Reconcile Claude platform packages with merged Codex defaults

Co-Authored-By: Paperclip <noreply@paperclip.ing>

* codex/claude-runner-default: (85 commits)
  feat: default new Codex agents to Paperclip Runner on Linux and macOS (#15683)
  docs(skills): add slow-query diagnosis and fix skill (#16303)
  feat(sentry): add opt-in run failure reporting with saved run references (#16300)
  refactor(server): isolate provider message admission and runtime policies (#16289)
  refactor(server): isolate provider webhook lifecycle decisions (#16283)
  fix(workspaces): keep cleanup Git scans fresh and dedupe page reads (#16302)
  fix(sentry): keep provider-rejected Grok wakes out of run failure reports (#16297)
  fix(runner): report Runner disconnect age when a Dot bridge exits (#16296)
  refactor(server): isolate chat conversation and control policies (#16276)
  perf(recovery): use indexed execution identity lookups (#16291)
  perf(runs): bound history and reduce repeated context reads (#16286)
  fix(native-runtime): report which close barrier failed (#16298)
  feat(skills): select and validate tracked GitHub branches (#16288)
  fix(observability): sample native runs independently of triggers (#16285)
  fix(github): retry and recover review publication (#16284)
  perf(workspaces): wake terminal cleanup from committed changes (#16282)
  fix(mcp): deduplicate discovered tool descriptors (#16281)
  perf: remove history scans from task and chat queries (#16278)
  docs(skills): add maintenance bot setup workflow (#16279)
  fix(observability): time execution configuration steps (#16236)
  ...

# Conflicts:
#	scripts/verify-grok-npm-install.mjs

maps/agent-access-map/README.md

@@ -4,51 +4,17 @@ This map accompanies the [feature map](../feature-map/README.md). It records API
 agent entry points, permission boundaries and verification for the same capability IDs.
 The [shared contract](../README.md) defines the format and maintenance rules.
 
-Initial inventory: **35 areas and 171 sub-features**, source-reviewed on 2026-10-12
-at `f981fa3cc10cb8663a87dec60345fbff46d54d0a`. All entries are `baseline` and `source-only`; none
-claims complete operation enumeration or freshly verified agent access. Existing
-API paths, native gaps, actor restrictions and local/operator exceptions are
-recorded separately. These statuses do not represent a live pass rate.
+## Browse access contracts
 
-## Areas
+The same-named feature recipes define navigation and capability IDs. Run
+`node scripts/storybook-catalog.mjs` for the generated
+`maps/generated/agent-access-map.md` index, or browse the
+[published feature guide](https://d1p6rlowie26tp.cloudfront.net/storybook/branches/master/?path=/story/overview-storybook-guide--coverage-guide).
+Add or update the affected companion; there is no central registration or count.
 
-| Area | Product map | Capabilities |
-| --- | --- | --- |
-| [Login, invitations, and access](access.md) | [access](../feature-map/access.md) | 5 |
-| [Dashboards, activity, and audit trails](activity.md) | [activity](../feature-map/activity.md) | 5 |
-| [Agent conversations and project handoff](agent-chat.md) | [agent-chat](../feature-map/agent-chat.md) | 4 |
-| [Hiring, agent configuration, and organization](agents.md) | [agents](../feature-map/agents.md) | 5 |
-| [App access, action permissions, and testing](app-permissions.md) | [app-permissions](../feature-map/app-permissions.md) | 5 |
-| [Costs, budgets, and spending controls](budgets-costs.md) | [budgets-costs](../feature-map/budgets-costs.md) | 4 |
-| [Cases and structured work records](cases.md) | [cases](../feature-map/cases.md) | 4 |
-| [External chat and email conversations](chat-channels.md) | [chat-channels](../feature-map/chat-channels.md) | 5 |
-| [CLI, API clients, and local worktrees](cli-operations.md) | [cli-operations](../feature-map/cli-operations.md) | 5 |
-| [Companies and portability](companies.md) | [companies](../feature-map/companies.md) | 4 |
-| [Connection setup](connection-setup.md) | [connection-setup](../feature-map/connection-setup.md) | 8 |
-| [Developer previews and diagnostic labs](developer-labs.md) | [developer-labs](../feature-map/developer-labs.md) | 4 |
-| [Documents, attachments, and work products](documents-artifacts.md) | [documents-artifacts](../feature-map/documents-artifacts.md) | 5 |
-| [Local, SSH, and sandbox environments](execution-environments.md) | [execution-environments](../feature-map/execution-environments.md) | 5 |
-| [Tool gateways and access profiles](gateways-profiles.md) | [gateways-profiles](../feature-map/gateways-profiles.md) | 5 |
-| [Goals and work alignment](goals.md) | [goals](../feature-map/goals.md) | 3 |
-| [Inbox, decisions, and search](inbox-search.md) | [inbox-search](../feature-map/inbox-search.md) | 4 |
-| [Installation, configuration, updates, and backups](instance-operations.md) | [instance-operations](../feature-map/instance-operations.md) | 5 |
-| [Navigation, profile, and announcements](navigation-preferences.md) | [navigation-preferences](../feature-map/navigation-preferences.md) | 5 |
-| [Onboarding and first work](onboarding.md) | [onboarding](../feature-map/onboarding.md) | 5 |
-| [Pipelines, review queues, and learnings](pipelines.md) | [pipelines](../feature-map/pipelines.md) | 4 |
-| [Plugins and contributed product surfaces](plugins.md) | [plugins](../feature-map/plugins.md) | 4 |
-| [Projects and repositories](projects.md) | [projects](../feature-map/projects.md) | 4 |
-| [Questions and approvals](questions-and-approvals.md) | [questions-and-approvals](../feature-map/questions-and-approvals.md) | 8 |
-| [Recovery](recovery.md) | [recovery](../feature-map/recovery.md) | 8 |
-| [Routines, schedules, and triggers](routines.md) | [routines](../feature-map/routines.md) | 5 |
-| [Runs, harnesses, and model accounts](runs-adapters.md) | [runs-adapters](../feature-map/runs-adapters.md) | 4 |
-| [Secrets, personal credentials, and proposals](secrets.md) | [secrets](../feature-map/secrets.md) | 5 |
-| [Skill discovery, authoring, and policy](skills.md) | [skills](../feature-map/skills.md) | 5 |
-| [Status cards and refreshed summaries](status-cards.md) | [status-cards](../feature-map/status-cards.md) | 4 |
-| [Steering and queued messages](steering.md) | [steering](../feature-map/steering.md) | 7 |
-| [Delegation, dependencies, and signoff](task-coordination.md) | [task-coordination](../feature-map/task-coordination.md) | 4 |
-| [Task creation and lifecycle](tasks.md) | [tasks](../feature-map/tasks.md) | 5 |
-| [Team packages and catalog installation](teams.md) | [teams](../feature-map/teams.md) | 4 |
-| [Execution workspaces, services, and files](workspaces.md) | [workspaces](../feature-map/workspaces.md) | 5 |
+Existing baseline source references describe the original inspection, not current
+verification. Record new executed evidence in the PR, issue, or CI artifact with
+its revision and scope. Do not refresh unrelated headers as bookkeeping.
 
