Mnemom — Trust Ratings for AI Agents

Name: Mnemom — Trust Ratings for AI Agents
Author: mnemom

Server Details

Trust infrastructure for AI agents: read a verifiable Trust Rating, claim an identity, earn a badge.

If you are the author of this connector, you can claim ownership by verifying the domain or GitHub account it belongs to. Claimed connector authors can inspect health checks, view analytics, and manage their listing.

Status: Healthy
Uptime: 99.9% over 56 days
Last Tested: 2026-10-12 08:17
Transport: Streamable HTTP · MCP 2025-06-18
URL
Repository: mnemom/mcp
GitHub Stars: 1
Server Listing: Mnemom

TDQS

A4.1/5.0

Scored 2026-09-30 21:40 across 15 tools

Disambiguation4/5

Tools mostly have distinct purposes, but scan_trust and verify_scan overlap because verify_scan can re-scan a URL, and the four reputation-related tools (get_reputation, get_reputation_badge, verify_reputation, search_reputation_directory) cluster in the same domain, which could cause some hesitation. Descriptions largely clarify boundaries, but a few pairs require careful reading.

Naming Consistency5/5

All tools use snake_case with a consistent verb_noun pattern (claim_agent, get_reputation, put_alignment_by_agent, etc.). The 'by_agent' suffix and multi-word verbs like preview_compose_ are applied consistently, with no mixed conventions.

Tool Count5/5

15 tools is well within the typical range and each tool appears to serve a distinct function across identity, reputation, scanning, governance, onboarding, and feedback. No obvious padding or extreme over/under supply.

Completeness4/5

Core create/read/update coverage for identity and reputation is solid, but governance cards have publish and preview operations without a corresponding get/read-back tool, and there is no explicit delete/revoke or opt-out operation for reputation visibility. These are minor gaps that agents could potentially work around, but they leave some dead ends.

Available Tools

15 tools

claim_agentA

Destructive

Inspect

Claim a verifiable identity — bind an agent to your organization so its trust and accountability record is provably yours. Requires the agent's possession proof (hash_proof). Re-claiming an agent you already own keeps its original claim date but files it under the organization you pass (org_id; if omitted, your personal organization), which can change the organization that owns and bills it.

ParametersJSON Schema

Name	Required	Description
`org_id`	No	Optional. The organization to claim the agent into (e.g. `org-...` or `pers-...`). The caller must be a member of this org (role floor: member). If omitted, the agent is claimed into the caller's personal org.
`agent_id`	Yes	Agent identifier (e.g. smolt-abc123)
`hash_proof`	Yes	Agent possession proof — either the live birth token (`mnbt_…`) whose row pins this agent's hash, or the full 64-hex SHA-256 digest of `${apiKey}\|${agentName}` (or `${apiKey}` for an unnamed singleton agent).

Output Schema

ParametersJSON Schema

Name	Required	Description
`org_id`	Yes	The organization the agent was claimed into (echoes the resolved org — the supplied `org_id`, or the caller's personal org when omitted).
`claimed`	Yes
`agent_id`	Yes
`claimed_at`	Yes

TDQS

A4.4/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare non-read-only, non-idempotent and destructive, so the description's job is to add context — and it does: it discloses the possession-proof requirement and the re-claim rule (original claim date preserved, org/billing ownership can shift). It does not spell out what is actually destroyed or taken from a previous owner, which is the one behavioral gap left to the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, purpose front-loaded, no filler or restatement of the title. The denser final sentence is justified because every clause (claim-date preservation, org default, billing impact) is decision-relevant.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given an output schema exists, return values needn't be described; the description covers prerequisites, the org default, and the re-claim edge case. It omits the role floor for the target org (only in the schema) and the concrete destructive consequence implied by destructiveHint=true.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% (baseline 3), but the description adds meaning beyond the schema: re-claiming files the agent under the passed `org_id` and can change which organization owns and bills it, which is not stated in the `org_id` schema text. That consequence-level detail elevates it above the baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Opens with a specific verb+resource ('Claim a verifiable identity — bind an agent to your organization') and states the outcome (trust/accountability record becomes provably yours). This clearly distinguishes it from read-oriented siblings like get_agent, list_agents, and verify_reputation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

States the precondition for use (the agent's possession proof, `hash_proof`, is required) and explains the default routing when `org_id` is omitted. It does not name an alternative tool or a when-not-to-use case, but the surrounding siblings are mostly read tools, so the context is adequate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_agentA

Read-onlyIdempotent

Inspect

Look up an agent's public identity and trust state by ID — the accountable record other agents and humans can rely on.

ParametersJSON Schema

Name	Required	Description	Default
`agent_id`	Yes	Agent identifier (e.g. smolt-abc123)

Output Schema

ParametersJSON Schema

Name	Required	Description
`id`	Yes	Agent identifier (e.g. smolt-abc123).
`name`	No	Agent name (2-32 chars, alphanumeric + hyphens).
`caller`	No	Which projection THIS response is. `org_member` receives the owner field set; `anonymous`/`authenticated` receive the reduced public set (id, name, claimed, created_at, last_seen, status, avatar_url, caller). Read this instead of inferring why a field is absent.
`groups`	No	Active groups this agent belongs to, name-ordered; `[]` when none. Present on org-fleet rows.
`org_id`	No	The agent's organization binding. Required as an input by the org-scoped tools (fleet listing, posture assignment). Identifies an organization, not a person.
`public`	No	Whether the agent's identity record is publicly discoverable. Distinct from Trust Rating visibility, which is always public.
`status`	No	Derived from last_seen (active = seen within the last hour).
`claimed`	No	Whether a human or organization has claimed accountability for this agent. On the owner projection this is derived from the ownership column; the owning user's identifier itself is not returned.
`last_seen`	No
`agent_hash`	No	The canonical public identity hash (first 16 hex chars) used as the gateway lookup key and as the input to verify_agent_binding. Owner projection only. Not a credential and not reversible to one.
`avatar_url`	No
`claimed_at`	No
`created_at`	No
`containment_status`	No	Containment state of the agent.
`aip_enforcement_mode`	No

TDQS

A3.8/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the read-only nature is covered. The description adds that the lookup targets 'public identity and trust state,' providing some scope beyond annotations, but it does not disclose behavior for missing IDs, error cases, or data freshness, so the added transparency is modest.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence with no wasted words. It names the action, the resource, and the lookup key, while the final clause adds meaningful context about the tool's reliability as an 'accountable record.'

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter lookup with an output schema and strong annotations, the description is largely complete: it identifies what is looked up and why it matters. The only missing piece is explicit guidance about when to prefer sibling tools, but that is more a usage-guideline concern and does not undermine overall completeness for a simple read-only lookup.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% coverage: agent_id is described with an example ('e.g. smolt-abc123'). The description only repeats 'by ID' without adding new parameter semantics, so baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Look up an agent's public identity and trust state by ID.' This clearly distinguishes it from siblings like list_agents (which lists) and get_reputation (which focuses on reputation), and it explicitly identifies the lookup key (ID).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies use when one needs the accountable agent record, but it provides no explicit when-to-use or when-not-to-use guidance, nor does it mention alternative tools like get_reputation or verify_agent_binding. It relies on context rather than explicit exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_reputationA

Read-onlyIdempotent

Inspect

Look up an AI agent's published Trust Rating — Mnemom's portable reliability signal for autonomous software, computed from the agent's own verified activity record. Returns the rating plus the technical factors behind it. Free, public, read-only: ratings are public by default, unless the agent's owner has opted out.

ParametersJSON Schema

Name	Required	Description	Default
`agent_id`	Yes	Agent identifier (e.g. smolt-abc123)

Output Schema

ParametersJSON Schema

Name	Required	Description
`tier`	No
`grade`	Yes	AAA–D or NR.
`score`	Yes
`claimed`	No
`agent_id`	Yes
`trend_30d`	No
`agent_name`	No
`components`	Yes
`confidence`	Yes
`visibility`	Yes	Reputation-publication axis — whether this agent's Trust Rating is published. Every registered agent's reputation is `public` by accountability standard (the default; that is the whole point of a portable, verifiable rating); `private` is a rare owner opt-out that 403s the read to non-owners. This is DISTINCT from `Agent.public` (the identity-record visibility axis) — they share the word "public" but govern different things.
`computed_at`	No
`is_eligible`	Yes
`next_compute_at`	No	Next scheduled recompute — the 00/06/12/18 UTC cron slot strictly after `computed_at` (`floor(computed_at/6h)*6h + 6h`). Null when `computed_at` is null.
`checkpoint_count`	Yes
`a2a_trust_extension`	No	A2A trust extension for interop. Only present on `GET /reputation/{agent_id}` (not on batch/compare rows).
`checkpoint_accounting`	No	Structured breakdown of how checkpoints were counted toward the score. `analyzed` is the scoring population; `excluded` buckets are mutually exclusive and `analyzed + synthetic + insufficient_thinking + quarantined = total`. Null for legacy rows computed before this field existed.

TDQS

A3.9/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, non-destructive and closed-world, so safety is covered. The description adds genuinely new behavioral context: the operation is free, ratings are public by default, and an owner opt-out can mean no published rating exists — a failure mode the annotations do not convey. It stops short of stating auth requirements or the exact response shape.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences, front-loaded with the action and result, followed by the access/privacy conditions. Every clause carries information; nothing is padding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so the description need not enumerate return fields, and it still flags that technical factors accompany the rating. For a single-parameter read-only lookup with full annotation coverage, nothing an agent needs to call it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Only one parameter (agent_id) and schema description coverage is 100%, so the schema already documents it fully (with an example like smolt-abc123). The description adds no syntax, format, or resolution guidance for agent_id, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Specific verb+resource: 'Look up an AI agent's published Trust Rating,' with a clarifying definition of what the rating is (a portable reliability signal computed from the agent's verified activity record). It also states what comes back (the rating plus the technical factors), which distinguishes it somewhat from a badge tool, but it never names or contrasts verify_reputation, search_reputation_directory, or get_reputation_badge despite those being close siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives contextual conditions — free, public, read-only, and that ratings exist by default unless the owner opted out — which implies when this lookup is appropriate. However, it offers no explicit when-to-use versus the several reputation-related siblings (verify_reputation, search_reputation_directory, get_reputation_badge, scan_trust), leaving the routing decision to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_reputation_badgeA

Read-onlyIdempotent

Inspect

Get an embeddable Trust Rating badge for an agent — returns the badge image URL plus ready-to-paste Markdown and HTML snippets for a README or agent card.

ParametersJSON Schema

Name	Required	Description	Default
`agent_id`	Yes	Agent identifier (e.g. smolt-abc123)

Output Schema

ParametersJSON Schema

Name	Required	Description
`agent_id`	Yes	The agent the badge is for (echoed from the request).
`badge_url`	Yes	Canonical SVG Trust Rating badge image URL (always on api.mnemom.ai).
`html_embed`	Yes	Paste-ready HTML badge snippet.
`profile_url`	Yes	Human-readable reputation profile page (on www.mnemom.ai).
`verified_url`	Yes	Public cryptographic verification URL for the rating.
`markdown_embed`	Yes	Paste-ready Markdown badge snippet.

TDQS

A3.9/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already provide readOnlyHint, idempotentHint, destructiveHint. The description adds output format details (URL, snippets) but does not disclose additional behavioral traits like authentication requirements or rate limits beyond what annotations imply.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, front-loaded sentence that conveys all necessary information without extraneous words. Every part contributes to understanding the tool's purpose and output.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (one parameter, clear output schema), the description fully covers what the tool does and returns. No additional context is needed for an agent to correctly invoke it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with a clear description for the single parameter 'agent_id'. The tool description does not add meaning beyond the schema, meeting the baseline of 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool returns an embeddable Trust Rating badge, specifying the output includes badge URL and Markdown/HTML snippets. The verb 'Get' and resource 'badge' are specific, and it distinguishes from sibling tools like 'get_reputation' which likely return raw data.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage when an embeddable badge is needed but does not explicitly state when to use this tool versus alternatives (e.g., 'get_reputation' for raw data). No guidance on when not to use it is provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_startedA

Read-onlyIdempotent

Inspect

Zero-auth, no-args orientation: who Mnemom is, the surface map, how to authenticate and what it unlocks, and the tools to try right now (scan_trust and the reputation lookups).

ParametersJSON Schema

Name	Required	Description	Default
`token`	No	Optional Dojo try-me invite token. When supplied and valid, returns the token-gated dojo briefing manifest (the same content as GET /v1/dojo/try-me/resolve); omit for public orientation.

Output Schema

ParametersJSON Schema

Name	Required	Description
`who`	Yes	One-line positioning.
`verify`	Yes	How to verify signed artifacts in-band (verify, don't trust).
`try_now`	Yes	Zero-auth value tools to call right now.
`doctrine`	Yes
`skill_path`	Yes	The two-step on-ramp to declaring and advertising capabilities as A2A skills in a signed, portable AgentCard.
`value_prop`	Yes	What Mnemom does for an agent.
`surface_map`	Yes	Stable links to the canonical read-only surfaces.
`authenticate`	Yes	How to authenticate and what auth unlocks.
`developer_path`	Yes	The developer hero on-ramp: the npx one-liner plus the intent-named MCP prompt-skills (try-me, onboard_an_agent, become_sovereign). Advertisement only — no functional dependency on those prompts existing yet.
`showcase_agent`	Yes	A real Mnemom-owned agent the try_now reputation reads target, so the loop runs verbatim.
`sovereignty_path`	Yes	The five-step on-ramp to becoming a sovereign, accountable agent, composed from existing tools. Walked end to end by the become_sovereign MCP prompt.
`visibility_model`	Yes	Disambiguates the two axes that share the word 'public': reputation-publication visibility (public by standard) vs identity-record visibility (agent.public), plus the caller-context self-description.
`what_we_keep_private_and_why`	Yes

TDQS

A4/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, non-destructive and closed-world, so the safety profile is covered. The description adds value the annotations don't carry: it declares the auth requirement (zero-auth) and enumerates what the orientation unlocks, which is exactly the extra context this dimension rewards. The 'no-args' claim is slightly loose given the optional token parameter, but the schema resolves it.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One front-loaded sentence with no filler; the colon-separated list packs the covered topics and the recommended next tools without redundancy. Nothing can be removed without losing information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return contents need not be described, and the single optional parameter is documented in the schema. The description covers purpose, auth posture, and next steps adequately; only the token-gated variant is left entirely to the schema, which is a minor omission.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the single optional token parameter is already fully explained in the schema, including the token-gated dojo manifest behavior. The description adds only 'no-args' and does not elaborate on the token path, so the baseline 3 for schema-driven parameter documentation applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific resource and scope: a zero-auth orientation covering who Mnemom is, the surface map, authentication, and starter tools. It distinguishes itself from siblings by naming scan_trust and the reputation lookups as downstream tools to try. It is not a verb+resource phrasing, but the intent is unambiguous without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

'Zero-auth, no-args orientation' plus 'the tools to try right now' gives clear context for when to call this: at the start, before the named sibling tools. It stops short of an explicit 'call this first / don't use it for X' exclusion, so it lands at clear-context-without-exclusions rather than a full routing rule.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_agentsB

Read-onlyIdempotent

Inspect

List the agents your account owns, with pagination (limit, offset). Read-only.

ParametersJSON Schema

Name	Required	Description	Default
`limit`	No	How many agents to return, 1-100.
`offset`	No	How many agents to skip, for pagination.

Output Schema

ParametersJSON Schema

Name	Required	Description
`scope`	Yes	Echoes the resolved listing scope.
`agents`	Yes	The caller's agents, reduced to the MCP trust-loop field set.

TDQS

B3.4/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true and destructiveHint=false, so the 'Read-only' claim merely repeats structured data. The description adds no behavioral context beyond the schema, such as ordering or what an empty result means; with annotations carrying the safety profile, a 3 is appropriate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One sentence, scope front-loaded, pagination and the read-only nature tacked on compactly. No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists so return values need no explanation, and both parameters are documented. For a simple scoped list tool the description is nearly complete, missing only ordering/tie-break behavior when paging.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with defaults and min/max bounds documented inline, so the schema does the heavy lifting. Naming `limit` and `offset` in the description adds no syntax or semantics beyond what the schema already states.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource and scopes it precisely to 'the agents your account owns', which separates it from directory-wide or reputation siblings. It does not name get_agent or claim_agent to differentiate further, so it falls short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no explicit when-to-use guidance and no mention of alternatives among the many siblings (get_agent, claim_agent, search_reputation_directory). The agent must infer that this is the enumeration path for its own agents.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

preview_compose_alignment_by_agentA

Read-onlyIdempotent

Inspect

Dry-run an alignment card: shows the card that would result after merging with the platform, organization and team policies above it, plus any conflicts. Nothing is saved.

ParametersJSON Schema

Name	Required	Description
`audit`	Yes	How long this agent's own decision log is kept, and whether it can be queried. Required. (This is the agent's audit policy — it is NOT Mnemom's retention policy for the card itself; see the tool's data-handling disclosure for that.)
`values`	Yes	The values this agent declares it is bound by. Required.
`agent_id`	Yes	The agent this card belongs to (e.g. `smolt-abc123`). Identifier only — never place an API key, a secret, an email address, or any other personal data in this field.
`autonomy`	Yes	What the agent may do on its own authority. Required.
`principal`	Yes	Whose authority this agent acts under. Required.
`card_version`	Yes	Card schema version. REQUIRED by the server-side validator. Current canonical value: `unified/2026-04-26`.
`autonomy_mode`	Yes	Master switch for the action-policing pipeline. Required. `off` disables it; `observe` records only; `nudge` warns; `enforce` blocks.
`integrity_mode`	Yes	Master switch for the values pipeline. Required. Same four states as `autonomy_mode`.

Output Schema

ParametersJSON Schema

Name	Required	Description
`ok`	Yes	True when composition succeeded (no blocking conflicts).
`summary`	Yes	One-line human-readable summary of composition status.
`full_report`	No	Optional pointer to the full /v1 conflict report (method + path).
`conflicts_count`	Yes	Total number of conflicts detected (0 = none).
`composition_valid`	Yes	True when the composed card is coherence-valid.

TDQS

A4.2/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true and destructiveHint=false, so safety is covered. The description adds genuinely new behavior: that the result is a composition against three tiers of inherited policy and that conflicts are surfaced rather than silently resolved, which an agent needs to know to interpret the output. It stops short of saying what happens on merge failure or whether conflicts block a subsequent put.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, front-loaded with the dry-run framing and the merge semantics, closing with the no-persistence guarantee. Nothing is redundant and nothing could be cut without losing meaning.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, the description needn't explain return values, and it correctly focuses on the composition behavior and the no-write guarantee. The remaining gap is that it doesn't hint that the payload is heavy (8 required params, nested objects) or that card_version is validator-enforced, though both are covered in the schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the nested schema documents every field, enum and constraint in detail, so the baseline is 3. The description adds no parameter-level meaning beyond the schema — notably it does not mention that the same full card body is required here as for the real put.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (dry-run) on a specific resource (alignment card) and describes exactly what the output is: the card resulting from merging platform, organization and team policies, plus conflicts. The closing "Nothing is saved" separates it cleanly from the write-path sibling put_alignment_by_agent and from preview_compose_protection_by_agent without needing the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description establishes clear usage context — this is the preview/dry-run path, so the agent should call it before committing anything. However, it never explicitly names the alternative (put_alignment_by_agent) or states conditions/exclusions for choosing between them, leaving that inference to the agent.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

preview_compose_protection_by_agentA

Read-onlyIdempotent

Inspect

Dry-run a protection card: shows the card that would result after merging with the platform, organization and team policies above it, plus any conflicts. Nothing is saved, and no publish grant is needed.

ParametersJSON Schema

Name	Required	Description
`mode`	Yes	Screening mode for the protection pipeline. Required. `off` disables screening; `observe` records only; `nudge` warns; `enforce` blocks.
`agent_id`	Yes	The agent this card belongs to (e.g. `smolt-abc123`). Identifier only — never place an API key, a secret, an email address, or any other personal data in this field.
`thresholds`	Yes	Risk-score cutoffs, each in [0, 1] and ordered warn ≤ quarantine ≤ block. Required. Send the full set: a publish replaces the agent's current card rather than patching it.
`card_version`	Yes	Card schema version. REQUIRED by the server-side validator. Current canonical value: `protection/2026-04-26`.
`screen_surfaces`	Yes	Which traffic surfaces are screened. Required, with all four flags set.
`trusted_sources`	Yes	Sources exempt from screening. Required, with all three lists present; send empty lists to trust nothing extra. Enumerate specific hosts — wildcards are rejected, and a server-side deny-list (public LLM/DNS endpoints, 0.0.0.0/0, ::/0, link-local, multicast) is always applied.
`protected_surface`	No	The assets and operations this agent must protect. Omit to accept the composed default (empty surface).

Output Schema

ParametersJSON Schema

Name	Required	Description
`ok`	Yes	True when composition succeeded (no blocking conflicts).
`summary`	Yes	One-line human-readable summary of composition status.
`full_report`	No	Optional pointer to the full /v1 conflict report (method + path).
`conflicts_count`	Yes	Total number of conflicts detected (0 = none).
`composition_valid`	Yes	True when the composed card is valid.

TDQS

A4.2/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish readOnly, idempotent and non-destructive, so the bar is lower, and the description still adds real value: nothing is persisted and no publish grant is needed, and the response surfaces conflicts. It doesn't state any auth/prerequisite constraints (e.g. whether the agent must already exist or be claimable), leaving one behavioral gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences with no waste; the dry-run framing and merge behavior are front-loaded, and the safety note (nothing saved, no grant needed) closes the thought efficiently.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, return-value explanation is not needed, and the description covers the essential behavioral facts: composed result, conflicts, no persistence. Minor gaps remain around prerequisites (whether the agent_id must reference an existing/claimable agent) that an agent would still have to infer.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% with unusually detailed field docs (enums, ordering constraint on thresholds, deny-listed sources), so the schema carries the parameter burden. The description adds only the high-level notion that a supplied card is merged with policies above it, and never names a parameter or its semantics, so baseline 3 is correct.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ("Dry-run a protection card") and explains the output semantics: the composed card after merging platform, org, and team policies, plus conflicts. The "Nothing is saved" clause implicitly separates it from the write sibling put_protection_by_agent, and the protection-vs-alignment distinction from preview_compose_alignment_by_agent is obvious from the resource name.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives clear context for when this applies (dry-run, no publish grant required), which is exactly the situation where an agent should prefer this over the publish counterpart. It stops short of an explicit "use this before calling put_protection_by_agent" or any exclusion, so it lands just under the top tier.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

put_alignment_by_agentA

DestructiveIdempotent

Inspect

Publish or replace an agent's alignment card: its governance modes, the principal it acts for, its declared values, the actions it may take on its own, and its audit policy. The server merges the card with the platform, organization and team policies above it and stores the result. Use preview_compose_alignment_by_agent to dry-run first.

ParametersJSON Schema

Name	Required	Description
`audit`	Yes	How long this agent's own decision log is kept, and whether it can be queried. Required. (This is the agent's audit policy — it is NOT Mnemom's retention policy for the card itself; see the tool's data-handling disclosure for that.)
`values`	Yes	The values this agent declares it is bound by. Required.
`agent_id`	Yes	The agent this card belongs to (e.g. `smolt-abc123`). Identifier only — never place an API key, a secret, an email address, or any other personal data in this field.
`autonomy`	Yes	What the agent may do on its own authority. Required.
`principal`	Yes	Whose authority this agent acts under. Required.
`card_version`	Yes	Card schema version. REQUIRED by the server-side validator. Current canonical value: `unified/2026-04-26`.
`autonomy_mode`	Yes	Master switch for the action-policing pipeline. Required. `off` disables it; `observe` records only; `nudge` warns; `enforce` blocks.
`integrity_mode`	Yes	Master switch for the values pipeline. Required. Same four states as `autonomy_mode`.

Output Schema

ParametersJSON Schema

Name	Required	Description
`ok`	Yes	Always true on successful storage (errors return non-200 status).
`card_id`	Yes	Card ID (ac-{uuid}) of the stored alignment card.
`issued_at`	Yes	ISO 8601 timestamp when the card was issued/stored.

TDQS

A4.4/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already flag destructiveHint=true and idempotentHint=true, so the write/replace profile is partly covered. The description adds genuinely new behavior beyond that: the server merges the submitted card with platform, organization, and team policies above it and stores the composed result. It stops short of 5 because it never says what a replace overwrites or discards.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the primary action and its scope, closing with the safest-path alternative. Zero filler; every clause carries information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex nested 8-parameter mutation with an output schema and rich annotations, the description supplies the compose/merge semantics and the dry-run pointer. The main residual gap is the destructive side of a replace, though the destructiveHint annotation partially compensates.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 100% schema coverage the baseline is 3, but the description maps its enumerated content (governance modes, principal, declared values, bounded actions, audit policy) onto the top-level required parameters, giving the agent a conceptual grouping the flat schema does not. It adds no per-field syntax beyond that, so not a 5.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb pair (publish/replace) and resource (an agent's alignment card), then enumerates the card's substance: governance modes, principal, declared values, autonomy bounds, and audit policy. An agent can distinguish this from siblings like put_protection_by_agent or the preview tools without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly routes to preview_compose_alignment_by_agent as a dry-run alternative before committing. It gives clear context for the safe path but does not state when NOT to use this tool or differentiate it from put_protection_by_agent, so it stops short of the 5-level bar.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

put_protection_by_agentA

DestructiveIdempotent

Inspect

Publish or replace an agent's protection card (screening mode, thresholds, trusted sources, protected assets). When connected by OAuth sign-in (e.g. ChatGPT), each publish first needs a one-time grant from the same signed-in account: open https://www.mnemom.ai/authorize-protection?agent_id=, approve, then publish within 15 minutes (each grant covers one publish). Required: agent_id, card_version, mode, thresholds, screen_surfaces and trusted_sources (protected_surface is optional); mode enforce also needs Safe House on the organization. Use preview_compose_protection_by_agent to dry-run without a grant.

ParametersJSON Schema

Name	Required	Description
`mode`	Yes	Screening mode for the protection pipeline. Required. `off` disables screening; `observe` records only; `nudge` warns; `enforce` blocks.
`agent_id`	Yes	The agent this card belongs to (e.g. `smolt-abc123`). Identifier only — never place an API key, a secret, an email address, or any other personal data in this field.
`thresholds`	Yes	Risk-score cutoffs, each in [0, 1] and ordered warn ≤ quarantine ≤ block. Required. Send the full set: a publish replaces the agent's current card rather than patching it.
`card_version`	Yes	Card schema version. REQUIRED by the server-side validator. Current canonical value: `protection/2026-04-26`.
`screen_surfaces`	Yes	Which traffic surfaces are screened. Required, with all four flags set.
`trusted_sources`	Yes	Sources exempt from screening. Required, with all three lists present; send empty lists to trust nothing extra. Enumerate specific hosts — wildcards are rejected, and a server-side deny-list (public LLM/DNS endpoints, 0.0.0.0/0, ::/0, link-local, multicast) is always applied.
`protected_surface`	No	The assets and operations this agent must protect. Omit to accept the composed default (empty surface).

Output Schema

ParametersJSON Schema

Name	Required	Description
`ok`	Yes	Always true on successful storage (errors return non-200 status).
`card_id`	Yes	Card ID (pc-{uuid}) of the stored protection card.
`issued_at`	Yes	ISO 8601 timestamp when the card was issued/stored.

TDQS

A4.6/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Adds critical behavior the annotations don't: the one-time OAuth grant flow with a URL, the 15-minute window, one grant per publish, the Safe House dependency for `enforce`, and the fact that a publish replaces rather than patches. Annotations only carry destructive/idempotent hints; the description supplies the operational prerequisites.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the action and payload, then the auth flow, then required fields, then the alternative — all in three dense sentences with no filler. Every clause is load-bearing.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

A destructive, idempotent write with an output schema and nested params is covered well: auth, prerequisites, required fields, replace-not-patch semantics, and the dry-run alternative all present. The output schema handles return values, so remaining gaps are minor (e.g. rate limits or failure modes).

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema documents all parameter semantics including nested objects and the ordering constraint on thresholds. The description lists required vs optional fields and notes mode `enforce` needs Safe House, but adds no format detail beyond the schema. Baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States specific verb 'Publish or replace' and resource 'an agent's protection card', and enumerates its contents (screening mode, thresholds, trusted sources, protected assets). Clearly distinguished from sibling preview_compose_protection_by_agent, which it names.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly routes to the alternative: 'Use preview_compose_protection_by_agent to dry-run without a grant.' Also states the exact OAuth precondition and the 15-minute publish window after approving the grant, plus the Safe House requirement for `enforce`.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

report_recipe_fn_fpAInspect

Submit a false-positive / false-negative correction for one of Mnemom's automated detection rules (a 'recipe') — technical feedback that improves detection accuracy, like filing a bug report against a spam filter.

ParametersJSON Schema

Name	Required	Description
`type`	Yes	`fn` = false negative (the recipe should have fired). `fp` = false positive (it fired on legitimate behaviour).
`summary`	Yes	A short description of what the recipe got wrong — what it flagged, or what it missed, and why that was incorrect. DESCRIBE the misfire; do NOT paste the conversation, the prompt, the raw payload or the log that triggered it. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization.
`agent_id`	No	Optional. The agent the report concerns. Identifier only.
`recipeId`	Yes	The detection recipe the report is filed against (the one that misfired or failed to fire). Identifier only.
`checkpoint_id`	No	Optional. The related integrity checkpoint, so the reviewer can correlate. Identifier only.

Output Schema

ParametersJSON Schema

Name	Required	Description
`ok`	Yes
`type`	Yes
`candidate_id`	Yes
`related_recipe_id`	Yes

TDQS

A4/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate this is a write operation (readOnlyHint=false) and not idempotent or destructive. The description adds the intended effect of improving detection accuracy but does not disclose side effects such as persistence on a governance card or visibility to the organization; that detail is deferred to the schema's summary parameter description.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence that states the action, target, and purpose without redundancy. Every phrase earns its place, and it is appropriately sized for the tool's complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description, combined with a fully covered input schema and an output schema, provides enough context for an agent to select and invoke the tool. It lacks an explicit 'when not to use' statement or mention of the governance-card storage detail, but those are not required given the structured schema information.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with parameter descriptions already explaining `type`, `summary` constraints, and identifier formats. The main description adds little beyond the domain context of a 'recipe' being an automated detection rule, so it does not need to compensate significantly.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Submit') and a specific resource ('false-positive / false-negative correction for one of Mnemom's automated detection rules (a 'recipe')'). It clearly distinguishes this tool from the sibling list, which contains no other submission/report tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context: this is for submitting technical feedback that improves detection accuracy, analogous to a bug report against a spam filter. It does not name explicit alternatives or exclusions, but no sibling appears to offer a similar reporting function, so the usage context is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scan_trustA

Read-onlyIdempotent

Inspect

Scan a website's agent-trust-readiness and return a signed scorecard (Trust, plus an Access axis on newer rubrics). Zero-auth. Results are CACHED for up to 24h — check cached and scannedAt on the result; pass fresh: true to force a re-scan (rate-limited). Proxies to the SSRF-locked isittrustready scanner; the Ed25519 signature + permalink are preserved verbatim. Rubric + docs: https://www.isittrustready.ai/rubric and https://docs.mnemom.ai/.

ParametersJSON Schema

Name	Required	Description	Default
`url`	Yes	Domain or URL to scan, e.g. "example.com" or "https://example.com".
`fresh`	No	Force a fresh re-scan instead of the cached result (results are cached up to 24h; the engine rate-limits re-scans). Equivalent to the scanner's rescan flag.

Output Schema

ParametersJSON Schema

Name	Required	Description
`grade`	Yes	Trust letter grade (A+…F).
`score`	Yes	0–100 weighted overall TRUST score.
`access`	No	The independent Access/discoverability axis (never blended with Trust). Present from the two-axis rubric (0.3.0+).
`cached`	No	True when served from the scanner's 24h cache rather than a fresh scan.
`schema`	Yes	iitr-scan schema version string (e.g. "iitr-scan/v0.N").
`target`	Yes	Normalized host that was scanned.
`permalink`	No	Shareable /r/ permalink (only on /r/ responses; transport field).
`scannedAt`	No	When this scorecard was produced. Results are cached up to 24h — pass fresh:true to scan_trust to force a re-scan.
`signature`	Yes	Ed25519 signature over the canonical result (transport field; stripped before verify).
`categories`	No	Trust-axis categories with per-category scores + checks.
`verification`	No	Self-describing in-band verification block {alg, kid, jwks, canonicalization} — how to verify this scorecard's signature. Self-describing, so signed-EXCLUDED (stripped before verify).
`rubricVersion`	No	Rubric version (e.g. "0.4.0").

TDQS

A4.7/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations (readOnlyHint, idempotentHint, destructiveHint false), the description adds significant behavioral details: results are cached for 24h, the `fresh` parameter bypasses cache but is rate-limited, it proxies to an SSRF-locked scanner, and preserves Ed25519 signature and permalink. There is no contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise with 4-5 sentences, each serving a distinct purpose: core action, caching behavior, forced re-scan, proxy details, and a link to docs. There is no fluff, and the most critical information is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the existence of an output schema (not shown), the description does not need to detail return values. It mentions result fields (cached, scannedAt), signature preservation, permalink, and a link to rubric docs. It also covers caching, rate limiting, and zero-auth. This provides a comprehensive understanding of the tool's behavior and output.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with basic descriptions for `url` and `fresh`. The description adds context: `fresh` is 'equivalent to the scanner's rescan flag' and explains caching implications. This adds value beyond the schema, raising the score above baseline 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool scans a website's agent-trust-readiness and returns a signed scorecard, specifying the verb 'scan' and resource 'website's agent-trust-readiness'. This distinguishes it from sibling tools like claim_agent, get_reputation, etc., which focus on agents and reputation rather than website scanning.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context: zero-auth, caching behavior, and the option to force a fresh scan with the `fresh` parameter. It implicitly tells when to use this tool (when you need a trust-readiness scan) but does not explicitly mention when not to use it or name alternatives. The sibling list contains verify_scan, which might be related, but no exclusion is given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_reputation_directoryA

Read-onlyIdempotent

Inspect

Resolve an agent name or id-prefix to a real agent_id over the PUBLIC reputation directory (only agents whose reputation visibility is public). Zero-auth. The arriving-agent entry point: discover a concrete agent_id, then call get_reputation / verify_reputation on it.

