WRITE to your Unlimitless brief lane + alias confirms (operational — NEVER ratification; sealing canon stays save_to_unl's anchor-gated gesture). One verb, routed by action; every call needs the single-use write-nonce. action: 'create_venture' — MINT a new venture: venture (their name for it) + human_direction + session. A name that doesn't resolve is a QUESTION, never a mint — a typo must not become a venture, and the write is refused without human_direction + nonce. ★ TWO CALLS, BECAUSE FOUNDING IS A LANDING: the first call writes NOTHING and hands you the offer to put to them in your own words; when they have ANSWERED, call again with the same name, their answer as human_direction, the same nonce, and origination_confirm_token. Their statement of what they are working on is the SUBJECT of the offer, never the answer to it, so the two calls must carry different words. A no, a silence or a change of subject ends it. The new venture starts empty and the writes that follow file to it; each later turn is read afresh from what it says, so nobody switches back (nothing is moved or lost — port things over if they belong there). 'withdraw_venture' — TAKE ONE BACK OUT on their word: venture + human_direction + nonce. One call, no confirmation step and no defence of the original write — a correction is theirs absolutely and asking them to justify it is the failure. Withdrawn, never deleted: the row stands and stays walkable, and it is gone from every list, resolve and serve — which is the whole of what they can see. Un-pinning is NOT this; that leaves the row to resurface. 'file_brief' — file a work_in_progress brief. content AND new_master_order are BOTH required: a brief is filed WITH its Critical Path position in the same gesture, or it is not filed (no brief is ever born a passenger). A filing that names no position is REFUSED and handed the current tail, so "I have no basis to judge priority" costs one field rather than a second call. Optional: lane, order_rank (the PER-LANE rank — internal routing, never a Critical Path position), governed_by, target_id, waiting_on. 'brief_steps' — author/REPLACE a brief's ordered executable steps (target by brief_id OR lane+order_rank; steps[] required). 'port_reflection' / 'port_ruling' — MOVE something between spaces (free space ↔ venture ↔ venture): item + to + human_direction. The move needs the human's words and a nonce; without them the write is refused. A reflection just moves (its why rides along). A ratified ruling cannot move — it is superseded where it is and refiled where it goes, carrying its why and a pointer home; canon is added to, never rewritten. 'file_target' — create a target/aim a brief serves (title required; optional venture, status). 'manage_brief' — change an existing brief (target by brief_id OR lane+order_rank): new_lane, new_order_rank, content, waiting_on, target_id, governed_by, autonomy, verified_against (stamp the source state the note was read against — {sha, at}, optional), depends_on (wire a brief→brief dependency, type-safe); OR set the CRITICAL PATH (the master sequence) via master_order_ids (front-anchored, self-deriving) or brief_id+new_master_order; OR UNRANK back to not-yet-sequenced via unrank_master_ids. 'claim_brief' — CLAIM a brief you are about to work under the standing instruction, so a concurrent agent's next-bar-ready read skips it: brief_id + session_token (the agent id). An operational in-flight marker only — never rank, never ratification; atomic (a genuine race resolves to one holder), auto-expires after a 10-min TTL (re-claim to renew the heartbeat), and release=true hands it back (the manage_unl tool with action="close_brief" releases too). 'declare_run' — DECLARE THE INSTRUMENTED RUN this agent belongs to, once, and every later verb inherits it: run_id (an opaque lowercase slug — the join key for the whole causal chain) + session_token (the agent this binds to), optionally condition / fleet_size / pool (the experiment's grouping dimensions — LABELS, never a description of the task). After it, your claims, gate cycles, stops and run report all carry the run without restating it; the SERVE lane carries it separately from your shell (UNL_RUN_ID), so set it in both or the run's context serves will not join. Operational only — it creates no brief, claims nothing, ranks nothing, and never touches the substrate. 'close_brief' — close with a terminal state: disposition completed|superseded|retired (default completed), optional note; closing an already-closed brief is a no-op. 'flag_north_star' — SET AN EXISTING RULING'S NORTH-STAR FLAG on the human's recorded word: ruling_id + north_star (true | false) + provenance (the momentum id carrying their VERBATIM, resolved at write). Flagging a ruling that is not live canon is refused; unflagging any ruling is allowed. The flag is a machine key, never the ruling's words; every change leaves a direction beat citing the provenance. Whether a ruling is a north star is the human's call, so an agent runs this only on their recorded word. 