Start or replay a concurrent session from an explicit user command.

briefing defaults to full detail; compact returns counts and IDs in at most 4,000 characters. Focus text appears only in session.started_focus.

An agent tracer is the only session the server opens or closes on its own; no hook and no auto-close may invoke this lifecycle boundary.

Attach durable artifacts from an explicit user command — to repair or refine.

No longer a compulsory ritual. With derived capture armed, artifacts created during the session are attributed without this call, and end no longer demands a receipt. What this tool is for now: attaching something the derivation could not see — created outside the window, on another connection, or in another project — and saying so on the record.

It never steals: an artifact already attributed stays where it is.

An agent tracer is the only session the server opens or closes on its own; no hook and no auto-close may invoke this lifecycle boundary.

Refresh an open session from an explicit user command.

An agent tracer is the only session the server opens or closes on its own; no hook and no auto-close may invoke this lifecycle boundary.

End a session from an explicit user command, on judgement alone.

nothing_to_capture_reason is now OPTIONAL. The old rule — a non-empty ledger XOR a written reason — measured whether the client had DECLARED its work. Derived capture feeds that signal from the server, and a check is hollow the moment the thing it checks can influence its own signal; worse, it made a session whose ledger the server had filled impossible to close. Give a reason if you have one to give; a blank one is still refused, because saying nothing and saying " " are not the same act.

What end still requires is what the server cannot produce for you: a summary and a next focus. It REPORTS unattributed_in_window — artifacts of this project created during the session that belong to no ledger — as a measure, never a gate. It cannot refuse a close, and a session cannot improve it by doing nothing.

For a bound session, expected_focus_revision is the SLOT revision (from bind, resume, or relay's slot.revision), never started_focus_revision.

For an UNBOUND session, next_focus REPLACES the project's whole base focus under a compare-and-swap on expected_focus_revision. SHRINK GUARD: a next_focus under 70% of the current base focus is refused before any write (base_focus_shrink, current, proposed and floor in the message) and the session stays open, so carry the durable content over and call again. A bound end REPLACES the whole slot body and meets the same 70% guard (slot_focus_shrink). allow_focus_shrink = true requires an active /brain-admin elevation for this credential and MCP connection; otherwise focus_shrink_override_refused is raised before any mutation. Shared-token and stdio callers cannot override; an operator relay can. A stale revision is still recorded as a conflict and closes the session, since nothing is written.

An agent tracer is the only session the server opens or closes on its own; no hook and no auto-close may invoke this lifecycle boundary.

Relay an open session onto its slot, or its project base: capture, end, restart.

One transaction: the named knowledge_ids are captured into the old session, the handover is written under a compare-and-swap, the old session ends, and a successor opens under new_client_key; its briefing follows. Two forms, and exactly one revision per call.

briefing defaults to full detail; compact returns counts and IDs in at most 4,000 characters. Focus text appears only in session.started_focus.

Bound session: send expected_slot_revision; the handover (at most 4,000 characters) REPLACES the whole slot body and the successor stays on the slot. A closed slot or a stale revision changes nothing and leaves the session open.

Unbound session: send expected_focus_revision, the BASE revision; the handover becomes the project's whole base focus and the successor is unbound. A stale revision (focus_revision_conflict) changes nothing and leaves the session open, unlike end, which closes anyway. SHRINK GUARD: a handover under 70% of the current base focus is refused (base_focus_shrink, both lengths in the message), because it REPLACES the whole base: carry the durable content over. An operator relay may pass allow_focus_shrink = true only with an active /brain-admin elevation for this credential and MCP connection; a guard mod never can.

The same 70% guard applies to a bound slot body (slot_focus_shrink). The override is enforced before mutation: only initiator='operator' can pass it, and only with an active /brain-admin elevation for this credential and MCP connection. A guard_mod relay is refused even if elevated.

An equal replay returns the same successor with replayed = true; any other payload on an ended session is terminal_conflict. The successor's next end or relay sends result.slot.revision (bound: the SLOT revision, from bind, resume, or relay) or result.focus_revision (unbound: the new BASE revision), never started_focus_revision for a bound one.

A guard mod the operator explicitly enabled may make this call as a standing user command, and only this one (Amendment — slot relay (ADR #34)); with initiator = 'guard_mod' it is refused while BRAIN_SESSION_RELAY_GUARD_MOD_ENABLED is false.

An agent tracer is the only session the server opens or closes on its own; no hook and no auto-close may invoke this lifecycle boundary.

List sessions only in response to an explicit user command.

An agent tracer is the only session the server opens or closes on its own; no hook and no auto-close may invoke this lifecycle boundary.

Resume an open session from an explicit user command.

An agent tracer is the only session the server opens or closes on its own; no hook and no auto-close may invoke this lifecycle boundary.

Bind an open operator session to one focus slot, from an explicit user command.

Once per session; binding the same slot again is a replay. From then on the session's end writes that slot only, never the project base: expected_focus_revision is the slot revision returned here. Refusals: session_not_open, session_is_agent_trace, session_already_bound, slot_not_found, slot_closed, slot_project_mismatch, slot_busy.

An agent tracer is the only session the server opens or closes on its own; no hook and no auto-close may invoke this lifecycle boundary.

Abandon a session only from an explicit user command.

An agent tracer is the only session the server opens or closes on its own; no hook and no auto-close may invoke this lifecycle boundary.

Search for tools using natural language.

Returns up to 5 matching tools ranked by relevance, each as a summary: name, one-line description, required parameters with types, optional parameter names. Pass an exact tool name to get that tool's full input schema.

Call a tool by name with the given arguments.

Use this to execute tools discovered via search_tools.