ParametersJSON Schema

Name	Required	Description	Default
`q`	No	Name search (ilike) or agent-id prefix match.
`page`	No	1-based page number for pagination. Default 1.
`sort`	No	Result ordering. Default "score" (highest-rated first); other supported keys order by recency or name.	score
`grade`	No	Filter to one grade (e.g. `AAA`, `B`, `NR`).
`per_page`	No	Number of results per page. 1–100, default 20.
`confidence`	No	Filter to agents at a given reputation-confidence level (driven by how much evidence backs the score).

Output Schema

ParametersJSON Schema

Name	Required	Description
`page`	Yes
`total`	Yes
`agents`	Yes
`per_page`	Yes

TDQS

A4.6/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already provide readOnlyHint, idempotentHint, destructiveHint. The description adds key behavioral info: the tool only searches agents with public reputation visibility, requires zero authentication, and returns agent_ids. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with core action, followed by usage guidance. No redundant words. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers purpose, scope (public directory), auth requirement, and next steps. With an output schema present, the description doesn't need to detail return format. Minor gap: does not explicitly state that results are paginated, but schema covers pagination params. Overall good completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

All 6 parameters have descriptions in the schema (100% coverage), so the description adds no new param-level detail. It provides context for the 'q' parameter ('name or id-prefix') but that is already in the schema. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Resolve an agent name or id-prefix to a real agent_id over the PUBLIC reputation directory', using a specific verb and resource. It distinguishes from siblings like get_agent (requires id) and list_agents (different scope), and positions itself as the entry point for discovering agent IDs.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly tells when to use this tool: as the entry point to discover a concrete agent_id, then delegate to get_reputation/verify_reputation. It also notes 'zero-auth', setting expectations. This provides clear guidance on alternatives and preconditions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

verify_reputationA

Read-onlyIdempotent

Inspect

Attest an agent's Trust Rating — returns a Merkle-root + hash-chain attestation (hash_chain_valid) proving the rating derives from an unbroken, append-only checkpoint chain, plus a pointer to the signed integrity certificate. This is a chain-integrity attestation, NOT an in-band Ed25519 signature check (that parity is verify_scan, for website scorecards).

ParametersJSON Schema

Name	Required	Description	Default
`agent_id`	Yes	Agent identifier (e.g. smolt-abc123)

Output Schema

ParametersJSON Schema

Name	Required	Description
`grade`	Yes
`score`	Yes
`agent_id`	Yes
`computed_at`	Yes
`verification`	Yes

TDQS

A4.5/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false. The description adds behavioral details: it returns a Merkle-root + hash-chain attestation and a pointer to the integrity certificate. It also clarifies that it does NOT perform an Ed25519 check. No contradictions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the main action and outputs, and contains no superfluous information. Every sentence adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has an output schema, good annotations, and only one parameter, the description fully addresses the return values and behavioral context. It is complete for an AI agent to understand invocation and interpretation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the lone parameter (agent_id) is already described in the schema. The description does not add additional meaning or constraints beyond what is in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Attest' and the resource 'agent's Trust Rating', and distinguishes itself from 'verify_scan' by specifying the type of attestation (chain-integrity vs. Ed25519 signature check). This provides a specific and unambiguous purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly tells when to use this tool (to verify chain integrity) and when not (for Ed25519 check, use verify_scan). This provides clear guidance on tool selection among siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

verify_scanA

Read-onlyIdempotent

Inspect

Verify a website scan scorecard's Ed25519 signature IN-BAND (verify, don't trust). Pass a scan (a scorecard from scan_trust) or a url to re-scan; returns {verified, key_id, canonicalization} checked against the public key at mnemom://iitr/jwks. Zero-auth. Spec + rubric: https://www.isittrustready.ai/rubric and https://docs.mnemom.ai/.

ParametersJSON Schema

Name	Required	Description	Default
`url`	No	Alternatively, a domain/URL to re-scan and then verify.
`scan`	No	A scan scorecard previously returned by scan_trust (or iitr's /r/ JSON), passed back verbatim to verify. Same shape as scan_trust's result; the signature is checked against mnemom://iitr/jwks.

Output Schema

ParametersJSON Schema

Name	Required	Description
`key_id`	Yes	The signing key id (kid) checked.
`reason`	No	Why verification failed or could not be evaluated (absent when verified).
`verified`	Yes	True iff the signature verifies against the in-band JWKS.
`algorithm`	Yes	Always "Ed25519".
`scorecard`	No	The scorecard verified (present when re-scanned via `url`).
`canonicalization`	Yes	The exact canonicalization used (so the verdict is reproducible).

TDQS

A4.3/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare the operation as read-only, idempotent, and non-destructive. The description adds valuable context beyond annotations: 'Zero-auth', the return shape {verified, key_id, canonicalization}, and that verification uses the public key at mnemom://iitr/jwks. This clarifies auth needs and output without contradicting the safety hints.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact (two sentences) yet rich with necessary information: purpose, input modes, return shape, key origin, and spec links. Every element earns its place with no redundancy or fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite the tool's complexity (nested scan object, oneOf constraint, output schema), the description covers the essential workflow: how to pass input, what verification is performed, the return value, and where to find detailed specifications. The output schema handles return details, so the description need not repeat them.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema fully documents the two parameters, including their types and relationships (oneOf). The description adds a slight clarification that `url` triggers a re-scan, but the schema already states this. No significant additional parameter semantics are provided beyond the structured fields.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool verifies a website scan scorecard's Ed25519 signature, distinguishing it from scan_trust (which creates the scorecard) and other verify tools (verify_reputation, verify_agent_binding). The phrase 'IN-BAND (verify, don't trust)' adds specific method and intent.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly says to pass either a `scan` from scan_trust or a `url` to re-scan, providing clear input guidance. It does not name specific sibling alternatives or exclusions, but the reference to scan_trust and 'verify, don't trust' implies when to use this tool over blindly accepting a scorecard.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

2 tool updatesSep 30, 2026

Changedpreview_compose_protection_by_agent6 fields changed

changedInput schema / properties / screen_surfaces / description

Previous value: -"Which traffic surfaces are screened. Omit to accept the composed defaults."New value: +"Which traffic surfaces are screened. Required, with all four flags set."

addedInput schema / properties / screen_surfaces / required

Added value: +[
+  "incoming",
+  "outgoing",
+  "tool_calls",
+  "tool_responses"
+]

changedInput schema / properties / thresholds / description

Previous value: -"Risk-score cutoffs, each in [0, 1] and ordered warn ≤ quarantine ≤ block. All three are required if this object is sent at all — omit the whole object to accept the composed defaults."New value: +"Risk-score cutoffs, each in [0, 1] and ordered warn ≤ quarantine ≤ block. Required. Send the full set: a publish replaces the agent's current card rather than patching it."

changedInput schema / properties / trusted_sources / description

Previous value: -"Sources exempt from screening. Enumerate specific hosts — wildcards are rejected, and a server-side deny-list (public LLM/DNS endpoints, 0.0.0.0/0, ::/0, link-local, multicast) is always applied."New value: +"Sources exempt from screening. Required, with all three lists present; send empty lists to trust nothing extra. Enumerate specific hosts — wildcards are rejected, and a server-side deny-list (public LLM/DNS endpoints, 0.0.0.0/0, ::/0, link-local, multicast) is always applied."

addedInput schema / properties / trusted_sources / required

Added value: +[
+  "domains",
+  "agent_ids",
+  "ip_ranges"
+]

changedInput schema / required

Previous value: -[
-  "agent_id",
-  "card_version",
-  "mode"
-]New value: +[
+  "agent_id",
+  "card_version",
+  "mode",
+  "thresholds",
+  "screen_surfaces",
+  "trusted_sources"
+]

Changedput_protection_by_agent6 fields changed

changedInput schema / properties / screen_surfaces / description

Previous value: -"Which traffic surfaces are screened. Omit to accept the composed defaults."New value: +"Which traffic surfaces are screened. Required, with all four flags set."

addedInput schema / properties / screen_surfaces / required

Added value: +[
+  "incoming",
+  "outgoing",
+  "tool_calls",
+  "tool_responses"
+]

changedInput schema / properties / thresholds / description

Previous value: -"Risk-score cutoffs, each in [0, 1] and ordered warn ≤ quarantine ≤ block. All three are required if this object is sent at all — omit the whole object to accept the composed defaults."New value: +"Risk-score cutoffs, each in [0, 1] and ordered warn ≤ quarantine ≤ block. Required. Send the full set: a publish replaces the agent's current card rather than patching it."

changedInput schema / properties / trusted_sources / description

Previous value: -"Sources exempt from screening. Enumerate specific hosts — wildcards are rejected, and a server-side deny-list (public LLM/DNS endpoints, 0.0.0.0/0, ::/0, link-local, multicast) is always applied."New value: +"Sources exempt from screening. Required, with all three lists present; send empty lists to trust nothing extra. Enumerate specific hosts — wildcards are rejected, and a server-side deny-list (public LLM/DNS endpoints, 0.0.0.0/0, ::/0, link-local, multicast) is always applied."

addedInput schema / properties / trusted_sources / required

Added value: +[
+  "domains",
+  "agent_ids",
+  "ip_ranges"
+]

changedInput schema / required

Previous value: -[
-  "agent_id",
-  "card_version",
-  "mode"
-]New value: +[
+  "agent_id",
+  "card_version",
+  "mode",
+  "thresholds",
+  "screen_surfaces",
+  "trusted_sources"
+]

1 tool updateAug 7, 2026
- Removedverify_agent_binding

1 tool updateAug 5, 2026

Changedclaim_agent3 fields changed

changedInput schema / properties / hash_proof / description

Previous value: -"Agent possession proof: the full 64-hex SHA-256 digest of `${apiKey}|${agentName}` (or `${apiKey}` for an unnamed singleton agent)."New value: +"Agent possession proof — either the live birth token (`mnbt_…`) whose row pins this agent's hash, or the full 64-hex SHA-256 digest of `${apiKey}|${agentName}` (or `${apiKey}` for an unnamed singleton agent)."

addedInput schema / properties / hash_proof / minLength
```
Added value: +16
```
removedInput schema / properties / hash_proof / pattern
```
Removed value: -"^[0-9a-f]{64}$"
```

1 tool updateAug 5, 2026

Changedverify_scan1 field changed

addedInput schema / oneOf

Added value: +[
+  {
+    "not": {
+      "required": [
+        "url"
+      ]
+    },
+    "required": [
+      "scan"
+    ]
+  },
+  {
+    "not": {
+      "required": [
+        "scan"
+      ]
+    },
+    "required": [
+      "url"
+    ]
+  }
+]

7 tool updatesAug 5, 2026

Changedget_agent24 fields changed

removedOutput schema / $defs

Removed value: -{
-  "Agent": {
-    "additionalProperties": true,
-    "description": "An agent. GET /v1/agents/{id} returns one of TWO projections by authorization: an ORGANIZATION-MEMBER (owner) caller receives the full agent row (all fields below); a NON-OWNER receives a reduced public projection (id, name, claimed, created_at, last_seen, status, avatar_url). additionalProperties is left open because the owner row is the full DB row and grows as agent-settings columns are added (ADR-053 / proof / DDR); over-constraining it would 500 the endpoint on the next migration under /v1 response enforcement.",
-    "properties": {
-      "agent_hash": {
-        "description": "First 16 hex chars of `SHA256(apiKey + '|' + agentName)` for named agents, or `SHA256(apiKey)` for unnamed singleton agents. The gateway computes the same value on each request and uses it as the lookup key. See [Agent Identity](https://docs.mnemom.ai/concepts/agent-identity#agent_hash--the-canonical-identity-hash).",
-        "example": "a1b2c3d4e5f6a7b8",
-        "type": "string"
-      },
-      "agent_proof_captured_at": {
-        "format": "date-time",
-        "type": [
-          "string",
-          "null"
-        ]
-      },
-      "agent_proof_hash": {
-        "description": "Owner projection: captured hash_proof of the bound key (mig 263).",
-        "type": [
-          "string",
-          "null"
-        ]
-      },
-      "aip_enforcement_mode": {
-        "enum": [
-          "observe",
-          "enforce",
-          "nudge"
-        ],
-        "type": [
-          "string",
-          "null"
-        ]
-      },
-      "avatar_url": {
-        "type": [
-          "string",
-          "null"
-        ]
-      },
-      "billing_account_id": {
-        "type": [
-          "string",
-          "null"
-        ]
-      },
-      "caller": {
-        "description": "Self-describing caller context for THIS response. `org_member` callers receive the full owner record (all fields here); `anonymous`/`authenticated` (non-member) callers receive the reduced public projection (id, name, claimed, created_at, last_seen, status, avatar_url, caller). The differing field set is GOVERNED by this value — read it instead of inferring why a field is absent.",
-        "enum": [
-          "anonymous",
-          "authenticated",
-          "org_member"
-        ],
-        "type": "string"
-      },
-      "claimed": {
-        "description": "Public projection only: whether the agent has been claimed by a user.",
-        "type": "boolean"
-      },
-      "claimed_at": {
-        "format": "date-time",
-        "type": [
-          "string",
-          "null"
-        ]
-      },
-      "claimed_by": {
-        "description": "Owner projection: user id that claimed the agent.",
-        "type": [
-          "string",
-          "null"
-        ]
-      },
-      "containment_status": {
-        "description": "Containment state of the agent (ADR-053).",
-        "enum": [
-          "active",
-          "paused",
-          "killed"
-        ],
-        "type": [
-          "string",
-          "null"
-        ]
-      },
-      "created_at": {
-        "format": "date-time",
-        "type": "string"
-      },
-      "created_by": {
-        "description": "Owner projection: user id that created the agent (provenance).",
-        "type": [
-          "string",
-          "null"
-        ]
-      },
-      "deleted_at": {
-        "description": "Owner projection: soft-delete timestamp (null when live).",
-        "format": "date-time",
-        "type": [
-          "string",
-          "null"
-        ]
-      },
-      "email": {
-        "type": [
-          "string",
-          "null"
-        ]
-      },
-      "groups": {
-        "description": "Active groups this agent belongs to, name-ordered; `[]` when none. Present on org-fleet rows (GET /v1/orgs/{org_id}/agents). Archived groups are excluded.",
-        "items": {
-          "properties": {
-            "color": {
-              "description": "Group color (hex, e.g. `#0d9488`); `null` when unset.",
-              "type": [
-                "string",
-                "null"
-              ]
-            },
-            "id": {
-              "type": "string"
-            },
-            "name": {
-              "type": "string"
-            }
-          },
-          "required": [
-            "id",
-            "name",
-            "color"
-          ],
-          "type": "object"
-        },
-        "type": "array"
-      },
-      "id": {
-        "type": "string"
-      },
-      "key_prefix": {
-        "description": "First 8 chars of the bound API key hash — useful for key-rotation debugging.",
-        "type": [
-          "string",
-          "null"
-        ]
-      },
-      "last_seen": {
-        "format": "date-time",
-        "type": [
-          "string",
-          "null"
-        ]
-      },
-      "name": {
-        "description": "Agent name (2-32 chars, alphanumeric + hyphens). Present on all list and get responses.",
-        "type": [
-          "string",
-          "null"
-        ]
-      },
-      "org_id": {
-        "description": "Owner projection: the agent's org binding (ADR-062 authz boundary).",
-        "type": [
-          "string",
-          "null"
-        ]
-      },
-      "public": {
-        "description": "Identity-record visibility axis — whether the agent's IDENTITY RECORD is publicly discoverable. This is DISTINCT from reputation visibility: every registered agent's reputation is public by accountability standard (see `ReputationScore.visibility`). `public` here governs only the identity record, never the Trust Rating.",
-        "type": "boolean"
-      },
-      "status": {
-        "enum": [
-          "active",
-          "offline"
-        ],
-        "type": "string"
-      },
-      "user_id": {
-        "type": [
-          "string",
-          "null"
-        ]
-      }
-    },
-    "type": "object"
-  }
-}

changedOutput schema / additionalProperties
```
Previous value: -trueNew value: +false
```

changedOutput schema / description

Previous value: -"An agent. GET /v1/agents/{id} returns one of TWO projections by authorization: an ORGANIZATION-MEMBER (owner) caller receives the full agent row (all fields below); a NON-OWNER receives a reduced public projection (id, name, claimed, created_at, last_seen, status, avatar_url). additionalProperties is left open because the owner row is the full DB row and grows as agent-settings columns are added (ADR-053 / proof / DDR); over-constraining it would 500 the endpoint on the next migration under /v1 response enforcement."New value: +"An agent's identity and trust state, reduced to the fields the trust loop needs. Personal data (owner email address, user identifiers), internal commercial identifiers (billing account) and key-material-derived values (bound-key proof hash, key prefix) are REMOVED at the MCP boundary and are never returned to an MCP client — see the Mnemom privacy policy at https://www.mnemom.ai/privacy. Which fields are present depends on authorization: read `caller` to know which projection you received."

changedOutput schema / properties / agent_hash / description

Previous value: -"First 16 hex chars of `SHA256(apiKey + '|' + agentName)` for named agents, or `SHA256(apiKey)` for unnamed singleton agents. The gateway computes the same value on each request and uses it as the lookup key. See [Agent Identity](https://docs.mnemom.ai/concepts/agent-identity#agent_hash--the-canonical-identity-hash)."New value: +"The canonical public identity hash (first 16 hex chars) used as the gateway lookup key and as the input to verify_agent_binding. Owner projection only. Not a credential and not reversible to one."

removedOutput schema / properties / agent_hash / example
```
Removed value: -"a1b2c3d4e5f6a7b8"
```

removedOutput schema / properties / agent_proof_captured_at

Removed value: -{
-  "format": "date-time",
-  "type": [
-    "string",
-    "null"
-  ]
-}

removedOutput schema / properties / agent_proof_hash

Removed value: -{
-  "description": "Owner projection: captured hash_proof of the bound key (mig 263).",
-  "type": [
-    "string",
-    "null"
-  ]
-}

removedOutput schema / properties / billing_account_id

Removed value: -{
-  "type": [
-    "string",
-    "null"
-  ]
-}

changedOutput schema / properties / caller / description

Previous value: -"Self-describing caller context for THIS response. `org_member` callers receive the full owner record (all fields here); `anonymous`/`authenticated` (non-member) callers receive the reduced public projection (id, name, claimed, created_at, last_seen, status, avatar_url, caller). The differing field set is GOVERNED by this value — read it instead of inferring why a field is absent."New value: +"Which projection THIS response is. `org_member` receives the owner field set; `anonymous`/`authenticated` receive the reduced public set (id, name, claimed, created_at, last_seen, status, avatar_url, caller). Read this instead of inferring why a field is absent."

changedOutput schema / properties / claimed / description

Previous value: -"Public projection only: whether the agent has been claimed by a user."New value: +"Whether a human or organization has claimed accountability for this agent. On the owner projection this is derived from the ownership column; the owning user's identifier itself is not returned."

removedOutput schema / properties / claimed_by

Removed value: -{
-  "description": "Owner projection: user id that claimed the agent.",
-  "type": [
-    "string",
-    "null"
-  ]
-}

changedOutput schema / properties / containment_status / description

Previous value: -"Containment state of the agent (ADR-053)."New value: +"Containment state of the agent."

removedOutput schema / properties / created_by

Removed value: -{
-  "description": "Owner projection: user id that created the agent (provenance).",
-  "type": [
-    "string",
-    "null"
-  ]
-}

removedOutput schema / properties / deleted_at

Removed value: -{
-  "description": "Owner projection: soft-delete timestamp (null when live).",
-  "format": "date-time",
-  "type": [
-    "string",
-    "null"
-  ]
-}

removedOutput schema / properties / email

Removed value: -{
-  "type": [
-    "string",
-    "null"
-  ]
-}

changedOutput schema / properties / groups / description

Previous value: -"Active groups this agent belongs to, name-ordered; `[]` when none. Present on org-fleet rows (GET /v1/orgs/{org_id}/agents). Archived groups are excluded."New value: +"Active groups this agent belongs to, name-ordered; `[]` when none. Present on org-fleet rows."

addedOutput schema / properties / id / description

Added value: +"Agent identifier (e.g. smolt-abc123)."

removedOutput schema / properties / key_prefix

Removed value: -{
-  "description": "First 8 chars of the bound API key hash — useful for key-rotation debugging.",
-  "type": [
-    "string",
-    "null"
-  ]
-}

changedOutput schema / properties / name / description

Previous value: -"Agent name (2-32 chars, alphanumeric + hyphens). Present on all list and get responses."New value: +"Agent name (2-32 chars, alphanumeric + hyphens)."

changedOutput schema / properties / org_id / description

Previous value: -"Owner projection: the agent's org binding (ADR-062 authz boundary)."New value: +"The agent's organization binding. Required as an input by the org-scoped tools (fleet listing, posture assignment). Identifies an organization, not a person."

changedOutput schema / properties / public / description

Previous value: -"Identity-record visibility axis — whether the agent's IDENTITY RECORD is publicly discoverable. This is DISTINCT from reputation visibility: every registered agent's reputation is public by accountability standard (see `ReputationScore.visibility`). `public` here governs only the identity record, never the Trust Rating."New value: +"Whether the agent's identity record is publicly discoverable. Distinct from Trust Rating visibility, which is always public."

addedOutput schema / properties / status / description

Added value: +"Derived from last_seen (active = seen within the last hour)."

removedOutput schema / properties / user_id

Removed value: -{
-  "type": [
-    "string",
-    "null"
-  ]
-}

addedOutput schema / required
```
Added value: +[
+  "id"
+]
```

Changedlist_agents9 fields changed

changedInput schema / properties / limit / description

Previous value: -"Maximum number of agents to return (max 100)"New value: +"How many agents to return, 1-100."

addedInput schema / properties / limit / minimum
```
Added value: +1
```

changedInput schema / properties / offset / description

Previous value: -"Number of agents to skip for pagination"New value: +"How many agents to skip, for pagination."

addedInput schema / properties / offset / maximum
```
Added value: +100000
```
addedInput schema / properties / offset / minimum
```
Added value: +0
```

removedOutput schema / $defs / Agent

Removed value: -{
-  "additionalProperties": true,
-  "description": "An agent. GET /v1/agents/{id} returns one of TWO projections by authorization: an ORGANIZATION-MEMBER (owner) caller receives the full agent row (all fields below); a NON-OWNER receives a reduced public projection (id, name, claimed, created_at, last_seen, status, avatar_url). additionalProperties is left open because the owner row is the full DB row and grows as agent-settings columns are added (ADR-053 / proof / DDR); over-constraining it would 500 the endpoint on the next migration under /v1 response enforcement.",
-  "properties": {
-    "agent_hash": {
-      "description": "First 16 hex chars of `SHA256(apiKey + '|' + agentName)` for named agents, or `SHA256(apiKey)` for unnamed singleton agents. The gateway computes the same value on each request and uses it as the lookup key. See [Agent Identity](https://docs.mnemom.ai/concepts/agent-identity#agent_hash--the-canonical-identity-hash).",
-      "example": "a1b2c3d4e5f6a7b8",
-      "type": "string"
-    },
-    "agent_proof_captured_at": {
-      "format": "date-time",
-      "type": [
-        "string",
-        "null"
-      ]
-    },
-    "agent_proof_hash": {
-      "description": "Owner projection: captured hash_proof of the bound key (mig 263).",
-      "type": [
-        "string",
-        "null"
-      ]
-    },
-    "aip_enforcement_mode": {
-      "enum": [
-        "observe",
-        "enforce",
-        "nudge"
-      ],
-      "type": [
-        "string",
-        "null"
-      ]
-    },
-    "avatar_url": {
-      "type": [
-        "string",
-        "null"
-      ]
-    },
-    "billing_account_id": {
-      "type": [
-        "string",
-        "null"
-      ]
-    },
-    "caller": {
-      "description": "Self-describing caller context for THIS response. `org_member` callers receive the full owner record (all fields here); `anonymous`/`authenticated` (non-member) callers receive the reduced public projection (id, name, claimed, created_at, last_seen, status, avatar_url, caller). The differing field set is GOVERNED by this value — read it instead of inferring why a field is absent.",
-      "enum": [
-        "anonymous",
-        "authenticated",
-        "org_member"
-      ],
-      "type": "string"
-    },
-    "claimed": {
-      "description": "Public projection only: whether the agent has been claimed by a user.",
-      "type": "boolean"
-    },
-    "claimed_at": {
-      "format": "date-time",
-      "type": [
-        "string",
-        "null"
-      ]
-    },
-    "claimed_by": {
-      "description": "Owner projection: user id that claimed the agent.",
-      "type": [
-        "string",
-        "null"
-      ]
-    },
-    "containment_status": {
-      "description": "Containment state of the agent (ADR-053).",
-      "enum": [
-        "active",
-        "paused",
-        "killed"
-      ],
-      "type": [
-        "string",
-        "null"
-      ]
-    },
-    "created_at": {
-      "format": "date-time",
-      "type": "string"
-    },
-    "created_by": {
-      "description": "Owner projection: user id that created the agent (provenance).",
-      "type": [
-        "string",
-        "null"
-      ]
-    },
-    "deleted_at": {
-      "description": "Owner projection: soft-delete timestamp (null when live).",
-      "format": "date-time",
-      "type": [
-        "string",
-        "null"
-      ]
-    },
-    "email": {
-      "type": [
-        "string",
-        "null"
-      ]
-    },
-    "groups": {
-      "description": "Active groups this agent belongs to, name-ordered; `[]` when none. Present on org-fleet rows (GET /v1/orgs/{org_id}/agents). Archived groups are excluded.",
-      "items": {
-        "properties": {
-          "color": {
-            "description": "Group color (hex, e.g. `#0d9488`); `null` when unset.",
-            "type": [
-              "string",
-              "null"
-            ]
-          },
-          "id": {
-            "type": "string"
-          },
-          "name": {
-            "type": "string"
-          }
-        },
-        "required": [
-          "id",
-          "name",
-          "color"
-        ],
-        "type": "object"
-      },
-      "type": "array"
-    },
-    "id": {
-      "type": "string"
-    },
-    "key_prefix": {
-      "description": "First 8 chars of the bound API key hash — useful for key-rotation debugging.",
-      "type": [
-        "string",
-        "null"
-      ]
-    },
-    "last_seen": {
-      "format": "date-time",
-      "type": [
-        "string",
-        "null"
-      ]
-    },
-    "name": {
-      "description": "Agent name (2-32 chars, alphanumeric + hyphens). Present on all list and get responses.",
-      "type": [
-        "string",
-        "null"
-      ]
-    },
-    "org_id": {
-      "description": "Owner projection: the agent's org binding (ADR-062 authz boundary).",
-      "type": [
-        "string",
-        "null"
-      ]
-    },
-    "public": {
-      "description": "Identity-record visibility axis — whether the agent's IDENTITY RECORD is publicly discoverable. This is DISTINCT from reputation visibility: every registered agent's reputation is public by accountability standard (see `ReputationScore.visibility`). `public` here governs only the identity record, never the Trust Rating.",
-      "type": "boolean"
-    },
-    "status": {
-      "enum": [
-        "active",
-        "offline"
-      ],
-      "type": "string"
-    },
-    "user_id": {
-      "type": [
-        "string",
-        "null"
-      ]
-    }
-  },
-  "type": "object"
-}

addedOutput schema / $defs / AgentMcpRecord

Added value: +{
+  "additionalProperties": false,
+  "description": "An agent's identity and trust state, reduced to the fields the trust loop needs. Personal data (owner email address, user identifiers), internal commercial identifiers (billing account) and key-material-derived values (bound-key proof hash, key prefix) are REMOVED at the MCP boundary and are never returned to an MCP client — see the Mnemom privacy policy at https://www.mnemom.ai/privacy. Which fields are present depends on authorization: read `caller` to know which projection you received.",
+  "properties": {
+    "agent_hash": {
+      "description": "The canonical public identity hash (first 16 hex chars) used as the gateway lookup key and as the input to verify_agent_binding. Owner projection only. Not a credential and not reversible to one.",
+      "type": "string"
+    },
+    "aip_enforcement_mode": {
+      "enum": [
+        "observe",
+        "enforce",
+        "nudge"
+      ],
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "avatar_url": {
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "caller": {
+      "description": "Which projection THIS response is. `org_member` receives the owner field set; `anonymous`/`authenticated` receive the reduced public set (id, name, claimed, created_at, last_seen, status, avatar_url, caller). Read this instead of inferring why a field is absent.",
+      "enum": [
+        "anonymous",
+        "authenticated",
+        "org_member"
+      ],
+      "type": "string"
+    },
+    "claimed": {
+      "description": "Whether a human or organization has claimed accountability for this agent. On the owner projection this is derived from the ownership column; the owning user's identifier itself is not returned.",
+      "type": "boolean"
+    },
+    "claimed_at": {
+      "format": "date-time",
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "containment_status": {
+      "description": "Containment state of the agent.",
+      "enum": [
+        "active",
+        "paused",
+        "killed"
+      ],
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "created_at": {
+      "format": "date-time",
+      "type": "string"
+    },
+    "groups": {
+      "description": "Active groups this agent belongs to, name-ordered; `[]` when none. Present on org-fleet rows.",
+      "items": {
+        "properties": {
+          "color": {
+            "description": "Group color (hex, e.g. `#0d9488`); `null` when unset.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "id": {
+            "type": "string"
+          },
+          "name": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "id",
+          "name",
+          "color"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "id": {
+      "description": "Agent identifier (e.g. smolt-abc123).",
+      "type": "string"
+    },
+    "last_seen": {
+      "format": "date-time",
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "name": {
+      "description": "Agent name (2-32 chars, alphanumeric + hyphens).",
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "org_id": {
+      "description": "The agent's organization binding. Required as an input by the org-scoped tools (fleet listing, posture assignment). Identifies an organization, not a person.",
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "public": {
+      "description": "Whether the agent's identity record is publicly discoverable. Distinct from Trust Rating visibility, which is always public.",
+      "type": "boolean"
+    },
+    "status": {
+      "description": "Derived from last_seen (active = seen within the last hour).",
+      "enum": [
+        "active",
+        "offline"
+      ],
+      "type": "string"
+    }
+  },
+  "required": [
+    "id"
+  ],
+  "type": "object"
+}

addedOutput schema / properties / agents / description

Added value: +"The caller's agents, reduced to the MCP trust-loop field set."

changedOutput schema / properties / agents / items / $ref

Previous value: -"#/$defs/Agent"New value: +"#/$defs/AgentMcpRecord"