'record_word' — THE WORD LANE: bank the human's GATE WORD as a row ON the brief it governs, so it stops being prose an agent has to be told about and becomes state ANY agent can execute with no relay. brief_id (or lane+order_rank) + word ('merge'|'hold') + scope (what it covers, their terms) + sha (REQUIRED for merge — the commit they gave it at) + provenance (the momentum id carrying their VERBATIM, resolved at write; a word that cannot be walked back to what they actually said is refused). Recording a word is REPORTING what the human said, never ratification and never a judgement that the word should be given. 'spend_word' — EXECUTE a standing word: word_id + observed_sha (the sha in front of you NOW) + observed_scope (what you are about to do) + optional execution_ref (the merge sha, recorded beside the word). SPENT ONCE and the word DOES NOT STRETCH — both the sha and the scope are compared inside the atomic claim, so two agents cannot both spend one word and a MOVED sha cannot be spent at all however the race falls. A refusal names which it was; a moved sha or mismatched scope RE-KNOCKS (put the question back to the human — there is no safe way to widen their word), while an already-spent word does not (another agent executed it, which is the system working). 'retire_word' — RETIRE a word whose PREMISE DIED, the third and final exit beside spend: word_id + retire_reason + provenance. A word pinned to a sha that a rebase moved, or to a PR that closed unmerged, can otherwise only be SPENT or stand forever — and spending it would record the act as authorised by a word that never covered what actually shipped. Retired words leave the human's open-questions panel and can never be spent; the row and its whole history stand, so it is a status move and never a delete. PROVENANCE IS REQUIRED AND IT IS THE SAFETY PROPERTY: a gate word IS the human's authority, so an agent able to retire one on its own judgement could dismiss the human's gate by deciding it no longer applied. Retiring costs exactly what recording cost — a momentum id carrying their own verbatim. 'answer_stop' — CLOSE A STOP the human has answered: stop_id + answered_by. This is the other half of the word lane — a stop stands in the chat agent's window every turn until it is machine-closed, and this is what closes it, so it stops standing and stops escalating. answered_by is REQUIRED and deliberately does NOT default to the calling agent: it carries the momentum id holding the human's verbatim, or the surface they answered on, because a closure with no provenance cannot be walked back to the words and recording the agent would say the agent answered a question that was the human's. Spent once, atomic, keyed on the stop itself; the question is never edited, so the walk reads both ways. 'file_message' — LEAVE A NOTE FOR A WORKING SEAT: to_seat (an agent's session token, or '*' for every live agent) + body + session_token (you, the sender). The note reaches the agent on ITS NEXT TURN through the agent's own per-turn pull — unl pushes nothing into a runtime, so this verb writes an inert row and the agent collects it. Served in full exactly once, then it rides as a pointer; that first serve stamps the receipt, and YOUR next serve shows what landed, so 'did my correction arrive' is answerable without asking the terminal. This is a CORRECTION lane, not a chat channel — scarce by the same law as knocks. Two refusals, both before the nonce is touched: a body that asserts a STATE (it rots before it is read), and one that reads as a spendable gate-word (that is the manage_unl tool with action="record_word"'s lane, and a broadcast word could be spent by every agent at once). 'reopen_brief' — reverse a close: clears closed_at/closed_by and the supersession key, returns the brief to work_in_progress (optional note appended); reopening an open brief is a no-op. REQUIRES new_master_order — a reopened brief is the SECOND door onto the departures board, so it is placed by a judgment made NOW: never its stale old slot by default, never the tail by default. The refusal shows you the stale position, who holds that slot today, and the tail, so you can judge contextually; the queue INSERTS (everything from your position down shifts back one), it never evicts. If the placement is contentious, raise it for the human's sign-off before it lands. 'archive_brief' — move a CLOSED brief into the 'done' lane. 'confirm_aliases' — EDIT a ruling's retrieval aliases (ruling_id + aliases[]; the human's pick; [] clears) — findability only, never canon. Aliases are AUTO-APPLIED on seal, so this is an optional later edit, never a required step. 