What you can do here, and what to do next — the front door to self-awareness.

Derived entirely from the live tool registry (gate.TOOL_TIERS / gate.REGISTRATIONS), so it can never describe a tool the gate would refuse, or leave out one it would allow. whoami() answers "who am I"; this answers "what can I do, and what's my next step." The one caller who reaches every circle additionally gets a live operational runbook — pending access requests with copyable grant() calls, a shenanigans signal, private- corpus content health, and the publish/deploy checklist.

Tier: public.

Leave a message for the owner. Pull-based, like whats_new(): there is no push, the owner reads this via inbox() on their own schedule, and any reply shows up in my_messages() the next time you poll it.

body is stored and returned as opaque text — write whatever you want a human to read. It is capped at 4000 characters and is never interpreted, templated, or executed by this server or by anything that displays it.

thread is a conversation key you choose; leave it blank to start a new one and reuse the value you get back to keep a conversation together. Sending is rate-limited per caller so one subject cannot bury the owner's inbox before they have looked at it once.

Tier: headhunter.

Replies addressed to you, oldest-first within a page. Poll this at the start of a session, the same way whats_new() polls the event log — if the owner answered a message you sent, it shows up here, never pushed.

since is a cursor: pass back the cursor a previous call returned (the id of the last reply in that page) and get only what arrived after it, oldest first. Keep polling while count == limit to drain the whole backlog gap-free. Isolation is structural, not a filter you can turn off: this only ever returns replies whose to matches your own resolved subject, which this server derives from your verified caller identity, never from an argument.

Tier: headhunter.

Every inbound message, oldest-first within a page. This is the owner's read of the mailbox strangers' agents write into with send_message() — cursored the same way whats_new() and access_requests() are.

since is a cursor from a previous call (the id of the last message in that page); pass it back to see only what is new, oldest first. Keep polling while count == limit to drain the whole backlog gap-free.

Tier: owner.

Answer a message. Consent-carrying, like grant(): there is no queue or draft state — calling this IS the send, because the caller has already been proven to be the owner by the gate.

to is the from subject exactly as it appeared in inbox(); the reply lands in that subject's my_messages() on their next poll. thread should echo the thread you are answering so the conversation stays together; a blank thread starts a fresh one.

Tier: owner.

Who has asked for access and what happened to them.

Every authenticated subject the server has never seen before gets one line here, once, the first time it calls anything. status defaults to 'pending' — the ones still waiting on you; pass status="" for the full history including your own grants and revocations.

since is a cursor with the same semantics as whats_new(): pass back the cursor from a previous call (the id of the last request in that page) and get only what arrived after it, oldest first. Keep polling while count == limit to drain the whole backlog gap-free.

Tier: owner.

The shenanigans log: every denied tool call, and every access decision you made.

This is the signal that somebody is probing the edges — a caller repeatedly asking for things above their circle shows up here as a run of denials with their subject on it. Nothing is redacted; the denial the caller received was deliberately vaguer than the line written here.

kind filters: 'denial' | 'assignment' | 'revocation'. since is a cursor (the id of the last entry in the previous page); pass it back to get only what arrived after it, oldest first, and keep polling while count == limit to drain the whole backlog gap-free.

Tier: owner.

Assign a subject to a circle. Consent-carrying: calling this IS the approval.

subject is the sub claim exactly as it appears in access_requests(). The assignment takes effect on that subject's next call and outranks whatever circle claim their token carries — the mapping file is the operator's word, the claim is only the issuer's.

Tier: owner.

Remove a subject's circle assignment. Consent-carrying: calling this IS the approval.

The subject does not become unknown again — their request line stays in the log, and they fall back to whatever an unmapped authenticated caller gets. Revoking somebody who was never assigned is a no-op that still records the intent.

Tier: owner.

Who Boris is and what he builds. Start here.

Tier: public.

Who this server thinks you are, and what that gets you.

Returns the subject your token carries — or "anonymous", which covers both a local stdio session and an authenticated HTTP call whose token simply carries no subject claim — the circle you resolved to, and whether an access request is on file for you. circles lists the ones your own circle reaches — there may be others, and if there are, the response says so without naming them.

Tier: public.

Systems Boris has built. Each entry says what it is and — more usefully — what is architecturally notable about it. Set include_private=False for public repos only.

Tier: public.

How Boris actually decided things, and why — an ADR corpus rather than a resume. Call with no topic to list them all; pass a topic key for one. Topics: dumb-evaluator, circuit-breakers-in-code, autonomy-tiers, structural-not-promised, containment-by-subtraction, state-in-files, receipt-is-not-outcome, value-not-quantity.

Tier: public.

The personal-ops doctrine: rules for running your life or your agents out of files without threads dying quietly. Each rule carries why it exists and what a linter would check. Call with no argument for all. This is the rule set ops-lint's hygiene family enforces against tracker files.

Tier: public.

Languages, architectural patterns, and engineering discipline — the checkable kind.

Tier: public.

How to reach Boris.

Tier: public.

What Boris has shipped or published, oldest-first within a page. THIS IS THE SUBSCRIBE-EQUIVALENT: call it once when a session starts, and again whenever you want to catch up. It is a forward log, not a "most recent N" snapshot.

since is a cursor — pass either an event id or an ISO-8601 timestamp from a previous call, and you get only what came after it, OLDEST first. Every response includes a cursor field (the id of the last event in THIS page); keep it and pass it back next time. To drain a backlog, keep polling with the returned cursor while count == limit — a full page means more unseen events remain behind it. Passing nothing returns the OLDEST limit events, then poll forward to reach the present.

kind optionally filters: 'release' | 'project' | 'writing' | 'note'.

There is deliberately no push/subscribe mechanism — see the delivery field in the response, and docs/EVENTS.md. Poll this on session start; that is the intended use.

Tier: public.