 ## Using an entry
 
@@ -67,3 +33,43 @@ Use `verify-paperclip` and existing API/runner/MCP fixtures to collect the
 permitted-agent and denial evidence; report blocked/not-run coverage honestly.
 Run `node scripts/check-maps.mjs` after editing. The structural check does not
 certify permissions, API catalog coverage, tool admission or live behavior.
+
+## Native REST transport
+
+The `call_api` parity change reconciles affected baselines against
+`58e16dbddfc9c8d0cf60867f9d9847f0feda055b` and the changes in this PR. Ordinary
+REST operations use the same route authorization as legacy agent REST. Dedicated
+tools remain optional for those operations; protocol endpoints still need their
+existing clients. Board-only routes remain restricted for agent identity.
+
+Native `search_api` / `call_api` requires operator rollout admission, a running
+authorized native run, current task assignment and execution-run binding, company
+and budget authority, task privacy, and a permitted work mode. Ask and Plan retain
+mutation restrictions, and runs retain their admitted JWT scope during restart
+recovery even when task mode changes. A waiting
+agent does not gain independent native control just because a REST route exists.
+
+Credential-bearing replies, including company exports and their legacy alias,
+stay inline under a 10 MiB limit and use encrypted mutation receipts. Other saved
+API snapshots are limited to the issuing actor and responsible user, plus authorized
+administrators. Artifact uploads enforce the same access checks as downloads;
+private snapshots are excluded from company exports and public company logos.
+Explicit deliverables use the existing sharing path. Native event history,
+checkpoints and completion records omit API bodies while preserving receipt
+metadata and replay digests. Restored webhook secrets use the same encrypted
+receipt and inline response policy as newly created webhook secrets.
+Task image access requires the company boundary and the task permission;
+skill-test and low-trust agents do not need company-wide browsing authority.
+Completion replay applies the same idempotent projection to stored and expected
+payloads; [the run-log guide](../../doc/run-log-events.md) describes its fields.
+
+Sources: [API client](../../server/src/services/native-runtime/runner-api-client.ts),
+[catalog](../../server/src/services/native-runtime/runner-api-catalog.ts),
+[native authority](../../server/src/services/native-runtime/paperclip-runner-tool-authority.ts),
+[credential storage classification](../../server/src/services/native-runtime/runner-api-sensitive-response.ts),
+[snapshot access](../../server/src/services/asset-content-access.ts),
+and [history redaction](../../server/src/services/native-runtime/runner-api-log-redaction.ts). The affected entries remain
+`baseline` and `source-only`; this reconciliation does not certify every operation.
+Targeted real-route proof lives in the
+[API integration suite](../../server/src/services/native-runtime/runner-api.integration.test.ts),
+including owned routines, skill tests, scoped secrets, proposals and private export replay.

maps/agent-access-map/access.md

@@ -2,7 +2,9 @@
 
 Product map: [Login, invitations, and access](../feature-map/access.md).
 
-Review date: 2026-10-12. Source commit: `f981fa3cc10cb8663a87dec60345fbff46d54d0a`.
+Review date: 2026-10-12. Source commit: `58e16dbddfc9c8d0cf60867f9d9847f0feda055b`.
+Native REST transport reconciled in this change; see the
+[shared transport contract](README.md#native-rest-transport).
 
 This is a source-reviewed baseline of representative operations and known gaps.
 Each capability needs operation-level review before its entire scope can be
@@ -43,8 +45,8 @@ API: `present` — representative operation IDs:
 - `POST /api/companies/{companyId}/invites`.
 - `POST /api/invites/{token}/accept`.
 
-Agent access: `partial` — REST with invite permission; CLI access; native call_api
-blocks invite credentials.
+Agent access: `partial` — REST / native `call_api` invite creation with the invite
+permission; CLI access. Human acceptance and agent onboarding have distinct policies.
 
 Policy: Company access plus action-specific grants; instance administration requires a
 board administrator.

maps/agent-access-map/activity.md

@@ -90,6 +90,9 @@ Assert the relevant denied actor, owner, company or mode from Policy. Review the
 remaining operations before qualifying the whole capability.
 
 Gaps: Telemetry/run visibility is checked independently from seeing the source task.
+Company heartbeat history defaults to 200 rows and caps explicit limits at 1,000
+in both the route and service. The response remains an array. Scope, visibility,
+and secret redaction checks apply to the bounded result set.
 
 ## `routine-audit`
 

maps/agent-access-map/agents.md

@@ -2,7 +2,9 @@
 
 Product map: [Hiring, agent configuration, and organization](../feature-map/agents.md).
 