'attach_refines' — wire a ruling→ruling 'refines' edge between two ALREADY-SEALED rulings (from_ruling refines to_ruling); both must resolve to rulings; idempotent. Records a ratified relation, not new canon. 'wire_edge' — the GENERAL edge writer: wire any genuine edge the substrate supports (from_id, edge_type, to_id, optional edge_why). Routes on the resolved from-type + edge_type + to-type and refuses a triple the schema does not call an edge; idempotent. Covers brief edges (depends_on, produces, proposes), reflection edges (relates_to, revises), deliberation edges (forks_from, reopens, references_ruling, …) and ruling edges. Operational — the model wires genuine links at write time; it never seals, supersedes or promotes canon (that stays save_to_unl's anchor-gated path). 'hand_residual' — THE TYPED, DIGEST-BOUND HANDOFF. A prose handoff is a claim; this is a fact a reader can recompute. Give brief_id (the SENDER), to_id (the RECEIVER) and cargo (the residual text, verbatim): the cargo is appended to BOTH briefs and a hands_residual edge carrying its sha256 is written IN ONE STATEMENT, so the edge cannot exist without the cargo having landed in the receiver. One full receiver per sender and cargo: additional receivers get a digest-bound pointer to the original receiver. A racing first delivery writes nothing and may retry the same unspent nonce. Idempotent on the cargo, not on the pair — the same residual re-recorded reports the existing edge; a different residual between the same two briefs is a second, genuine handoff. The general the manage_unl tool with action="wire_edge" door REFUSES hands_residual by name, because wiring it bare would record a verified handoff of nothing. governed_by + the manage_unl tool with action="attach_refines" accept an id-PREFIX and reject a non-ruling target ('seal it first'). — DELIBERATION CAPTURE (the walk behind a sealed ruling; propose-confirm, never auto — enriches the graph, never mints canon): 'file_deliberation' — file the deliberation + its pillars BEHIND an already-sealed ruling (ruling_ref, title, pillars=[{pillar_type, structured_data}]), wiring rulings.deliberation_id so the ruling's walk reaches its reasoning. TWO-CALL gate like the north-star seal: the first call previews the proposed pillars and returns a confirm_token WRITING NOTHING; a second call carrying confirm_token AND human_direction (the human's own words) seals a one-shot-immutable deliberation and its pillars. Refuses a ruling whose walk is already filled (never overwrites, never orphans). 'file_pillar' — append ONE further immutable pillar (deliberation_ref, pillar_type, structured_data) to an existing deliberation, next order, INSERT-only; human_direction required (the anchor). pillar_type ∈ constraint|tension|prior_ruling|option_weighed|fact|precedent|principle|rejected_alternative|verbatim_quote. 'scope_connection' — answer what a connection represents, the question the portal asks when a workspace has several ventures: connection (its provider, its name or id) + venture=<name> or shared=true. 'add_feed' — connect a PUBLIC FEED the person names (an https address that answers a plain GET; no key): url + venture=<name> or shared=true when they have several. Verified by a live read before anything is stored. 'add_mcp_server' — connect an OPEN MCP SERVER the person names by its https address: url + venture=<name> or shared=true when they have several. A live handshake and one read-only call verify it before anything is stored. If the server needs sign-in, it returns the provider's own link for the person to open (the token never enters the conversation). An address carrying a credential (a token in its query, user:password) is refused here and belongs in the portal. 'bind_resource' — pick WHICH project/site/space a connection reads (e.g. which PostHog project), or which repository a git connection reads (resource=owner/repo, checked against the GitHub installation): connection (its provider, name or id) + resource (its name or id; 'none' unbinds). Omit resource to LIST what the connection's credential can reach, writing nothing. A named resource is checked against that list before it is stored. 'route_knocks' — choose which knock classes land on a notification route: connection (the route's name or id) + classes=[…] (the FULL set it should receive; [] switches all off). Omit classes to SHOW its current switches and every class. An unknown class is refused by name. Recorded with who changed it and what it replaced. 'connect_link' — THE SECRET PATH: when the person wants to connect something that needs a key (provider=<id or name>), mint a Unl API key (kind=api_key), add a webhook (kind=webhook) or connect a GitHub repository (kind=github), return the portal link where they paste it themselves, signed in. For a tool with no built-in connection, pass api_host (+ api_path) from your own knowledge of its API: the link opens with them filled in, and Unl finds how the tool takes its key by trying it, so the person only pastes. Never ask them to paste a key, token or webhook URL into the conversation. Writes nothing; no nonce is spent. 