Changedpreview_compose_alignment_by_agent34 fields changed

removedInput schema / $defs

Removed value: -{
-  "CompositionMetadata": {
-    "description": "System-managed block describing which scope sources merged into the canonical card. Only returned when `?include_composition=true`.",
-    "properties": {
-      "canonical_id": {
-        "type": "string"
-      },
-      "composed_at": {
-        "format": "date-time",
-        "type": "string"
-      },
-      "exemptions_applied": {
-        "items": {
-          "type": "string"
-        },
-        "type": "array"
-      },
-      "scopes_applied": {
-        "items": {
-          "properties": {
-            "card_id": {
-              "type": "string"
-            },
-            "scope": {
-              "description": "`platform`, `org:<id>`, or `agent:<id>`.",
-              "type": "string"
-            },
-            "template_version": {
-              "type": "integer"
-            },
-            "version": {
-              "type": "integer"
-            }
-          },
-          "type": "object"
-        },
-        "type": "array"
-      },
-      "source_card_id": {
-        "type": "string"
-      },
-      "source_policy_id": {
-        "type": "string"
-      }
-    },
-    "type": "object"
-  },
-  "UnifiedAlignmentCard": {
-    "description": "Unified alignment card (ADR-008/ADR-039). Authored in YAML or JSON; composed server-side with platform defaults, org template, and active exemptions before storage. This schema matches the runtime validator at src/composition/validate.ts EXACTLY — a card authored strictly to it passes `PUT /v1/agents/{id}/alignment-card` and the preview-compose endpoint. Output-only fields (card_id, issued_at, expires_at, _composition, content_hash, version) are server-assigned and must NOT be sent on a PUT.",
-    "properties": {
-      "_composition": {
-        "$ref": "#/$defs/CompositionMetadata"
-      },
-      "agent_id": {
-        "description": "Target agent id. On PUT, server overwrites to match the URL path.",
-        "type": "string"
-      },
-      "audit": {
-        "allOf": [
-          {
-            "if": {
-              "properties": {
-                "queryable": {
-                  "const": true
-                }
-              },
-              "required": [
-                "queryable"
-              ]
-            },
-            "then": {
-              "required": [
-                "query_endpoint"
-              ]
-            }
-          }
-        ],
-        "properties": {
-          "query_endpoint": {
-            "description": "Required when audit.queryable is true.",
-            "type": "string"
-          },
-          "queryable": {
-            "type": "boolean"
-          },
-          "retention_days": {
-            "minimum": 0,
-            "type": "integer"
-          },
-          "storage": {
-            "properties": {
-              "location": {
-                "type": "string"
-              },
-              "type": {
-                "enum": [
-                  "local",
-                  "remote",
-                  "distributed"
-                ],
-                "type": "string"
-              }
-            },
-            "type": "object"
-          },
-          "tamper_evidence": {
-            "enum": [
-              "append_only",
-              "signed",
-              "merkle",
-              null
-            ],
-            "type": [
-              "string",
-              "null"
-            ]
-          },
-          "trace_format": {
-            "type": "string"
-          }
-        },
-        "required": [
-          "retention_days",
-          "queryable"
-        ],
-        "type": "object"
-      },
-      "autonomy": {
-        "properties": {
-          "bounded_actions": {
-            "items": {
-              "type": "string"
-            },
-            "minItems": 1,
-            "type": "array"
-          },
-          "escalation_triggers": {
-            "items": {
-              "properties": {
-                "action": {
-                  "enum": [
-                    "escalate",
-                    "deny",
-                    "log"
-                  ],
-                  "type": "string"
-                },
-                "condition": {
-                  "type": "string"
-                },
-                "reason": {
-                  "type": "string"
-                }
-              },
-              "required": [
-                "condition",
-                "action",
-                "reason"
-              ],
-              "type": "object"
-            },
-            "type": "array"
-          },
-          "forbidden_actions": {
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "max_autonomous_value": {
-            "properties": {
-              "amount": {
-                "type": "number"
-              },
-              "currency": {
-                "type": "string"
-              }
-            },
-            "type": "object"
-          }
-        },
-        "required": [
-          "bounded_actions"
-        ],
-        "type": "object"
-      },
-      "autonomy_mode": {
-        "description": "ADR-039 master switch for the action-policing pipeline (autonomy constraints). Required at the top level post-cutover; the legacy `enforcement.mode` location is rejected.",
-        "enum": [
-          "off",
-          "observe",
-          "nudge",
-          "enforce"
-        ],
-        "type": "string"
-      },
-      "capabilities": {
-        "additionalProperties": {
-          "properties": {
-            "description": {
-              "type": "string"
-            },
-            "required_actions": {
-              "items": {
-                "type": "string"
-              },
-              "type": "array"
-            },
-            "tools": {
-              "items": {
-                "type": "string"
-              },
-              "type": "array"
-            }
-          },
-          "type": "object"
-        },
-        "type": "object"
-      },
-      "card_id": {
-        "description": "Card row id. Server-assigned on PUT (`ac-{uuid}`).",
-        "type": "string"
-      },
-      "card_version": {
-        "description": "Card schema version (required, non-empty). Current canonical value: `unified/2026-04-26`.",
-        "minLength": 1,
-        "type": "string"
-      },
-      "conscience": {
-        "properties": {
-          "mode": {
-            "enum": [
-              "augment",
-              "replace"
-            ],
-            "type": "string"
-          },
-          "values": {
-            "items": {
-              "properties": {
-                "content": {
-                  "type": "string"
-                },
-                "id": {
-                  "type": "string"
-                },
-                "severity": {
-                  "enum": [
-                    "advisory",
-                    "mandatory"
-                  ],
-                  "type": "string"
-                },
-                "type": {
-                  "enum": [
-                    "BOUNDARY",
-                    "FEAR",
-                    "COMMITMENT",
-                    "BELIEF",
-                    "HOPE"
-                  ],
-                  "type": "string"
-                }
-              },
-              "required": [
-                "type",
-                "content"
-              ],
-              "type": "object"
-            },
-            "type": "array"
-          }
-        },
-        "required": [
-          "mode",
-          "values"
-        ],
-        "type": "object"
-      },
-      "content_hash": {
-        "description": "Response-only: content hash of the composed card (`sha256:<hex>`), injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-        "type": "string"
-      },
-      "enforcement": {
-        "description": "Optional ADR-039 Decision-3 user-facing knobs for unmapped-tool handling. The legacy `mode`, `unmapped_tool_action` and `fail_open` keys are REJECTED by the validator (mode → top-level autonomy_mode; fail_open → gateway env config).",
-        "properties": {
-          "allow_unmapped_tools": {
-            "description": "When true, tools not mapped to a capability are allowed by default.",
-            "type": "boolean"
-          },
-          "default_unmapped_severity": {
-            "description": "Severity assigned to an unmapped tool when allow_unmapped_tools is false.",
-            "enum": [
-              "low",
-              "medium",
-              "high",
-              "critical"
-            ],
-            "type": "string"
-          },
-          "forbidden_tools": {
-            "items": {
-              "properties": {
-                "pattern": {
-                  "type": "string"
-                },
-                "reason": {
-                  "type": "string"
-                },
-                "severity": {
-                  "enum": [
-                    "critical",
-                    "high",
-                    "medium",
-                    "low"
-                  ],
-                  "type": "string"
-                }
-              },
-              "required": [
-                "pattern",
-                "reason",
-                "severity"
-              ],
-              "type": "object"
-            },
-            "type": "array"
-          },
-          "grace_period_hours": {
-            "type": "integer"
-          }
-        },
-        "type": "object"
-      },
-      "expires_at": {
-        "format": "date-time",
-        "type": [
-          "string",
-          "null"
-        ]
-      },
-      "extensions": {
-        "additionalProperties": true,
-        "type": "object"
-      },
-      "integrity_mode": {
-        "description": "ADR-039 master switch for the values/conscience pipeline (integrity constraints). Required at the top level post-cutover; the legacy `integrity.enforcement_mode` location is rejected.",
-        "enum": [
-          "off",
-          "observe",
-          "nudge",
-          "enforce"
-        ],
-        "type": "string"
-      },
-      "issued_at": {
-        "format": "date-time",
-        "type": "string"
-      },
-      "principal": {
-        "allOf": [
-          {
-            "if": {
-              "properties": {
-                "type": {
-                  "not": {
-                    "const": "unspecified"
-                  }
-                }
-              }
-            },
-            "then": {
-              "required": [
-                "identifier"
-              ]
-            }
-          }
-        ],
-        "description": "Required object describing whose authority the agent acts under (ADR-039 Decision 10).",
-        "properties": {
-          "escalation_contact": {
-            "type": "string"
-          },
-          "identifier": {
-            "description": "Required (non-empty) when principal.type is not `unspecified`; identifies the human / organization / agent.",
-            "minLength": 1,
-            "type": "string"
-          },
-          "relationship": {
-            "enum": [
-              "delegated_authority",
-              "advisory",
-              "autonomous"
-            ],
-            "type": "string"
-          },
-          "type": {
-            "enum": [
-              "human",
-              "organization",
-              "agent",
-              "unspecified"
-            ],
-            "type": "string"
-          }
-        },
-        "required": [
-          "type",
-          "relationship"
-        ],
-        "type": "object"
-      },
-      "values": {
-        "properties": {
-          "conflicts_with": {
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "declared": {
-            "description": "Ordered list of declared values. Phase 1 cards-as-primitive: each entry is either a catalog-v1 ID string (e.g. `'accuracy'`) or a parameterized map carrying optional `intensity` / `domain` / `severity_on_violation` / `scope` (e.g. `{id: 'accuracy', domain: 'financial', severity_on_violation: 'critical'}`).",
-            "items": {
-              "oneOf": [
-                {
-                  "minLength": 1,
-                  "type": "string"
-                },
-                {
-                  "additionalProperties": {
-                    "type": "string"
-                  },
-                  "properties": {
-                    "id": {
-                      "minLength": 1,
-                      "type": "string"
-                    }
-                  },
-                  "required": [
-                    "id"
-                  ],
-                  "type": "object"
-                }
-              ]
-            },
-            "minItems": 1,
-            "type": "array"
-          },
-          "definitions": {
-            "additionalProperties": {
-              "properties": {
-                "description": {
-                  "type": "string"
-                },
-                "priority": {
-                  "type": "integer"
-                }
-              },
-              "type": "object"
-            },
-            "type": "object"
-          },
-          "hierarchy": {
-            "enum": [
-              "lexicographic",
-              "weighted",
-              "contextual"
-            ],
-            "type": "string"
-          }
-        },
-        "required": [
-          "declared"
-        ],
-        "type": "object"
-      },
-      "version": {
-        "description": "Response-only: monotonic card version, injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-        "type": "integer"
-      }
-    },
-    "required": [
-      "card_version",
-      "agent_id",
-      "autonomy_mode",
-      "integrity_mode",
-      "principal",
-      "values",
-      "autonomy",
-      "audit"
-    ],
-    "type": "object"
-  }
-}

changedInput schema / properties / agent_id / description

Previous value: -"Agent identifier (e.g. smolt-abc123)"New value: +"The agent this card belongs to (e.g. `smolt-abc123`). Identifier only — never place an API key, a secret, an email address, or any other personal data in this field."

addedInput schema / properties / agent_id / maxLength
```
Added value: +64
```
addedInput schema / properties / agent_id / minLength
```
Added value: +3
```

addedInput schema / properties / agent_id / pattern

Added value: +"^[A-Za-z0-9][A-Za-z0-9_-]{1,62}[A-Za-z0-9]$"

addedInput schema / properties / audit

Added value: +{
+  "additionalProperties": false,
+  "description": "How long this agent's own decision log is kept, and whether it can be queried. Required. (This is the agent's audit policy — it is NOT Mnemom's retention policy for the card itself; see the tool's data-handling disclosure for that.)",
+  "properties": {
+    "query_endpoint": {
+      "description": "HTTPS endpoint the records can be queried from. REQUIRED when `queryable` is true, and ignored when it is false.",
+      "maxLength": 300,
+      "type": "string"
+    },
+    "queryable": {
+      "default": false,
+      "description": "Whether those retained records can be queried. Leave false unless you also supply `query_endpoint` — the server rejects a queryable audit policy with no endpoint.",
+      "type": "boolean"
+    },
+    "retention_days": {
+      "description": "How many days the agent's decision records are retained. 0 means do not retain. 3650 (10 years) maximum.",
+      "maximum": 3650,
+      "minimum": 0,
+      "type": "integer"
+    },
+    "tamper_evidence": {
+      "description": "Tamper-evidence scheme applied to the retained records.",
+      "enum": [
+        "append_only",
+        "signed",
+        "merkle"
+      ],
+      "type": "string"
+    }
+  },
+  "required": [
+    "retention_days",
+    "queryable"
+  ],
+  "type": "object"
+}

addedInput schema / properties / autonomy

Added value: +{
+  "additionalProperties": false,
+  "description": "What the agent may do on its own authority. Required.",
+  "properties": {
+    "bounded_actions": {
+      "description": "Action names the agent may take within its bounds — e.g. [\"send_email\", \"create_ticket\"]. At least one required. Action identifiers only, not descriptions.",
+      "items": {
+        "maxLength": 128,
+        "minLength": 1,
+        "type": "string"
+      },
+      "maxItems": 64,
+      "minItems": 1,
+      "type": "array"
+    },
+    "escalation_triggers": {
+      "description": "Conditions that route to a human instead of acting.",
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "action": {
+            "description": "What to do when the condition holds.",
+            "enum": [
+              "escalate",
+              "deny",
+              "log"
+            ],
+            "type": "string"
+          },
+          "condition": {
+            "description": "The condition, as a short expression or slug (e.g. \"amount > 1000\"). Short condition only — never paste a conversation, a log excerpt, or a record about a person. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization.",
+            "maxLength": 200,
+            "minLength": 1,
+            "type": "string"
+          },
+          "reason": {
+            "description": "Why this trigger exists, in one short sentence. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization.",
+            "maxLength": 200,
+            "minLength": 1,
+            "type": "string"
+          }
+        },
+        "required": [
+          "condition",
+          "action",
+          "reason"
+        ],
+        "type": "object"
+      },
+      "maxItems": 32,
+      "type": "array"
+    },
+    "forbidden_actions": {
+      "description": "Action names the agent must never take. Must be disjoint from `bounded_actions`.",
+      "items": {
+        "maxLength": 128,
+        "minLength": 1,
+        "type": "string"
+      },
+      "maxItems": 64,
+      "type": "array"
+    }
+  },
+  "required": [
+    "bounded_actions"
+  ],
+  "type": "object"
+}

addedInput schema / properties / autonomy_mode

Added value: +{
+  "description": "Master switch for the action-policing pipeline. Required. `off` disables it; `observe` records only; `nudge` warns; `enforce` blocks.",
+  "enum": [
+    "off",
+    "observe",
+    "nudge",
+    "enforce"
+  ],
+  "type": "string"
+}

removedInput schema / properties / body

Removed value: -{
-  "description": "Unified alignment card (ADR-008/ADR-039). Authored in YAML or JSON; composed server-side with platform defaults, org template, and active exemptions before storage. This schema matches the runtime validator at src/composition/validate.ts EXACTLY — a card authored strictly to it passes `PUT /v1/agents/{id}/alignment-card` and the preview-compose endpoint. Output-only fields (card_id, issued_at, expires_at, _composition, content_hash, version) are server-assigned and must NOT be sent on a PUT.",
-  "properties": {
-    "_composition": {
-      "$ref": "#/$defs/CompositionMetadata"
-    },
-    "agent_id": {
-      "description": "Target agent id. On PUT, server overwrites to match the URL path.",
-      "type": "string"
-    },
-    "audit": {
-      "allOf": [
-        {
-          "if": {
-            "properties": {
-              "queryable": {
-                "const": true
-              }
-            },
-            "required": [
-              "queryable"
-            ]
-          },
-          "then": {
-            "required": [
-              "query_endpoint"
-            ]
-          }
-        }
-      ],
-      "properties": {
-        "query_endpoint": {
-          "description": "Required when audit.queryable is true.",
-          "type": "string"
-        },
-        "queryable": {
-          "type": "boolean"
-        },
-        "retention_days": {
-          "minimum": 0,
-          "type": "integer"
-        },
-        "storage": {
-          "properties": {
-            "location": {
-              "type": "string"
-            },
-            "type": {
-              "enum": [
-                "local",
-                "remote",
-                "distributed"
-              ],
-              "type": "string"
-            }
-          },
-          "type": "object"
-        },
-        "tamper_evidence": {
-          "enum": [
-            "append_only",
-            "signed",
-            "merkle",
-            null
-          ],
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "trace_format": {
-          "type": "string"
-        }
-      },
-      "required": [
-        "retention_days",
-        "queryable"
-      ],
-      "type": "object"
-    },
-    "autonomy": {
-      "properties": {
-        "bounded_actions": {
-          "items": {
-            "type": "string"
-          },
-          "minItems": 1,
-          "type": "array"
-        },
-        "escalation_triggers": {
-          "items": {
-            "properties": {
-              "action": {
-                "enum": [
-                  "escalate",
-                  "deny",
-                  "log"
-                ],
-                "type": "string"
-              },
-              "condition": {
-                "type": "string"
-              },
-              "reason": {
-                "type": "string"
-              }
-            },
-            "required": [
-              "condition",
-              "action",
-              "reason"
-            ],
-            "type": "object"
-          },
-          "type": "array"
-        },
-        "forbidden_actions": {
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        },
-        "max_autonomous_value": {
-          "properties": {
-            "amount": {
-              "type": "number"
-            },
-            "currency": {
-              "type": "string"
-            }
-          },
-          "type": "object"
-        }
-      },
-      "required": [
-        "bounded_actions"
-      ],
-      "type": "object"
-    },
-    "autonomy_mode": {
-      "description": "ADR-039 master switch for the action-policing pipeline (autonomy constraints). Required at the top level post-cutover; the legacy `enforcement.mode` location is rejected.",
-      "enum": [
-        "off",
-        "observe",
-        "nudge",
-        "enforce"
-      ],
-      "type": "string"
-    },
-    "capabilities": {
-      "additionalProperties": {
-        "properties": {
-          "description": {
-            "type": "string"
-          },
-          "required_actions": {
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "tools": {
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          }
-        },
-        "type": "object"
-      },
-      "type": "object"
-    },
-    "card_id": {
-      "description": "Card row id. Server-assigned on PUT (`ac-{uuid}`).",
-      "type": "string"
-    },
-    "card_version": {
-      "description": "Card schema version (required, non-empty). Current canonical value: `unified/2026-04-26`.",
-      "minLength": 1,
-      "type": "string"
-    },
-    "conscience": {
-      "properties": {
-        "mode": {
-          "enum": [
-            "augment",
-            "replace"
-          ],
-          "type": "string"
-        },
-        "values": {
-          "items": {
-            "properties": {
-              "content": {
-                "type": "string"
-              },
-              "id": {
-                "type": "string"
-              },
-              "severity": {
-                "enum": [
-                  "advisory",
-                  "mandatory"
-                ],
-                "type": "string"
-              },
-              "type": {
-                "enum": [
-                  "BOUNDARY",
-                  "FEAR",
-                  "COMMITMENT",
-                  "BELIEF",
-                  "HOPE"
-                ],
-                "type": "string"
-              }
-            },
-            "required": [
-              "type",
-              "content"
-            ],
-            "type": "object"
-          },
-          "type": "array"
-        }
-      },
-      "required": [
-        "mode",
-        "values"
-      ],
-      "type": "object"
-    },
-    "content_hash": {
-      "description": "Response-only: content hash of the composed card (`sha256:<hex>`), injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-      "type": "string"
-    },
-    "enforcement": {
-      "description": "Optional ADR-039 Decision-3 user-facing knobs for unmapped-tool handling. The legacy `mode`, `unmapped_tool_action` and `fail_open` keys are REJECTED by the validator (mode → top-level autonomy_mode; fail_open → gateway env config).",
-      "properties": {
-        "allow_unmapped_tools": {
-          "description": "When true, tools not mapped to a capability are allowed by default.",
-          "type": "boolean"
-        },
-        "default_unmapped_severity": {
-          "description": "Severity assigned to an unmapped tool when allow_unmapped_tools is false.",
-          "enum": [
-            "low",
-            "medium",
-            "high",
-            "critical"
-          ],
-          "type": "string"
-        },
-        "forbidden_tools": {
-          "items": {
-            "properties": {
-              "pattern": {
-                "type": "string"
-              },
-              "reason": {
-                "type": "string"
-              },
-              "severity": {
-                "enum": [
-                  "critical",
-                  "high",
-                  "medium",
-                  "low"
-                ],
-                "type": "string"
-              }
-            },
-            "required": [
-              "pattern",
-              "reason",
-              "severity"
-            ],
-            "type": "object"
-          },
-          "type": "array"
-        },
-        "grace_period_hours": {
-          "type": "integer"
-        }
-      },
-      "type": "object"
-    },
-    "expires_at": {
-      "format": "date-time",
-      "type": [
-        "string",
-        "null"
-      ]
-    },
-    "extensions": {
-      "additionalProperties": true,
-      "type": "object"
-    },
-    "integrity_mode": {
-      "description": "ADR-039 master switch for the values/conscience pipeline (integrity constraints). Required at the top level post-cutover; the legacy `integrity.enforcement_mode` location is rejected.",
-      "enum": [
-        "off",
-        "observe",
-        "nudge",
-        "enforce"
-      ],
-      "type": "string"
-    },
-    "issued_at": {
-      "format": "date-time",
-      "type": "string"
-    },
-    "principal": {
-      "allOf": [
-        {
-          "if": {
-            "properties": {
-              "type": {
-                "not": {
-                  "const": "unspecified"
-                }
-              }
-            }
-          },
-          "then": {
-            "required": [
-              "identifier"
-            ]
-          }
-        }
-      ],
-      "description": "Required object describing whose authority the agent acts under (ADR-039 Decision 10).",
-      "properties": {
-        "escalation_contact": {
-          "type": "string"
-        },
-        "identifier": {
-          "description": "Required (non-empty) when principal.type is not `unspecified`; identifies the human / organization / agent.",
-          "minLength": 1,
-          "type": "string"
-        },
-        "relationship": {
-          "enum": [
-            "delegated_authority",
-            "advisory",
-            "autonomous"
-          ],
-          "type": "string"
-        },
-        "type": {
-          "enum": [
-            "human",
-            "organization",
-            "agent",
-            "unspecified"
-          ],
-          "type": "string"
-        }
-      },
-      "required": [
-        "type",
-        "relationship"
-      ],
-      "type": "object"
-    },
-    "values": {
-      "properties": {
-        "conflicts_with": {
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        },
-        "declared": {
-          "description": "Ordered list of declared values. Phase 1 cards-as-primitive: each entry is either a catalog-v1 ID string (e.g. `'accuracy'`) or a parameterized map carrying optional `intensity` / `domain` / `severity_on_violation` / `scope` (e.g. `{id: 'accuracy', domain: 'financial', severity_on_violation: 'critical'}`).",
-          "items": {
-            "oneOf": [
-              {
-                "minLength": 1,
-                "type": "string"
-              },
-              {
-                "additionalProperties": {
-                  "type": "string"
-                },
-                "properties": {
-                  "id": {
-                    "minLength": 1,
-                    "type": "string"
-                  }
-                },
-                "required": [
-                  "id"
-                ],
-                "type": "object"
-              }
-            ]
-          },
-          "minItems": 1,
-          "type": "array"
-        },
-        "definitions": {
-          "additionalProperties": {
-            "properties": {
-              "description": {
-                "type": "string"
-              },
-              "priority": {
-                "type": "integer"
-              }
-            },
-            "type": "object"
-          },
-          "type": "object"
-        },
-        "hierarchy": {
-          "enum": [
-            "lexicographic",
-            "weighted",
-            "contextual"
-          ],
-          "type": "string"
-        }
-      },
-      "required": [
-        "declared"
-      ],
-      "type": "object"
-    },
-    "version": {
-      "description": "Response-only: monotonic card version, injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-      "type": "integer"
-    }
-  },
-  "required": [
-    "card_version",
-    "agent_id",
-    "autonomy_mode",
-    "integrity_mode",
-    "principal",
-    "values",
-    "autonomy",
-    "audit"
-  ],
-  "type": "object"
-}

addedInput schema / properties / card_version

Added value: +{
+  "description": "Card schema version. REQUIRED by the server-side validator. Current canonical value: `unified/2026-04-26`.",
+  "maxLength": 40,
+  "minLength": 3,
+  "pattern": "^[A-Za-z0-9][A-Za-z0-9._/-]{1,38}[A-Za-z0-9]$",
+  "type": "string"
+}

addedInput schema / properties / integrity_mode

Added value: +{
+  "description": "Master switch for the values pipeline. Required. Same four states as `autonomy_mode`.",
+  "enum": [
+    "off",
+    "observe",
+    "nudge",
+    "enforce"
+  ],
+  "type": "string"
+}

addedInput schema / properties / principal

Added value: +{
+  "additionalProperties": false,
+  "description": "Whose authority this agent acts under. Required.",
+  "properties": {
+    "escalation_contact": {
+      "description": "Where an escalation is routed. Use a ROLE ALIAS or SHARED INBOX (\"oncall-sre\", \"security@example.com\"), never an individual's personal contact details. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization.",
+      "maxLength": 128,
+      "minLength": 1,
+      "type": "string"
+    },
+    "identifier": {
+      "description": "Who the principal is. Use a ROLE or ORGANIZATION name (\"support-team\", \"Acme Corp Finance\"), NOT an individual's name, email address or phone number. Pass \"unspecified\" if there is no named principal. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization.",
+      "maxLength": 128,
+      "minLength": 1,
+      "type": "string"
+    },
+    "relationship": {
+      "description": "How the agent relates to that principal.",
+      "enum": [
+        "delegated_authority",
+        "advisory",
+        "autonomous"
+      ],
+      "type": "string"
+    },
+    "type": {
+      "description": "The kind of principal the agent answers to.",
+      "enum": [
+        "human",
+        "organization",
+        "agent",
+        "unspecified"
+      ],
+      "type": "string"
+    }
+  },
+  "required": [
+    "type",
+    "relationship",
+    "identifier"
+  ],
+  "type": "object"
+}

addedInput schema / properties / values

Added value: +{
+  "additionalProperties": false,
+  "description": "The values this agent declares it is bound by. Required.",
+  "properties": {
+    "declared": {
+      "description": "Value catalog IDs — e.g. [\"honesty\", \"no_harm\", \"privacy\"]. At least one required, 32 maximum. Short catalog slugs ONLY, never prose and never personal data. (Parameterized value references and long-form value definitions are available on the /v1 REST + CLI path; they are deliberately not exposed here.)",
+      "items": {
+        "maxLength": 64,
+        "minLength": 1,
+        "type": "string"
+      },
+      "maxItems": 32,
+      "minItems": 1,
+      "type": "array"
+    }
+  },
+  "required": [
+    "declared"
+  ],
+  "type": "object"
+}

changedInput schema / required

Previous value: -[
-  "agent_id"
-]New value: +[
+  "agent_id",
+  "card_version",
+  "autonomy_mode",
+  "integrity_mode",
+  "principal",
+  "values",
+  "autonomy",
+  "audit"
+]

removedOutput schema / properties / coherence_violations

Removed value: -{
-  "additionalProperties": false,
-  "properties": {
-    "by_severity": {
-      "additionalProperties": {
-        "type": "integer"
-      },
-      "type": "object"
-    },
-    "items": {
-      "items": {
-        "additionalProperties": false,
-        "properties": {
-          "field": {},
-          "message": {},
-          "rule": {},
-          "severity": {}
-        },
-        "type": "object"
-      },
-      "type": "array"
-    },
-    "not_shown": {
-      "type": "integer"
-    },
-    "total": {
-      "type": "integer"
-    }
-  },
-  "required": [
-    "total",
-    "by_severity",
-    "items"
-  ],
-  "type": "object"
-}

addedOutput schema / properties / composition_valid

Added value: +{
+  "description": "True when the composed card is coherence-valid.",
+  "type": "boolean"
+}

removedOutput schema / properties / conflicts

Removed value: -{
-  "additionalProperties": false,
-  "properties": {
-    "by_reason": {
-      "additionalProperties": {
-        "type": "integer"
-      },
-      "type": "object"
-    },
-    "not_shown": {
-      "description": "Conflicts beyond the inline top-N (present only when > top-N).",
-      "type": "integer"
-    },
-    "overrides": {
-      "items": {
-        "additionalProperties": false,
-        "properties": {
-          "field": {},
-          "from": {},
-          "reason": {},
-          "to": {},
-          "won_by": {}
-        },
-        "type": "object"
-      },
-      "type": "array"
-    },
-    "total": {
-      "type": "integer"
-    }
-  },
-  "required": [
-    "total",
-    "by_reason",
-    "overrides"
-  ],
-  "type": "object"
-}

addedOutput schema / properties / conflicts_count

Added value: +{
+  "description": "Total number of conflicts detected (0 = none).",
+  "type": "integer"
+}

removedOutput schema / properties / effective

Removed value: -{
-  "additionalProperties": false,
-  "properties": {
-    "autonomy_mode": {
-      "type": "string"
-    },
-    "capabilities_count": {
-      "type": "integer"
-    },
-    "conscience_value_count": {
-      "type": "integer"
-    },
-    "forbidden_actions_count": {
-      "type": "integer"
-    },
-    "integrity_mode": {
-      "type": "string"
-    },
-    "principal_type": {
-      "type": "string"
-    },
-    "values_declared_count": {
-      "type": "integer"
-    }
-  },
-  "required": [
-    "values_declared_count",
-    "conscience_value_count",
-    "forbidden_actions_count",
-    "capabilities_count"
-  ],
-  "type": "object"
-}

removedOutput schema / properties / full_report / additionalProperties
```
Removed value: -false
```

addedOutput schema / properties / full_report / description

Added value: +"Optional pointer to the full /v1 conflict report (method + path)."

addedOutput schema / properties / full_report / oneOf

Added value: +[
+  {
+    "type": "null"
+  },
+  {
+    "additionalProperties": false,
+    "properties": {
+      "method": {
+        "type": "string"
+      },
+      "note": {
+        "type": "string"
+      },
+      "path": {
+        "type": "string"
+      }
+    },
+    "required": [
+      "method",
+      "path",
+      "note"
+    ],
+    "type": "object"
+  }
+]

removedOutput schema / properties / full_report / properties

Removed value: -{
-  "method": {
-    "type": "string"
-  },
-  "note": {
-    "type": "string"
-  },
-  "path": {
-    "type": "string"
-  }
-}

removedOutput schema / properties / full_report / required
```
Removed value: -[
-  "method",
-  "path",
-  "note"
-]
```
removedOutput schema / properties / full_report / type
```
Removed value: -"object"
```

addedOutput schema / properties / ok / description

Added value: +"True when composition succeeded (no blocking conflicts)."

addedOutput schema / properties / summary / description

Added value: +"One-line human-readable summary of composition status."

removedOutput schema / properties / summary / enum
```
Removed value: -[
-  true
-]
```

changedOutput schema / properties / summary / type

Previous value: -"boolean"New value: +"string"

removedOutput schema / properties / tool

Removed value: -{
-  "enum": [
-    "preview_compose_alignment_by_agent"
-  ],
-  "type": "string"
-}

removedOutput schema / properties / what_changed
```
Removed value: -{
-  "type": "string"
-}
```
removedOutput schema / properties / what_to_do_next
```
Removed value: -{
-  "type": "string"
-}
```
removedOutput schema / properties / what_would_break
```
Removed value: -{
-  "type": "string"
-}
```

changedOutput schema / required

Previous value: -[
-  "summary",
-  "tool",
-  "ok",
-  "effective",
-  "conflicts",
-  "coherence_violations",
-  "what_changed",
-  "what_would_break",
-  "what_to_do_next",
-  "full_report"
-]New value: +[
+  "ok",
+  "composition_valid",
+  "conflicts_count",
+  "summary"
+]

Changedpreview_compose_protection_by_agent32 fields changed

removedInput schema / $defs

Removed value: -{
-  "CompositionMetadata": {
-    "description": "System-managed block describing which scope sources merged into the canonical card. Only returned when `?include_composition=true`.",
-    "properties": {
-      "canonical_id": {
-        "type": "string"
-      },
-      "composed_at": {
-        "format": "date-time",
-        "type": "string"
-      },
-      "exemptions_applied": {
-        "items": {
-          "type": "string"
-        },
-        "type": "array"
-      },
-      "scopes_applied": {
-        "items": {
-          "properties": {
-            "card_id": {
-              "type": "string"
-            },
-            "scope": {
-              "description": "`platform`, `org:<id>`, or `agent:<id>`.",
-              "type": "string"
-            },
-            "template_version": {
-              "type": "integer"
-            },
-            "version": {
-              "type": "integer"
-            }
-          },
-          "type": "object"
-        },
-        "type": "array"
-      },
-      "source_card_id": {
-        "type": "string"
-      },
-      "source_policy_id": {
-        "type": "string"
-      }
-    },
-    "type": "object"
-  },
-  "UnifiedProtectionCard": {
-    "description": "Unified protection card (ADR-037). Safe House thresholds + trusted-source policy for a single agent. Shape matches src/composition/types.ts::UnifiedProtectionCard (canonical) and what the runtime validator at src/composition/validate.ts accepts. The customer-facing docs at /concepts/protection-card and /specifications/protection-card-schema document this same shape.",
-    "properties": {
-      "_composition": {
-        "$ref": "#/$defs/CompositionMetadata"
-      },
-      "agent_id": {
-        "type": "string"
-      },
-      "card_id": {
-        "type": "string"
-      },
-      "card_version": {
-        "type": "string"
-      },
-      "content_hash": {
-        "description": "Response-only: content hash of the composed card (`sha256:<hex>`), injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-        "type": "string"
-      },
-      "expires_at": {
-        "format": "date-time",
-        "type": [
-          "string",
-          "null"
-        ]
-      },
-      "extensions": {
-        "additionalProperties": true,
-        "description": "Free-form extension slot for non-canonical fields. Ignored by the composer; preserved on read for tooling that needs an audit-tail metadata bag.",
-        "type": "object"
-      },
-      "issued_at": {
-        "format": "date-time",
-        "type": "string"
-      },
-      "mode": {
-        "description": "Strictest-wins composition: enforce > nudge > observe > off.",
-        "enum": [
-          "off",
-          "observe",
-          "nudge",
-          "enforce"
-        ],
-        "type": "string"
-      },
-      "protected_surface": {
-        "description": "Org-declared protected surface policy (MNE-830). Strengthen-only UNION across platform → org → team → agent: each scope may add entries; none may remove. The composer always emits this block; callers omit it to inherit the composed floor. See ADR-037 §protected_surface.",
-        "properties": {
-          "assets": {
-            "description": "Protected assets. Intrinsic identity = `${kind}:${selector}` (normalized). Composer merges by identity, keeping the strictest entry per scope.",
-            "items": {
-              "properties": {
-                "kind": {
-                  "description": "Asset kind (e.g. `row`, `field`, `resource`, `table`).",
-                  "type": "string"
-                },
-                "label": {
-                  "description": "Human-facing display label (optional).",
-                  "type": "string"
-                },
-                "reason": {
-                  "description": "Why this asset is protected (optional).",
-                  "type": "string"
-                },
-                "selector": {
-                  "description": "Asset selector (e.g. `customer:critical-0000`, `replica_dsn`).",
-                  "type": "string"
-                },
-                "source_scope": {
-                  "description": "Composer-assigned provenance (`platform`, `org:<id>`, `team:<id>`, `agent:<id>`). Server-assigned — do not send on a PUT.",
-                  "type": "string"
-                }
-              },
-              "required": [
-                "kind",
-                "selector"
-              ],
-              "type": "object"
-            },
-            "type": "array"
-          },
-          "escalation_required": {
-            "description": "Operations that require escalation before proceeding. Same intrinsic-identity + union rules as forbidden_operations (minus severity).",
-            "items": {
-              "properties": {
-                "applies_to": {
-                  "description": "Asset identities this escalation applies to. Empty/absent = GLOBAL.",
-                  "items": {
-                    "type": "string"
-                  },
-                  "type": "array"
-                },
-                "pattern": {
-                  "description": "Operation pattern requiring escalation.",
-                  "type": "string"
-                },
-                "reason": {
-                  "description": "Why escalation is required (optional).",
-                  "type": "string"
-                },
-                "source_scope": {
-                  "description": "Composer-assigned provenance. Server-assigned — do not send on a PUT.",
-                  "type": "string"
-                }
-              },
-              "required": [
-                "pattern"
-              ],
-              "type": "object"
-            },
-            "type": "array"
-          },
-          "forbidden_operations": {
-            "description": "Operations that are unconditionally forbidden. Intrinsic identity = normalized `pattern`. Composer unions across scopes; on identity collision, severity → max.",
-            "items": {
-              "properties": {
-                "applies_to": {
-                  "description": "Asset identities (`${kind}:${selector}`) this operation applies to. Empty/absent means GLOBAL.",
-                  "items": {
-                    "type": "string"
-                  },
-                  "type": "array"
-                },
-                "pattern": {
-                  "description": "Operation pattern (e.g. `TRUNCATE`, `unscoped UPDATE/DELETE`, `exfiltrate:pii`).",
-                  "type": "string"
-                },
-                "reason": {
-                  "description": "Why this operation is forbidden (optional).",
-                  "type": "string"
-                },
-                "severity": {
-                  "description": "Severity level. Composer merges to strictest across scopes.",
-                  "enum": [
-                    "low",
-                    "medium",
-                    "high",
-                    "critical"
-                  ],
-                  "type": "string"
-                },
-                "source_scope": {
-                  "description": "Composer-assigned provenance. Server-assigned — do not send on a PUT.",
-                  "type": "string"
-                }
-              },
-              "required": [
-                "pattern"
-              ],
-              "type": "object"
-            },
-            "type": "array"
-          }
-        },
-        "type": "object"
-      },
-      "review": {
-        "description": "Review-hold policy (Safe House Review, Slice 2a — MNE-920 design). gate_on is the minimum verdict band per surface that escalates to a review-hold. Composition is strictest-wins; on_timeout defaults to 'reject' (fail-closed). reviewer.kind 'endpoint' is designed for MNE-1650 and not consumed yet.",
-        "properties": {
-          "enabled": {
-            "type": "boolean"
-          },
-          "gate_on": {
-            "properties": {
-              "incoming": {
-                "enum": [
-                  "off",
-                  "warn",
-                  "quarantine",
-                  "block"
-                ],
-                "type": "string"
-              },
-              "integrity": {
-                "enum": [
-                  "off",
-                  "review_needed",
-                  "boundary_violation"
-                ],
-                "type": "string"
-              },
-              "outgoing": {
-                "enum": [
-                  "off",
-                  "warn",
-                  "quarantine",
-                  "block"
-                ],
-                "type": "string"
-              },
-              "tool_calls": {
-                "enum": [
-                  "off",
-                  "warn",
-                  "quarantine",
-                  "block"
-                ],
-                "type": "string"
-              },
-              "tool_responses": {
-                "enum": [
-                  "off",
-                  "warn",
-                  "quarantine",
-                  "block"
-                ],
-                "type": "string"
-              }
-            },
-            "type": "object"
-          },
-          "notify": {
-            "properties": {
-              "sse": {
-                "type": "boolean"
-              },
-              "webhooks": {
-                "type": "boolean"
-              }
-            },
-            "type": "object"
-          },
-          "on_timeout": {
-            "enum": [
-              "reject",
-              "release"
-            ],
-            "type": "string"
-          },
-          "quarantine_notice": {
-            "maxLength": 2000,
-            "type": "string"
-          },
-          "reviewer": {
-            "properties": {
-              "endpoint_url": {
-                "format": "uri",
-                "type": "string"
-              },
-              "kind": {
-                "enum": [
-                  "builtin_opus",
-                  "endpoint"
-                ],
-                "type": "string"
-              }
-            },
-            "required": [
-              "kind"
-            ],
-            "type": "object"
-          },
-          "sla_seconds": {
-            "minimum": 1,
-            "type": "number"
-          }
-        },
-        "required": [
-          "enabled"
-        ],
-        "type": "object"
-      },
-      "screen_surfaces": {
-        "description": "Which request surfaces Safe House inspects. Composed across scopes by OR-per-field (any scope requiring inspection wins).",
-        "properties": {
-          "incoming": {
-            "description": "The user/principal prompt entering the agent.",
-            "type": "boolean"
-          },
-          "outgoing": {
-            "description": "The agent's response leaving the agent.",
-            "type": "boolean"
-          },
-          "tool_calls": {
-            "description": "Tool-use invocations the agent makes.",
-            "type": "boolean"
-          },
-          "tool_responses": {
-            "description": "Responses to tool calls returning to the agent.",
-            "type": "boolean"
-          }
-        },
-        "required": [
-          "incoming",
-          "outgoing",
-          "tool_calls",
-          "tool_responses"
-        ],
-        "type": "object"
-      },
-      "thresholds": {
-        "description": "Score bands. Must satisfy warn <= quarantine <= block; each value in [0, 1].",
-        "properties": {
-          "block": {
-            "maximum": 1,
-            "minimum": 0,
-            "type": "number"
-          },
-          "quarantine": {
-            "maximum": 1,
-            "minimum": 0,
-            "type": "number"
-          },
-          "warn": {
-            "maximum": 1,
-            "minimum": 0,
-            "type": "number"
-          }
-        },
-        "required": [
-          "warn",
-          "quarantine",
-          "block"
-        ],
-        "type": "object"
-      },
-      "trusted_sources": {
-        "description": "Sources for which detectors short-circuit (each match logged in the trace). Composed as platform->agent intersection (compliance ceiling) with org+agent union inside that ceiling — an agent cannot widen trust beyond what the platform allows.",
-        "properties": {
-          "agent_ids": {
-            "description": "Mnemom agent IDs (mnm-* / smolt-* prefixed).",
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "domains": {
-            "description": "DNS names or host:port entries.",
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "ip_ranges": {
-            "description": "IPv4 or IPv6 CIDR ranges.",
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          }
-        },
-        "required": [
-          "domains",
-          "agent_ids",
-          "ip_ranges"
-        ],
-        "type": "object"
-      },
-      "version": {
-        "description": "Response-only: monotonic card version, injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-        "type": "integer"
-      }
-    },
-    "required": [
-      "card_version",
-      "agent_id",
-      "mode",
-      "thresholds",
-      "screen_surfaces",
-      "trusted_sources"
-    ],
-    "type": "object"
-  }
-}

changedInput schema / properties / agent_id / description

Previous value: -"Agent identifier (e.g. smolt-abc123)"New value: +"The agent this card belongs to (e.g. `smolt-abc123`). Identifier only — never place an API key, a secret, an email address, or any other personal data in this field."

