files touched on the dispatch record. This is the closing step of the dispatch lifecycle (delimit_agent_dispatch -> [subagent runs] -> this). Without calling this, the task remains "dispatched" in the ledger and dashboards will count it as in-flight. When NOT to use: to hand off ownership to a different model (use delimit_agent_handoff), to dispatch a fresh task (delimit_agent_dispatch), or to read task status without closing (delimit_agent_status). Also: do not call repeatedly on the same task_id — the backend treats a second complete as an error.

Sibling contrast: delimit_agent_handoff transfers active ownership to another model (task stays open); this closes ownership entirely. delimit_agent_status is the read-only sibling.

Side effects: writes a completion record via ai.agent_dispatch.complete_task — the task's status flips from "dispatched" to "completed", result and files_changed are persisted, and an audit log entry is appended. files_changed is coerced from a comma string to a list. No license gate on this lifecycle surface. No notification — pair with delimit_notify if the operator needs to be told.

Hand off an agent task to a different AI model.

When to use: when an executor is blocked or when cross-model review is required and the next model needs the task's context. When NOT to use: to close out the task (delimit_agent_complete) or create a new one (delimit_agent_dispatch).

Sibling contrast: delimit_agent_complete ends the task; this transfers it to another model.

Side effects: writes a handoff record via ai.agent_dispatch.handoff_task; updates assignee on the task.

Link an agent task to a ledger item so the dashboard shows the relationship.

When to use: after delimit_agent_dispatch creates a task and you want the dashboard to show which ledger item it's working on. When NOT to use: to dispatch a new task (delimit_agent_dispatch) or close out a task (delimit_agent_complete).

Sibling contrast: delimit_agent_dispatch creates; delimit_ledger_link links between two ledger items; this links a task to a ledger item.

Side effects: writes the link via ai.agent_dispatch.link_ledger_item.

View the multi-agent orchestration dashboard.

When to use: as a one-shot read of all agent activity grouped by assignee/status — useful for orchestrator status reporting. When NOT to use: for a single task's status (use delimit_agent_status) or to dispatch new work (delimit_agent_dispatch).

Sibling contrast: delimit_agent_status returns raw records; this returns an aggregated dashboard view.

Side effects: read-only. Calls ai.agent_dispatch.get_agent_dashboard.

Args: None.

Returns: Dict with grouped tasks, handoff history, linked ledger items, recent audit trail, next_steps.

Aggregate all governance lanes into one queue; approve/reject approvals (LED-1709).

When to use: as the shared queue the CLI and web dashboard both render — attestations, approvals, sensing (STR-), ops (LED-) — and to approve/reject founder-approval items from that same surface. When NOT to use: to act on attestation/sensing/ops items; approve/reject are approval-class only in Phase 1 (mutate those via their owning tool).

Sibling contrast: delimit_agent_dashboard is dispatch-only, delimit_ledger_context is one-venture-only, delimit_notify_inbox is inbox-only; this unifies all four into one lane-aware view.

Side effects: list/get are READ-ONLY. approve/reject append the same founder_directive_completed ack the email "ship it" loop writes to the EXISTING store (~/.delimit/inbox_routing.jsonl); reject stamps disposition="rejected". No new store; idempotent re-approve no-ops.

Set or view per-model governance permissions.

When to use: to inspect or modify the access policy that gates each AI model's operations on the ledger, memory, evidence, deploy, and secrets. When NOT to use: for runtime governance evaluation (use delimit_gov_evaluate) or session policy (delimit_project_config).

Sibling contrast: delimit_gov_evaluate evaluates one action; this configures the per-model policy that those evaluations use.

Side effects: providing any of ledger/memory/deploy/evidence/ secrets/custom_constraints writes via ai.agent_policy.set_agent_policy. Empty/no-changes is read-only.

Access levels for ledger/memory/evidence: "read-only", "read-write", "none". Boolean flags for deploy/secrets: "true" or "false".

Check if a model is allowed to perform an action under agent policy.

When to use: as a per-action gate before executing sensitive operations from a non-orchestrator model — verify it has the required permission. When NOT to use: to set / inspect policies overall (use delimit_agent_policy) or for runtime governance evaluation (delimit_gov_evaluate).

Sibling contrast: delimit_agent_policy manages the policy; delimit_gov_evaluate is the runtime governance gate; this is a per-action permission check.