'reconnect_connection' — renew a connection the person names (connection: its provider, name or id): re-verified with what is stored and updated in place; an OAuth server returns the provider's own sign-in link; a credential that cannot renew returns the portal link to re-enter it (never in chat). 'set_surface' — choose where a knock's reopen link opens: surface (in the person's words, e.g. ChatGPT, or an https address with {q}); clear=true removes it. The handoff is tested before it is saved. 'forget_turns' — when the person asks Unl to forget what their AI sent it ("forget what I sent Unl today"): since ("today", "all", "6 hours" or a date, as they put it) + human_direction (their words). Clears the kept turn text in their own workspace and answers with the count; which decisions were served where stays on record. 'team' — a TEAM, configured in conversation (no forms). team_op: show (seats, invites, cost, billing) | create_team (team_name) | invite (member=<email>, seat_type Team Basic|Team Pro|Team Max, optional team_name; returns a join code once) | join (invite_code: the caller takes the seat, and their chat reaches the team from the next turn; their own Unl and plan are untouched) | seat (member or "me", seat_type: pro-rated at Paddle when billed) | remove (member) | grant (member, area, optional team_name, ruling_ref = the sealed decision granting it: granting authority is itself a decision) | leave (leave the team; a member always works in their own Unl and the team's decisions reach them beside their own) | role (member, role manager|member) | resend (member: a fresh join code) | rename (team_name) | seats (seat_type + count: the seats of that type the team has bought; a cut saves from the next renewal) | cycle (billing_cycle monthly|annual) | propose (any seat holder: proposal_title, proposal_statement, proposal_why, optional ruling_ref = the team decision it changes; goes to the managers as a Slack thread, or by email) | proposals (the team's proposals with their threads) | decide (a manager: proposal + outcome yes|no|not_yet, their words as human_direction; a yes hands back the save_to_unl lock to make with answers_stops, Unl never seals for anyone —, never a button). Manager-only (the owner is always a manager): every op but show, join, leave, propose and proposals; the Team page's controls do the same things. Writes need human_direction + nonce. Behind the teams switch. 'comp' — owner only: give a named person a paid tier free ("comp sam@x.com on Pro for three months", "end sam's comp", "who have I comped?"). comp_op: grant (member=<email>, tier Basic|Pro|Max, until e.g. "three months" or a date, empty = open-ended; a second grant replaces the first) | end (member) | list. human_direction = the owner's words, kept as the reason. No card, no checkout; an email not yet signed up applies at first sign-in. Never touches who may reach Unl. 'safe_mode' — owner only: safe_op="status" says whether Unl's outbound is stopped and what it has held back; safe_op="enter" is the manual kill switch ("stop everything Unl sends out"): knocks, writes into connected tools, projection refreshes and sitemap resubmits stop for every user, reads carry on. human_direction = the owner's words, kept as the reason. Leaving safe mode is never from chat: it is the owner's word on the admin hub. 'moderate' — owner only: mod_op show | suspend | ban | reinstate, member = the account's email or Clerk id. Suspend and ban refuse that account's connector and /api calls from its next call (the portal still signs them in); a suspend never softens a ban; a house account is refused. human_direction = the owner's words, kept as the reason. Answers with the account's state read back. 'public_terminal' — "pause the public terminal": terminal_state="pause" blanks the site's live Unl terminal back to the still within about 15 seconds (anyone's word, any time); terminal_state="on" turns it back on (the person's word only, carried verbatim). human_direction (their words) + nonce; house workspace only. Answers with the switch read back. 'change_orca' — ONE CHANGE TO ORCA, SAID IN CHAT (the person's word, never an agent's own idea): orca_automation (the timer, as the fleet read names it) + orca_setting (enabled = on/off, cap, or schedule) + orca_value (what it should read after: on|off, a number up to 10, or a cron line / RRULE) + human_direction (their words, verbatim) + nonce. Records the one change with its FROM read from the latest Orca reading; the Mini's precheck applies exactly that once within about 3 minutes and refuses it if the setting has moved since. Never a prompt or which agent a timer starts; one live change per timer and setting. The fleet read shows before, after and when. 