Find the authoritative live structured-workflow registry. Call this before start_workflow instead of guessing an id from examples or a static catalog. It covers every deployed workflow family, including risk/TARA, DPIA/FRIA, regulatory and medical-device gap analysis, procurement, document review, drone/OT workflows, and vulnerability decisions. Each entry carries workflow_type, base_type, display_name, description, produces (the final deliverable), required_slots, overridable_configurable, legal-review state, plus gateway-added minimum_tier and available_to_caller fields. Every tier sees the full directory; which rows are marked available depends on the caller — free and solo the seven included rows (threat_model, gap_analysis with its NIS2, DORA, CRA and AI Act variants, dpia), Premium the interview-grounded rows (adding LINDDUN, TARA, FRIA, the jurisdictional DPIA and gap variants, SORA, drone/OT, machinery conformity, enterprise risk), Team and Company every live row. A row locked by TIER carries tier_caveat: which tier runs it, what that tier adds, and the upgrade URL — so a tier-locked row is never a bare false. Discovery service failures and malformed responses fail explicitly; no static list is returned as if it were live.