-Review date: 2026-10-12. Source commit: `f981fa3cc10cb8663a87dec60345fbff46d54d0a`.
+Review date: 2026-10-12. Source commit: `58e16dbddfc9c8d0cf60867f9d9847f0feda055b`.
+Native REST transport reconciled in this change; see the
+[shared transport contract](README.md#native-rest-transport).
 
 This is a source-reviewed baseline of representative operations and known gaps.
 Each capability needs operation-level review before its entire scope can be
@@ -139,8 +141,8 @@ API: `present` — representative operation IDs:
 - `POST /api/agents/{id}/resume`.
 - `POST /api/agents/{id}/terminate`.
 
-Agent access: `partial` — REST resume under change grant; pause/terminate require board;
-native call_api blocks all three.
+Agent access: `partial` — REST / native `call_api` resume under agent_config:update
+change-grant authorization; pause and termination remain board-only.
 
 Policy: Agent creation/configuration uses action grants, resource policies and change
 consent; some controls require a board actor.
@@ -153,8 +155,8 @@ credentials/run context; inspect its result and applicable persistence/attributi
 Assert the relevant denied actor, owner, company or mode from Policy. Review the
 remaining operations before qualifying the whole capability.
 
-Gaps: Resume is agent-eligible but lacks a default native binding. Pause and termination
-are actor-boundary decisions.
+Gaps: Resume has a generic native REST path. Pause and termination remain
+enforced actor restrictions.
 
 ## `built-in`
 
@@ -187,3 +189,52 @@ provisioning resolves the runner, while unrelated reconciliation and same-harnes
 edits retain existing execution. Verify explicit runner changes preserve compatible
 saved settings; the general creation/access policy above still applies. This is
 source-only evidence at the scoped commit, not a live provisioning result.
+
+## `primary-agent`
+
+Review: `baseline`.
+
+API: `present` — GET and PUT /api/companies/{companyId}/primary-agent/me.
+
+Agent access: `restricted` — this is the authenticated human's personal
+preference. Agent keys and native call_api use agent identity and are denied by
+the board gate; no dedicated agent selection tool is present.
+
+Policy: Requires board user identity, company access and active membership,
+except implicit-local board or instance administrator. Viewers may choose their
+own primary. Selection requires a same-company readable, available agent and
+is scoped to actor user ID; the request cannot select another user's preference.
+Explicit null selection is rejected; leave/termination can clear an unavailable
+choice. Initialization stays recorded so clearing does not silently replace it.
+
+Evidence: `source-only` — reviewed on 2026-10-13 at
+`60bc0d5fee9a6e48db08fc016521fee3d9f57d67`:
+[routes](../../server/src/routes/primary-agent.ts),
+[service](../../server/src/services/primary-agent.ts),
+[provider](../../ui/src/context/PrimaryAgentProvider.tsx), and
+[route tests](../../server/src/__tests__/primary-agent.test.ts).
+
+Verification: `not-run` — select and read the preference as two company users;
+assert isolation, wrong-company/unreadable targets, pending/terminated agent
+rejection and agent-key denial. Verify replacement confirmation and fallback
+precedence in the UI; inspect the cleared state after permitted leave/termination.
+
+Gaps: No agent mutation path for another person's preference. Live human/agent
+access is unverified; UI fixture callbacks do not establish persistence or task
+and Chat default resolution.
+
+## `grok-bot`
+
+Review: `baseline`.
+
+API: `present` — `POST /api/companies/{companyId}/grok-invitations`, operator-owned Grok invitations and agent-scoped `/grok-binding` setup, routine, verify, stop, recover and disconnect endpoints. Direct HTTPS `/mcp/runner` uses fixed named-agent OAuth. Grok tools expose durable assignment operations and task-bound upload/download grants.
+
+Agent access: `available` — `paperclip_grok_*` through the dedicated agent grant. First-party Paperclip operations execute through the shared Rust Runner. The Bot retains its own apps; Paperclip workspace and third-party app tools are unavailable.
+
+Policy: company/agent/client/resource/authorizer binding; current manage-agent permission for consent and subsequent calls; normal task ownership, controller lease, governance, pause, revocation and recorded budget checks. Execution and file transfers require current task-bound sessions. Secret credentials remain in encrypted secret storage and are redacted from HTTP logs.
+
+Evidence: `source-only` — [routes](../../server/src/routes/grok-bot.ts), [shared authority](../../server/src/services/external-bot-authority.ts), [routine receipts](../../server/src/services/grok-bot/routine.ts) and [Runner broker](../../server/src/services/dot-runner-broker.ts). Temporary actual-client OAuth and an outbound routine wake are qualified separately; they do not prove this candidate’s acceptance.
+
+Verification: `not-run` — deployed acceptance pending; focused protocol/authorization and actual Rust backend tests; run fresh/saved setup, assigned and proactive tasks, duplicate calls, stale sessions, restart, ambiguous delivery, stop and recovery through the real client on the serving managed candidate.
+
+Gaps: deployed two-way work and unattended first-time onboarding remain unqualified; remote termination, provider transcript streaming and usage accounting are unavailable.

maps/agent-access-map/chat-channels.md

@@ -2,7 +2,9 @@
 
 Product map: [External chat and email conversations](../feature-map/chat-channels.md).
 
-Review date: 2026-10-12. Source commit: `f981fa3cc10cb8663a87dec60345fbff46d54d0a`.
+Review date: 2026-10-12. Source commit: `58e16dbddfc9c8d0cf60867f9d9847f0feda055b`.
+Native REST transport reconciled in this change; see the
+[shared transport contract](README.md#native-rest-transport).
 
 This is a source-reviewed baseline of representative operations and known gaps.
 Each capability needs operation-level review before its entire scope can be
@@ -33,6 +35,10 @@ own policy and access review.
 Gaps: Provider installation and account enrollment are not available to an ordinary
 agent actor.
 