'revoke_key' — revoke one of the person's own API keys: key (its name, last four characters or id). Two calls, like the manage_unl tool with action="retire_connection". A notification route is a connection: retire it with the manage_unl tool with action="retire_connection". 'retire_connection' — retire a connection the person names; its stored credential is destroyed. Two calls: the first names it and writes nothing, the second carries the confirm_token the first returned, so they see which connection goes before it goes. 'import_document' — read ONE document the person asks you to bring in (their README, an ADR, CLAUDE.md or AGENTS.md) and PROPOSE each decision-shaped sentence in it: content (the full text, up to 128k characters) + title (its name) + human_direction (their words asking for it). Every proposal is inert — nothing holds until they answer each one, one at a time, here in this conversation. One they say is right becomes a decision only through save_to_unl kind="lock", in their words; then record their answer with the manage_unl tool with action="resolve_candidate" carrying their words. There is no button for it anywhere. Only when they ask; never on your own reading. 'reopen_ruling' — reopen a LIVE ruling for reconsideration WITHOUT retiring it (ruling_ref + human_direction). Opens a re-deliberation and wires a 'reopens' edge to the ruling; the ruling KEEPS governing and then serves WITH its doubt attached ('under re-deliberation since X'), derived at read time. The outcome is the human's separate gesture — re-affirm (clears the doubt) or supersede (the machine-keyed retire). One open re-deliberation per ruling; a second is refused. Distinct from supersede, which retires. — RISK REGISTER (surface-never-bury; severity is a Claude-applied OVERRIDABLE indicator, never a sort key): 'add_risk' — file an uncovered risk (title required; optional description, severity High|Moderate|Low, status open|worked|closed, resolution). Does not require human confirmation; any identity may add; the human owns the set. 'update_risk' — re-score / change status / update resolution by APPEND-ONLY supersession (risk_id + why required; the new entry carries why-it-moved, the prior is kept superseded). 'remove_risk' — the HUMAN release valve (risk_id) — soft-delete, the row is kept; resolution is NOT deletion (close it instead). — YOUR WAKE (operational config, never the substrate): 'tune_wake' — change ONE thing about the wake the human sees every time they connect, from a NATURAL GESTURE, with no template authored. "keep my wake shorter" → wake_length='brief'. "lead with what I shipped" → wake_lead='…'. "stop showing me themes" → wake_sections=[…without themes]. "back to normal" → wake_reset=true. It is a PATCH: name only what they asked to change, everything else keeps its current value. Their setting is held per workspace and merges OVER their way-of-working template. It is the light path — shaping the wake never requires CC, code, or authoring a way of working. — WAYS OF WORKING (momentum-log templates; operational config, never the substrate): 'set_way_of_working' — make a template ACTIVE for this workspace (template = its key or id-prefix); the active template governs how connect/ask render. 'author_way_of_working' — create or update a CUSTOM template (wow_key + wow_name + wow_layers required). Validated against the five-layer MOM-schema; a template whose rules use a non-closed (deciding) verb, or that drops an inherited guard, or is missing a layer, is REJECTED with the reason. Built-in keys are reserved. List them via the get_from_unl tool with action=templates. — PROJECTIONS (project the substrate OUT, one-way + derived; operational config, compile reads the substrate read-only): 'configure_projection' — create a projection target (projection_type = claude_md|agents_md|doc|notion|critical_path_xlsx; projection_scope = { kind: lanes|rulings|momentum|critical_path }; optional destination_note). critical_path_xlsx additionally PINS one file via place_target={ file_id, connection_host, mime? } — the standing authority to refresh-and-overwrite THAT file in place, nothing else. 'refresh_projection' — COMPILE from the CURRENT substrate. Return-only types hand back the artifact (generated-at header + 'the substrate governs' line) — the connector writes to NO external store, you place it. critical_path_xlsx instead OVERWRITES its pinned file in place via the http lane (same fileId, same share link, new content). 'remove_projection' — remove a target (projection_id); the substrate is untouched (a projection is derived). List via the get_from_unl tool with action=projections. BOUNDARY: files/manages/relates/registers/configures, never locks or seals; projections are render-out only, never a second store.