Advanced: attach session policy
runtime_session_policy[advanced/internal] Attach allow rules on an already-open raw session (allow_slugs / allow_ops). Policy overlay — not open and not exec. Identity remains Aziel Eliab. Use this when an already-open session needs tighter allow_slugs / allow_ops before exec. Do not use it for executing an op or opening a session; use runtime_session_exec or runtime_session_open (prefer fraggate_call, which applies defaults) instead. Write: mutates session policy only. A sealed session refuses session_closed (409). Expired sessions refuse session_expired (410). Missing both session_id and id fails before the door runs. Does not exec and does not mint a new id. session_id or id (aliases) required. allow_slugs / allow_ops replace the allow overlay when sent; omit them to leave the current lists. max_payload_bytes and kv_increment are optional overlays, not exec payload. Nested policy{} is accepted as the same overlay. Mutation requires confirm=true (runtime gate) or dry_run=true (preview only, no write). confirm and dry_run stay optional on inputSchema.required. Returns updated session policy plus a policy receipt.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| id | No | Alias of session_id. The door accepts either key; do not send two different values. | |
| confirm | No | Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true (preview, no write). | |
| dry_run | No | Optional preview flag. When true, return a would-mutate preview and do not write. Alternative to confirm=true. Does not mutate. | |
| allow_ops | No | Optional replacement allowlist of ops this session may exec. Omit to keep the current list. | |
| session_id | Yes | Required. Raw session id from runtime_session_open (sess_ + 32 lowercase hex). Alias: id. Missing both fails with session_id required; unknown id returns session_not_found. | |
| allow_slugs | No | Optional replacement allowlist of catalog slugs this session may exec. Omit to keep the current list. | |
| kv_increment | No | Optional. When true, allow KV increment side effects on later exec. Not an increment itself. | |
| max_payload_bytes | No | Optional max payload size in bytes for later exec (integer 1..1048576). Overlay only; not the exec body. Out of range refuses bad_policy. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| code | No | FragGate or fabric code when present: FG-OK, FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-UNKNOWN-OP, FG-GATE-REFUSE, FG-LAMB-REFUSE, or a module refuse such as MESH-* / AKM-*. | |
| door | No | Door name. The public door is fraggate. | |
| ran_in | No | Execution locale (for example aziel-runtime) when present. | |
| result | No | Policy body: updated session allow lists and a policy receipt. Refuses session_id required, session_not_found, session_closed, session_expired. | |
| status | No | HTTP-like status when present on wrappers (200 ok; 400+ error / refuse). | |
| display | No | Human-facing envelope. Show title and summary, then take the next input. | |
| receipt | No | Optional receipt, ledger tip, or TemporalLock/ForgeReceipts exit when the door stamped one. | |
| refusal | No | Explicit refuse object, code, or message when the door or engine refused. | |
| engine_op | No | Resolved engine op when present (often inside result). | |
| ledger_tip | No | Ask/refuse ledger tip when the door stamped one. | |
| provenance | No | Provenance / input packet when the pipeline attached one. | |
| session_id | No | Raw session id when session plumbing was used. Hidden unless the user asked for the chain. | |
| engine_slug | No | Resolved engine slug when present (often inside result). | |
| limitations | No | Capability limitations or Remain-OFF notes when present. | |
| engine_digest | No | 64-hex engine_digest when a true in-process engine ran (often inside result). |