+Speko UI reconciliation (2026-10-13): experimental voice setup uses the same
+board-managed endpoint boundary. Source review follows the merged voice runtime
+and the UI integration; live provider qualification is still separate.
+
 ## `identity`
 
 Review: `baseline`.
@@ -53,8 +59,8 @@ Verification: `not-run` — assert the documented agent denial with an owned tes
 verify any listed agent request/result path separately. A delegated operation needs its
 own policy and access review.
 
-Gaps: No impersonation path; native call_api additionally blocks identity-link
-operations.
+Gaps: Identity linking requires a signed-in board user, rollout admission and
+provider checks at the HTTP route. Native `call_api` preserves these permissions.
 
 ## `conversation`
 
@@ -81,6 +87,34 @@ remaining operations before qualifying the whole capability.
 Gaps: Normal agent replies work through server delivery. Explicit endpoint publication
 APIs are board management paths.
 
+GitHub publication recovery (2026-10-14): assigned-agent `submit_review`, `comment`,
+and `update_comment` calls reuse their run-, task-, endpoint-, and argument-bound
+publication on an exact retry. Fresh gateway policy and provider authority remain
+required. The durable worker resumes transient failures after restart and stops
+at its retry cap, revoked authority, or a superseded head. A pending receipt is
+not task completion. Source:
+[publication service](../../server/src/services/chat-github-reviews.ts) and
+[gateway](../../server/src/services/tool-gateway.ts). Verification uses
+PostgreSQL-backed provider fixtures; this entry does not claim live provider
+qualification for the new retry path.
+
+Speko browser sessions use `POST /api/companies/{companyId}/voice-sessions`,
+with GET inspection/notification and POST `/{sessionId}/end` operations below
+that collection. These routes require board identity; ordinary agent credentials
+cannot start a private voice session. Start and notification also require the
+experimental chat-connectors gate. Signed provider callbacks use the separate
+voice-webhook routes and their session capability. Evidence: `source-only` —
+[voice routes](../../server/src/routes/voice-sessions.ts). No live browser answer
+retrieval or telephone playback is established by the UI fixtures.
+
+Slack's **Require at-mention** policy applies to channel messages and channel
+thread replies, including queued work. DMs are exempt from mention checks;
+endpoint availability, **Allow direct messages**, and sender authorization still
+apply. Top-level DM replies retain their linear conversation destination. Source:
+[admission](../../server/src/services/chat-channels.ts) and
+[queued run policy](../../server/src/services/durable-chat-wakeup.ts). Live Slack
+verification of this exemption remains separate from provider-fixture coverage.
+
 New conversations resolve typed project/workspace defaults from their endpoint
 and destination under the task-creation transaction. Defaults do not authorize
 private sources: admission checks the linked user's authority and assigned agent.
@@ -142,3 +176,12 @@ to reply.
 Endpoint/destination execution defaults use the same board-only management
 boundary. Agents select an authorized workspace for their current task through
 the [workspace APIs](workspaces.md), rather than editing channel configuration.
+
+Speko callback preferences, incoming phone configuration/approval, and call
+history use the company-scoped `voice-callbacks`, `voice-phone`, and
+`voice-history` routes. Their UI controls do not grant agents board authority.
+See [voice routes](../../server/src/routes/voice-sessions.ts); service-level
+caller/session permissions and real provider delivery need separate verification.
+
+GitHub review summary headings use the bot display name. Checks remain
+independently scoped by GitHub App and endpoint/PR/commit identity.

maps/agent-access-map/companies.md

@@ -2,7 +2,9 @@
 
 Product map: [Companies and portability](../feature-map/companies.md).
 
-Review date: 2026-10-12. Source commit: `f981fa3cc10cb8663a87dec60345fbff46d54d0a`.
+Review date: 2026-10-12. Source commit: `58e16dbddfc9c8d0cf60867f9d9847f0feda055b`.
+Native REST transport reconciled in this change; see the
+[shared transport contract](README.md#native-rest-transport).
 
 This is a source-reviewed baseline of representative operations and known gaps.
 Each capability needs operation-level review before its entire scope can be
@@ -97,8 +99,8 @@ API: `present` — representative operation IDs:
 - `POST /api/companies/{companyId}/imports/preview`.
 - `POST /api/companies/{companyId}/imports/apply`.
 
-Agent access: `partial` — CEO REST / CLI company; native export restricted, eligible
-same-company import uses fallback.
+Agent access: `partial` — Same-company CEO REST / native `call_api` / CLI exports
+and eligible same-company imports.
 
 Policy: Same-company CEO or board for identity/import operations; list/create/archive
 convenience endpoint is board-gated.
@@ -111,5 +113,73 @@ credentials/run context; inspect its result and applicable persistence/attributi
 Assert the relevant denied actor, owner, company or mode from Policy. Review the
 remaining operations before qualifying the whole capability.
 