addedInput schema / properties / agent_id / maxLength
```
Added value: +64
```
addedInput schema / properties / agent_id / minLength
```
Added value: +3
```

addedInput schema / properties / agent_id / pattern

Added value: +"^[A-Za-z0-9][A-Za-z0-9_-]{1,62}[A-Za-z0-9]$"

removedInput schema / properties / body

Removed value: -{
-  "description": "Unified protection card (ADR-037). Safe House thresholds + trusted-source policy for a single agent. Shape matches src/composition/types.ts::UnifiedProtectionCard (canonical) and what the runtime validator at src/composition/validate.ts accepts. The customer-facing docs at /concepts/protection-card and /specifications/protection-card-schema document this same shape.",
-  "properties": {
-    "_composition": {
-      "$ref": "#/$defs/CompositionMetadata"
-    },
-    "agent_id": {
-      "type": "string"
-    },
-    "card_id": {
-      "type": "string"
-    },
-    "card_version": {
-      "type": "string"
-    },
-    "content_hash": {
-      "description": "Response-only: content hash of the composed card (`sha256:<hex>`), injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-      "type": "string"
-    },
-    "expires_at": {
-      "format": "date-time",
-      "type": [
-        "string",
-        "null"
-      ]
-    },
-    "extensions": {
-      "additionalProperties": true,
-      "description": "Free-form extension slot for non-canonical fields. Ignored by the composer; preserved on read for tooling that needs an audit-tail metadata bag.",
-      "type": "object"
-    },
-    "issued_at": {
-      "format": "date-time",
-      "type": "string"
-    },
-    "mode": {
-      "description": "Strictest-wins composition: enforce > nudge > observe > off.",
-      "enum": [
-        "off",
-        "observe",
-        "nudge",
-        "enforce"
-      ],
-      "type": "string"
-    },
-    "protected_surface": {
-      "description": "Org-declared protected surface policy (MNE-830). Strengthen-only UNION across platform → org → team → agent: each scope may add entries; none may remove. The composer always emits this block; callers omit it to inherit the composed floor. See ADR-037 §protected_surface.",
-      "properties": {
-        "assets": {
-          "description": "Protected assets. Intrinsic identity = `${kind}:${selector}` (normalized). Composer merges by identity, keeping the strictest entry per scope.",
-          "items": {
-            "properties": {
-              "kind": {
-                "description": "Asset kind (e.g. `row`, `field`, `resource`, `table`).",
-                "type": "string"
-              },
-              "label": {
-                "description": "Human-facing display label (optional).",
-                "type": "string"
-              },
-              "reason": {
-                "description": "Why this asset is protected (optional).",
-                "type": "string"
-              },
-              "selector": {
-                "description": "Asset selector (e.g. `customer:critical-0000`, `replica_dsn`).",
-                "type": "string"
-              },
-              "source_scope": {
-                "description": "Composer-assigned provenance (`platform`, `org:<id>`, `team:<id>`, `agent:<id>`). Server-assigned — do not send on a PUT.",
-                "type": "string"
-              }
-            },
-            "required": [
-              "kind",
-              "selector"
-            ],
-            "type": "object"
-          },
-          "type": "array"
-        },
-        "escalation_required": {
-          "description": "Operations that require escalation before proceeding. Same intrinsic-identity + union rules as forbidden_operations (minus severity).",
-          "items": {
-            "properties": {
-              "applies_to": {
-                "description": "Asset identities this escalation applies to. Empty/absent = GLOBAL.",
-                "items": {
-                  "type": "string"
-                },
-                "type": "array"
-              },
-              "pattern": {
-                "description": "Operation pattern requiring escalation.",
-                "type": "string"
-              },
-              "reason": {
-                "description": "Why escalation is required (optional).",
-                "type": "string"
-              },
-              "source_scope": {
-                "description": "Composer-assigned provenance. Server-assigned — do not send on a PUT.",
-                "type": "string"
-              }
-            },
-            "required": [
-              "pattern"
-            ],
-            "type": "object"
-          },
-          "type": "array"
-        },
-        "forbidden_operations": {
-          "description": "Operations that are unconditionally forbidden. Intrinsic identity = normalized `pattern`. Composer unions across scopes; on identity collision, severity → max.",
-          "items": {
-            "properties": {
-              "applies_to": {
-                "description": "Asset identities (`${kind}:${selector}`) this operation applies to. Empty/absent means GLOBAL.",
-                "items": {
-                  "type": "string"
-                },
-                "type": "array"
-              },
-              "pattern": {
-                "description": "Operation pattern (e.g. `TRUNCATE`, `unscoped UPDATE/DELETE`, `exfiltrate:pii`).",
-                "type": "string"
-              },
-              "reason": {
-                "description": "Why this operation is forbidden (optional).",
-                "type": "string"
-              },
-              "severity": {
-                "description": "Severity level. Composer merges to strictest across scopes.",
-                "enum": [
-                  "low",
-                  "medium",
-                  "high",
-                  "critical"
-                ],
-                "type": "string"
-              },
-              "source_scope": {
-                "description": "Composer-assigned provenance. Server-assigned — do not send on a PUT.",
-                "type": "string"
-              }
-            },
-            "required": [
-              "pattern"
-            ],
-            "type": "object"
-          },
-          "type": "array"
-        }
-      },
-      "type": "object"
-    },
-    "review": {
-      "description": "Review-hold policy (Safe House Review, Slice 2a — MNE-920 design). gate_on is the minimum verdict band per surface that escalates to a review-hold. Composition is strictest-wins; on_timeout defaults to 'reject' (fail-closed). reviewer.kind 'endpoint' is designed for MNE-1650 and not consumed yet.",
-      "properties": {
-        "enabled": {
-          "type": "boolean"
-        },
-        "gate_on": {
-          "properties": {
-            "incoming": {
-              "enum": [
-                "off",
-                "warn",
-                "quarantine",
-                "block"
-              ],
-              "type": "string"
-            },
-            "integrity": {
-              "enum": [
-                "off",
-                "review_needed",
-                "boundary_violation"
-              ],
-              "type": "string"
-            },
-            "outgoing": {
-              "enum": [
-                "off",
-                "warn",
-                "quarantine",
-                "block"
-              ],
-              "type": "string"
-            },
-            "tool_calls": {
-              "enum": [
-                "off",
-                "warn",
-                "quarantine",
-                "block"
-              ],
-              "type": "string"
-            },
-            "tool_responses": {
-              "enum": [
-                "off",
-                "warn",
-                "quarantine",
-                "block"
-              ],
-              "type": "string"
-            }
-          },
-          "type": "object"
-        },
-        "notify": {
-          "properties": {
-            "sse": {
-              "type": "boolean"
-            },
-            "webhooks": {
-              "type": "boolean"
-            }
-          },
-          "type": "object"
-        },
-        "on_timeout": {
-          "enum": [
-            "reject",
-            "release"
-          ],
-          "type": "string"
-        },
-        "quarantine_notice": {
-          "maxLength": 2000,
-          "type": "string"
-        },
-        "reviewer": {
-          "properties": {
-            "endpoint_url": {
-              "format": "uri",
-              "type": "string"
-            },
-            "kind": {
-              "enum": [
-                "builtin_opus",
-                "endpoint"
-              ],
-              "type": "string"
-            }
-          },
-          "required": [
-            "kind"
-          ],
-          "type": "object"
-        },
-        "sla_seconds": {
-          "minimum": 1,
-          "type": "number"
-        }
-      },
-      "required": [
-        "enabled"
-      ],
-      "type": "object"
-    },
-    "screen_surfaces": {
-      "description": "Which request surfaces Safe House inspects. Composed across scopes by OR-per-field (any scope requiring inspection wins).",
-      "properties": {
-        "incoming": {
-          "description": "The user/principal prompt entering the agent.",
-          "type": "boolean"
-        },
-        "outgoing": {
-          "description": "The agent's response leaving the agent.",
-          "type": "boolean"
-        },
-        "tool_calls": {
-          "description": "Tool-use invocations the agent makes.",
-          "type": "boolean"
-        },
-        "tool_responses": {
-          "description": "Responses to tool calls returning to the agent.",
-          "type": "boolean"
-        }
-      },
-      "required": [
-        "incoming",
-        "outgoing",
-        "tool_calls",
-        "tool_responses"
-      ],
-      "type": "object"
-    },
-    "thresholds": {
-      "description": "Score bands. Must satisfy warn <= quarantine <= block; each value in [0, 1].",
-      "properties": {
-        "block": {
-          "maximum": 1,
-          "minimum": 0,
-          "type": "number"
-        },
-        "quarantine": {
-          "maximum": 1,
-          "minimum": 0,
-          "type": "number"
-        },
-        "warn": {
-          "maximum": 1,
-          "minimum": 0,
-          "type": "number"
-        }
-      },
-      "required": [
-        "warn",
-        "quarantine",
-        "block"
-      ],
-      "type": "object"
-    },
-    "trusted_sources": {
-      "description": "Sources for which detectors short-circuit (each match logged in the trace). Composed as platform->agent intersection (compliance ceiling) with org+agent union inside that ceiling — an agent cannot widen trust beyond what the platform allows.",
-      "properties": {
-        "agent_ids": {
-          "description": "Mnemom agent IDs (mnm-* / smolt-* prefixed).",
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        },
-        "domains": {
-          "description": "DNS names or host:port entries.",
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        },
-        "ip_ranges": {
-          "description": "IPv4 or IPv6 CIDR ranges.",
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        }
-      },
-      "required": [
-        "domains",
-        "agent_ids",
-        "ip_ranges"
-      ],
-      "type": "object"
-    },
-    "version": {
-      "description": "Response-only: monotonic card version, injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-      "type": "integer"
-    }
-  },
-  "required": [
-    "card_version",
-    "agent_id",
-    "mode",
-    "thresholds",
-    "screen_surfaces",
-    "trusted_sources"
-  ],
-  "type": "object"
-}

addedInput schema / properties / card_version

Added value: +{
+  "description": "Card schema version. REQUIRED by the server-side validator. Current canonical value: `protection/2026-04-26`.",
+  "maxLength": 40,
+  "minLength": 3,
+  "pattern": "^[A-Za-z0-9][A-Za-z0-9._/-]{1,38}[A-Za-z0-9]$",
+  "type": "string"
+}

addedInput schema / properties / mode

Added value: +{
+  "description": "Screening mode for the protection pipeline. Required. `off` disables screening; `observe` records only; `nudge` warns; `enforce` blocks.",
+  "enum": [
+    "off",
+    "observe",
+    "nudge",
+    "enforce"
+  ],
+  "type": "string"
+}

addedInput schema / properties / protected_surface

Added value: +{
+  "additionalProperties": false,
+  "description": "The assets and operations this agent must protect. Omit to accept the composed default (empty surface).",
+  "properties": {
+    "assets": {
+      "description": "The assets under protection.",
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "kind": {
+            "description": "Asset class — e.g. \"repo\", \"database\", \"bucket\".",
+            "maxLength": 64,
+            "minLength": 1,
+            "type": "string"
+          },
+          "label": {
+            "description": "Short human-readable name for the asset.",
+            "maxLength": 120,
+            "minLength": 1,
+            "type": "string"
+          },
+          "reason": {
+            "description": "Why it is protected, in one short sentence. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization.",
+            "maxLength": 200,
+            "minLength": 1,
+            "type": "string"
+          },
+          "selector": {
+            "description": "Which instance — e.g. \"mnemom/mnemom-api\". A resource identifier only: no credentials, no connection strings, no personal data.",
+            "maxLength": 256,
+            "minLength": 1,
+            "type": "string"
+          }
+        },
+        "required": [
+          "kind",
+          "selector"
+        ],
+        "type": "object"
+      },
+      "maxItems": 64,
+      "type": "array"
+    },
+    "escalation_required": {
+      "description": "Operations that require human approval before the agent may proceed.",
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "applies_to": {
+            "description": "Asset identities this entry applies to. Omit to apply to every protected asset.",
+            "items": {
+              "maxLength": 256,
+              "minLength": 1,
+              "type": "string"
+            },
+            "maxItems": 64,
+            "type": "array"
+          },
+          "pattern": {
+            "description": "Operation matcher — e.g. \"force_push\", \"drop_table*\". A short pattern, not a description.",
+            "maxLength": 200,
+            "minLength": 1,
+            "type": "string"
+          },
+          "reason": {
+            "description": "Why this entry exists, in one short sentence. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization.",
+            "maxLength": 200,
+            "minLength": 1,
+            "type": "string"
+          }
+        },
+        "required": [
+          "pattern"
+        ],
+        "type": "object"
+      },
+      "maxItems": 64,
+      "type": "array"
+    },
+    "forbidden_operations": {
+      "description": "Operations the agent must never perform on the protected assets.",
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "applies_to": {
+            "description": "Asset identities this entry applies to. Omit to apply to every protected asset.",
+            "items": {
+              "maxLength": 256,
+              "minLength": 1,
+              "type": "string"
+            },
+            "maxItems": 64,
+            "type": "array"
+          },
+          "pattern": {
+            "description": "Operation matcher — e.g. \"force_push\", \"drop_table*\". A short pattern, not a description.",
+            "maxLength": 200,
+            "minLength": 1,
+            "type": "string"
+          },
+          "reason": {
+            "description": "Why this entry exists, in one short sentence. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization.",
+            "maxLength": 200,
+            "minLength": 1,
+            "type": "string"
+          },
+          "severity": {
+            "description": "How serious a violation of this entry is.",
+            "enum": [
+              "low",
+              "medium",
+              "high",
+              "critical"
+            ],
+            "type": "string"
+          }
+        },
+        "required": [
+          "pattern"
+        ],
+        "type": "object"
+      },
+      "maxItems": 64,
+      "type": "array"
+    }
+  },
+  "type": "object"
+}

addedInput schema / properties / screen_surfaces

Added value: +{
+  "additionalProperties": false,
+  "description": "Which traffic surfaces are screened. Omit to accept the composed defaults.",
+  "properties": {
+    "incoming": {
+      "description": "Screen prompts arriving at the agent.",
+      "type": "boolean"
+    },
+    "outgoing": {
+      "description": "Screen the agent's outbound messages.",
+      "type": "boolean"
+    },
+    "tool_calls": {
+      "description": "Screen the tool calls the agent makes.",
+      "type": "boolean"
+    },
+    "tool_responses": {
+      "description": "Screen tool responses returned to the agent.",
+      "type": "boolean"
+    }
+  },
+  "type": "object"
+}

addedInput schema / properties / thresholds

Added value: +{
+  "additionalProperties": false,
+  "description": "Risk-score cutoffs, each in [0, 1] and ordered warn ≤ quarantine ≤ block. All three are required if this object is sent at all — omit the whole object to accept the composed defaults.",
+  "properties": {
+    "block": {
+      "description": "Score at or above which the request is refused.",
+      "maximum": 1,
+      "minimum": 0,
+      "type": "number"
+    },
+    "quarantine": {
+      "description": "Score at or above which the request is held for review.",
+      "maximum": 1,
+      "minimum": 0,
+      "type": "number"
+    },
+    "warn": {
+      "description": "Score at or above which the request is flagged.",
+      "maximum": 1,
+      "minimum": 0,
+      "type": "number"
+    }
+  },
+  "required": [
+    "warn",
+    "quarantine",
+    "block"
+  ],
+  "type": "object"
+}

addedInput schema / properties / trusted_sources

Added value: +{
+  "additionalProperties": false,
+  "description": "Sources exempt from screening. Enumerate specific hosts — wildcards are rejected, and a server-side deny-list (public LLM/DNS endpoints, 0.0.0.0/0, ::/0, link-local, multicast) is always applied.",
+  "properties": {
+    "agent_ids": {
+      "description": "Trusted Mnemom agent IDs. Must be in canonical `mnm-*` form.",
+      "items": {
+        "maxLength": 64,
+        "minLength": 8,
+        "pattern": "^mnm-[A-Za-z0-9-]{4,}$",
+        "type": "string"
+      },
+      "maxItems": 64,
+      "type": "array"
+    },
+    "domains": {
+      "description": "Trusted DNS names, optionally with `:port`. No wildcards.",
+      "items": {
+        "maxLength": 253,
+        "minLength": 3,
+        "type": "string"
+      },
+      "maxItems": 64,
+      "type": "array"
+    },
+    "ip_ranges": {
+      "description": "Trusted CIDR ranges (e.g. `10.0.0.0/8`).",
+      "items": {
+        "maxLength": 43,
+        "minLength": 4,
+        "type": "string"
+      },
+      "maxItems": 64,
+      "type": "array"
+    }
+  },
+  "type": "object"
+}

changedInput schema / required

Previous value: -[
-  "agent_id"
-]New value: +[
+  "agent_id",
+  "card_version",
+  "mode"
+]

addedOutput schema / properties / composition_valid

Added value: +{
+  "description": "True when the composed card is valid.",
+  "type": "boolean"
+}

removedOutput schema / properties / conflicts

Removed value: -{
-  "additionalProperties": false,
-  "properties": {
-    "by_reason": {
-      "additionalProperties": {
-        "type": "integer"
-      },
-      "type": "object"
-    },
-    "not_shown": {
-      "description": "Conflicts beyond the inline top-N (present only when > top-N).",
-      "type": "integer"
-    },
-    "overrides": {
-      "items": {
-        "additionalProperties": false,
-        "properties": {
-          "field": {},
-          "from": {},
-          "reason": {},
-          "to": {},
-          "won_by": {}
-        },
-        "type": "object"
-      },
-      "type": "array"
-    },
-    "total": {
-      "type": "integer"
-    }
-  },
-  "required": [
-    "total",
-    "by_reason",
-    "overrides"
-  ],
-  "type": "object"
-}

addedOutput schema / properties / conflicts_count

Added value: +{
+  "description": "Total number of conflicts detected (0 = none).",
+  "type": "integer"
+}

removedOutput schema / properties / effective

Removed value: -{
-  "additionalProperties": false,
-  "properties": {
-    "mode": {
-      "type": "string"
-    },
-    "screen_surfaces": {},
-    "thresholds": {},
-    "trusted_sources_counts": {
-      "additionalProperties": false,
-      "properties": {
-        "agent_ids": {
-          "type": "integer"
-        },
-        "domains": {
-          "type": "integer"
-        },
-        "ip_ranges": {
-          "type": "integer"
-        }
-      },
-      "required": [
-        "domains",
-        "agent_ids",
-        "ip_ranges"
-      ],
-      "type": "object"
-    }
-  },
-  "required": [
-    "trusted_sources_counts"
-  ],
-  "type": "object"
-}

removedOutput schema / properties / full_report / additionalProperties
```
Removed value: -false
```

addedOutput schema / properties / full_report / description

Added value: +"Optional pointer to the full /v1 conflict report (method + path)."

addedOutput schema / properties / full_report / oneOf

Added value: +[
+  {
+    "type": "null"
+  },
+  {
+    "additionalProperties": false,
+    "properties": {
+      "method": {
+        "type": "string"
+      },
+      "note": {
+        "type": "string"
+      },
+      "path": {
+        "type": "string"
+      }
+    },
+    "required": [
+      "method",
+      "path",
+      "note"
+    ],
+    "type": "object"
+  }
+]

removedOutput schema / properties / full_report / properties

Removed value: -{
-  "method": {
-    "type": "string"
-  },
-  "note": {
-    "type": "string"
-  },
-  "path": {
-    "type": "string"
-  }
-}

removedOutput schema / properties / full_report / required
```
Removed value: -[
-  "method",
-  "path",
-  "note"
-]
```
removedOutput schema / properties / full_report / type
```
Removed value: -"object"
```

addedOutput schema / properties / ok / description

Added value: +"True when composition succeeded (no blocking conflicts)."

addedOutput schema / properties / summary / description

Added value: +"One-line human-readable summary of composition status."

removedOutput schema / properties / summary / enum
```
Removed value: -[
-  true
-]
```

changedOutput schema / properties / summary / type

Previous value: -"boolean"New value: +"string"

removedOutput schema / properties / tool

Removed value: -{
-  "enum": [
-    "preview_compose_protection_by_agent"
-  ],
-  "type": "string"
-}

removedOutput schema / properties / what_changed
```
Removed value: -{
-  "type": "string"
-}
```
removedOutput schema / properties / what_to_do_next
```
Removed value: -{
-  "type": "string"
-}
```
removedOutput schema / properties / what_would_break
```
Removed value: -{
-  "type": "string"
-}
```

changedOutput schema / required

Previous value: -[
-  "summary",
-  "tool",
-  "ok",
-  "effective",
-  "conflicts",
-  "what_changed",
-  "what_would_break",
-  "what_to_do_next",
-  "full_report"
-]New value: +[
+  "ok",
+  "composition_valid",
+  "conflicts_count",
+  "summary"
+]

Changedput_alignment_by_agent38 fields changed

removedInput schema / $defs

Removed value: -{
-  "CompositionMetadata": {
-    "description": "System-managed block describing which scope sources merged into the canonical card. Only returned when `?include_composition=true`.",
-    "properties": {
-      "canonical_id": {
-        "type": "string"
-      },
-      "composed_at": {
-        "format": "date-time",
-        "type": "string"
-      },
-      "exemptions_applied": {
-        "items": {
-          "type": "string"
-        },
-        "type": "array"
-      },
-      "scopes_applied": {
-        "items": {
-          "properties": {
-            "card_id": {
-              "type": "string"
-            },
-            "scope": {
-              "description": "`platform`, `org:<id>`, or `agent:<id>`.",
-              "type": "string"
-            },
-            "template_version": {
-              "type": "integer"
-            },
-            "version": {
-              "type": "integer"
-            }
-          },
-          "type": "object"
-        },
-        "type": "array"
-      },
-      "source_card_id": {
-        "type": "string"
-      },
-      "source_policy_id": {
-        "type": "string"
-      }
-    },
-    "type": "object"
-  },
-  "UnifiedAlignmentCard": {
-    "description": "Unified alignment card (ADR-008/ADR-039). Authored in YAML or JSON; composed server-side with platform defaults, org template, and active exemptions before storage. This schema matches the runtime validator at src/composition/validate.ts EXACTLY — a card authored strictly to it passes `PUT /v1/agents/{id}/alignment-card` and the preview-compose endpoint. Output-only fields (card_id, issued_at, expires_at, _composition, content_hash, version) are server-assigned and must NOT be sent on a PUT.",
-    "properties": {
-      "_composition": {
-        "$ref": "#/$defs/CompositionMetadata"
-      },
-      "agent_id": {
-        "description": "Target agent id. On PUT, server overwrites to match the URL path.",
-        "type": "string"
-      },
-      "audit": {
-        "allOf": [
-          {
-            "if": {
-              "properties": {
-                "queryable": {
-                  "const": true
-                }
-              },
-              "required": [
-                "queryable"
-              ]
-            },
-            "then": {
-              "required": [
-                "query_endpoint"
-              ]
-            }
-          }
-        ],
-        "properties": {
-          "query_endpoint": {
-            "description": "Required when audit.queryable is true.",
-            "type": "string"
-          },
-          "queryable": {
-            "type": "boolean"
-          },
-          "retention_days": {
-            "minimum": 0,
-            "type": "integer"
-          },
-          "storage": {
-            "properties": {
-              "location": {
-                "type": "string"
-              },
-              "type": {
-                "enum": [
-                  "local",
-                  "remote",
-                  "distributed"
-                ],
-                "type": "string"
-              }
-            },
-            "type": "object"
-          },
-          "tamper_evidence": {
-            "enum": [
-              "append_only",
-              "signed",
-              "merkle",
-              null
-            ],
-            "type": [
-              "string",
-              "null"
-            ]
-          },
-          "trace_format": {
-            "type": "string"
-          }
-        },
-        "required": [
-          "retention_days",
-          "queryable"
-        ],
-        "type": "object"
-      },
-      "autonomy": {
-        "properties": {
-          "bounded_actions": {
-            "items": {
-              "type": "string"
-            },
-            "minItems": 1,
-            "type": "array"
-          },
-          "escalation_triggers": {
-            "items": {
-              "properties": {
-                "action": {
-                  "enum": [
-                    "escalate",
-                    "deny",
-                    "log"
-                  ],
-                  "type": "string"
-                },
-                "condition": {
-                  "type": "string"
-                },
-                "reason": {
-                  "type": "string"
-                }
-              },
-              "required": [
-                "condition",
-                "action",
-                "reason"
-              ],
-              "type": "object"
-            },
-            "type": "array"
-          },
-          "forbidden_actions": {
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "max_autonomous_value": {
-            "properties": {
-              "amount": {
-                "type": "number"
-              },
-              "currency": {
-                "type": "string"
-              }
-            },
-            "type": "object"
-          }
-        },
-        "required": [
-          "bounded_actions"
-        ],
-        "type": "object"
-      },
-      "autonomy_mode": {
-        "description": "ADR-039 master switch for the action-policing pipeline (autonomy constraints). Required at the top level post-cutover; the legacy `enforcement.mode` location is rejected.",
-        "enum": [
-          "off",
-          "observe",
-          "nudge",
-          "enforce"
-        ],
-        "type": "string"
-      },
-      "capabilities": {
-        "additionalProperties": {
-          "properties": {
-            "description": {
-              "type": "string"
-            },
-            "required_actions": {
-              "items": {
-                "type": "string"
-              },
-              "type": "array"
-            },
-            "tools": {
-              "items": {
-                "type": "string"
-              },
-              "type": "array"
-            }
-          },
-          "type": "object"
-        },
-        "type": "object"
-      },
-      "card_id": {
-        "description": "Card row id. Server-assigned on PUT (`ac-{uuid}`).",
-        "type": "string"
-      },
-      "card_version": {
-        "description": "Card schema version (required, non-empty). Current canonical value: `unified/2026-04-26`.",
-        "minLength": 1,
-        "type": "string"
-      },
-      "conscience": {
-        "properties": {
-          "mode": {
-            "enum": [
-              "augment",
-              "replace"
-            ],
-            "type": "string"
-          },
-          "values": {
-            "items": {
-              "properties": {
-                "content": {
-                  "type": "string"
-                },
-                "id": {
-                  "type": "string"
-                },
-                "severity": {
-                  "enum": [
-                    "advisory",
-                    "mandatory"
-                  ],
-                  "type": "string"
-                },
-                "type": {
-                  "enum": [
-                    "BOUNDARY",
-                    "FEAR",
-                    "COMMITMENT",
-                    "BELIEF",
-                    "HOPE"
-                  ],
-                  "type": "string"
-                }
-              },
-              "required": [
-                "type",
-                "content"
-              ],
-              "type": "object"
-            },
-            "type": "array"
-          }
-        },
-        "required": [
-          "mode",
-          "values"
-        ],
-        "type": "object"
-      },
-      "content_hash": {
-        "description": "Response-only: content hash of the composed card (`sha256:<hex>`), injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-        "type": "string"
-      },
-      "enforcement": {
-        "description": "Optional ADR-039 Decision-3 user-facing knobs for unmapped-tool handling. The legacy `mode`, `unmapped_tool_action` and `fail_open` keys are REJECTED by the validator (mode → top-level autonomy_mode; fail_open → gateway env config).",
-        "properties": {
-          "allow_unmapped_tools": {
-            "description": "When true, tools not mapped to a capability are allowed by default.",
-            "type": "boolean"
-          },
-          "default_unmapped_severity": {
-            "description": "Severity assigned to an unmapped tool when allow_unmapped_tools is false.",
-            "enum": [
-              "low",
-              "medium",
-              "high",
-              "critical"
-            ],
-            "type": "string"
-          },
-          "forbidden_tools": {
-            "items": {
-              "properties": {
-                "pattern": {
-                  "type": "string"
-                },
-                "reason": {
-                  "type": "string"
-                },
-                "severity": {
-                  "enum": [
-                    "critical",
-                    "high",
-                    "medium",
-                    "low"
-                  ],
-                  "type": "string"
-                }
-              },
-              "required": [
-                "pattern",
-                "reason",
-                "severity"
-              ],
-              "type": "object"
-            },
-            "type": "array"
-          },
-          "grace_period_hours": {
-            "type": "integer"
-          }
-        },
-        "type": "object"
-      },
-      "expires_at": {
-        "format": "date-time",
-        "type": [
-          "string",
-          "null"
-        ]
-      },
-      "extensions": {
-        "additionalProperties": true,
-        "type": "object"
-      },
-      "integrity_mode": {
-        "description": "ADR-039 master switch for the values/conscience pipeline (integrity constraints). Required at the top level post-cutover; the legacy `integrity.enforcement_mode` location is rejected.",
-        "enum": [
-          "off",
-          "observe",
-          "nudge",
-          "enforce"
-        ],
-        "type": "string"
-      },
-      "issued_at": {
-        "format": "date-time",
-        "type": "string"
-      },
-      "principal": {
-        "allOf": [
-          {
-            "if": {
-              "properties": {
-                "type": {
-                  "not": {
-                    "const": "unspecified"
-                  }
-                }
-              }
-            },
-            "then": {
-              "required": [
-                "identifier"
-              ]
-            }
-          }
-        ],
-        "description": "Required object describing whose authority the agent acts under (ADR-039 Decision 10).",
-        "properties": {
-          "escalation_contact": {
-            "type": "string"
-          },
-          "identifier": {
-            "description": "Required (non-empty) when principal.type is not `unspecified`; identifies the human / organization / agent.",
-            "minLength": 1,
-            "type": "string"
-          },
-          "relationship": {
-            "enum": [
-              "delegated_authority",
-              "advisory",
-              "autonomous"
-            ],
-            "type": "string"
-          },
-          "type": {
-            "enum": [
-              "human",
-              "organization",
-              "agent",
-              "unspecified"
-            ],
-            "type": "string"
-          }
-        },
-        "required": [
-          "type",
-          "relationship"
-        ],
-        "type": "object"
-      },
-      "values": {
-        "properties": {
-          "conflicts_with": {
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "declared": {
-            "description": "Ordered list of declared values. Phase 1 cards-as-primitive: each entry is either a catalog-v1 ID string (e.g. `'accuracy'`) or a parameterized map carrying optional `intensity` / `domain` / `severity_on_violation` / `scope` (e.g. `{id: 'accuracy', domain: 'financial', severity_on_violation: 'critical'}`).",
-            "items": {
-              "oneOf": [
-                {
-                  "minLength": 1,
-                  "type": "string"
-                },
-                {
-                  "additionalProperties": {
-                    "type": "string"
-                  },
-                  "properties": {
-                    "id": {
-                      "minLength": 1,
-                      "type": "string"
-                    }
-                  },
-                  "required": [
-                    "id"
-                  ],
-                  "type": "object"
-                }
-              ]
-            },
-            "minItems": 1,
-            "type": "array"
-          },
-          "definitions": {
-            "additionalProperties": {
-              "properties": {
-                "description": {
-                  "type": "string"
-                },
-                "priority": {
-                  "type": "integer"
-                }
-              },
-              "type": "object"
-            },
-            "type": "object"
-          },
-          "hierarchy": {
-            "enum": [
-              "lexicographic",
-              "weighted",
-              "contextual"
-            ],
-            "type": "string"
-          }
-        },
-        "required": [
-          "declared"
-        ],
-        "type": "object"
-      },
-      "version": {
-        "description": "Response-only: monotonic card version, injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-        "type": "integer"
-      }
-    },
-    "required": [
-      "card_version",
-      "agent_id",
-      "autonomy_mode",
-      "integrity_mode",
-      "principal",
-      "values",
-      "autonomy",
-      "audit"
-    ],
-    "type": "object"
-  }
-}

changedInput schema / properties / agent_id / description

Previous value: -"Agent identifier (e.g. smolt-abc123)"New value: +"The agent this card belongs to (e.g. `smolt-abc123`). Identifier only — never place an API key, a secret, an email address, or any other personal data in this field."