Side effects: read-only on the policy store. Calls ai.agent_policy.check_agent_permission.

Get the next task to work on with safeguard checks.

When to use: inside a loop session, to fetch the highest-priority open task with safeguard checks (cost cap, error threshold). When NOT to use: to mark a task done (use delimit_task_complete) or list all tasks (delimit_ledger_list).

Sibling contrast: delimit_task_complete closes + advances; delimit_ledger_list is general listing; this is the loop fetch that may return STOP.

Side effects: read-only on the ledger. Returns action: BUILD, CONSENSUS (queue empty), or STOP (safeguard tripped).

Propose new ledger items based on signals, completed work, and gaps.

When to use: at the end of a build loop or when the queue is empty, to suggest 3-5 next items with rationale. When NOT to use: to add a known item (use delimit_ledger_add) or list current items (delimit_ledger_list).

Sibling contrast: delimit_ledger_add commits chosen items; this proposes candidates.

Side effects: read-only analysis (does NOT auto-create ledger items). The caller decides which proposals to commit.

Mark current loop task done and get the next one.

When to use: at the end of each loop iteration — records completion, updates session metrics, returns the next task. When NOT to use: to close a regular ledger item (use delimit_ledger_done) or fetch next task without closing (delimit_next_task).

Sibling contrast: delimit_ledger_done is per-item; delimit_next_task only fetches; this completes + advances.

Side effects: writes status to the ledger, updates session metrics (cost, errors), returns next task. Loop continues until a STOP signal.

Check autonomous loop metrics for a session.

When to use: to inspect a continuous-loop session's run-time metrics — iterations completed, cost, errors, safeguard status. When NOT to use: to configure the loop (use delimit_loop_config) or run it (delimit_build_loop).

Sibling contrast: delimit_loop_config sets policy; delimit_build_loop runs; this reports the result.

Side effects: read-only. Calls ai.loop_engine.loop_status.

Configure autonomous build loop safeguards.

When to use: BEFORE starting a loop session — to set max iterations, cost cap, error threshold, approval policy. When NOT to use: to read loop metrics (use delimit_loop_status) or drive the loop (delimit_build_loop).

Sibling contrast: delimit_loop_status reads metrics; delimit_build_loop runs; this configures the policy.

Side effects: writes the loop session config via ai.loop_engine.loop_config. Only non-zero/non-empty values are applied — pass just the fields you want to change.

Manage the tool-schema cache to reduce per-session token waste.

When to use: when an MCP client repeatedly dumps full tool definitions and you want to send only diffs across sessions. When NOT to use: as a runtime tool dispatcher — this is a cache side-channel, not a tool-call surface.

Sibling contrast: this caches tool schemas; delimit_help describes individual tools at runtime.

Side effects: action="register" / "clear" / "flush" mutate the cache; "status" / "delta" / "estimate" are read-only.

Create a handoff receipt when transitioning between agents.

When to use: at the end of a session or before passing work to another model — documents what was done, what's pending, and what the next agent should do first. When NOT to use: for general session summary (use delimit_session_handoff) or to acknowledge a receipt (delimit_handoff_acknowledge).

Sibling contrast: delimit_session_handoff is venture-scoped summary; delimit_soul_capture is richer cross-model state; this is the structured per-agent handoff with explicit completed/ not-completed/blockers/scope fields.

Side effects: writes a new handoff receipt via ai.handoff_receipts.create_receipt. The receiving agent should later call delimit_handoff_acknowledge.

Acknowledge a pending handoff receipt before starting work.

When to use: at session start when delimit_handoff_list shows a pending receipt — the receiving agent must acknowledge before starting work. When NOT to use: to create a handoff (use delimit_handoff_create) or list receipts (delimit_handoff_list).

Sibling contrast: delimit_handoff_create writes; delimit_handoff_list reads; this closes the loop on a specific receipt.

Side effects: writes an acknowledgement record via ai.handoff_receipts.acknowledge_receipt; flips the receipt status from pending to acknowledged.

List session handoff receipts.

When to use: at session start to see what previous sessions left pending, or to audit acknowledged handoffs. When NOT to use: to create a handoff (use delimit_handoff_create) or acknowledge one (delimit_handoff_acknowledge).

Sibling contrast: delimit_handoff_create writes; delimit_handoff_acknowledge closes; this reads the receipt list.

Side effects: read-only. Calls ai.handoff_receipts.get_receipts.