-Gaps: Secure exports lack a default native binding; new-company/ZIP import flows have
-different board and transport constraints.
+Gaps: Exports use inline credential delivery and encrypted mutation receipts.
+New-company/ZIP import flows retain their board and transport constraints.
+
+## `decision-models`
+
+Review: `baseline`.
+
+API: `present` — GET and PUT /api/companies/{companyId}/decision-model;
+POST /api/companies/{companyId}/decision-model/test;
+GET /api/companies/{companyId}/decision-model/availability;
+GET /api/companies/{companyId}/decision-model/history.
+
+Agent access: `partial` — same-company REST and admitted native call_api
+availability/history reads where policy allows. Settings and the fixed Test
+action require board identity. Native rollout/run gates follow the shared
+[transport contract](README.md#native-rest-transport).
+
+Policy: Settings access requires board and company access; non-managers receive
+no settings or choices. Configuration and tests additionally require connection
+management authority (owner/admin, instance admin, or tools:manage_connections).
+History requires company_scope:read and redacts task/run links without issue:read.
+Background sponsorship and budget admission remain separate service checks.
+
+Evidence: `source-only` — reviewed on 2026-10-13 at
+`60bc0d5fee9a6e48db08fc016521fee3d9f57d67`:
+[routes](../../server/src/routes/decision-models.ts),
+[service](../../server/src/services/decision-models.ts), and
+[connection authority](../../server/src/routes/ai-connections.ts).
+
+Verification: `not-run` — read history with an allowed company actor and an actor
+without task access; check link redaction. Reject agent configuration/tests and
+board mutations without connection-management permission. Verify settings and
+bounded test receipts with an owned simulated provider.
+
+Gaps: No agent settings/test path; permitted history does not delegate management.
+Live native and agent-credential reads remain unverified.
+
+## `fast-responses`
+
+Review: `baseline`.
+
+API: `present` — GET and PUT /api/companies/{companyId}/fast-response;
+GET /api/companies/{companyId}/fast-response/models;
+GET /api/companies/{companyId}/fast-response/availability;
+POST /api/companies/{companyId}/fast-response/test;
+GET /api/companies/{companyId}/fast-response/history.
+
+Agent access: `partial` — same-company REST and admitted native call_api history
+reads where policy allows, subject to the shared
+[transport contract](README.md#native-rest-transport).
+Settings, model selection, availability and test controls require board identity.
+
+Policy: Board and company access gate configuration surfaces. Updates, models
+and tests additionally require connection-management authority. History requires
+company_scope:read; task/run links require issue:read. The experiment, provider
+account, sponsorship and budget controls still gate actual acknowledgements.
+
+Evidence: `source-only` — reviewed on 2026-10-13 at
+`60bc0d5fee9a6e48db08fc016521fee3d9f57d67`:
+[routes](../../server/src/routes/fast-responses.ts),
+[service](../../server/src/services/fast-responses.ts), and
+[connection authority](../../server/src/routes/ai-connections.ts).
+
+Verification: `not-run` — inspect history and redacted task links as an allowed
+company actor. Reject agent settings/models/availability/tests and unauthorized
+board mutations. Use a simulated provider to inspect a saved configuration,
+success receipt, timeout and recorded usage.
+
+Gaps: No agent configuration/test path. An acknowledgement is not completed task
+work. Live native, provider and agent access remain unverified.

maps/agent-access-map/connection-setup.md

@@ -181,6 +181,14 @@ own policy and access review.
 
 Gaps: Provider endpoint, represented agent and linked sender are operator choices today.
 
+Internal recovery: Telegram discovery walks bounded pages at startup. Configuration
+commits only queue the changed connection; durable maintenance rows supply retry deadlines. Inactive subscription
+repair is parked until an endpoint or connection change. This creates no agent
+management permission or new API. Local database-backed provider-fixture tests in
+[channel integration](../../server/src/__tests__/chat-channels.integration.test.ts)
+cover recovery, rollback, retries and idle query silence; they do not establish
+live provider or agent access.
+
 ## `failure`
 
 Review: `baseline`.

maps/agent-access-map/gateways-profiles.md

@@ -2,7 +2,9 @@
 
 Product map: [Tool gateways and access profiles](../feature-map/gateways-profiles.md).
 
-Review date: 2026-10-12. Source commit: `f981fa3cc10cb8663a87dec60345fbff46d54d0a`.
+Review date: 2026-10-12. Source commit: `58e16dbddfc9c8d0cf60867f9d9847f0feda055b`.
+Native REST transport reconciled in this change; see the
+[shared transport contract](README.md#native-rest-transport).
 
 This is a source-reviewed baseline of representative operations and known gaps.
 Each capability needs operation-level review before its entire scope can be
@@ -65,8 +67,8 @@ API: `present` — representative operation IDs:
 - `GET /api/tool-gateway/gateways/{gatewayId}/mcp`.
 - `POST /api/tool-gateway/sessions`.
 
-Agent access: `partial` — Existing scoped MCP client/session flow; assigned native app
-tools.
+Agent access: `partial` — Agent REST / native `call_api` for scoped session creation
+and revocation; existing MCP client protocol and assigned native app tools.
 
 Policy: Named gateway/profile administration and credentials are board tools:admin;
 agent sessions/tool use use separate scoped authority.
@@ -79,8 +81,16 @@ credentials/run context; inspect its result and applicable persistence/attributi
 Assert the relevant denied actor, owner, company or mode from Policy. Review the
 remaining operations before qualifying the whole capability.
 
-Gaps: Agent tool consumption exists. Copying/managing the endpoint and its client
-credentials remain management operations.
+Gaps: Scoped sessions remain agent/run-bound. MCP requires its existing protocol
+client; named gateways and gateway-token management retain board permissions.
+
+Discovery collapses identical descriptors with the same gateway name across
+providers, including native assigned-tool startup and fresh searches. Conflicting
+definitions remain an error. Distinct names and the normal invocation grants,
+approvals and revocation checks remain independent. Regression coverage lives in
+[gateway tests](../../server/src/__tests__/tool-gateway.test.ts) and
+[assigned-tool tests](../../server/src/services/native-runtime/assigned-mcp-tools.test.ts);
+these fixtures do not certify a live external-client journey.
 
 ## `tokens`
 
@@ -103,8 +113,9 @@ Verification: `not-run` — assert the documented agent denial with an owned tes
 verify any listed agent request/result path separately. A delegated operation needs its
 own policy and access review.
 
-Gaps: Native call_api blocks credential management; a grant to use an app does not
-create gateway-token authority.
+Gaps: Gateway-token management requires board tools:admin at the HTTP route.
+A grant to use an app does not create this authority; native `call_api` preserves
+the denial.
 
 ## `activity`
 

maps/agent-access-map/inbox-search.md

@@ -11,6 +11,14 @@ for format, permission checks, evidence and maintenance.
 
 ## `views`
 
+The issue-list API accepts optional `includeAgentCreatedTasks`; false restricts
+independent results to human creation before search/pagination. Omission retains
+existing agent/API behavior. `includeParticipatedTasks=true` requires a board user
+and retains only that authenticated user's existing participation as a creation
+visibility exception. Company/private-task access checks still apply. Collection
+preferences and hierarchy presentation are browser state, not additional authority.
+Source-reviewed behavior; live agent access verification remains separate.
+
 Review: `baseline`.
 