addedInput schema / properties / agent_id / maxLength
```
Added value: +64
```
addedInput schema / properties / agent_id / minLength
```
Added value: +3
```

addedInput schema / properties / agent_id / pattern

Added value: +"^[A-Za-z0-9][A-Za-z0-9_-]{1,62}[A-Za-z0-9]$"

addedInput schema / properties / audit

Added value: +{
+  "additionalProperties": false,
+  "description": "How long this agent's own decision log is kept, and whether it can be queried. Required. (This is the agent's audit policy — it is NOT Mnemom's retention policy for the card itself; see the tool's data-handling disclosure for that.)",
+  "properties": {
+    "query_endpoint": {
+      "description": "HTTPS endpoint the records can be queried from. REQUIRED when `queryable` is true, and ignored when it is false.",
+      "maxLength": 300,
+      "type": "string"
+    },
+    "queryable": {
+      "default": false,
+      "description": "Whether those retained records can be queried. Leave false unless you also supply `query_endpoint` — the server rejects a queryable audit policy with no endpoint.",
+      "type": "boolean"
+    },
+    "retention_days": {
+      "description": "How many days the agent's decision records are retained. 0 means do not retain. 3650 (10 years) maximum.",
+      "maximum": 3650,
+      "minimum": 0,
+      "type": "integer"
+    },
+    "tamper_evidence": {
+      "description": "Tamper-evidence scheme applied to the retained records.",
+      "enum": [
+        "append_only",
+        "signed",
+        "merkle"
+      ],
+      "type": "string"
+    }
+  },
+  "required": [
+    "retention_days",
+    "queryable"
+  ],
+  "type": "object"
+}

addedInput schema / properties / autonomy

Added value: +{
+  "additionalProperties": false,
+  "description": "What the agent may do on its own authority. Required.",
+  "properties": {
+    "bounded_actions": {
+      "description": "Action names the agent may take within its bounds — e.g. [\"send_email\", \"create_ticket\"]. At least one required. Action identifiers only, not descriptions.",
+      "items": {
+        "maxLength": 128,
+        "minLength": 1,
+        "type": "string"
+      },
+      "maxItems": 64,
+      "minItems": 1,
+      "type": "array"
+    },
+    "escalation_triggers": {
+      "description": "Conditions that route to a human instead of acting.",
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "action": {
+            "description": "What to do when the condition holds.",
+            "enum": [
+              "escalate",
+              "deny",
+              "log"
+            ],
+            "type": "string"
+          },
+          "condition": {
+            "description": "The condition, as a short expression or slug (e.g. \"amount > 1000\"). Short condition only — never paste a conversation, a log excerpt, or a record about a person. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization.",
+            "maxLength": 200,
+            "minLength": 1,
+            "type": "string"
+          },
+          "reason": {
+            "description": "Why this trigger exists, in one short sentence. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization.",
+            "maxLength": 200,
+            "minLength": 1,
+            "type": "string"
+          }
+        },
+        "required": [
+          "condition",
+          "action",
+          "reason"
+        ],
+        "type": "object"
+      },
+      "maxItems": 32,
+      "type": "array"
+    },
+    "forbidden_actions": {
+      "description": "Action names the agent must never take. Must be disjoint from `bounded_actions`.",
+      "items": {
+        "maxLength": 128,
+        "minLength": 1,
+        "type": "string"
+      },
+      "maxItems": 64,
+      "type": "array"
+    }
+  },
+  "required": [
+    "bounded_actions"
+  ],
+  "type": "object"
+}

addedInput schema / properties / autonomy_mode

Added value: +{
+  "description": "Master switch for the action-policing pipeline. Required. `off` disables it; `observe` records only; `nudge` warns; `enforce` blocks.",
+  "enum": [
+    "off",
+    "observe",
+    "nudge",
+    "enforce"
+  ],
+  "type": "string"
+}

removedInput schema / properties / body

Removed value: -{
-  "description": "Unified alignment card (ADR-008/ADR-039). Authored in YAML or JSON; composed server-side with platform defaults, org template, and active exemptions before storage. This schema matches the runtime validator at src/composition/validate.ts EXACTLY — a card authored strictly to it passes `PUT /v1/agents/{id}/alignment-card` and the preview-compose endpoint. Output-only fields (card_id, issued_at, expires_at, _composition, content_hash, version) are server-assigned and must NOT be sent on a PUT.",
-  "properties": {
-    "_composition": {
-      "$ref": "#/$defs/CompositionMetadata"
-    },
-    "agent_id": {
-      "description": "Target agent id. On PUT, server overwrites to match the URL path.",
-      "type": "string"
-    },
-    "audit": {
-      "allOf": [
-        {
-          "if": {
-            "properties": {
-              "queryable": {
-                "const": true
-              }
-            },
-            "required": [
-              "queryable"
-            ]
-          },
-          "then": {
-            "required": [
-              "query_endpoint"
-            ]
-          }
-        }
-      ],
-      "properties": {
-        "query_endpoint": {
-          "description": "Required when audit.queryable is true.",
-          "type": "string"
-        },
-        "queryable": {
-          "type": "boolean"
-        },
-        "retention_days": {
-          "minimum": 0,
-          "type": "integer"
-        },
-        "storage": {
-          "properties": {
-            "location": {
-              "type": "string"
-            },
-            "type": {
-              "enum": [
-                "local",
-                "remote",
-                "distributed"
-              ],
-              "type": "string"
-            }
-          },
-          "type": "object"
-        },
-        "tamper_evidence": {
-          "enum": [
-            "append_only",
-            "signed",
-            "merkle",
-            null
-          ],
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "trace_format": {
-          "type": "string"
-        }
-      },
-      "required": [
-        "retention_days",
-        "queryable"
-      ],
-      "type": "object"
-    },
-    "autonomy": {
-      "properties": {
-        "bounded_actions": {
-          "items": {
-            "type": "string"
-          },
-          "minItems": 1,
-          "type": "array"
-        },
-        "escalation_triggers": {
-          "items": {
-            "properties": {
-              "action": {
-                "enum": [
-                  "escalate",
-                  "deny",
-                  "log"
-                ],
-                "type": "string"
-              },
-              "condition": {
-                "type": "string"
-              },
-              "reason": {
-                "type": "string"
-              }
-            },
-            "required": [
-              "condition",
-              "action",
-              "reason"
-            ],
-            "type": "object"
-          },
-          "type": "array"
-        },
-        "forbidden_actions": {
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        },
-        "max_autonomous_value": {
-          "properties": {
-            "amount": {
-              "type": "number"
-            },
-            "currency": {
-              "type": "string"
-            }
-          },
-          "type": "object"
-        }
-      },
-      "required": [
-        "bounded_actions"
-      ],
-      "type": "object"
-    },
-    "autonomy_mode": {
-      "description": "ADR-039 master switch for the action-policing pipeline (autonomy constraints). Required at the top level post-cutover; the legacy `enforcement.mode` location is rejected.",
-      "enum": [
-        "off",
-        "observe",
-        "nudge",
-        "enforce"
-      ],
-      "type": "string"
-    },
-    "capabilities": {
-      "additionalProperties": {
-        "properties": {
-          "description": {
-            "type": "string"
-          },
-          "required_actions": {
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "tools": {
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          }
-        },
-        "type": "object"
-      },
-      "type": "object"
-    },
-    "card_id": {
-      "description": "Card row id. Server-assigned on PUT (`ac-{uuid}`).",
-      "type": "string"
-    },
-    "card_version": {
-      "description": "Card schema version (required, non-empty). Current canonical value: `unified/2026-04-26`.",
-      "minLength": 1,
-      "type": "string"
-    },
-    "conscience": {
-      "properties": {
-        "mode": {
-          "enum": [
-            "augment",
-            "replace"
-          ],
-          "type": "string"
-        },
-        "values": {
-          "items": {
-            "properties": {
-              "content": {
-                "type": "string"
-              },
-              "id": {
-                "type": "string"
-              },
-              "severity": {
-                "enum": [
-                  "advisory",
-                  "mandatory"
-                ],
-                "type": "string"
-              },
-              "type": {
-                "enum": [
-                  "BOUNDARY",
-                  "FEAR",
-                  "COMMITMENT",
-                  "BELIEF",
-                  "HOPE"
-                ],
-                "type": "string"
-              }
-            },
-            "required": [
-              "type",
-              "content"
-            ],
-            "type": "object"
-          },
-          "type": "array"
-        }
-      },
-      "required": [
-        "mode",
-        "values"
-      ],
-      "type": "object"
-    },
-    "content_hash": {
-      "description": "Response-only: content hash of the composed card (`sha256:<hex>`), injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-      "type": "string"
-    },
-    "enforcement": {
-      "description": "Optional ADR-039 Decision-3 user-facing knobs for unmapped-tool handling. The legacy `mode`, `unmapped_tool_action` and `fail_open` keys are REJECTED by the validator (mode → top-level autonomy_mode; fail_open → gateway env config).",
-      "properties": {
-        "allow_unmapped_tools": {
-          "description": "When true, tools not mapped to a capability are allowed by default.",
-          "type": "boolean"
-        },
-        "default_unmapped_severity": {
-          "description": "Severity assigned to an unmapped tool when allow_unmapped_tools is false.",
-          "enum": [
-            "low",
-            "medium",
-            "high",
-            "critical"
-          ],
-          "type": "string"
-        },
-        "forbidden_tools": {
-          "items": {
-            "properties": {
-              "pattern": {
-                "type": "string"
-              },
-              "reason": {
-                "type": "string"
-              },
-              "severity": {
-                "enum": [
-                  "critical",
-                  "high",
-                  "medium",
-                  "low"
-                ],
-                "type": "string"
-              }
-            },
-            "required": [
-              "pattern",
-              "reason",
-              "severity"
-            ],
-            "type": "object"
-          },
-          "type": "array"
-        },
-        "grace_period_hours": {
-          "type": "integer"
-        }
-      },
-      "type": "object"
-    },
-    "expires_at": {
-      "format": "date-time",
-      "type": [
-        "string",
-        "null"
-      ]
-    },
-    "extensions": {
-      "additionalProperties": true,
-      "type": "object"
-    },
-    "integrity_mode": {
-      "description": "ADR-039 master switch for the values/conscience pipeline (integrity constraints). Required at the top level post-cutover; the legacy `integrity.enforcement_mode` location is rejected.",
-      "enum": [
-        "off",
-        "observe",
-        "nudge",
-        "enforce"
-      ],
-      "type": "string"
-    },
-    "issued_at": {
-      "format": "date-time",
-      "type": "string"
-    },
-    "principal": {
-      "allOf": [
-        {
-          "if": {
-            "properties": {
-              "type": {
-                "not": {
-                  "const": "unspecified"
-                }
-              }
-            }
-          },
-          "then": {
-            "required": [
-              "identifier"
-            ]
-          }
-        }
-      ],
-      "description": "Required object describing whose authority the agent acts under (ADR-039 Decision 10).",
-      "properties": {
-        "escalation_contact": {
-          "type": "string"
-        },
-        "identifier": {
-          "description": "Required (non-empty) when principal.type is not `unspecified`; identifies the human / organization / agent.",
-          "minLength": 1,
-          "type": "string"
-        },
-        "relationship": {
-          "enum": [
-            "delegated_authority",
-            "advisory",
-            "autonomous"
-          ],
-          "type": "string"
-        },
-        "type": {
-          "enum": [
-            "human",
-            "organization",
-            "agent",
-            "unspecified"
-          ],
-          "type": "string"
-        }
-      },
-      "required": [
-        "type",
-        "relationship"
-      ],
-      "type": "object"
-    },
-    "values": {
-      "properties": {
-        "conflicts_with": {
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        },
-        "declared": {
-          "description": "Ordered list of declared values. Phase 1 cards-as-primitive: each entry is either a catalog-v1 ID string (e.g. `'accuracy'`) or a parameterized map carrying optional `intensity` / `domain` / `severity_on_violation` / `scope` (e.g. `{id: 'accuracy', domain: 'financial', severity_on_violation: 'critical'}`).",
-          "items": {
-            "oneOf": [
-              {
-                "minLength": 1,
-                "type": "string"
-              },
-              {
-                "additionalProperties": {
-                  "type": "string"
-                },
-                "properties": {
-                  "id": {
-                    "minLength": 1,
-                    "type": "string"
-                  }
-                },
-                "required": [
-                  "id"
-                ],
-                "type": "object"
-              }
-            ]
-          },
-          "minItems": 1,
-          "type": "array"
-        },
-        "definitions": {
-          "additionalProperties": {
-            "properties": {
-              "description": {
-                "type": "string"
-              },
-              "priority": {
-                "type": "integer"
-              }
-            },
-            "type": "object"
-          },
-          "type": "object"
-        },
-        "hierarchy": {
-          "enum": [
-            "lexicographic",
-            "weighted",
-            "contextual"
-          ],
-          "type": "string"
-        }
-      },
-      "required": [
-        "declared"
-      ],
-      "type": "object"
-    },
-    "version": {
-      "description": "Response-only: monotonic card version, injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-      "type": "integer"
-    }
-  },
-  "required": [
-    "card_version",
-    "agent_id",
-    "autonomy_mode",
-    "integrity_mode",
-    "principal",
-    "values",
-    "autonomy",
-    "audit"
-  ],
-  "type": "object"
-}

addedInput schema / properties / card_version

Added value: +{
+  "description": "Card schema version. REQUIRED by the server-side validator. Current canonical value: `unified/2026-04-26`.",
+  "maxLength": 40,
+  "minLength": 3,
+  "pattern": "^[A-Za-z0-9][A-Za-z0-9._/-]{1,38}[A-Za-z0-9]$",
+  "type": "string"
+}

addedInput schema / properties / integrity_mode

Added value: +{
+  "description": "Master switch for the values pipeline. Required. Same four states as `autonomy_mode`.",
+  "enum": [
+    "off",
+    "observe",
+    "nudge",
+    "enforce"
+  ],
+  "type": "string"
+}

addedInput schema / properties / principal

Added value: +{
+  "additionalProperties": false,
+  "description": "Whose authority this agent acts under. Required.",
+  "properties": {
+    "escalation_contact": {
+      "description": "Where an escalation is routed. Use a ROLE ALIAS or SHARED INBOX (\"oncall-sre\", \"security@example.com\"), never an individual's personal contact details. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization.",
+      "maxLength": 128,
+      "minLength": 1,
+      "type": "string"
+    },
+    "identifier": {
+      "description": "Who the principal is. Use a ROLE or ORGANIZATION name (\"support-team\", \"Acme Corp Finance\"), NOT an individual's name, email address or phone number. Pass \"unspecified\" if there is no named principal. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization.",
+      "maxLength": 128,
+      "minLength": 1,
+      "type": "string"
+    },
+    "relationship": {
+      "description": "How the agent relates to that principal.",
+      "enum": [
+        "delegated_authority",
+        "advisory",
+        "autonomous"
+      ],
+      "type": "string"
+    },
+    "type": {
+      "description": "The kind of principal the agent answers to.",
+      "enum": [
+        "human",
+        "organization",
+        "agent",
+        "unspecified"
+      ],
+      "type": "string"
+    }
+  },
+  "required": [
+    "type",
+    "relationship",
+    "identifier"
+  ],
+  "type": "object"
+}

addedInput schema / properties / values

Added value: +{
+  "additionalProperties": false,
+  "description": "The values this agent declares it is bound by. Required.",
+  "properties": {
+    "declared": {
+      "description": "Value catalog IDs — e.g. [\"honesty\", \"no_harm\", \"privacy\"]. At least one required, 32 maximum. Short catalog slugs ONLY, never prose and never personal data. (Parameterized value references and long-form value definitions are available on the /v1 REST + CLI path; they are deliberately not exposed here.)",
+      "items": {
+        "maxLength": 64,
+        "minLength": 1,
+        "type": "string"
+      },
+      "maxItems": 32,
+      "minItems": 1,
+      "type": "array"
+    }
+  },
+  "required": [
+    "declared"
+  ],
+  "type": "object"
+}

changedInput schema / required

Previous value: -[
-  "agent_id"
-]New value: +[
+  "agent_id",
+  "card_version",
+  "autonomy_mode",
+  "integrity_mode",
+  "principal",
+  "values",
+  "autonomy",
+  "audit"
+]

removedOutput schema / $defs

Removed value: -{
-  "ComposedAlignmentCard": {
-    "description": "OUTPUT-only variant of `UnifiedAlignmentCard` for the COMPOSED card the server emits on GET `/v1/alignment/{scope}/{id}`, `/effective`, and the `composed` field of preview-compose. Identical to `UnifiedAlignmentCard` except `principal` is optional (a default / org-scope composed card has no agent principal) and `values.declared` / `autonomy.bounded_actions` may be empty (a fresh card declares nothing yet). The strict `UnifiedAlignmentCard` remains the authoring/request contract.",
-    "properties": {
-      "_composition": {
-        "$ref": "#/$defs/CompositionMetadata"
-      },
-      "agent_id": {
-        "description": "Target agent id. On PUT, server overwrites to match the URL path.",
-        "type": "string"
-      },
-      "audit": {
-        "allOf": [
-          {
-            "if": {
-              "properties": {
-                "queryable": {
-                  "const": true
-                }
-              },
-              "required": [
-                "queryable"
-              ]
-            },
-            "then": {
-              "required": [
-                "query_endpoint"
-              ]
-            }
-          }
-        ],
-        "properties": {
-          "query_endpoint": {
-            "description": "Required when audit.queryable is true.",
-            "type": "string"
-          },
-          "queryable": {
-            "type": "boolean"
-          },
-          "retention_days": {
-            "minimum": 0,
-            "type": "integer"
-          },
-          "storage": {
-            "properties": {
-              "location": {
-                "type": "string"
-              },
-              "type": {
-                "enum": [
-                  "local",
-                  "remote",
-                  "distributed"
-                ],
-                "type": "string"
-              }
-            },
-            "type": "object"
-          },
-          "tamper_evidence": {
-            "enum": [
-              "append_only",
-              "signed",
-              "merkle",
-              null
-            ],
-            "type": [
-              "string",
-              "null"
-            ]
-          },
-          "trace_format": {
-            "type": "string"
-          }
-        },
-        "required": [
-          "retention_days",
-          "queryable"
-        ],
-        "type": "object"
-      },
-      "autonomy": {
-        "properties": {
-          "bounded_actions": {
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "escalation_triggers": {
-            "items": {
-              "properties": {
-                "action": {
-                  "enum": [
-                    "escalate",
-                    "deny",
-                    "log"
-                  ],
-                  "type": "string"
-                },
-                "condition": {
-                  "type": "string"
-                },
-                "reason": {
-                  "type": "string"
-                }
-              },
-              "required": [
-                "condition",
-                "action",
-                "reason"
-              ],
-              "type": "object"
-            },
-            "type": "array"
-          },
-          "forbidden_actions": {
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "max_autonomous_value": {
-            "properties": {
-              "amount": {
-                "type": "number"
-              },
-              "currency": {
-                "type": "string"
-              }
-            },
-            "type": "object"
-          }
-        },
-        "required": [
-          "bounded_actions"
-        ],
-        "type": "object"
-      },
-      "autonomy_mode": {
-        "description": "ADR-039 master switch for the action-policing pipeline (autonomy constraints). Required at the top level post-cutover; the legacy `enforcement.mode` location is rejected.",
-        "enum": [
-          "off",
-          "observe",
-          "nudge",
-          "enforce"
-        ],
-        "type": "string"
-      },
-      "capabilities": {
-        "additionalProperties": {
-          "properties": {
-            "description": {
-              "type": "string"
-            },
-            "required_actions": {
-              "items": {
-                "type": "string"
-              },
-              "type": "array"
-            },
-            "tools": {
-              "items": {
-                "type": "string"
-              },
-              "type": "array"
-            }
-          },
-          "type": "object"
-        },
-        "type": "object"
-      },
-      "card_id": {
-        "description": "Card row id. Server-assigned on PUT (`ac-{uuid}`).",
-        "type": "string"
-      },
-      "card_version": {
-        "description": "Card schema version (required, non-empty). Current canonical value: `unified/2026-04-26`.",
-        "minLength": 1,
-        "type": "string"
-      },
-      "conscience": {
-        "properties": {
-          "mode": {
-            "enum": [
-              "augment",
-              "replace"
-            ],
-            "type": "string"
-          },
-          "values": {
-            "items": {
-              "properties": {
-                "content": {
-                  "type": "string"
-                },
-                "id": {
-                  "type": "string"
-                },
-                "severity": {
-                  "enum": [
-                    "advisory",
-                    "mandatory"
-                  ],
-                  "type": "string"
-                },
-                "type": {
-                  "enum": [
-                    "BOUNDARY",
-                    "FEAR",
-                    "COMMITMENT",
-                    "BELIEF",
-                    "HOPE"
-                  ],
-                  "type": "string"
-                }
-              },
-              "required": [
-                "type",
-                "content"
-              ],
-              "type": "object"
-            },
-            "type": "array"
-          }
-        },
-        "required": [
-          "mode",
-          "values"
-        ],
-        "type": "object"
-      },
-      "content_hash": {
-        "description": "Response-only: content hash of the composed card (`sha256:<hex>`), injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-        "type": "string"
-      },
-      "enforcement": {
-        "description": "Optional ADR-039 Decision-3 user-facing knobs for unmapped-tool handling. The legacy `mode`, `unmapped_tool_action` and `fail_open` keys are REJECTED by the validator (mode → top-level autonomy_mode; fail_open → gateway env config).",
-        "properties": {
-          "allow_unmapped_tools": {
-            "description": "When true, tools not mapped to a capability are allowed by default.",
-            "type": "boolean"
-          },
-          "default_unmapped_severity": {
-            "description": "Severity assigned to an unmapped tool when allow_unmapped_tools is false.",
-            "enum": [
-              "low",
-              "medium",
-              "high",
-              "critical"
-            ],
-            "type": "string"
-          },
-          "forbidden_tools": {
-            "items": {
-              "properties": {
-                "pattern": {
-                  "type": "string"
-                },
-                "reason": {
-                  "type": "string"
-                },
-                "severity": {
-                  "enum": [
-                    "critical",
-                    "high",
-                    "medium",
-                    "low"
-                  ],
-                  "type": "string"
-                }
-              },
-              "required": [
-                "pattern",
-                "reason",
-                "severity"
-              ],
-              "type": "object"
-            },
-            "type": "array"
-          },
-          "grace_period_hours": {
-            "type": "integer"
-          }
-        },
-        "type": "object"
-      },
-      "expires_at": {
-        "format": "date-time",
-        "type": [
-          "string",
-          "null"
-        ]
-      },
-      "extensions": {
-        "additionalProperties": true,
-        "type": "object"
-      },
-      "integrity_mode": {
-        "description": "ADR-039 master switch for the values/conscience pipeline (integrity constraints). Required at the top level post-cutover; the legacy `integrity.enforcement_mode` location is rejected.",
-        "enum": [
-          "off",
-          "observe",
-          "nudge",
-          "enforce"
-        ],
-        "type": "string"
-      },
-      "issued_at": {
-        "format": "date-time",
-        "type": "string"
-      },
-      "principal": {
-        "allOf": [
-          {
-            "if": {
-              "properties": {
-                "type": {
-                  "not": {
-                    "const": "unspecified"
-                  }
-                }
-              }
-            },
-            "then": {
-              "required": [
-                "identifier"
-              ]
-            }
-          }
-        ],
-        "description": "Required object describing whose authority the agent acts under (ADR-039 Decision 10).",
-        "properties": {
-          "escalation_contact": {
-            "type": "string"
-          },
-          "identifier": {
-            "description": "Required (non-empty) when principal.type is not `unspecified`; identifies the human / organization / agent.",
-            "minLength": 1,
-            "type": "string"
-          },
-          "relationship": {
-            "enum": [
-              "delegated_authority",
-              "advisory",
-              "autonomous"
-            ],
-            "type": "string"
-          },
-          "type": {
-            "enum": [
-              "human",
-              "organization",
-              "agent",
-              "unspecified"
-            ],
-            "type": "string"
-          }
-        },
-        "required": [
-          "type",
-          "relationship"
-        ],
-        "type": "object"
-      },
-      "values": {
-        "properties": {
-          "conflicts_with": {
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "declared": {
-            "description": "Ordered list of declared values. Phase 1 cards-as-primitive: each entry is either a catalog-v1 ID string (e.g. `'accuracy'`) or a parameterized map carrying optional `intensity` / `domain` / `severity_on_violation` / `scope` (e.g. `{id: 'accuracy', domain: 'financial', severity_on_violation: 'critical'}`).",
-            "items": {
-              "oneOf": [
-                {
-                  "minLength": 1,
-                  "type": "string"
-                },
-                {
-                  "additionalProperties": {
-                    "type": "string"
-                  },
-                  "properties": {
-                    "id": {
-                      "minLength": 1,
-                      "type": "string"
-                    }
-                  },
-                  "required": [
-                    "id"
-                  ],
-                  "type": "object"
-                }
-              ]
-            },
-            "type": "array"
-          },
-          "definitions": {
-            "additionalProperties": {
-              "properties": {
-                "description": {
-                  "type": "string"
-                },
-                "priority": {
-                  "type": "integer"
-                }
-              },
-              "type": "object"
-            },
-            "type": "object"
-          },
-          "hierarchy": {
-            "enum": [
-              "lexicographic",
-              "weighted",
-              "contextual"
-            ],
-            "type": "string"
-          }
-        },
-        "required": [
-          "declared"
-        ],
-        "type": "object"
-      },
-      "version": {
-        "description": "Response-only: monotonic card version, injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-        "type": "integer"
-      }
-    },
-    "required": [
-      "card_version",
-      "agent_id",
-      "autonomy_mode",
-      "integrity_mode",
-      "values",
-      "autonomy",
-      "audit"
-    ],
-    "type": "object"
-  },
-  "CompositionMetadata": {
-    "description": "System-managed block describing which scope sources merged into the canonical card. Only returned when `?include_composition=true`.",
-    "properties": {
-      "canonical_id": {
-        "type": "string"
-      },
-      "composed_at": {
-        "format": "date-time",
-        "type": "string"
-      },
-      "exemptions_applied": {
-        "items": {
-          "type": "string"
-        },
-        "type": "array"
-      },
-      "scopes_applied": {
-        "items": {
-          "properties": {
-            "card_id": {
-              "type": "string"
-            },
-            "scope": {
-              "description": "`platform`, `org:<id>`, or `agent:<id>`.",
-              "type": "string"
-            },
-            "template_version": {
-              "type": "integer"
-            },
-            "version": {
-              "type": "integer"
-            }
-          },
-          "type": "object"
-        },
-        "type": "array"
-      },
-      "source_card_id": {
-        "type": "string"
-      },
-      "source_policy_id": {
-        "type": "string"
-      }
-    },
-    "type": "object"
-  }
-}

addedOutput schema / additionalProperties
```
Added value: +false
```

removedOutput schema / description

Removed value: -"OUTPUT-only variant of `UnifiedAlignmentCard` for the COMPOSED card the server emits on GET `/v1/alignment/{scope}/{id}`, `/effective`, and the `composed` field of preview-compose. Identical to `UnifiedAlignmentCard` except `principal` is optional (a default / org-scope composed card has no agent principal) and `values.declared` / `autonomy.bounded_actions` may be empty (a fresh card declares nothing yet). The strict `UnifiedAlignmentCard` remains the authoring/request contract."

removedOutput schema / properties / _composition

Removed value: -{
-  "$ref": "#/$defs/CompositionMetadata"
-}

removedOutput schema / properties / agent_id

Removed value: -{
-  "description": "Target agent id. On PUT, server overwrites to match the URL path.",
-  "type": "string"
-}

removedOutput schema / properties / audit

Removed value: -{
-  "allOf": [
-    {
-      "if": {
-        "properties": {
-          "queryable": {
-            "const": true
-          }
-        },
-        "required": [
-          "queryable"
-        ]
-      },
-      "then": {
-        "required": [
-          "query_endpoint"
-        ]
-      }
-    }
-  ],
-  "properties": {
-    "query_endpoint": {
-      "description": "Required when audit.queryable is true.",
-      "type": "string"
-    },
-    "queryable": {
-      "type": "boolean"
-    },
-    "retention_days": {
-      "minimum": 0,
-      "type": "integer"
-    },
-    "storage": {
-      "properties": {
-        "location": {
-          "type": "string"
-        },
-        "type": {
-          "enum": [
-            "local",
-            "remote",
-            "distributed"
-          ],
-          "type": "string"
-        }
-      },
-      "type": "object"
-    },
-    "tamper_evidence": {
-      "enum": [
-        "append_only",
-        "signed",
-        "merkle",
-        null
-      ],
-      "type": [
-        "string",
-        "null"
-      ]
-    },
-    "trace_format": {
-      "type": "string"
-    }
-  },
-  "required": [
-    "retention_days",
-    "queryable"
-  ],
-  "type": "object"
-}

removedOutput schema / properties / autonomy

Removed value: -{
-  "properties": {
-    "bounded_actions": {
-      "items": {
-        "type": "string"
-      },
-      "type": "array"
-    },
-    "escalation_triggers": {
-      "items": {
-        "properties": {
-          "action": {
-            "enum": [
-              "escalate",
-              "deny",
-              "log"
-            ],
-            "type": "string"
-          },
-          "condition": {
-            "type": "string"
-          },
-          "reason": {
-            "type": "string"
-          }
-        },
-        "required": [
-          "condition",
-          "action",
-          "reason"
-        ],
-        "type": "object"
-      },
-      "type": "array"
-    },
-    "forbidden_actions": {
-      "items": {
-        "type": "string"
-      },
-      "type": "array"
-    },
-    "max_autonomous_value": {
-      "properties": {
-        "amount": {
-          "type": "number"
-        },
-        "currency": {
-          "type": "string"
-        }
-      },
-      "type": "object"
-    }
-  },
-  "required": [
-    "bounded_actions"
-  ],
-  "type": "object"
-}

removedOutput schema / properties / autonomy_mode

Removed value: -{
-  "description": "ADR-039 master switch for the action-policing pipeline (autonomy constraints). Required at the top level post-cutover; the legacy `enforcement.mode` location is rejected.",
-  "enum": [
-    "off",
-    "observe",
-    "nudge",
-    "enforce"
-  ],
-  "type": "string"
-}

removedOutput schema / properties / capabilities

Removed value: -{
-  "additionalProperties": {
-    "properties": {
-      "description": {
-        "type": "string"
-      },
-      "required_actions": {
-        "items": {
-          "type": "string"
-        },
-        "type": "array"
-      },
-      "tools": {
-        "items": {
-          "type": "string"
-        },
-        "type": "array"
-      }
-    },
-    "type": "object"
-  },
-  "type": "object"
-}

changedOutput schema / properties / card_id / description

Previous value: -"Card row id. Server-assigned on PUT (`ac-{uuid}`)."New value: +"Card ID (ac-{uuid}) of the stored alignment card."

addedOutput schema / properties / card_id / pattern

Added value: +"^ac-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$"

removedOutput schema / properties / card_version

Removed value: -{
-  "description": "Card schema version (required, non-empty). Current canonical value: `unified/2026-04-26`.",
-  "minLength": 1,
-  "type": "string"
-}

removedOutput schema / properties / conscience

Removed value: -{
-  "properties": {
-    "mode": {
-      "enum": [
-        "augment",
-        "replace"
-      ],
-      "type": "string"
-    },
-    "values": {
-      "items": {
-        "properties": {
-          "content": {
-            "type": "string"
-          },
-          "id": {
-            "type": "string"
-          },
-          "severity": {
-            "enum": [
-              "advisory",
-              "mandatory"
-            ],
-            "type": "string"
-          },
-          "type": {
-            "enum": [
-              "BOUNDARY",
-              "FEAR",
-              "COMMITMENT",
-              "BELIEF",
-              "HOPE"
-            ],
-            "type": "string"
-          }
-        },
-        "required": [
-          "type",
-          "content"
-        ],
-        "type": "object"
-      },
-      "type": "array"
-    }
-  },
-  "required": [
-    "mode",
-    "values"
-  ],
-  "type": "object"
-}

removedOutput schema / properties / content_hash

Removed value: -{
-  "description": "Response-only: content hash of the composed card (`sha256:<hex>`), injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-  "type": "string"
-}

removedOutput schema / properties / enforcement

Removed value: -{
-  "description": "Optional ADR-039 Decision-3 user-facing knobs for unmapped-tool handling. The legacy `mode`, `unmapped_tool_action` and `fail_open` keys are REJECTED by the validator (mode → top-level autonomy_mode; fail_open → gateway env config).",
-  "properties": {
-    "allow_unmapped_tools": {
-      "description": "When true, tools not mapped to a capability are allowed by default.",
-      "type": "boolean"
-    },
-    "default_unmapped_severity": {
-      "description": "Severity assigned to an unmapped tool when allow_unmapped_tools is false.",
-      "enum": [
-        "low",
-        "medium",
-        "high",
-        "critical"
-      ],
-      "type": "string"
-    },
-    "forbidden_tools": {
-      "items": {
-        "properties": {
-          "pattern": {
-            "type": "string"
-          },
-          "reason": {
-            "type": "string"
-          },
-          "severity": {
-            "enum": [
-              "critical",
-              "high",
-              "medium",
-              "low"
-            ],
-            "type": "string"
-          }
-        },
-        "required": [
-          "pattern",
-          "reason",
-          "severity"
-        ],
-        "type": "object"
-      },
-      "type": "array"
-    },
-    "grace_period_hours": {
-      "type": "integer"
-    }
-  },
-  "type": "object"
-}

removedOutput schema / properties / expires_at

Removed value: -{
-  "format": "date-time",
-  "type": [
-    "string",
-    "null"
-  ]
-}

removedOutput schema / properties / extensions

Removed value: -{
-  "additionalProperties": true,
-  "type": "object"
-}

removedOutput schema / properties / integrity_mode

Removed value: -{
-  "description": "ADR-039 master switch for the values/conscience pipeline (integrity constraints). Required at the top level post-cutover; the legacy `integrity.enforcement_mode` location is rejected.",
-  "enum": [
-    "off",
-    "observe",
-    "nudge",
-    "enforce"
-  ],
-  "type": "string"
-}

addedOutput schema / properties / issued_at / description

Added value: +"ISO 8601 timestamp when the card was issued/stored."