 API: `present` — representative operation IDs:
@@ -119,3 +127,29 @@ remaining operations before qualifying the whole capability.
 
 Gaps: General company search and dedicated task search are different result sets; use
 the appropriate one.
+
+
+## `toasts`
+
+Review: `baseline`.
+
+API: `present` — GET /api/companies/{companyId}/events/ws (WebSocket upgrade); viewer-specific
+`toastEligible` metadata on authorized events. No notification mutation endpoint.
+
+Agent access: `not-applicable` — toast presentation is a human browser concern.
+Agent-authenticated event subscriptions retain authorization but do not qualify
+for human toasts. Agent task mutations may notify participating humans.
+
+Policy: Company membership and task/run read checks precede human participation
+checks. Creator, current human assignee, commenter, deliberate actor, or explicit
+user mention qualifies; agent ownership and responsible-user attribution alone do
+not. See [toast semantics](../../doc/TOASTS.md).
+
+Evidence: `source-only` — [socket projection](../../server/src/realtime/live-events-ws.ts)
+and [eligibility](../../server/src/realtime/task-toast-eligibility.ts).
+
+Verification: `not-run` — Connect two users and an agent; assert per-user eligibility without
+losing authorized cache updates. Deny revoked membership and private task access.
+Confirm relevance lookup failure yields a quiet authorized event.
+
+Gaps: Browser recipes and regression sources are not deployment acceptance proof.

maps/agent-access-map/instance-operations.md

@@ -88,6 +88,14 @@ Review: `baseline`.
 API: `present` — representative operation IDs:
 
 - `GET /api/health`.
+- `GET /api/liveness` and `HEAD /api/liveness` — public process startup status
+  and build commit only; no database readiness or workspace identity.
+
+Liveness is anonymous and runs before actor/session resolution. Hostname and
+signed-bootstrap endpoint validation still apply. It grants no instance control
+authority. [Liveness tests](../../server/src/__tests__/liveness.test.ts) cover idle
+drain, invalid ambient credentials, unavailable SQL, and startup recovery with
+local Express fixtures; no live provider or agent access is claimed.
 
 Agent access: `partial` — REST health plus local CLI doctor.
 

maps/agent-access-map/onboarding.md

@@ -88,6 +88,39 @@ testing an existing agent; interactive account login additionally requires a
 board user and owner-bound session. An agent's right to hire is not login or
 instance-environment administration authority.
 
+For fresh managed Codex Auto setup, the wizard's explicit Connect path can call
+`POST /api/environments/{environmentId}/probe?companyId={companyId}` before
+selected-runtime testing, then refresh scoped adapter discovery. This reuses the
+existing board instance-admin/local-implicit probe gate; `agents:create` alone
+is insufficient. A 403, absent proof, changed configuration, missing response
+identity or unconfirmed cleanup remains visible. No probe is added to creation
+or discovery, no agent/company grant is broadened, and provider authentication
+errors never cause an automatic runner switch.
+
+Native setup derives outer sandbox isolation from the server-resolved execution
+target, as task execution does. This is an internal transport choice, not a
+request/configuration permission. Local and SSH setup keep Codex isolation;
+caller-supplied environment flags do not authorize an external sandbox. Existing
+company, account, probe and registration-cleanup gates still apply.
+The bounded hello probe retains read-only permissions and no dynamic tools. Its
+trusted launch skips project-instruction discovery in the new, empty setup
+workspace. This grants no filesystem or networking permission and does not
+change instruction discovery for ordinary task execution.
+
+Scoped source review: 2026-10-13, exact baseline
+`1a0ca66242121e39d88455aa2b52a07acc4a07d9` plus the privately composed onboarding
+correction. [Wizard controls](../../ui/src/components/OnboardingWizard.test.tsx)
+and [existing Product E2E observer controls](../../tests/runner-e2e/first-task.test.ts)
+exercise mocked allowed/denied setup and sticky unknown cost coverage. They do
+not prove live actor authorization or provider execution. The explicit manual
+`confirmation-replies.runner-codex.daytona.task-card-accept` case requires an
+eligible immutable OCI target and the existing probe authority, two identified
+setup leases and separately authorized paid/cleanup reservations. Its fixture
+neither prequalifies the environment nor creates the agent. Actual Cloud named
+snapshot binding, warm/cold signup and live allowed/denied agent checks remain
+`not-run`.
+
+
 Evidence: `source-only` —
 [implementation](../../ui/src/components/OnboardingWizard.tsx#L279) at the reviewed
 commit above.
@@ -135,6 +168,20 @@ remaining operations before qualifying the whole capability.
 
 Gaps: Task creation is agent-accessible where permitted; scheduling/readiness does not
 follow from successful creation.
+The Codex first-task fixture's operator cost guard uses the existing board
+agent-configuration PATCH before admitting work. This is not evidence of agent
+permission to update its runtime; the listed agent-context checks remain not-run.
+
+Scoped source review: 2026-10-13, the first-task asset correction against
+`ea6c8eb5e16d61111968f633a66748b397b64a3e`. The existing
+[first-task instructions](../../server/src/onboarding-assets/first-task/skills/first-task/SKILL.md)
+send file-producing work through the child's own execution and existing
+dependency/block controls. Native `register_deliverable` retains its current-task
+binding; this adds no cross-task file-registration authority or permission.
+Document-only work may use the existing child-document API inline, and plan-only
+approval does not authorize implementation. The existing asset tests check
+wording only. The literal baseline live attempt failed child-file delivery and
+completion reporting; revised live authorization and execution remain `not-run`.
 
 ## `resume`
 
@@ -164,3 +211,15 @@ Scoped source review of [draft restoration](../../ui/src/components/OnboardingWi
 preserves harness/runner intent and invalidates obsolete setup-test results after
 a selection change. Browser draft continuity is not API or live-agent evidence,
 and opening a saved Legacy agent does not apply new-agent defaults.
+
+The initial matching route opening preserves the authorized saved wizard step
+on bare and company-prefixed reloads. Explicit new-company or changed-company
+openings retain their navigation override and clear foreign company resource
+IDs. [Existing component controls](../../ui/src/components/OnboardingWizard.test.tsx)
+exercise these presentation and account boundaries. This scoped correction adds
+no server draft API, agent grant or proof of live actor authorization. The
+managed first-task eval still reloads before Get started and remains a separate
+live acceptance gate. The existing mocked-login browser case also checks the
+same company-scoped active session and saved selection through route reopening
+and a real reload, with one login start and no pending-login hire. These fixture
+assertions do not prove server authorization or live credential use.

maps/agent-access-map/pipelines.md

@@ -2,7 +2,9 @@
 
 Product map: [Pipelines, review queues, and learnings](../feature-map/pipelines.md).
 
-Review date: 2026-10-12. Source commit: `f981fa3cc10cb8663a87dec60345fbff46d54d0a`.
+Review date: 2026-10-12. Source commit: `58e16dbddfc9c8d0cf60867f9d9847f0feda055b`.
+Native REST transport reconciled in this change; see the
+[shared transport contract](README.md#native-rest-transport).
 
 This is a source-reviewed baseline of representative operations and known gaps.
 Each capability needs operation-level review before its entire scope can be
@@ -31,8 +33,9 @@ credentials/run context; inspect its result and applicable persistence/attributi
 Assert the relevant denied actor, owner, company or mode from Policy. Review the
 remaining operations before qualifying the whole capability.
 
-Gaps: Configuration paths exist. Generic fallback blocks case automation execution
-paths; do not conflate configuration and dispatch.
+Gaps: Configuration and case-automation retry/rerun have native `call_api` REST
+paths under company, active-agent-run, case and target-pipeline write checks. The
+route and service retain retry/rerun eligibility and dispatch policy.
 
 ## `items`
 

maps/agent-access-map/projects.md

@@ -111,3 +111,12 @@ remaining operations before qualifying the whole capability.
 
 Gaps: Description/goal/target selection exist; host workspace command mutation is denied
 to agents and budget policy is board-managed.
+
+Repository attachment also writes a durable skill import binding in its transaction.
+Agent-created bindings derive their refresh person from authenticated responsible-user
+context. Project selection does not grant runtime credentials or override private
+project skill access. Verify automatic import and denial with the actual agent identity.
+
+Workspace creation, update and deletion require project:write_workspace through
+the shared authorization evaluator in addition to project read access. Repository
+attachment does not bypass skill-import policy for its background discovery.

maps/agent-access-map/recovery.md

@@ -2,7 +2,9 @@
 
 Product map: [Recovery](../feature-map/recovery.md).
 
-Review date: 2026-10-12. Source commit: `f981fa3cc10cb8663a87dec60345fbff46d54d0a`.
+Review date: 2026-10-12. Source commit: `58e16dbddfc9c8d0cf60867f9d9847f0feda055b`.
+Native REST transport reconciled in this change; see the
+[shared transport contract](README.md#native-rest-transport).
 
 This is a source-reviewed baseline of representative operations and known gaps.
 Each capability needs operation-level review before its entire scope can be
@@ -42,7 +44,8 @@ API: `present` — representative operation IDs:
 
 - `POST /api/issues/{id}/recovery-actions/resolve`.
 
-Agent access: `partial` — Eligible agent REST / CLI; native generic mutation restricted.
+Agent access: `partial` — Eligible agent REST / native `call_api` / CLI under
+source-bound recovery authority.
 
 Policy: Task/run visibility, run ownership and source/action policy; workspace export
 retry and some operator controls require board.
@@ -55,8 +58,20 @@ credentials/run context; inspect its result and applicable persistence/attributi
 Assert the relevant denied actor, owner, company or mode from Policy. Review the
 remaining operations before qualifying the whole capability.
 
-Gaps: Underlying route has agent checks; no corresponding default native recovery
-mutation tool is advertised.
+Gaps: Eligible resolutions use native `call_api`. The route retains owner and
+management authority, active-run/source-trust checks, board-only outcomes and
+reconciliation controls.
+
+Scoped source review: 2026-10-13, recovery correction against
+`ea6c8eb5e16d61111968f633a66748b397b64a3e`. The
+[recovery service](../../server/src/services/recovery/service.ts) reuses the
+existing completed-onboarding handoff validator. It checks the source company,
+onboarding origin, Done parent, assignee and Done child, with no unfinished
+siblings, before exempting the report from the issue-terminal backstop. Other
+terminal work and process-death/controller ownership checks remain enforced.
+This internal wake handling adds no recovery-resolution or cross-company agent
+authority. Real PostgreSQL regressions cover allowed and rejected bindings;
+revised live agent authorization and callback delivery remain `not-run`.
 
 ## `source-action`
 
@@ -67,13 +82,25 @@ API: `present` — representative operation IDs:
 - `GET /api/issues/{id}/recovery-actions`.
 - `POST /api/issues/{id}/recovery-actions/resolve`.
 
-Agent access: `partial` — Eligible agent REST / CLI; source-bound recovery state.
+Agent access: `partial` — Eligible agent REST / native `call_api` / CLI; source-bound
+recovery state.
 
 Policy: Task/run visibility, run ownership and source/action policy; workspace export
 retry and some operator controls require board. Completion or cancellation of a
 task does not clear its exact unresolved native workspace owner hold. Physical
 owner release still requires the [operator stop-verification procedure](../../doc/native-workspace-finalization-recovery.md).
 