addedOutput schema / properties / ok

Added value: +{
+  "const": true,
+  "description": "Always true on successful storage (errors return non-200 status).",
+  "type": "boolean"
+}

removedOutput schema / properties / principal

Removed value: -{
-  "allOf": [
-    {
-      "if": {
-        "properties": {
-          "type": {
-            "not": {
-              "const": "unspecified"
-            }
-          }
-        }
-      },
-      "then": {
-        "required": [
-          "identifier"
-        ]
-      }
-    }
-  ],
-  "description": "Required object describing whose authority the agent acts under (ADR-039 Decision 10).",
-  "properties": {
-    "escalation_contact": {
-      "type": "string"
-    },
-    "identifier": {
-      "description": "Required (non-empty) when principal.type is not `unspecified`; identifies the human / organization / agent.",
-      "minLength": 1,
-      "type": "string"
-    },
-    "relationship": {
-      "enum": [
-        "delegated_authority",
-        "advisory",
-        "autonomous"
-      ],
-      "type": "string"
-    },
-    "type": {
-      "enum": [
-        "human",
-        "organization",
-        "agent",
-        "unspecified"
-      ],
-      "type": "string"
-    }
-  },
-  "required": [
-    "type",
-    "relationship"
-  ],
-  "type": "object"
-}

removedOutput schema / properties / values

Removed value: -{
-  "properties": {
-    "conflicts_with": {
-      "items": {
-        "type": "string"
-      },
-      "type": "array"
-    },
-    "declared": {
-      "description": "Ordered list of declared values. Phase 1 cards-as-primitive: each entry is either a catalog-v1 ID string (e.g. `'accuracy'`) or a parameterized map carrying optional `intensity` / `domain` / `severity_on_violation` / `scope` (e.g. `{id: 'accuracy', domain: 'financial', severity_on_violation: 'critical'}`).",
-      "items": {
-        "oneOf": [
-          {
-            "minLength": 1,
-            "type": "string"
-          },
-          {
-            "additionalProperties": {
-              "type": "string"
-            },
-            "properties": {
-              "id": {
-                "minLength": 1,
-                "type": "string"
-              }
-            },
-            "required": [
-              "id"
-            ],
-            "type": "object"
-          }
-        ]
-      },
-      "type": "array"
-    },
-    "definitions": {
-      "additionalProperties": {
-        "properties": {
-          "description": {
-            "type": "string"
-          },
-          "priority": {
-            "type": "integer"
-          }
-        },
-        "type": "object"
-      },
-      "type": "object"
-    },
-    "hierarchy": {
-      "enum": [
-        "lexicographic",
-        "weighted",
-        "contextual"
-      ],
-      "type": "string"
-    }
-  },
-  "required": [
-    "declared"
-  ],
-  "type": "object"
-}

removedOutput schema / properties / version

Removed value: -{
-  "description": "Response-only: monotonic card version, injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-  "type": "integer"
-}

changedOutput schema / required

Previous value: -[
-  "card_version",
-  "agent_id",
-  "autonomy_mode",
-  "integrity_mode",
-  "values",
-  "autonomy",
-  "audit"
-]New value: +[
+  "card_id",
+  "issued_at",
+  "ok"
+]

Changedput_protection_by_agent34 fields changed

removedInput schema / $defs

Removed value: -{
-  "CompositionMetadata": {
-    "description": "System-managed block describing which scope sources merged into the canonical card. Only returned when `?include_composition=true`.",
-    "properties": {
-      "canonical_id": {
-        "type": "string"
-      },
-      "composed_at": {
-        "format": "date-time",
-        "type": "string"
-      },
-      "exemptions_applied": {
-        "items": {
-          "type": "string"
-        },
-        "type": "array"
-      },
-      "scopes_applied": {
-        "items": {
-          "properties": {
-            "card_id": {
-              "type": "string"
-            },
-            "scope": {
-              "description": "`platform`, `org:<id>`, or `agent:<id>`.",
-              "type": "string"
-            },
-            "template_version": {
-              "type": "integer"
-            },
-            "version": {
-              "type": "integer"
-            }
-          },
-          "type": "object"
-        },
-        "type": "array"
-      },
-      "source_card_id": {
-        "type": "string"
-      },
-      "source_policy_id": {
-        "type": "string"
-      }
-    },
-    "type": "object"
-  },
-  "UnifiedProtectionCard": {
-    "description": "Unified protection card (ADR-037). Safe House thresholds + trusted-source policy for a single agent. Shape matches src/composition/types.ts::UnifiedProtectionCard (canonical) and what the runtime validator at src/composition/validate.ts accepts. The customer-facing docs at /concepts/protection-card and /specifications/protection-card-schema document this same shape.",
-    "properties": {
-      "_composition": {
-        "$ref": "#/$defs/CompositionMetadata"
-      },
-      "agent_id": {
-        "type": "string"
-      },
-      "card_id": {
-        "type": "string"
-      },
-      "card_version": {
-        "type": "string"
-      },
-      "content_hash": {
-        "description": "Response-only: content hash of the composed card (`sha256:<hex>`), injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-        "type": "string"
-      },
-      "expires_at": {
-        "format": "date-time",
-        "type": [
-          "string",
-          "null"
-        ]
-      },
-      "extensions": {
-        "additionalProperties": true,
-        "description": "Free-form extension slot for non-canonical fields. Ignored by the composer; preserved on read for tooling that needs an audit-tail metadata bag.",
-        "type": "object"
-      },
-      "issued_at": {
-        "format": "date-time",
-        "type": "string"
-      },
-      "mode": {
-        "description": "Strictest-wins composition: enforce > nudge > observe > off.",
-        "enum": [
-          "off",
-          "observe",
-          "nudge",
-          "enforce"
-        ],
-        "type": "string"
-      },
-      "protected_surface": {
-        "description": "Org-declared protected surface policy (MNE-830). Strengthen-only UNION across platform → org → team → agent: each scope may add entries; none may remove. The composer always emits this block; callers omit it to inherit the composed floor. See ADR-037 §protected_surface.",
-        "properties": {
-          "assets": {
-            "description": "Protected assets. Intrinsic identity = `${kind}:${selector}` (normalized). Composer merges by identity, keeping the strictest entry per scope.",
-            "items": {
-              "properties": {
-                "kind": {
-                  "description": "Asset kind (e.g. `row`, `field`, `resource`, `table`).",
-                  "type": "string"
-                },
-                "label": {
-                  "description": "Human-facing display label (optional).",
-                  "type": "string"
-                },
-                "reason": {
-                  "description": "Why this asset is protected (optional).",
-                  "type": "string"
-                },
-                "selector": {
-                  "description": "Asset selector (e.g. `customer:critical-0000`, `replica_dsn`).",
-                  "type": "string"
-                },
-                "source_scope": {
-                  "description": "Composer-assigned provenance (`platform`, `org:<id>`, `team:<id>`, `agent:<id>`). Server-assigned — do not send on a PUT.",
-                  "type": "string"
-                }
-              },
-              "required": [
-                "kind",
-                "selector"
-              ],
-              "type": "object"
-            },
-            "type": "array"
-          },
-          "escalation_required": {
-            "description": "Operations that require escalation before proceeding. Same intrinsic-identity + union rules as forbidden_operations (minus severity).",
-            "items": {
-              "properties": {
-                "applies_to": {
-                  "description": "Asset identities this escalation applies to. Empty/absent = GLOBAL.",
-                  "items": {
-                    "type": "string"
-                  },
-                  "type": "array"
-                },
-                "pattern": {
-                  "description": "Operation pattern requiring escalation.",
-                  "type": "string"
-                },
-                "reason": {
-                  "description": "Why escalation is required (optional).",
-                  "type": "string"
-                },
-                "source_scope": {
-                  "description": "Composer-assigned provenance. Server-assigned — do not send on a PUT.",
-                  "type": "string"
-                }
-              },
-              "required": [
-                "pattern"
-              ],
-              "type": "object"
-            },
-            "type": "array"
-          },
-          "forbidden_operations": {
-            "description": "Operations that are unconditionally forbidden. Intrinsic identity = normalized `pattern`. Composer unions across scopes; on identity collision, severity → max.",
-            "items": {
-              "properties": {
-                "applies_to": {
-                  "description": "Asset identities (`${kind}:${selector}`) this operation applies to. Empty/absent means GLOBAL.",
-                  "items": {
-                    "type": "string"
-                  },
-                  "type": "array"
-                },
-                "pattern": {
-                  "description": "Operation pattern (e.g. `TRUNCATE`, `unscoped UPDATE/DELETE`, `exfiltrate:pii`).",
-                  "type": "string"
-                },
-                "reason": {
-                  "description": "Why this operation is forbidden (optional).",
-                  "type": "string"
-                },
-                "severity": {
-                  "description": "Severity level. Composer merges to strictest across scopes.",
-                  "enum": [
-                    "low",
-                    "medium",
-                    "high",
-                    "critical"
-                  ],
-                  "type": "string"
-                },
-                "source_scope": {
-                  "description": "Composer-assigned provenance. Server-assigned — do not send on a PUT.",
-                  "type": "string"
-                }
-              },
-              "required": [
-                "pattern"
-              ],
-              "type": "object"
-            },
-            "type": "array"
-          }
-        },
-        "type": "object"
-      },
-      "review": {
-        "description": "Review-hold policy (Safe House Review, Slice 2a — MNE-920 design). gate_on is the minimum verdict band per surface that escalates to a review-hold. Composition is strictest-wins; on_timeout defaults to 'reject' (fail-closed). reviewer.kind 'endpoint' is designed for MNE-1650 and not consumed yet.",
-        "properties": {
-          "enabled": {
-            "type": "boolean"
-          },
-          "gate_on": {
-            "properties": {
-              "incoming": {
-                "enum": [
-                  "off",
-                  "warn",
-                  "quarantine",
-                  "block"
-                ],
-                "type": "string"
-              },
-              "integrity": {
-                "enum": [
-                  "off",
-                  "review_needed",
-                  "boundary_violation"
-                ],
-                "type": "string"
-              },
-              "outgoing": {
-                "enum": [
-                  "off",
-                  "warn",
-                  "quarantine",
-                  "block"
-                ],
-                "type": "string"
-              },
-              "tool_calls": {
-                "enum": [
-                  "off",
-                  "warn",
-                  "quarantine",
-                  "block"
-                ],
-                "type": "string"
-              },
-              "tool_responses": {
-                "enum": [
-                  "off",
-                  "warn",
-                  "quarantine",
-                  "block"
-                ],
-                "type": "string"
-              }
-            },
-            "type": "object"
-          },
-          "notify": {
-            "properties": {
-              "sse": {
-                "type": "boolean"
-              },
-              "webhooks": {
-                "type": "boolean"
-              }
-            },
-            "type": "object"
-          },
-          "on_timeout": {
-            "enum": [
-              "reject",
-              "release"
-            ],
-            "type": "string"
-          },
-          "quarantine_notice": {
-            "maxLength": 2000,
-            "type": "string"
-          },
-          "reviewer": {
-            "properties": {
-              "endpoint_url": {
-                "format": "uri",
-                "type": "string"
-              },
-              "kind": {
-                "enum": [
-                  "builtin_opus",
-                  "endpoint"
-                ],
-                "type": "string"
-              }
-            },
-            "required": [
-              "kind"
-            ],
-            "type": "object"
-          },
-          "sla_seconds": {
-            "minimum": 1,
-            "type": "number"
-          }
-        },
-        "required": [
-          "enabled"
-        ],
-        "type": "object"
-      },
-      "screen_surfaces": {
-        "description": "Which request surfaces Safe House inspects. Composed across scopes by OR-per-field (any scope requiring inspection wins).",
-        "properties": {
-          "incoming": {
-            "description": "The user/principal prompt entering the agent.",
-            "type": "boolean"
-          },
-          "outgoing": {
-            "description": "The agent's response leaving the agent.",
-            "type": "boolean"
-          },
-          "tool_calls": {
-            "description": "Tool-use invocations the agent makes.",
-            "type": "boolean"
-          },
-          "tool_responses": {
-            "description": "Responses to tool calls returning to the agent.",
-            "type": "boolean"
-          }
-        },
-        "required": [
-          "incoming",
-          "outgoing",
-          "tool_calls",
-          "tool_responses"
-        ],
-        "type": "object"
-      },
-      "thresholds": {
-        "description": "Score bands. Must satisfy warn <= quarantine <= block; each value in [0, 1].",
-        "properties": {
-          "block": {
-            "maximum": 1,
-            "minimum": 0,
-            "type": "number"
-          },
-          "quarantine": {
-            "maximum": 1,
-            "minimum": 0,
-            "type": "number"
-          },
-          "warn": {
-            "maximum": 1,
-            "minimum": 0,
-            "type": "number"
-          }
-        },
-        "required": [
-          "warn",
-          "quarantine",
-          "block"
-        ],
-        "type": "object"
-      },
-      "trusted_sources": {
-        "description": "Sources for which detectors short-circuit (each match logged in the trace). Composed as platform->agent intersection (compliance ceiling) with org+agent union inside that ceiling — an agent cannot widen trust beyond what the platform allows.",
-        "properties": {
-          "agent_ids": {
-            "description": "Mnemom agent IDs (mnm-* / smolt-* prefixed).",
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "domains": {
-            "description": "DNS names or host:port entries.",
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "ip_ranges": {
-            "description": "IPv4 or IPv6 CIDR ranges.",
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          }
-        },
-        "required": [
-          "domains",
-          "agent_ids",
-          "ip_ranges"
-        ],
-        "type": "object"
-      },
-      "version": {
-        "description": "Response-only: monotonic card version, injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-        "type": "integer"
-      }
-    },
-    "required": [
-      "card_version",
-      "agent_id",
-      "mode",
-      "thresholds",
-      "screen_surfaces",
-      "trusted_sources"
-    ],
-    "type": "object"
-  }
-}

changedInput schema / properties / agent_id / description

Previous value: -"Agent identifier (e.g. smolt-abc123)"New value: +"The agent this card belongs to (e.g. `smolt-abc123`). Identifier only — never place an API key, a secret, an email address, or any other personal data in this field."

addedInput schema / properties / agent_id / maxLength
```
Added value: +64
```
addedInput schema / properties / agent_id / minLength
```
Added value: +3
```

addedInput schema / properties / agent_id / pattern

Added value: +"^[A-Za-z0-9][A-Za-z0-9_-]{1,62}[A-Za-z0-9]$"

removedInput schema / properties / body

Removed value: -{
-  "description": "Unified protection card (ADR-037). Safe House thresholds + trusted-source policy for a single agent. Shape matches src/composition/types.ts::UnifiedProtectionCard (canonical) and what the runtime validator at src/composition/validate.ts accepts. The customer-facing docs at /concepts/protection-card and /specifications/protection-card-schema document this same shape.",
-  "properties": {
-    "_composition": {
-      "$ref": "#/$defs/CompositionMetadata"
-    },
-    "agent_id": {
-      "type": "string"
-    },
-    "card_id": {
-      "type": "string"
-    },
-    "card_version": {
-      "type": "string"
-    },
-    "content_hash": {
-      "description": "Response-only: content hash of the composed card (`sha256:<hex>`), injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-      "type": "string"
-    },
-    "expires_at": {
-      "format": "date-time",
-      "type": [
-        "string",
-        "null"
-      ]
-    },
-    "extensions": {
-      "additionalProperties": true,
-      "description": "Free-form extension slot for non-canonical fields. Ignored by the composer; preserved on read for tooling that needs an audit-tail metadata bag.",
-      "type": "object"
-    },
-    "issued_at": {
-      "format": "date-time",
-      "type": "string"
-    },
-    "mode": {
-      "description": "Strictest-wins composition: enforce > nudge > observe > off.",
-      "enum": [
-        "off",
-        "observe",
-        "nudge",
-        "enforce"
-      ],
-      "type": "string"
-    },
-    "protected_surface": {
-      "description": "Org-declared protected surface policy (MNE-830). Strengthen-only UNION across platform → org → team → agent: each scope may add entries; none may remove. The composer always emits this block; callers omit it to inherit the composed floor. See ADR-037 §protected_surface.",
-      "properties": {
-        "assets": {
-          "description": "Protected assets. Intrinsic identity = `${kind}:${selector}` (normalized). Composer merges by identity, keeping the strictest entry per scope.",
-          "items": {
-            "properties": {
-              "kind": {
-                "description": "Asset kind (e.g. `row`, `field`, `resource`, `table`).",
-                "type": "string"
-              },
-              "label": {
-                "description": "Human-facing display label (optional).",
-                "type": "string"
-              },
-              "reason": {
-                "description": "Why this asset is protected (optional).",
-                "type": "string"
-              },
-              "selector": {
-                "description": "Asset selector (e.g. `customer:critical-0000`, `replica_dsn`).",
-                "type": "string"
-              },
-              "source_scope": {
-                "description": "Composer-assigned provenance (`platform`, `org:<id>`, `team:<id>`, `agent:<id>`). Server-assigned — do not send on a PUT.",
-                "type": "string"
-              }
-            },
-            "required": [
-              "kind",
-              "selector"
-            ],
-            "type": "object"
-          },
-          "type": "array"
-        },
-        "escalation_required": {
-          "description": "Operations that require escalation before proceeding. Same intrinsic-identity + union rules as forbidden_operations (minus severity).",
-          "items": {
-            "properties": {
-              "applies_to": {
-                "description": "Asset identities this escalation applies to. Empty/absent = GLOBAL.",
-                "items": {
-                  "type": "string"
-                },
-                "type": "array"
-              },
-              "pattern": {
-                "description": "Operation pattern requiring escalation.",
-                "type": "string"
-              },
-              "reason": {
-                "description": "Why escalation is required (optional).",
-                "type": "string"
-              },
-              "source_scope": {
-                "description": "Composer-assigned provenance. Server-assigned — do not send on a PUT.",
-                "type": "string"
-              }
-            },
-            "required": [
-              "pattern"
-            ],
-            "type": "object"
-          },
-          "type": "array"
-        },
-        "forbidden_operations": {
-          "description": "Operations that are unconditionally forbidden. Intrinsic identity = normalized `pattern`. Composer unions across scopes; on identity collision, severity → max.",
-          "items": {
-            "properties": {
-              "applies_to": {
-                "description": "Asset identities (`${kind}:${selector}`) this operation applies to. Empty/absent means GLOBAL.",
-                "items": {
-                  "type": "string"
-                },
-                "type": "array"
-              },
-              "pattern": {
-                "description": "Operation pattern (e.g. `TRUNCATE`, `unscoped UPDATE/DELETE`, `exfiltrate:pii`).",
-                "type": "string"
-              },
-              "reason": {
-                "description": "Why this operation is forbidden (optional).",
-                "type": "string"
-              },
-              "severity": {
-                "description": "Severity level. Composer merges to strictest across scopes.",
-                "enum": [
-                  "low",
-                  "medium",
-                  "high",
-                  "critical"
-                ],
-                "type": "string"
-              },
-              "source_scope": {
-                "description": "Composer-assigned provenance. Server-assigned — do not send on a PUT.",
-                "type": "string"
-              }
-            },
-            "required": [
-              "pattern"
-            ],
-            "type": "object"
-          },
-          "type": "array"
-        }
-      },
-      "type": "object"
-    },
-    "review": {
-      "description": "Review-hold policy (Safe House Review, Slice 2a — MNE-920 design). gate_on is the minimum verdict band per surface that escalates to a review-hold. Composition is strictest-wins; on_timeout defaults to 'reject' (fail-closed). reviewer.kind 'endpoint' is designed for MNE-1650 and not consumed yet.",
-      "properties": {
-        "enabled": {
-          "type": "boolean"
-        },
-        "gate_on": {
-          "properties": {
-            "incoming": {
-              "enum": [
-                "off",
-                "warn",
-                "quarantine",
-                "block"
-              ],
-              "type": "string"
-            },
-            "integrity": {
-              "enum": [
-                "off",
-                "review_needed",
-                "boundary_violation"
-              ],
-              "type": "string"
-            },
-            "outgoing": {
-              "enum": [
-                "off",
-                "warn",
-                "quarantine",
-                "block"
-              ],
-              "type": "string"
-            },
-            "tool_calls": {
-              "enum": [
-                "off",
-                "warn",
-                "quarantine",
-                "block"
-              ],
-              "type": "string"
-            },
-            "tool_responses": {
-              "enum": [
-                "off",
-                "warn",
-                "quarantine",
-                "block"
-              ],
-              "type": "string"
-            }
-          },
-          "type": "object"
-        },
-        "notify": {
-          "properties": {
-            "sse": {
-              "type": "boolean"
-            },
-            "webhooks": {
-              "type": "boolean"
-            }
-          },
-          "type": "object"
-        },
-        "on_timeout": {
-          "enum": [
-            "reject",
-            "release"
-          ],
-          "type": "string"
-        },
-        "quarantine_notice": {
-          "maxLength": 2000,
-          "type": "string"
-        },
-        "reviewer": {
-          "properties": {
-            "endpoint_url": {
-              "format": "uri",
-              "type": "string"
-            },
-            "kind": {
-              "enum": [
-                "builtin_opus",
-                "endpoint"
-              ],
-              "type": "string"
-            }
-          },
-          "required": [
-            "kind"
-          ],
-          "type": "object"
-        },
-        "sla_seconds": {
-          "minimum": 1,
-          "type": "number"
-        }
-      },
-      "required": [
-        "enabled"
-      ],
-      "type": "object"
-    },
-    "screen_surfaces": {
-      "description": "Which request surfaces Safe House inspects. Composed across scopes by OR-per-field (any scope requiring inspection wins).",
-      "properties": {
-        "incoming": {
-          "description": "The user/principal prompt entering the agent.",
-          "type": "boolean"
-        },
-        "outgoing": {
-          "description": "The agent's response leaving the agent.",
-          "type": "boolean"
-        },
-        "tool_calls": {
-          "description": "Tool-use invocations the agent makes.",
-          "type": "boolean"
-        },
-        "tool_responses": {
-          "description": "Responses to tool calls returning to the agent.",
-          "type": "boolean"
-        }
-      },
-      "required": [
-        "incoming",
-        "outgoing",
-        "tool_calls",
-        "tool_responses"
-      ],
-      "type": "object"
-    },
-    "thresholds": {
-      "description": "Score bands. Must satisfy warn <= quarantine <= block; each value in [0, 1].",
-      "properties": {
-        "block": {
-          "maximum": 1,
-          "minimum": 0,
-          "type": "number"
-        },
-        "quarantine": {
-          "maximum": 1,
-          "minimum": 0,
-          "type": "number"
-        },
-        "warn": {
-          "maximum": 1,
-          "minimum": 0,
-          "type": "number"
-        }
-      },
-      "required": [
-        "warn",
-        "quarantine",
-        "block"
-      ],
-      "type": "object"
-    },
-    "trusted_sources": {
-      "description": "Sources for which detectors short-circuit (each match logged in the trace). Composed as platform->agent intersection (compliance ceiling) with org+agent union inside that ceiling — an agent cannot widen trust beyond what the platform allows.",
-      "properties": {
-        "agent_ids": {
-          "description": "Mnemom agent IDs (mnm-* / smolt-* prefixed).",
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        },
-        "domains": {
-          "description": "DNS names or host:port entries.",
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        },
-        "ip_ranges": {
-          "description": "IPv4 or IPv6 CIDR ranges.",
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        }
-      },
-      "required": [
-        "domains",
-        "agent_ids",
-        "ip_ranges"
-      ],
-      "type": "object"
-    },
-    "version": {
-      "description": "Response-only: monotonic card version, injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-      "type": "integer"
-    }
-  },
-  "required": [
-    "card_version",
-    "agent_id",
-    "mode",
-    "thresholds",
-    "screen_surfaces",
-    "trusted_sources"
-  ],
-  "type": "object"
-}

addedInput schema / properties / card_version

Added value: +{
+  "description": "Card schema version. REQUIRED by the server-side validator. Current canonical value: `protection/2026-04-26`.",
+  "maxLength": 40,
+  "minLength": 3,
+  "pattern": "^[A-Za-z0-9][A-Za-z0-9._/-]{1,38}[A-Za-z0-9]$",
+  "type": "string"
+}

addedInput schema / properties / mode

Added value: +{
+  "description": "Screening mode for the protection pipeline. Required. `off` disables screening; `observe` records only; `nudge` warns; `enforce` blocks.",
+  "enum": [
+    "off",
+    "observe",
+    "nudge",
+    "enforce"
+  ],
+  "type": "string"
+}

addedInput schema / properties / protected_surface

Added value: +{
+  "additionalProperties": false,
+  "description": "The assets and operations this agent must protect. Omit to accept the composed default (empty surface).",
+  "properties": {
+    "assets": {
+      "description": "The assets under protection.",
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "kind": {
+            "description": "Asset class — e.g. \"repo\", \"database\", \"bucket\".",
+            "maxLength": 64,
+            "minLength": 1,
+            "type": "string"
+          },
+          "label": {
+            "description": "Short human-readable name for the asset.",
+            "maxLength": 120,
+            "minLength": 1,
+            "type": "string"
+          },
+          "reason": {
+            "description": "Why it is protected, in one short sentence. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization.",
+            "maxLength": 200,
+            "minLength": 1,
+            "type": "string"
+          },
+          "selector": {
+            "description": "Which instance — e.g. \"mnemom/mnemom-api\". A resource identifier only: no credentials, no connection strings, no personal data.",
+            "maxLength": 256,
+            "minLength": 1,
+            "type": "string"
+          }
+        },
+        "required": [
+          "kind",
+          "selector"
+        ],
+        "type": "object"
+      },
+      "maxItems": 64,
+      "type": "array"
+    },
+    "escalation_required": {
+      "description": "Operations that require human approval before the agent may proceed.",
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "applies_to": {
+            "description": "Asset identities this entry applies to. Omit to apply to every protected asset.",
+            "items": {
+              "maxLength": 256,
+              "minLength": 1,
+              "type": "string"
+            },
+            "maxItems": 64,
+            "type": "array"
+          },
+          "pattern": {
+            "description": "Operation matcher — e.g. \"force_push\", \"drop_table*\". A short pattern, not a description.",
+            "maxLength": 200,
+            "minLength": 1,
+            "type": "string"
+          },
+          "reason": {
+            "description": "Why this entry exists, in one short sentence. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization.",
+            "maxLength": 200,
+            "minLength": 1,
+            "type": "string"
+          }
+        },
+        "required": [
+          "pattern"
+        ],
+        "type": "object"
+      },
+      "maxItems": 64,
+      "type": "array"
+    },
+    "forbidden_operations": {
+      "description": "Operations the agent must never perform on the protected assets.",
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "applies_to": {
+            "description": "Asset identities this entry applies to. Omit to apply to every protected asset.",
+            "items": {
+              "maxLength": 256,
+              "minLength": 1,
+              "type": "string"
+            },
+            "maxItems": 64,
+            "type": "array"
+          },
+          "pattern": {
+            "description": "Operation matcher — e.g. \"force_push\", \"drop_table*\". A short pattern, not a description.",
+            "maxLength": 200,
+            "minLength": 1,
+            "type": "string"
+          },
+          "reason": {
+            "description": "Why this entry exists, in one short sentence. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization.",
+            "maxLength": 200,
+            "minLength": 1,
+            "type": "string"
+          },
+          "severity": {
+            "description": "How serious a violation of this entry is.",
+            "enum": [
+              "low",
+              "medium",
+              "high",
+              "critical"
+            ],
+            "type": "string"
+          }
+        },
+        "required": [
+          "pattern"
+        ],
+        "type": "object"
+      },
+      "maxItems": 64,
+      "type": "array"
+    }
+  },
+  "type": "object"
+}

addedInput schema / properties / screen_surfaces

Added value: +{
+  "additionalProperties": false,
+  "description": "Which traffic surfaces are screened. Omit to accept the composed defaults.",
+  "properties": {
+    "incoming": {
+      "description": "Screen prompts arriving at the agent.",
+      "type": "boolean"
+    },
+    "outgoing": {
+      "description": "Screen the agent's outbound messages.",
+      "type": "boolean"
+    },
+    "tool_calls": {
+      "description": "Screen the tool calls the agent makes.",
+      "type": "boolean"
+    },
+    "tool_responses": {
+      "description": "Screen tool responses returned to the agent.",
+      "type": "boolean"
+    }
+  },
+  "type": "object"
+}

addedInput schema / properties / thresholds

Added value: +{
+  "additionalProperties": false,
+  "description": "Risk-score cutoffs, each in [0, 1] and ordered warn ≤ quarantine ≤ block. All three are required if this object is sent at all — omit the whole object to accept the composed defaults.",
+  "properties": {
+    "block": {
+      "description": "Score at or above which the request is refused.",
+      "maximum": 1,
+      "minimum": 0,
+      "type": "number"
+    },
+    "quarantine": {
+      "description": "Score at or above which the request is held for review.",
+      "maximum": 1,
+      "minimum": 0,
+      "type": "number"
+    },
+    "warn": {
+      "description": "Score at or above which the request is flagged.",
+      "maximum": 1,
+      "minimum": 0,
+      "type": "number"
+    }
+  },
+  "required": [
+    "warn",
+    "quarantine",
+    "block"
+  ],
+  "type": "object"
+}

addedInput schema / properties / trusted_sources

Added value: +{
+  "additionalProperties": false,
+  "description": "Sources exempt from screening. Enumerate specific hosts — wildcards are rejected, and a server-side deny-list (public LLM/DNS endpoints, 0.0.0.0/0, ::/0, link-local, multicast) is always applied.",
+  "properties": {
+    "agent_ids": {
+      "description": "Trusted Mnemom agent IDs. Must be in canonical `mnm-*` form.",
+      "items": {
+        "maxLength": 64,
+        "minLength": 8,
+        "pattern": "^mnm-[A-Za-z0-9-]{4,}$",
+        "type": "string"
+      },
+      "maxItems": 64,
+      "type": "array"
+    },
+    "domains": {
+      "description": "Trusted DNS names, optionally with `:port`. No wildcards.",
+      "items": {
+        "maxLength": 253,
+        "minLength": 3,
+        "type": "string"
+      },
+      "maxItems": 64,
+      "type": "array"
+    },
+    "ip_ranges": {
+      "description": "Trusted CIDR ranges (e.g. `10.0.0.0/8`).",
+      "items": {
+        "maxLength": 43,
+        "minLength": 4,
+        "type": "string"
+      },
+      "maxItems": 64,
+      "type": "array"
+    }
+  },
+  "type": "object"
+}

changedInput schema / required

Previous value: -[
-  "agent_id"
-]New value: +[
+  "agent_id",
+  "card_version",
+  "mode"
+]

removedOutput schema / $defs

Removed value: -{
-  "CompositionMetadata": {
-    "description": "System-managed block describing which scope sources merged into the canonical card. Only returned when `?include_composition=true`.",
-    "properties": {
-      "canonical_id": {
-        "type": "string"
-      },
-      "composed_at": {
-        "format": "date-time",
-        "type": "string"
-      },
-      "exemptions_applied": {
-        "items": {
-          "type": "string"
-        },
-        "type": "array"
-      },
-      "scopes_applied": {
-        "items": {
-          "properties": {
-            "card_id": {
-              "type": "string"
-            },
-            "scope": {
-              "description": "`platform`, `org:<id>`, or `agent:<id>`.",
-              "type": "string"
-            },
-            "template_version": {
-              "type": "integer"
-            },
-            "version": {
-              "type": "integer"
-            }
-          },
-          "type": "object"
-        },
-        "type": "array"
-      },
-      "source_card_id": {
-        "type": "string"
-      },
-      "source_policy_id": {
-        "type": "string"
-      }
-    },
-    "type": "object"
-  },
-  "UnifiedProtectionCard": {
-    "description": "Unified protection card (ADR-037). Safe House thresholds + trusted-source policy for a single agent. Shape matches src/composition/types.ts::UnifiedProtectionCard (canonical) and what the runtime validator at src/composition/validate.ts accepts. The customer-facing docs at /concepts/protection-card and /specifications/protection-card-schema document this same shape.",
-    "properties": {
-      "_composition": {
-        "$ref": "#/$defs/CompositionMetadata"
-      },
-      "agent_id": {
-        "type": "string"
-      },
-      "card_id": {
-        "type": "string"
-      },
-      "card_version": {
-        "type": "string"
-      },
-      "content_hash": {
-        "description": "Response-only: content hash of the composed card (`sha256:<hex>`), injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-        "type": "string"
-      },
-      "expires_at": {
-        "format": "date-time",
-        "type": [
-          "string",
-          "null"
-        ]
-      },
-      "extensions": {
-        "additionalProperties": true,
-        "description": "Free-form extension slot for non-canonical fields. Ignored by the composer; preserved on read for tooling that needs an audit-tail metadata bag.",
-        "type": "object"
-      },
-      "issued_at": {
-        "format": "date-time",
-        "type": "string"
-      },
-      "mode": {
-        "description": "Strictest-wins composition: enforce > nudge > observe > off.",
-        "enum": [
-          "off",
-          "observe",
-          "nudge",
-          "enforce"
-        ],
-        "type": "string"
-      },
-      "protected_surface": {
-        "description": "Org-declared protected surface policy (MNE-830). Strengthen-only UNION across platform → org → team → agent: each scope may add entries; none may remove. The composer always emits this block; callers omit it to inherit the composed floor. See ADR-037 §protected_surface.",
-        "properties": {
-          "assets": {
-            "description": "Protected assets. Intrinsic identity = `${kind}:${selector}` (normalized). Composer merges by identity, keeping the strictest entry per scope.",
-            "items": {
-              "properties": {
-                "kind": {
-                  "description": "Asset kind (e.g. `row`, `field`, `resource`, `table`).",
-                  "type": "string"
-                },
-                "label": {
-                  "description": "Human-facing display label (optional).",
-                  "type": "string"
-                },
-                "reason": {
-                  "description": "Why this asset is protected (optional).",
-                  "type": "string"
-                },
-                "selector": {
-                  "description": "Asset selector (e.g. `customer:critical-0000`, `replica_dsn`).",
-                  "type": "string"
-                },
-                "source_scope": {
-                  "description": "Composer-assigned provenance (`platform`, `org:<id>`, `team:<id>`, `agent:<id>`). Server-assigned — do not send on a PUT.",
-                  "type": "string"
-                }
-              },
-              "required": [
-                "kind",
-                "selector"
-              ],
-              "type": "object"
-            },
-            "type": "array"
-          },
-          "escalation_required": {
-            "description": "Operations that require escalation before proceeding. Same intrinsic-identity + union rules as forbidden_operations (minus severity).",
-            "items": {
-              "properties": {
-                "applies_to": {
-                  "description": "Asset identities this escalation applies to. Empty/absent = GLOBAL.",
-                  "items": {
-                    "type": "string"
-                  },
-                  "type": "array"
-                },
-                "pattern": {
-                  "description": "Operation pattern requiring escalation.",
-                  "type": "string"
-                },
-                "reason": {
-                  "description": "Why escalation is required (optional).",
-                  "type": "string"
-                },
-                "source_scope": {
-                  "description": "Composer-assigned provenance. Server-assigned — do not send on a PUT.",
-                  "type": "string"
-                }
-              },
-              "required": [
-                "pattern"
-              ],
-              "type": "object"
-            },
-            "type": "array"
-          },
-          "forbidden_operations": {
-            "description": "Operations that are unconditionally forbidden. Intrinsic identity = normalized `pattern`. Composer unions across scopes; on identity collision, severity → max.",
-            "items": {
-              "properties": {
-                "applies_to": {
-                  "description": "Asset identities (`${kind}:${selector}`) this operation applies to. Empty/absent means GLOBAL.",
-                  "items": {
-                    "type": "string"
-                  },
-                  "type": "array"
-                },
-                "pattern": {
-                  "description": "Operation pattern (e.g. `TRUNCATE`, `unscoped UPDATE/DELETE`, `exfiltrate:pii`).",
-                  "type": "string"
-                },
-                "reason": {
-                  "description": "Why this operation is forbidden (optional).",
-                  "type": "string"
-                },
-                "severity": {
-                  "description": "Severity level. Composer merges to strictest across scopes.",
-                  "enum": [
-                    "low",
-                    "medium",
-                    "high",
-                    "critical"
-                  ],
-                  "type": "string"
-                },
-                "source_scope": {
-                  "description": "Composer-assigned provenance. Server-assigned — do not send on a PUT.",
-                  "type": "string"
-                }
-              },
-              "required": [
-                "pattern"
-              ],
-              "type": "object"
-            },
-            "type": "array"
-          }
-        },
-        "type": "object"
-      },
-      "review": {
-        "description": "Review-hold policy (Safe House Review, Slice 2a — MNE-920 design). gate_on is the minimum verdict band per surface that escalates to a review-hold. Composition is strictest-wins; on_timeout defaults to 'reject' (fail-closed). reviewer.kind 'endpoint' is designed for MNE-1650 and not consumed yet.",
-        "properties": {
-          "enabled": {
-            "type": "boolean"
-          },
-          "gate_on": {
-            "properties": {
-              "incoming": {
-                "enum": [
-                  "off",
-                  "warn",
-                  "quarantine",
-                  "block"
-                ],
-                "type": "string"
-              },
-              "integrity": {
-                "enum": [
-                  "off",
-                  "review_needed",
-                  "boundary_violation"
-                ],
-                "type": "string"
-              },
-              "outgoing": {
-                "enum": [
-                  "off",
-                  "warn",
-                  "quarantine",
-                  "block"
-                ],
-                "type": "string"
-              },
-              "tool_calls": {
-                "enum": [
-                  "off",
-                  "warn",
-                  "quarantine",
-                  "block"
-                ],
-                "type": "string"
-              },
-              "tool_responses": {
-                "enum": [
-                  "off",
-                  "warn",
-                  "quarantine",
-                  "block"
-                ],
-                "type": "string"
-              }
-            },
-            "type": "object"
-          },
-          "notify": {
-            "properties": {
-              "sse": {
-                "type": "boolean"
-              },
-              "webhooks": {
-                "type": "boolean"
-              }
-            },
-            "type": "object"
-          },
-          "on_timeout": {
-            "enum": [
-              "reject",
-              "release"
-            ],
-            "type": "string"
-          },
-          "quarantine_notice": {
-            "maxLength": 2000,
-            "type": "string"
-          },
-          "reviewer": {
-            "properties": {
-              "endpoint_url": {
-                "format": "uri",
-                "type": "string"
-              },
-              "kind": {
-                "enum": [
-                  "builtin_opus",
-                  "endpoint"
-                ],
-                "type": "string"
-              }
-            },
-            "required": [
-              "kind"
-            ],
-            "type": "object"
-          },
-          "sla_seconds": {
-            "minimum": 1,
-            "type": "number"
-          }
-        },
-        "required": [
-          "enabled"
-        ],
-        "type": "object"
-      },
-      "screen_surfaces": {
-        "description": "Which request surfaces Safe House inspects. Composed across scopes by OR-per-field (any scope requiring inspection wins).",
-        "properties": {
-          "incoming": {
-            "description": "The user/principal prompt entering the agent.",
-            "type": "boolean"
-          },
-          "outgoing": {
-            "description": "The agent's response leaving the agent.",
-            "type": "boolean"
-          },
-          "tool_calls": {
-            "description": "Tool-use invocations the agent makes.",
-            "type": "boolean"
-          },
-          "tool_responses": {
-            "description": "Responses to tool calls returning to the agent.",
-            "type": "boolean"
-          }
-        },
-        "required": [
-          "incoming",
-          "outgoing",
-          "tool_calls",
-          "tool_responses"
-        ],
-        "type": "object"
-      },
-      "thresholds": {
-        "description": "Score bands. Must satisfy warn <= quarantine <= block; each value in [0, 1].",
-        "properties": {
-          "block": {
-            "maximum": 1,
-            "minimum": 0,
-            "type": "number"
-          },
-          "quarantine": {
-            "maximum": 1,
-            "minimum": 0,
-            "type": "number"
-          },
-          "warn": {
-            "maximum": 1,
-            "minimum": 0,
-            "type": "number"
-          }
-        },
-        "required": [
-          "warn",
-          "quarantine",
-          "block"
-        ],
-        "type": "object"
-      },
-      "trusted_sources": {
-        "description": "Sources for which detectors short-circuit (each match logged in the trace). Composed as platform->agent intersection (compliance ceiling) with org+agent union inside that ceiling — an agent cannot widen trust beyond what the platform allows.",
-        "properties": {
-          "agent_ids": {
-            "description": "Mnemom agent IDs (mnm-* / smolt-* prefixed).",
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "domains": {
-            "description": "DNS names or host:port entries.",
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "ip_ranges": {
-            "description": "IPv4 or IPv6 CIDR ranges.",
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          }
-        },
-        "required": [
-          "domains",
-          "agent_ids",
-          "ip_ranges"
-        ],
-        "type": "object"
-      },
-      "version": {
-        "description": "Response-only: monotonic card version, injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-        "type": "integer"
-      }
-    },
-    "required": [
-      "card_version",
-      "agent_id",
-      "mode",
-      "thresholds",
-      "screen_surfaces",
-      "trusted_sources"
-    ],
-    "type": "object"
-  }
-}

addedOutput schema / additionalProperties
```
Added value: +false
```

removedOutput schema / description

Removed value: -"Unified protection card (ADR-037). Safe House thresholds + trusted-source policy for a single agent. Shape matches src/composition/types.ts::UnifiedProtectionCard (canonical) and what the runtime validator at src/composition/validate.ts accepts. The customer-facing docs at /concepts/protection-card and /specifications/protection-card-schema document this same shape."

removedOutput schema / properties / _composition

Removed value: -{
-  "$ref": "#/$defs/CompositionMetadata"
-}

removedOutput schema / properties / agent_id
```
Removed value: -{
-  "type": "string"
-}
```

addedOutput schema / properties / card_id / description

Added value: +"Card ID (pc-{uuid}) of the stored protection card."

addedOutput schema / properties / card_id / pattern

Added value: +"^pc-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$"

removedOutput schema / properties / card_version
```
Removed value: -{
-  "type": "string"
-}
```

removedOutput schema / properties / content_hash

Removed value: -{
-  "description": "Response-only: content hash of the composed card (`sha256:<hex>`), injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-  "type": "string"
-}

removedOutput schema / properties / expires_at

Removed value: -{
-  "format": "date-time",
-  "type": [
-    "string",
-    "null"
-  ]
-}

removedOutput schema / properties / extensions

Removed value: -{
-  "additionalProperties": true,
-  "description": "Free-form extension slot for non-canonical fields. Ignored by the composer; preserved on read for tooling that needs an audit-tail metadata bag.",
-  "type": "object"
-}

addedOutput schema / properties / issued_at / description

Added value: +"ISO 8601 timestamp when the card was issued/stored."

removedOutput schema / properties / mode

Removed value: -{
-  "description": "Strictest-wins composition: enforce > nudge > observe > off.",
-  "enum": [
-    "off",
-    "observe",
-    "nudge",
-    "enforce"
-  ],
-  "type": "string"
-}

addedOutput schema / properties / ok

Added value: +{
+  "const": true,
+  "description": "Always true on successful storage (errors return non-200 status).",
+  "type": "boolean"
+}

removedOutput schema / properties / protected_surface

Removed value: -{
-  "description": "Org-declared protected surface policy (MNE-830). Strengthen-only UNION across platform → org → team → agent: each scope may add entries; none may remove. The composer always emits this block; callers omit it to inherit the composed floor. See ADR-037 §protected_surface.",
-  "properties": {
-    "assets": {
-      "description": "Protected assets. Intrinsic identity = `${kind}:${selector}` (normalized). Composer merges by identity, keeping the strictest entry per scope.",
-      "items": {
-        "properties": {
-          "kind": {
-            "description": "Asset kind (e.g. `row`, `field`, `resource`, `table`).",
-            "type": "string"
-          },
-          "label": {
-            "description": "Human-facing display label (optional).",
-            "type": "string"
-          },
-          "reason": {
-            "description": "Why this asset is protected (optional).",
-            "type": "string"
-          },
-          "selector": {
-            "description": "Asset selector (e.g. `customer:critical-0000`, `replica_dsn`).",
-            "type": "string"
-          },
-          "source_scope": {
-            "description": "Composer-assigned provenance (`platform`, `org:<id>`, `team:<id>`, `agent:<id>`). Server-assigned — do not send on a PUT.",
-            "type": "string"
-          }
-        },
-        "required": [
-          "kind",
-          "selector"
-        ],
-        "type": "object"
-      },
-      "type": "array"
-    },
-    "escalation_required": {
-      "description": "Operations that require escalation before proceeding. Same intrinsic-identity + union rules as forbidden_operations (minus severity).",
-      "items": {
-        "properties": {
-          "applies_to": {
-            "description": "Asset identities this escalation applies to. Empty/absent = GLOBAL.",
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "pattern": {
-            "description": "Operation pattern requiring escalation.",
-            "type": "string"
-          },
-          "reason": {
-            "description": "Why escalation is required (optional).",
-            "type": "string"
-          },
-          "source_scope": {
-            "description": "Composer-assigned provenance. Server-assigned — do not send on a PUT.",
-            "type": "string"
-          }
-        },
-        "required": [
-          "pattern"
-        ],
-        "type": "object"
-      },
-      "type": "array"
-    },
-    "forbidden_operations": {
-      "description": "Operations that are unconditionally forbidden. Intrinsic identity = normalized `pattern`. Composer unions across scopes; on identity collision, severity → max.",
-      "items": {
-        "properties": {
-          "applies_to": {
-            "description": "Asset identities (`${kind}:${selector}`) this operation applies to. Empty/absent means GLOBAL.",
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "pattern": {
-            "description": "Operation pattern (e.g. `TRUNCATE`, `unscoped UPDATE/DELETE`, `exfiltrate:pii`).",
-            "type": "string"
-          },
-          "reason": {
-            "description": "Why this operation is forbidden (optional).",
-            "type": "string"
-          },
-          "severity": {
-            "description": "Severity level. Composer merges to strictest across scopes.",
-            "enum": [
-              "low",
-              "medium",
-              "high",
-              "critical"
-            ],
-            "type": "string"
-          },
-          "source_scope": {
-            "description": "Composer-assigned provenance. Server-assigned — do not send on a PUT.",
-            "type": "string"
-          }
-        },
-        "required": [
-          "pattern"
-        ],
-        "type": "object"
-      },
-      "type": "array"
-    }
-  },
-  "type": "object"
-}

removedOutput schema / properties / review

Removed value: -{
-  "description": "Review-hold policy (Safe House Review, Slice 2a — MNE-920 design). gate_on is the minimum verdict band per surface that escalates to a review-hold. Composition is strictest-wins; on_timeout defaults to 'reject' (fail-closed). reviewer.kind 'endpoint' is designed for MNE-1650 and not consumed yet.",
-  "properties": {
-    "enabled": {
-      "type": "boolean"
-    },
-    "gate_on": {
-      "properties": {
-        "incoming": {
-          "enum": [
-            "off",
-            "warn",
-            "quarantine",
-            "block"
-          ],
-          "type": "string"
-        },
-        "integrity": {
-          "enum": [
-            "off",
-            "review_needed",
-            "boundary_violation"
-          ],
-          "type": "string"
-        },
-        "outgoing": {
-          "enum": [
-            "off",
-            "warn",
-            "quarantine",
-            "block"
-          ],
-          "type": "string"
-        },
-        "tool_calls": {
-          "enum": [
-            "off",
-            "warn",
-            "quarantine",
-            "block"
-          ],
-          "type": "string"
-        },
-        "tool_responses": {
-          "enum": [
-            "off",
-            "warn",
-            "quarantine",
-            "block"
-          ],
-          "type": "string"
-        }
-      },
-      "type": "object"
-    },
-    "notify": {
-      "properties": {
-        "sse": {
-          "type": "boolean"
-        },
-        "webhooks": {
-          "type": "boolean"
-        }
-      },
-      "type": "object"
-    },
-    "on_timeout": {
-      "enum": [
-        "reject",
-        "release"
-      ],
-      "type": "string"
-    },
-    "quarantine_notice": {
-      "maxLength": 2000,
-      "type": "string"
-    },
-    "reviewer": {
-      "properties": {
-        "endpoint_url": {
-          "format": "uri",
-          "type": "string"
-        },
-        "kind": {
-          "enum": [
-            "builtin_opus",
-            "endpoint"
-          ],
-          "type": "string"
-        }
-      },
-      "required": [
-        "kind"
-      ],
-      "type": "object"
-    },
-    "sla_seconds": {
-      "minimum": 1,
-      "type": "number"
-    }
-  },
-  "required": [
-    "enabled"
-  ],
-  "type": "object"
-}

removedOutput schema / properties / screen_surfaces

Removed value: -{
-  "description": "Which request surfaces Safe House inspects. Composed across scopes by OR-per-field (any scope requiring inspection wins).",
-  "properties": {
-    "incoming": {
-      "description": "The user/principal prompt entering the agent.",
-      "type": "boolean"
-    },
-    "outgoing": {
-      "description": "The agent's response leaving the agent.",
-      "type": "boolean"
-    },
-    "tool_calls": {
-      "description": "Tool-use invocations the agent makes.",
-      "type": "boolean"
-    },
-    "tool_responses": {
-      "description": "Responses to tool calls returning to the agent.",
-      "type": "boolean"
-    }
-  },
-  "required": [
-    "incoming",
-    "outgoing",
-    "tool_calls",
-    "tool_responses"
-  ],
-  "type": "object"
-}

removedOutput schema / properties / thresholds

Removed value: -{
-  "description": "Score bands. Must satisfy warn <= quarantine <= block; each value in [0, 1].",
-  "properties": {
-    "block": {
-      "maximum": 1,
-      "minimum": 0,
-      "type": "number"
-    },
-    "quarantine": {
-      "maximum": 1,
-      "minimum": 0,
-      "type": "number"
-    },
-    "warn": {
-      "maximum": 1,
-      "minimum": 0,
-      "type": "number"
-    }
-  },
-  "required": [
-    "warn",
-    "quarantine",
-    "block"
-  ],
-  "type": "object"
-}

removedOutput schema / properties / trusted_sources

Removed value: -{
-  "description": "Sources for which detectors short-circuit (each match logged in the trace). Composed as platform->agent intersection (compliance ceiling) with org+agent union inside that ceiling — an agent cannot widen trust beyond what the platform allows.",
-  "properties": {
-    "agent_ids": {
-      "description": "Mnemom agent IDs (mnm-* / smolt-* prefixed).",
-      "items": {
-        "type": "string"
-      },
-      "type": "array"
-    },
-    "domains": {
-      "description": "DNS names or host:port entries.",
-      "items": {
-        "type": "string"
-      },
-      "type": "array"
-    },
-    "ip_ranges": {
-      "description": "IPv4 or IPv6 CIDR ranges.",
-      "items": {
-        "type": "string"
-      },
-      "type": "array"
-    }
-  },
-  "required": [
-    "domains",
-    "agent_ids",
-    "ip_ranges"
-  ],
-  "type": "object"
-}

removedOutput schema / properties / version

Removed value: -{
-  "description": "Response-only: monotonic card version, injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-  "type": "integer"
-}

changedOutput schema / required

Previous value: -[
-  "card_version",
-  "agent_id",
-  "mode",
-  "thresholds",
-  "screen_surfaces",
-  "trusted_sources"
-]New value: +[
+  "card_id",
+  "issued_at",
+  "ok"
+]

Changedreport_recipe_fn_fp17 fields changed

changedInput schema / properties / agent_id / description

Previous value: -"Optional. Customer's agent id, when the report concerns a specific agent."New value: +"Optional. The agent the report concerns. Identifier only."

addedInput schema / properties / agent_id / maxLength
```
Added value: +64
```
addedInput schema / properties / agent_id / minLength
```
Added value: +3
```

addedInput schema / properties / agent_id / pattern

Added value: +"^[A-Za-z0-9][A-Za-z0-9_-]{1,62}[A-Za-z0-9]$"

changedInput schema / properties / checkpoint_id / description

Previous value: -"Optional. Related integrity_checkpoints id (helps the reviewer correlate)."New value: +"Optional. The related integrity checkpoint, so the reviewer can correlate. Identifier only."

addedInput schema / properties / checkpoint_id / maxLength
```
Added value: +64
```
addedInput schema / properties / checkpoint_id / minLength
```
Added value: +3
```

addedInput schema / properties / checkpoint_id / pattern

Added value: +"^[A-Za-z0-9][A-Za-z0-9_-]{1,62}[A-Za-z0-9]$"

removedInput schema / properties / evidence

Removed value: -{
-  "description": "Optional raw payload / log excerpt the admin reviewer can inspect.",
-  "type": "string"
-}

changedInput schema / properties / recipeId / description

Previous value: -"The detection_recipes id the report is filed against (the recipe that misfired or failed to fire)."New value: +"The detection recipe the report is filed against (the one that misfired or failed to fire). Identifier only."

addedInput schema / properties / recipeId / maxLength
```
Added value: +64
```
addedInput schema / properties / recipeId / minLength
```
Added value: +3
```

addedInput schema / properties / recipeId / pattern

Added value: +"^[A-Za-z0-9][A-Za-z0-9_-]{1,62}[A-Za-z0-9]$"

changedInput schema / properties / summary / description

Previous value: -"Customer's description of what happened."New value: +"A short description of what the recipe got wrong — what it flagged, or what it missed, and why that was incorrect. DESCRIBE the misfire; do NOT paste the conversation, the prompt, the raw payload or the log that triggered it. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization."

addedInput schema / properties / summary / maxLength
```
Added value: +500
```

changedInput schema / properties / type / description

Previous value: -"'fn' (false negative — recipe should have fired) or 'fp' (false positive — recipe fired on legitimate behaviour)."New value: +"`fn` = false negative (the recipe should have fired). `fp` = false positive (it fired on legitimate behaviour)."

changedInput schema / required

Previous value: -[
-  "recipeId",
-  "summary",
-  "type"
-]New value: +[
+  "recipeId",
+  "type",
+  "summary"
+]

2 tool updatesJul 31, 2026

Changedget_agent2 fields changed

addedOutput schema / $defs / Agent / properties / groups

Added value: +{
+  "description": "Active groups this agent belongs to, name-ordered; `[]` when none. Present on org-fleet rows (GET /v1/orgs/{org_id}/agents). Archived groups are excluded.",
+  "items": {
+    "properties": {
+      "color": {
+        "description": "Group color (hex, e.g. `#0d9488`); `null` when unset.",
+        "type": [
+          "string",
+          "null"
+        ]
+      },
+      "id": {
+        "type": "string"
+      },
+      "name": {
+        "type": "string"
+      }
+    },
+    "required": [
+      "id",
+      "name",
+      "color"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}

addedOutput schema / properties / groups

Added value: +{
+  "description": "Active groups this agent belongs to, name-ordered; `[]` when none. Present on org-fleet rows (GET /v1/orgs/{org_id}/agents). Archived groups are excluded.",
+  "items": {
+    "properties": {
+      "color": {
+        "description": "Group color (hex, e.g. `#0d9488`); `null` when unset.",
+        "type": [
+          "string",
+          "null"
+        ]
+      },
+      "id": {
+        "type": "string"
+      },
+      "name": {
+        "type": "string"
+      }
+    },
+    "required": [
+      "id",
+      "name",
+      "color"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}

Changedlist_agents1 field changed

addedOutput schema / $defs / Agent / properties / groups

Added value: +{
+  "description": "Active groups this agent belongs to, name-ordered; `[]` when none. Present on org-fleet rows (GET /v1/orgs/{org_id}/agents). Archived groups are excluded.",
+  "items": {
+    "properties": {
+      "color": {
+        "description": "Group color (hex, e.g. `#0d9488`); `null` when unset.",
+        "type": [
+          "string",
+          "null"
+        ]
+      },
+      "id": {
+        "type": "string"
+      },
+      "name": {
+        "type": "string"
+      }
+    },
+    "required": [
+      "id",
+      "name",
+      "color"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}

2 tool updatesJul 27, 2026

Changedget_reputation2 fields changed

addedOutput schema / $defs / ReputationScore / properties / checkpoint_accounting / properties / re_evaluated

Added value: +{
+  "description": "How many of the agent's checkpoints carry each kind of re-evaluation annotation (counted over `total`, not the analyzed subset). Observability only — these are not an exclusion bucket and do not enter the score arithmetic. Absent on scores computed before this breakdown existed.",
+  "properties": {
+    "corrected_clear": {
+      "description": "Checkpoints explicitly corrected to `clear` (`re_evaluation_metadata.corrected_verdict = 'clear'`).",
+      "type": "integer"
+    },
+    "corrected_non_clear": {
+      "description": "Checkpoints corrected to a NON-clear verdict — a cross-turn escalation or a reviewer reclassification to `review_needed`/`boundary_violation`. These count against the score per the correction, not as exonerations; a non-zero value is why this agent's score differs from the pre-MNE-2156 calculation.",
+      "type": "integer"
+    },
+    "resolved_no_correction": {
+      "description": "Checkpoints re-evaluated with NO recorded correction — the trust-recovery convention, scored as `clear`.",
+      "type": "integer"
+    }
+  },
+  "required": [
+    "corrected_clear",
+    "corrected_non_clear",
+    "resolved_no_correction"
+  ],
+  "type": "object"
+}

addedOutput schema / properties / checkpoint_accounting / properties / re_evaluated

Added value: +{
+  "description": "How many of the agent's checkpoints carry each kind of re-evaluation annotation (counted over `total`, not the analyzed subset). Observability only — these are not an exclusion bucket and do not enter the score arithmetic. Absent on scores computed before this breakdown existed.",
+  "properties": {
+    "corrected_clear": {
+      "description": "Checkpoints explicitly corrected to `clear` (`re_evaluation_metadata.corrected_verdict = 'clear'`).",
+      "type": "integer"
+    },
+    "corrected_non_clear": {
+      "description": "Checkpoints corrected to a NON-clear verdict — a cross-turn escalation or a reviewer reclassification to `review_needed`/`boundary_violation`. These count against the score per the correction, not as exonerations; a non-zero value is why this agent's score differs from the pre-MNE-2156 calculation.",
+      "type": "integer"
+    },
+    "resolved_no_correction": {
+      "description": "Checkpoints re-evaluated with NO recorded correction — the trust-recovery convention, scored as `clear`.",
+      "type": "integer"
+    }
+  },
+  "required": [
+    "corrected_clear",
+    "corrected_non_clear",
+    "resolved_no_correction"
+  ],
+  "type": "object"
+}

Changedsearch_reputation_directory1 field changed

addedOutput schema / $defs / ReputationScore / properties / checkpoint_accounting / properties / re_evaluated

Added value: +{
+  "description": "How many of the agent's checkpoints carry each kind of re-evaluation annotation (counted over `total`, not the analyzed subset). Observability only — these are not an exclusion bucket and do not enter the score arithmetic. Absent on scores computed before this breakdown existed.",
+  "properties": {
+    "corrected_clear": {
+      "description": "Checkpoints explicitly corrected to `clear` (`re_evaluation_metadata.corrected_verdict = 'clear'`).",
+      "type": "integer"
+    },
+    "corrected_non_clear": {
+      "description": "Checkpoints corrected to a NON-clear verdict — a cross-turn escalation or a reviewer reclassification to `review_needed`/`boundary_violation`. These count against the score per the correction, not as exonerations; a non-zero value is why this agent's score differs from the pre-MNE-2156 calculation.",
+      "type": "integer"
+    },
+    "resolved_no_correction": {
+      "description": "Checkpoints re-evaluated with NO recorded correction — the trust-recovery convention, scored as `clear`.",
+      "type": "integer"
+    }
+  },
+  "required": [
+    "corrected_clear",
+    "corrected_non_clear",
+    "resolved_no_correction"
+  ],
+  "type": "object"
+}

1 tool updateJul 16, 2026

Changedget_started3 fields changed

addedOutput schema / properties / developer_path

Added value: +{
+  "additionalProperties": false,
+  "description": "The developer hero on-ramp: the npx one-liner plus the intent-named MCP prompt-skills (try-me, onboard_an_agent, become_sovereign). Advertisement only — no functional dependency on those prompts existing yet.",
+  "properties": {
+    "narrative": {
+      "type": "string"
+    },
+    "note": {
+      "type": "string"
+    },
+    "npx": {
+      "additionalProperties": false,
+      "properties": {
+        "command": {
+          "type": "string"
+        },
+        "what": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "command",
+        "what"
+      ],
+      "type": "object"
+    },
+    "prompt_skills": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "name": {
+            "type": "string"
+          },
+          "what": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "name",
+          "what"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    }
+  },
+  "required": [
+    "narrative",
+    "npx",
+    "prompt_skills",
+    "note"
+  ],
+  "type": "object"
+}

addedOutput schema / properties / skill_path

Added value: +{
+  "additionalProperties": false,
+  "description": "The two-step on-ramp to declaring and advertising capabilities as A2A skills in a signed, portable AgentCard.",
+  "properties": {
+    "narrative": {
+      "type": "string"
+    },
+    "steps": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "auth": {
+            "enum": [
+              "none",
+              "required"
+            ],
+            "type": "string"
+          },
+          "step": {
+            "type": "integer"
+          },
+          "tool": {
+            "type": "string"
+          },
+          "what": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "step",
+          "tool",
+          "auth",
+          "what"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    }
+  },
+  "required": [
+    "narrative",
+    "steps"
+  ],
+  "type": "object"
+}

changedOutput schema / required

Previous value: -[
-  "who",
-  "value_prop",
-  "try_now",
-  "authenticate",
-  "sovereignty_path",
-  "surface_map",
-  "showcase_agent",
-  "visibility_model",
-  "what_we_keep_private_and_why",
-  "verify",
-  "doctrine"
-]New value: +[
+  "who",
+  "value_prop",
+  "try_now",
+  "authenticate",
+  "skill_path",
+  "sovereignty_path",
+  "developer_path",
+  "surface_map",
+  "showcase_agent",
+  "visibility_model",
+  "what_we_keep_private_and_why",
+  "verify",
+  "doctrine"
+]

1 tool updateJul 11, 2026

Changedput_alignment_by_agent6 fields changed

addedOutput schema / $defs / ComposedAlignmentCard

Added value: +{
+  "description": "OUTPUT-only variant of `UnifiedAlignmentCard` for the COMPOSED card the server emits on GET `/v1/alignment/{scope}/{id}`, `/effective`, and the `composed` field of preview-compose. Identical to `UnifiedAlignmentCard` except `principal` is optional (a default / org-scope composed card has no agent principal) and `values.declared` / `autonomy.bounded_actions` may be empty (a fresh card declares nothing yet). The strict `UnifiedAlignmentCard` remains the authoring/request contract.",
+  "properties": {
+    "_composition": {
+      "$ref": "#/$defs/CompositionMetadata"
+    },
+    "agent_id": {
+      "description": "Target agent id. On PUT, server overwrites to match the URL path.",
+      "type": "string"
+    },
+    "audit": {
+      "allOf": [
+        {
+          "if": {
+            "properties": {
+              "queryable": {
+                "const": true
+              }
+            },
+            "required": [
+              "queryable"
+            ]
+          },
+          "then": {
+            "required": [
+              "query_endpoint"
+            ]
+          }
+        }
+      ],
+      "properties": {
+        "query_endpoint": {
+          "description": "Required when audit.queryable is true.",
+          "type": "string"
+        },
+        "queryable": {
+          "type": "boolean"
+        },
+        "retention_days": {
+          "minimum": 0,
+          "type": "integer"
+        },
+        "storage": {
+          "properties": {
+            "location": {
+              "type": "string"
+            },
+            "type": {
+              "enum": [
+                "local",
+                "remote",
+                "distributed"
+              ],
+              "type": "string"
+            }
+          },
+          "type": "object"
+        },
+        "tamper_evidence": {
+          "enum": [
+            "append_only",
+            "signed",
+            "merkle",
+            null
+          ],
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "trace_format": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "retention_days",
+        "queryable"
+      ],
+      "type": "object"
+    },
+    "autonomy": {
+      "properties": {
+        "bounded_actions": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "escalation_triggers": {
+          "items": {
+            "properties": {
+              "action": {
+                "enum": [
+                  "escalate",
+                  "deny",
+                  "log"
+                ],
+                "type": "string"
+              },
+              "condition": {
+                "type": "string"
+              },
+              "reason": {
+                "type": "string"
+              }
+            },
+            "required": [
+              "condition",
+              "action",
+              "reason"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "forbidden_actions": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "max_autonomous_value": {
+          "properties": {
+            "amount": {
+              "type": "number"
+            },
+            "currency": {
+              "type": "string"
+            }
+          },
+          "type": "object"
+        }
+      },
+      "required": [
+        "bounded_actions"
+      ],
+      "type": "object"
+    },
+    "autonomy_mode": {
+      "description": "ADR-039 master switch for the action-policing pipeline (autonomy constraints). Required at the top level post-cutover; the legacy `enforcement.mode` location is rejected.",
+      "enum": [
+        "off",
+        "observe",
+        "nudge",
+        "enforce"
+      ],
+      "type": "string"
+    },
+    "capabilities": {
+      "additionalProperties": {
+        "properties": {
+          "description": {
+            "type": "string"
+          },
+          "required_actions": {
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "tools": {
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          }
+        },
+        "type": "object"
+      },
+      "type": "object"
+    },
+    "card_id": {
+      "description": "Card row id. Server-assigned on PUT (`ac-{uuid}`).",
+      "type": "string"
+    },
+    "card_version": {
+      "description": "Card schema version (required, non-empty). Current canonical value: `unified/2026-04-26`.",
+      "minLength": 1,
+      "type": "string"
+    },
+    "conscience": {
+      "properties": {
+        "mode": {
+          "enum": [
+            "augment",
+            "replace"
+          ],
+          "type": "string"
+        },
+        "values": {
+          "items": {
+            "properties": {
+              "content": {
+                "type": "string"
+              },
+              "id": {
+                "type": "string"
+              },
+              "severity": {
+                "enum": [
+                  "advisory",
+                  "mandatory"
+                ],
+                "type": "string"
+              },
+              "type": {
+                "enum": [
+                  "BOUNDARY",
+                  "FEAR",
+                  "COMMITMENT",
+                  "BELIEF",
+                  "HOPE"
+                ],
+                "type": "string"
+              }
+            },
+            "required": [
+              "type",
+              "content"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        }
+      },
+      "required": [
+        "mode",
+        "values"
+      ],
+      "type": "object"
+    },
+    "content_hash": {
+      "description": "Response-only: content hash of the composed card (`sha256:<hex>`), injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
+      "type": "string"
+    },
+    "enforcement": {
+      "description": "Optional ADR-039 Decision-3 user-facing knobs for unmapped-tool handling. The legacy `mode`, `unmapped_tool_action` and `fail_open` keys are REJECTED by the validator (mode → top-level autonomy_mode; fail_open → gateway env config).",
+      "properties": {
+        "allow_unmapped_tools": {
+          "description": "When true, tools not mapped to a capability are allowed by default.",
+          "type": "boolean"
+        },
+        "default_unmapped_severity": {
+          "description": "Severity assigned to an unmapped tool when allow_unmapped_tools is false.",
+          "enum": [
+            "low",
+            "medium",
+            "high",
+            "critical"
+          ],
+          "type": "string"
+        },
+        "forbidden_tools": {
+          "items": {
+            "properties": {
+              "pattern": {
+                "type": "string"
+              },
+              "reason": {
+                "type": "string"
+              },
+              "severity": {
+                "enum": [
+                  "critical",
+                  "high",
+                  "medium",
+                  "low"
+                ],
+                "type": "string"
+              }
+            },
+            "required": [
+              "pattern",
+              "reason",
+              "severity"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "grace_period_hours": {
+          "type": "integer"
+        }
+      },
+      "type": "object"
+    },
+    "expires_at": {
+      "format": "date-time",
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "extensions": {
+      "additionalProperties": true,
+      "type": "object"
+    },
+    "integrity_mode": {
+      "description": "ADR-039 master switch for the values/conscience pipeline (integrity constraints). Required at the top level post-cutover; the legacy `integrity.enforcement_mode` location is rejected.",
+      "enum": [
+        "off",
+        "observe",
+        "nudge",
+        "enforce"
+      ],
+      "type": "string"
+    },
+    "issued_at": {
+      "format": "date-time",
+      "type": "string"
+    },
+    "principal": {
+      "allOf": [
+        {
+          "if": {
+            "properties": {
+              "type": {
+                "not": {
+                  "const": "unspecified"
+                }
+              }
+            }
+          },
+          "then": {
+            "required": [
+              "identifier"
+            ]
+          }
+        }
+      ],
+      "description": "Required object describing whose authority the agent acts under (ADR-039 Decision 10).",
+      "properties": {
+        "escalation_contact": {
+          "type": "string"
+        },
+        "identifier": {
+          "description": "Required (non-empty) when principal.type is not `unspecified`; identifies the human / organization / agent.",
+          "minLength": 1,
+          "type": "string"
+        },
+        "relationship": {
+          "enum": [
+            "delegated_authority",
+            "advisory",
+            "autonomous"
+          ],
+          "type": "string"
+        },
+        "type": {
+          "enum": [
+            "human",
+            "organization",
+            "agent",
+            "unspecified"
+          ],
+          "type": "string"
+        }
+      },
+      "required": [
+        "type",
+        "relationship"
+      ],
+      "type": "object"
+    },
+    "values": {
+      "properties": {
+        "conflicts_with": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "declared": {
+          "description": "Ordered list of declared values. Phase 1 cards-as-primitive: each entry is either a catalog-v1 ID string (e.g. `'accuracy'`) or a parameterized map carrying optional `intensity` / `domain` / `severity_on_violation` / `scope` (e.g. `{id: 'accuracy', domain: 'financial', severity_on_violation: 'critical'}`).",
+          "items": {
+            "oneOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "additionalProperties": {
+                  "type": "string"
+                },
+                "properties": {
+                  "id": {
+                    "minLength": 1,
+                    "type": "string"
+                  }
+                },
+                "required": [
+                  "id"
+                ],
+                "type": "object"
+              }
+            ]
+          },
+          "type": "array"
+        },
+        "definitions": {
+          "additionalProperties": {
+            "properties": {
+              "description": {
+                "type": "string"
+              },
+              "priority": {
+                "type": "integer"
+              }
+            },
+            "type": "object"
+          },
+          "type": "object"
+        },
+        "hierarchy": {
+          "enum": [
+            "lexicographic",
+            "weighted",
+            "contextual"
+          ],
+          "type": "string"
+        }
+      },
+      "required": [
+        "declared"
+      ],
+      "type": "object"
+    },
+    "version": {
+      "description": "Response-only: monotonic card version, injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
+      "type": "integer"
+    }
+  },
+  "required": [
+    "card_version",
+    "agent_id",
+    "autonomy_mode",
+    "integrity_mode",
+    "values",
+    "autonomy",
+    "audit"
+  ],
+  "type": "object"
+}

removedOutput schema / $defs / UnifiedAlignmentCard

Removed value: -{
-  "description": "Unified alignment card (ADR-008/ADR-039). Authored in YAML or JSON; composed server-side with platform defaults, org template, and active exemptions before storage. This schema matches the runtime validator at src/composition/validate.ts EXACTLY — a card authored strictly to it passes `PUT /v1/agents/{id}/alignment-card` and the preview-compose endpoint. Output-only fields (card_id, issued_at, expires_at, _composition, content_hash, version) are server-assigned and must NOT be sent on a PUT.",
-  "properties": {
-    "_composition": {
-      "$ref": "#/$defs/CompositionMetadata"
-    },
-    "agent_id": {
-      "description": "Target agent id. On PUT, server overwrites to match the URL path.",
-      "type": "string"
-    },
-    "audit": {
-      "allOf": [
-        {
-          "if": {
-            "properties": {
-              "queryable": {
-                "const": true
-              }
-            },
-            "required": [
-              "queryable"
-            ]
-          },
-          "then": {
-            "required": [
-              "query_endpoint"
-            ]
-          }
-        }
-      ],
-      "properties": {
-        "query_endpoint": {
-          "description": "Required when audit.queryable is true.",
-          "type": "string"
-        },
-        "queryable": {
-          "type": "boolean"
-        },
-        "retention_days": {
-          "minimum": 0,
-          "type": "integer"
-        },
-        "storage": {
-          "properties": {
-            "location": {
-              "type": "string"
-            },
-            "type": {
-              "enum": [
-                "local",
-                "remote",
-                "distributed"
-              ],
-              "type": "string"
-            }
-          },
-          "type": "object"
-        },
-        "tamper_evidence": {
-          "enum": [
-            "append_only",
-            "signed",
-            "merkle",
-            null
-          ],
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "trace_format": {
-          "type": "string"
-        }
-      },
-      "required": [
-        "retention_days",
-        "queryable"
-      ],
-      "type": "object"
-    },
-    "autonomy": {
-      "properties": {
-        "bounded_actions": {
-          "items": {
-            "type": "string"
-          },
-          "minItems": 1,
-          "type": "array"
-        },
-        "escalation_triggers": {
-          "items": {
-            "properties": {
-              "action": {
-                "enum": [
-                  "escalate",
-                  "deny",
-                  "log"
-                ],
-                "type": "string"
-              },
-              "condition": {
-                "type": "string"
-              },
-              "reason": {
-                "type": "string"
-              }
-            },
-            "required": [
-              "condition",
-              "action",
-              "reason"
-            ],
-            "type": "object"
-          },
-          "type": "array"
-        },
-        "forbidden_actions": {
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        },
-        "max_autonomous_value": {
-          "properties": {
-            "amount": {
-              "type": "number"
-            },
-            "currency": {
-              "type": "string"
-            }
-          },
-          "type": "object"
-        }
-      },
-      "required": [
-        "bounded_actions"
-      ],
-      "type": "object"
-    },
-    "autonomy_mode": {
-      "description": "ADR-039 master switch for the action-policing pipeline (autonomy constraints). Required at the top level post-cutover; the legacy `enforcement.mode` location is rejected.",
-      "enum": [
-        "off",
-        "observe",
-        "nudge",
-        "enforce"
-      ],
-      "type": "string"
-    },
-    "capabilities": {
-      "additionalProperties": {
-        "properties": {
-          "description": {
-            "type": "string"
-          },
-          "required_actions": {
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "tools": {
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          }
-        },
-        "type": "object"
-      },
-      "type": "object"
-    },
-    "card_id": {
-      "description": "Card row id. Server-assigned on PUT (`ac-{uuid}`).",
-      "type": "string"
-    },
-    "card_version": {
-      "description": "Card schema version (required, non-empty). Current canonical value: `unified/2026-04-26`.",
-      "minLength": 1,
-      "type": "string"
-    },
-    "conscience": {
-      "properties": {
-        "mode": {
-          "enum": [
-            "augment",
-            "replace"
-          ],
-          "type": "string"
-        },
-        "values": {
-          "items": {
-            "properties": {
-              "content": {
-                "type": "string"
-              },
-              "id": {
-                "type": "string"
-              },
-              "severity": {
-                "enum": [
-                  "advisory",
-                  "mandatory"
-                ],
-                "type": "string"
-              },
-              "type": {
-                "enum": [
-                  "BOUNDARY",
-                  "FEAR",
-                  "COMMITMENT",
-                  "BELIEF",
-                  "HOPE"
-                ],
-                "type": "string"
-              }
-            },
-            "required": [
-              "type",
-              "content"
-            ],
-            "type": "object"
-          },
-          "type": "array"
-        }
-      },
-      "required": [
-        "mode",
-        "values"
-      ],
-      "type": "object"
-    },
-    "content_hash": {
-      "description": "Response-only: content hash of the composed card (`sha256:<hex>`), injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-      "type": "string"
-    },
-    "enforcement": {
-      "description": "Optional ADR-039 Decision-3 user-facing knobs for unmapped-tool handling. The legacy `mode`, `unmapped_tool_action` and `fail_open` keys are REJECTED by the validator (mode → top-level autonomy_mode; fail_open → gateway env config).",
-      "properties": {
-        "allow_unmapped_tools": {
-          "description": "When true, tools not mapped to a capability are allowed by default.",
-          "type": "boolean"
-        },
-        "default_unmapped_severity": {
-          "description": "Severity assigned to an unmapped tool when allow_unmapped_tools is false.",
-          "enum": [
-            "low",
-            "medium",
-            "high",
-            "critical"
-          ],
-          "type": "string"
-        },
-        "forbidden_tools": {
-          "items": {
-            "properties": {
-              "pattern": {
-                "type": "string"
-              },
-              "reason": {
-                "type": "string"
-              },
-              "severity": {
-                "enum": [
-                  "critical",
-                  "high",
-                  "medium",
-                  "low"
-                ],
-                "type": "string"
-              }
-            },
-            "required": [
-              "pattern",
-              "reason",
-              "severity"
-            ],
-            "type": "object"
-          },
-          "type": "array"
-        },
-        "grace_period_hours": {
-          "type": "integer"
-        }
-      },
-      "type": "object"
-    },
-    "expires_at": {
-      "format": "date-time",
-      "type": [
-        "string",
-        "null"
-      ]
-    },
-    "extensions": {
-      "additionalProperties": true,
-      "type": "object"
-    },
-    "integrity_mode": {
-      "description": "ADR-039 master switch for the values/conscience pipeline (integrity constraints). Required at the top level post-cutover; the legacy `integrity.enforcement_mode` location is rejected.",
-      "enum": [
-        "off",
-        "observe",
-        "nudge",
-        "enforce"
-      ],
-      "type": "string"
-    },
-    "issued_at": {
-      "format": "date-time",
-      "type": "string"
-    },
-    "principal": {
-      "allOf": [
-        {
-          "if": {
-            "properties": {
-              "type": {
-                "not": {
-                  "const": "unspecified"
-                }
-              }
-            }
-          },
-          "then": {
-            "required": [
-              "identifier"
-            ]
-          }
-        }
-      ],
-      "description": "Required object describing whose authority the agent acts under (ADR-039 Decision 10).",
-      "properties": {
-        "escalation_contact": {
-          "type": "string"
-        },
-        "identifier": {
-          "description": "Required (non-empty) when principal.type is not `unspecified`; identifies the human / organization / agent.",
-          "minLength": 1,
-          "type": "string"
-        },
-        "relationship": {
-          "enum": [
-            "delegated_authority",
-            "advisory",
-            "autonomous"
-          ],
-          "type": "string"
-        },
-        "type": {
-          "enum": [
-            "human",
-            "organization",
-            "agent",
-            "unspecified"
-          ],
-          "type": "string"
-        }
-      },
-      "required": [
-        "type",
-        "relationship"
-      ],
-      "type": "object"
-    },
-    "values": {
-      "properties": {
-        "conflicts_with": {
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        },
-        "declared": {
-          "description": "Ordered list of declared values. Phase 1 cards-as-primitive: each entry is either a catalog-v1 ID string (e.g. `'accuracy'`) or a parameterized map carrying optional `intensity` / `domain` / `severity_on_violation` / `scope` (e.g. `{id: 'accuracy', domain: 'financial', severity_on_violation: 'critical'}`).",
-          "items": {
-            "oneOf": [
-              {
-                "minLength": 1,
-                "type": "string"
-              },
-              {
-                "additionalProperties": {
-                  "type": "string"
-                },
-                "properties": {
-                  "id": {
-                    "minLength": 1,
-                    "type": "string"
-                  }
-                },
-                "required": [
-                  "id"
-                ],
-                "type": "object"
-              }
-            ]
-          },
-          "minItems": 1,
-          "type": "array"
-        },
-        "definitions": {
-          "additionalProperties": {
-            "properties": {
-              "description": {
-                "type": "string"
-              },
-              "priority": {
-                "type": "integer"
-              }
-            },
-            "type": "object"
-          },
-          "type": "object"
-        },
-        "hierarchy": {
-          "enum": [
-            "lexicographic",
-            "weighted",
-            "contextual"
-          ],
-          "type": "string"
-        }
-      },
-      "required": [
-        "declared"
-      ],
-      "type": "object"
-    },
-    "version": {
-      "description": "Response-only: monotonic card version, injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-      "type": "integer"
-    }
-  },
-  "required": [
-    "card_version",
-    "agent_id",
-    "autonomy_mode",
-    "integrity_mode",
-    "principal",
-    "values",
-    "autonomy",
-    "audit"
-  ],
-  "type": "object"
-}

changedOutput schema / description

Previous value: -"Unified alignment card (ADR-008/ADR-039). Authored in YAML or JSON; composed server-side with platform defaults, org template, and active exemptions before storage. This schema matches the runtime validator at src/composition/validate.ts EXACTLY — a card authored strictly to it passes `PUT /v1/agents/{id}/alignment-card` and the preview-compose endpoint. Output-only fields (card_id, issued_at, expires_at, _composition, content_hash, version) are server-assigned and must NOT be sent on a PUT."New value: +"OUTPUT-only variant of `UnifiedAlignmentCard` for the COMPOSED card the server emits on GET `/v1/alignment/{scope}/{id}`, `/effective`, and the `composed` field of preview-compose. Identical to `UnifiedAlignmentCard` except `principal` is optional (a default / org-scope composed card has no agent principal) and `values.declared` / `autonomy.bounded_actions` may be empty (a fresh card declares nothing yet). The strict `UnifiedAlignmentCard` remains the authoring/request contract."

removedOutput schema / properties / autonomy / properties / bounded_actions / minItems
```
Removed value: -1
```
removedOutput schema / properties / values / properties / declared / minItems
```
Removed value: -1
```

changedOutput schema / required

Previous value: -[
-  "card_version",
-  "agent_id",
-  "autonomy_mode",
-  "integrity_mode",
-  "principal",
-  "values",
-  "autonomy",
-  "audit"
-]New value: +[
+  "card_version",
+  "agent_id",
+  "autonomy_mode",
+  "integrity_mode",
+  "values",
+  "autonomy",
+  "audit"
+]

2 tool updatesJul 10, 2026

Changedpreview_compose_protection_by_agent2 fields changed

addedInput schema / $defs / UnifiedProtectionCard / properties / review

Added value: +{
+  "description": "Review-hold policy (Safe House Review, Slice 2a — MNE-920 design). gate_on is the minimum verdict band per surface that escalates to a review-hold. Composition is strictest-wins; on_timeout defaults to 'reject' (fail-closed). reviewer.kind 'endpoint' is designed for MNE-1650 and not consumed yet.",
+  "properties": {
+    "enabled": {
+      "type": "boolean"
+    },
+    "gate_on": {
+      "properties": {
+        "incoming": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "integrity": {
+          "enum": [
+            "off",
+            "review_needed",
+            "boundary_violation"
+          ],
+          "type": "string"
+        },
+        "outgoing": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "tool_calls": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "tool_responses": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "notify": {
+      "properties": {
+        "sse": {
+          "type": "boolean"
+        },
+        "webhooks": {
+          "type": "boolean"
+        }
+      },
+      "type": "object"
+    },
+    "on_timeout": {
+      "enum": [
+        "reject",
+        "release"
+      ],
+      "type": "string"
+    },
+    "quarantine_notice": {
+      "maxLength": 2000,
+      "type": "string"
+    },
+    "reviewer": {
+      "properties": {
+        "endpoint_url": {
+          "format": "uri",
+          "type": "string"
+        },
+        "kind": {
+          "enum": [
+            "builtin_opus",
+            "endpoint"
+          ],
+          "type": "string"
+        }
+      },
+      "required": [
+        "kind"
+      ],
+      "type": "object"
+    },
+    "sla_seconds": {
+      "minimum": 1,
+      "type": "number"
+    }
+  },
+  "required": [
+    "enabled"
+  ],
+  "type": "object"
+}

addedInput schema / properties / body / properties / review

Added value: +{
+  "description": "Review-hold policy (Safe House Review, Slice 2a — MNE-920 design). gate_on is the minimum verdict band per surface that escalates to a review-hold. Composition is strictest-wins; on_timeout defaults to 'reject' (fail-closed). reviewer.kind 'endpoint' is designed for MNE-1650 and not consumed yet.",
+  "properties": {
+    "enabled": {
+      "type": "boolean"
+    },
+    "gate_on": {
+      "properties": {
+        "incoming": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "integrity": {
+          "enum": [
+            "off",
+            "review_needed",
+            "boundary_violation"
+          ],
+          "type": "string"
+        },
+        "outgoing": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "tool_calls": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "tool_responses": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "notify": {
+      "properties": {
+        "sse": {
+          "type": "boolean"
+        },
+        "webhooks": {
+          "type": "boolean"
+        }
+      },
+      "type": "object"
+    },
+    "on_timeout": {
+      "enum": [
+        "reject",
+        "release"
+      ],
+      "type": "string"
+    },
+    "quarantine_notice": {
+      "maxLength": 2000,
+      "type": "string"
+    },
+    "reviewer": {
+      "properties": {
+        "endpoint_url": {
+          "format": "uri",
+          "type": "string"
+        },
+        "kind": {
+          "enum": [
+            "builtin_opus",
+            "endpoint"
+          ],
+          "type": "string"
+        }
+      },
+      "required": [
+        "kind"
+      ],
+      "type": "object"
+    },
+    "sla_seconds": {
+      "minimum": 1,
+      "type": "number"
+    }
+  },
+  "required": [
+    "enabled"
+  ],
+  "type": "object"
+}

Changedput_protection_by_agent4 fields changed

addedInput schema / $defs / UnifiedProtectionCard / properties / review

Added value: +{
+  "description": "Review-hold policy (Safe House Review, Slice 2a — MNE-920 design). gate_on is the minimum verdict band per surface that escalates to a review-hold. Composition is strictest-wins; on_timeout defaults to 'reject' (fail-closed). reviewer.kind 'endpoint' is designed for MNE-1650 and not consumed yet.",
+  "properties": {
+    "enabled": {
+      "type": "boolean"
+    },
+    "gate_on": {
+      "properties": {
+        "incoming": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "integrity": {
+          "enum": [
+            "off",
+            "review_needed",
+            "boundary_violation"
+          ],
+          "type": "string"
+        },
+        "outgoing": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "tool_calls": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "tool_responses": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "notify": {
+      "properties": {
+        "sse": {
+          "type": "boolean"
+        },
+        "webhooks": {
+          "type": "boolean"
+        }
+      },
+      "type": "object"
+    },
+    "on_timeout": {
+      "enum": [
+        "reject",
+        "release"
+      ],
+      "type": "string"
+    },
+    "quarantine_notice": {
+      "maxLength": 2000,
+      "type": "string"
+    },
+    "reviewer": {
+      "properties": {
+        "endpoint_url": {
+          "format": "uri",
+          "type": "string"
+        },
+        "kind": {
+          "enum": [
+            "builtin_opus",
+            "endpoint"
+          ],
+          "type": "string"
+        }
+      },
+      "required": [
+        "kind"
+      ],
+      "type": "object"
+    },
+    "sla_seconds": {
+      "minimum": 1,
+      "type": "number"
+    }
+  },
+  "required": [
+    "enabled"
+  ],
+  "type": "object"
+}

addedInput schema / properties / body / properties / review

Added value: +{
+  "description": "Review-hold policy (Safe House Review, Slice 2a — MNE-920 design). gate_on is the minimum verdict band per surface that escalates to a review-hold. Composition is strictest-wins; on_timeout defaults to 'reject' (fail-closed). reviewer.kind 'endpoint' is designed for MNE-1650 and not consumed yet.",
+  "properties": {
+    "enabled": {
+      "type": "boolean"
+    },
+    "gate_on": {
+      "properties": {
+        "incoming": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "integrity": {
+          "enum": [
+            "off",
+            "review_needed",
+            "boundary_violation"
+          ],
+          "type": "string"
+        },
+        "outgoing": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "tool_calls": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "tool_responses": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "notify": {
+      "properties": {
+        "sse": {
+          "type": "boolean"
+        },
+        "webhooks": {
+          "type": "boolean"
+        }
+      },
+      "type": "object"
+    },
+    "on_timeout": {
+      "enum": [
+        "reject",
+        "release"
+      ],
+      "type": "string"
+    },
+    "quarantine_notice": {
+      "maxLength": 2000,
+      "type": "string"
+    },
+    "reviewer": {
+      "properties": {
+        "endpoint_url": {
+          "format": "uri",
+          "type": "string"
+        },
+        "kind": {
+          "enum": [
+            "builtin_opus",
+            "endpoint"
+          ],
+          "type": "string"
+        }
+      },
+      "required": [
+        "kind"
+      ],
+      "type": "object"
+    },
+    "sla_seconds": {
+      "minimum": 1,
+      "type": "number"
+    }
+  },
+  "required": [
+    "enabled"
+  ],
+  "type": "object"
+}

addedOutput schema / $defs / UnifiedProtectionCard / properties / review

Added value: +{
+  "description": "Review-hold policy (Safe House Review, Slice 2a — MNE-920 design). gate_on is the minimum verdict band per surface that escalates to a review-hold. Composition is strictest-wins; on_timeout defaults to 'reject' (fail-closed). reviewer.kind 'endpoint' is designed for MNE-1650 and not consumed yet.",
+  "properties": {
+    "enabled": {
+      "type": "boolean"
+    },
+    "gate_on": {
+      "properties": {
+        "incoming": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "integrity": {
+          "enum": [
+            "off",
+            "review_needed",
+            "boundary_violation"
+          ],
+          "type": "string"
+        },
+        "outgoing": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "tool_calls": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "tool_responses": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "notify": {
+      "properties": {
+        "sse": {
+          "type": "boolean"
+        },
+        "webhooks": {
+          "type": "boolean"
+        }
+      },
+      "type": "object"
+    },
+    "on_timeout": {
+      "enum": [
+        "reject",
+        "release"
+      ],
+      "type": "string"
+    },
+    "quarantine_notice": {
+      "maxLength": 2000,
+      "type": "string"
+    },
+    "reviewer": {
+      "properties": {
+        "endpoint_url": {
+          "format": "uri",
+          "type": "string"
+        },
+        "kind": {
+          "enum": [
+            "builtin_opus",
+            "endpoint"
+          ],
+          "type": "string"
+        }
+      },
+      "required": [
+        "kind"
+      ],
+      "type": "object"
+    },
+    "sla_seconds": {
+      "minimum": 1,
+      "type": "number"
+    }
+  },
+  "required": [
+    "enabled"
+  ],
+  "type": "object"
+}

addedOutput schema / properties / review

Added value: +{
+  "description": "Review-hold policy (Safe House Review, Slice 2a — MNE-920 design). gate_on is the minimum verdict band per surface that escalates to a review-hold. Composition is strictest-wins; on_timeout defaults to 'reject' (fail-closed). reviewer.kind 'endpoint' is designed for MNE-1650 and not consumed yet.",
+  "properties": {
+    "enabled": {
+      "type": "boolean"
+    },
+    "gate_on": {
+      "properties": {
+        "incoming": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "integrity": {
+          "enum": [
+            "off",
+            "review_needed",
+            "boundary_violation"
+          ],
+          "type": "string"
+        },
+        "outgoing": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "tool_calls": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "tool_responses": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "notify": {
+      "properties": {
+        "sse": {
+          "type": "boolean"
+        },
+        "webhooks": {
+          "type": "boolean"
+        }
+      },
+      "type": "object"
+    },
+    "on_timeout": {
+      "enum": [
+        "reject",
+        "release"
+      ],
+      "type": "string"
+    },
+    "quarantine_notice": {
+      "maxLength": 2000,
+      "type": "string"
+    },
+    "reviewer": {
+      "properties": {
+        "endpoint_url": {
+          "format": "uri",
+          "type": "string"
+        },
+        "kind": {
+          "enum": [
+            "builtin_opus",
+            "endpoint"
+          ],
+          "type": "string"
+        }
+      },
+      "required": [
+        "kind"
+      ],
+      "type": "object"
+    },
+    "sla_seconds": {
+      "minimum": 1,
+      "type": "number"
+    }
+  },
+  "required": [
+    "enabled"
+  ],
+  "type": "object"
+}

1 tool updateJul 2, 2026

Changedget_started2 fields changed

addedOutput schema / properties / authenticate / properties / headless

Added value: +{
+  "additionalProperties": false,
+  "description": "The headless/cloud write-auth fallback (MNE-1392): when your host has no local browser and the standard OAuth redirect can't complete, drive the RFC 8628 Device Authorization Grant yourself.",
+  "properties": {
+    "discovery": {
+      "format": "uri",
+      "type": "string"
+    },
+    "grant_type": {
+      "type": "string"
+    },
+    "note": {
+      "type": "string"
+    },
+    "steps": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "use": {
+      "type": "string"
+    },
+    "when": {
+      "type": "string"
+    }
+  },
+  "required": [
+    "when",
+    "use",
+    "grant_type",
+    "discovery",
+    "steps"
+  ],
+  "type": "object"
+}

changedOutput schema / properties / authenticate / required

Previous value: -[
-  "methods",
-  "unlocks",
-  "discovery"
-]New value: +[
+  "methods",
+  "unlocks",
+  "discovery",
+  "headless"
+]

1 tool updateJun 27, 2026
- Removedget_risk_history

2 tool updatesJun 23, 2026

Changedget_agent14 fields changed

removedOutput schema / $defs / Agent / properties / aap_enabled

Removed value: -{
-  "description": "Owner projection: AAP pipeline enabled.",
-  "type": "boolean"
-}

removedOutput schema / $defs / Agent / properties / aip_enabled

Removed value: -{
-  "description": "Owner projection: AIP pipeline enabled.",
-  "type": "boolean"
-}

removedOutput schema / $defs / Agent / properties / analyze_output

Removed value: -{
-  "description": "Owner projection: analyze agent output.",
-  "type": [
-    "boolean",
-    "null"
-  ]
-}

removedOutput schema / $defs / Agent / properties / ddr_mode

Removed value: -{
-  "description": "Owner projection: drift-detection-response mode (mig default 'flag').",
-  "type": "string"
-}

removedOutput schema / $defs / Agent / properties / nudge_strategy

Removed value: -{
-  "description": "Owner projection: nudge strategy.",
-  "type": [
-    "string",
-    "null"
-  ]
-}

removedOutput schema / $defs / Agent / properties / proof_enabled

Removed value: -{
-  "description": "Owner projection: proof capture enabled.",
-  "type": "boolean"
-}

removedOutput schema / $defs / Agent / properties / proof_rate

Removed value: -{
-  "description": "Owner projection: proof sampling rate (0–100%).",
-  "type": "integer"
-}

removedOutput schema / properties / aap_enabled

Removed value: -{
-  "description": "Owner projection: AAP pipeline enabled.",
-  "type": "boolean"
-}

removedOutput schema / properties / aip_enabled

Removed value: -{
-  "description": "Owner projection: AIP pipeline enabled.",
-  "type": "boolean"
-}

removedOutput schema / properties / analyze_output

Removed value: -{
-  "description": "Owner projection: analyze agent output.",
-  "type": [
-    "boolean",
-    "null"
-  ]
-}

removedOutput schema / properties / ddr_mode

Removed value: -{
-  "description": "Owner projection: drift-detection-response mode (mig default 'flag').",
-  "type": "string"
-}

removedOutput schema / properties / nudge_strategy

Removed value: -{
-  "description": "Owner projection: nudge strategy.",
-  "type": [
-    "string",
-    "null"
-  ]
-}

removedOutput schema / properties / proof_enabled

Removed value: -{
-  "description": "Owner projection: proof capture enabled.",
-  "type": "boolean"
-}

removedOutput schema / properties / proof_rate

Removed value: -{
-  "description": "Owner projection: proof sampling rate (0–100%).",
-  "type": "integer"
-}

Changedlist_agents7 fields changed

removedOutput schema / $defs / Agent / properties / aap_enabled

Removed value: -{
-  "description": "Owner projection: AAP pipeline enabled.",
-  "type": "boolean"
-}

removedOutput schema / $defs / Agent / properties / aip_enabled

Removed value: -{
-  "description": "Owner projection: AIP pipeline enabled.",
-  "type": "boolean"
-}

removedOutput schema / $defs / Agent / properties / analyze_output

Removed value: -{
-  "description": "Owner projection: analyze agent output.",
-  "type": [
-    "boolean",
-    "null"
-  ]
-}

removedOutput schema / $defs / Agent / properties / ddr_mode

Removed value: -{
-  "description": "Owner projection: drift-detection-response mode (mig default 'flag').",
-  "type": "string"
-}

removedOutput schema / $defs / Agent / properties / nudge_strategy

Removed value: -{
-  "description": "Owner projection: nudge strategy.",
-  "type": [
-    "string",
-    "null"
-  ]
-}

removedOutput schema / $defs / Agent / properties / proof_enabled

Removed value: -{
-  "description": "Owner projection: proof capture enabled.",
-  "type": "boolean"
-}

removedOutput schema / $defs / Agent / properties / proof_rate

Removed value: -{
-  "description": "Owner projection: proof sampling rate (0–100%).",
-  "type": "integer"
-}

2 tool updatesJun 23, 2026
- Addedpreview_compose_protection_by_agent
- Addedput_protection_by_agent

1 tool updateJun 21, 2026

Changedget_started1 field changed

addedInput schema / properties / token

Added value: +{
+  "description": "Optional Dojo try-me invite token. When supplied and valid, returns the token-gated dojo briefing manifest (the same content as GET /v1/dojo/try-me/resolve); omit for public orientation.",
+  "type": "string"
+}

5 tool updatesJun 12, 2026
- Changedget_risk_history3 fields changed
  - addedInput schema / properties / include_playground / description
```
Added value: +"When true, include assessments produced in playground/test runs alongside production ones. Default false (production only)."
```
  - addedInput schema / properties / limit / description
```
Added value: +"Maximum number of risk assessments to return (most recent first). 1–100, default 20."
```
  - addedInput schema / properties / offset / description
```
Added value: +"Number of assessments to skip before returning results, for pagination. Default 0."
```
- Changedreport_recipe_fn_fp1 field changed
  - addedInput schema / properties / recipeId / description
```
Added value: +"The detection_recipes id the report is filed against (the recipe that misfired or failed to fire)."
```
- Changedscan_trust5 fields changed
  - addedOutput schema / properties / access / properties / categories / description
```
Added value: +"Per-category Access scores + checks."
```
  - addedOutput schema / properties / access / properties / grade / description
```
Added value: +"Access letter grade (A+…F)."
```
  - addedOutput schema / properties / access / properties / score / description
```
Added value: +"0–100 weighted Access/discoverability score (independent of Trust)."
```
  - addedOutput schema / properties / access / properties / version / description
```
Added value: +"Access-axis rubric version this sub-score was computed against."
```
  - addedOutput schema / properties / signature / properties / signedAt / description
```
Added value: +"When the scorecard was signed."
```
- Changedsearch_reputation_directory4 fields changed
  - addedInput schema / properties / confidence / description
```
Added value: +"Filter to agents at a given reputation-confidence level (driven by how much evidence backs the score)."
```
  - addedInput schema / properties / page / description
```
Added value: +"1-based page number for pagination. Default 1."
```
  - addedInput schema / properties / per_page / description
```
Added value: +"Number of results per page. 1–100, default 20."
```
  - addedInput schema / properties / sort / description
```
Added value: +"Result ordering. Default \"score\" (highest-rated first); other supported keys order by recency or name."
```
- Changedverify_scan5 fields changed
  - addedInput schema / properties / scan / properties / access / properties / categories / description
```
Added value: +"Per-category Access scores + checks."
```
  - addedInput schema / properties / scan / properties / access / properties / grade / description
```
Added value: +"Access letter grade (A+…F)."
```
  - addedInput schema / properties / scan / properties / access / properties / score / description
```
Added value: +"0–100 weighted Access/discoverability score (independent of Trust)."
```
  - addedInput schema / properties / scan / properties / access / properties / version / description
```
Added value: +"Access-axis rubric version this sub-score was computed against."
```
  - addedInput schema / properties / scan / properties / signature / properties / signedAt / description
```
Added value: +"When the scorecard was signed."
```

Related MCP Connectors

Joy Trust Network B
io.github.tlkc888-Jenkins
Trust infrastructure for AI agents. Portable reputation (JTS 0-5), agent discovery, vouching.
Autonomous Agents Security
312
Agent^Rider C
io.github.ceedot-rock
Signed agent identity, trust scoring, credit economy, and social layer for AI agents.
Security Agent Orchestration
6621
MINT Protocol — Universal Work Attestation A
io.github.FoundryNet
Trust stack for AI agents: identity, attest, verify, rate, recommend, discover — on Solana.
Blockchain Web3 & Decentralized Tech Autonomous Agents
22
BLOCKTRUST TrustScan
io.github.brnbtech770
Trust verification for AI agents: identities, domains, phishing, contacts, Trust Circle, Vault.
Security Web3 & Decentralized Tech
2

Related MCP Servers

maiat-protocol
Blockchain Agent Orchestration Finance
JhiNResH
A
license
A
quality
D
maintenance
Trust infrastructure for the agent economy.
Updated 4 months ago (2026-06-27 02:17 UTC)
10
3
MIT
Agent Reputation MCP Server
AiAgentKarl
A
license
Not graded
quality
D
maintenance
Trust and reputation system for AI agents, enabling tracking, verifying, and building trust through scores, interactions, ratings, and reports.
Updated 6 months ago (2026-04-03 16:05 UTC)
MIT
TrustMesh MCP Server
Autonomous Agents Security AI & Machine Learning
Clioloop
A
license
Not graded
quality
Not graded
maintenance
Provides AI agents with trust scoring and reputation management capabilities for secure interactions. Enables agents to check trust scores, rate interactions, and manage disputes before transacting with other agents.
Updated 6 months ago (2026-04-19 00:57 UTC)
-
Agent Guild
Autonomous Agents
AgentTanuki
A
license
B
quality
A
maintenance
Agent trust checks, reputation and signed passports. Glama's build is a separate local Guild with an empty graph and its own issuer. Registrations and evidence stay local. Use the remote MCP connector for the shared hosted Guild; its free preflight and metered trust services are separate.
Updated 20 days ago (2026-09-24 13:34 UTC)
43
Apache 2.0

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Server Details

Available Tools

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Tool Schema Changelog

Related MCP Connectors

Related MCP Servers

Glama MCP Gateway

Resources