+For a resolved legacy action that retains a file hold, the same resolution API
+supports source-only file repair. Board runtime management and recovery-resolution
+authority are required. The request identifies the exact source action/run and
+records recovered-file evidence; the server verifies the original stop receipt.
+It preserves the current task status and does not wake or replay the agent. The
+task form fails closed without permission or source bindings. Agent Chat retains
+the file diagnosis while this hold exists. The
+[repair route regressions](../../server/src/__tests__/workspace-restore-repair-route.test.ts)
+and [file form](../../ui/src/components/WorkspaceFileRecovery.test.tsx) cover the
+local contract; they do not independently recover files or qualify a live provider.
+
 Evidence: `source-only` — [implementation](../../server/src/routes/issues.ts#L9478) at
 the reviewed commit above. Exact owner hold retention in the
 [recovery state helper](../../server/src/services/native-runtime/native-workspace-finalization-recovery-state.ts)
@@ -89,8 +116,8 @@ physical copyback, and cleanup after the receipt is cleared. Exercise this
 sequence in a disposable instance; automatic cleanup must use the system actor
 and must not create reader participation. No live recovery proof is claimed.
 
-Gaps: Need operation-level eligibility and a real native binding for permitted recovery
-actions; do not route around lifecycle authority.
+Gaps: Permitted resolutions use native `call_api` under existing eligibility
+and ownership checks. Source/action policy determines whether continuation is allowed.
 
 ## `exhaustion`
 
@@ -124,23 +151,45 @@ Review: `baseline`.
 API: `present` — representative operation IDs:
 
 - `POST /api/issues/{id}/recovery-actions/retry-workspace-export`.
+- `POST /api/issues/{id}/recovery-actions/resume-workspace-finalization`.
+- `POST /api/issues/{id}/recovery-actions/resolve` for retained-source file repair.
 - `POST /api/execution-workspaces/{id}/reconcile-branch`.
 
 Agent access: `restricted` — Board/runtime management APIs; agent reads diagnosis and
 performs permitted workspace work.
 
-Policy: Task/run visibility, run ownership and source/action policy; workspace export
-retry and some operator controls require board.
+Policy: Export retry and branch reconciliation require board runtime management.
+Retained legacy file-only repair requires the board, exact stopped-source receipts,
+and recovered-file evidence. It can record repair for a successful legacy turn
+without changing its result or authorizing replay. Queued and running sources
+remain denied. Source-only reconciliation regressions cover this boundary.
+Physical-owner stop confirmation uses the separate `runtime:confirm_owner_stop`
+action. It requires active company owner/admin membership, trusted local board
+access, or instance administration. Agents and ordinary runtime managers are denied.
+The exact source task, running native run, accepted result and owner receipt must
+match; active copyback locks, live local writers, and newer runs prevent admission.
+An authorized administrator must first verify through the deployment platform that
+the exact controller and all copyback children stopped, then attest that evidence.
+Elapsed time, an expired coordinator lease or a lost advisory connection is not proof.
+Only the exact owner receipt is released; normal reconciliation performs export and
+commitment without another provider turn or bypassing existing task waits.
 
-Evidence: `source-only` — [implementation](../../server/src/routes/issues.ts#L9478) at
-the reviewed commit above.
+Evidence: `source-only` — [route](../../server/src/routes/issues.ts),
+[administrator authorization](../../server/src/services/authorization.ts), and
+[owner admission](../../server/src/services/native-runtime/native-workspace-owner-recovery.ts)
+reviewed for this change. Local authorization, route, UI and finalization regressions
+cover member/agent denial, exact-owner admission and the real reconciler preserving
+monitor and approval waits. This is not live provider-stop proof.
 
-Verification: `not-run` — assert the documented agent denial with an owned test fixture;
+Verification: `not-run` for live agent/deployment execution — assert the documented agent denial with an owned test fixture;
 verify any listed agent request/result path separately. A delegated operation needs its
 own policy and access review.
 
-Gaps: Export retry/reconciliation APIs exist but require board. Native generic
-execution-control mutations are also blocked.
+Gaps: Export retry and branch reconciliation require board runtime:manage at
+their HTTP routes. The exact-owner operator fallback additionally requires
+runtime:confirm_owner_stop. Native call_api preserves these agent denials.
+Automatic managed-cloud recovery uses independently verified, signed platform
+proof through the finalization reconciler; agents cannot attest owner shutdown.
 
 ## `unknown-outcome`
 

maps/agent-access-map/routines.md

@@ -2,7 +2,9 @@
 
 Product map: [Routines, schedules, and triggers](../feature-map/routines.md).
 
-Review date: 2026-10-12. Source commit: `f981fa3cc10cb8663a87dec60345fbff46d54d0a`.
+Review date: 2026-10-12. Source commit: `58e16dbddfc9c8d0cf60867f9d9847f0feda055b`.
+Native REST transport reconciled in this change; see the
+[shared transport contract](README.md#native-rest-transport).
 
 This is a source-reviewed baseline of representative operations and known gaps.
 Each capability needs operation-level review before its entire scope can be
@@ -18,8 +20,8 @@ API: `present` — representative operation IDs:
 - `POST /api/companies/{companyId}/routines`.
 - `PATCH /api/routines/{id}`.
 
-Agent access: `partial` — Agent REST / CLI routine create/update; optional installed MCP
-generic request.
+Agent access: `available` — Agent REST / native `call_api` / CLI routine create/update;
+optional installed MCP generic request.
 
 Policy: Agents may read company routines but only create/manage routines assigned to
 themselves; trigger secrets need secure handling.
@@ -32,8 +34,9 @@ credentials/run context; inspect its result and applicable persistence/attributi
 Assert the relevant denied actor, owner, company or mode from Policy. Review the
 remaining operations before qualifying the whole capability.
 
-Gaps: Native call_api rejects routine mutation; manage_routine is scenario-only/unbound.
-Agent REST is implemented.
+Gaps: No dedicated production manage_routine binding; generic `call_api` provides
+the permitted REST path. Creation needs a responsible user resolved from the parent
+issue or company default.
 
 ## `triggers`
 
@@ -44,7 +47,8 @@ API: `present` — representative operation IDs:
 - `POST /api/routines/{id}/triggers`.
 - `PATCH /api/routine-triggers/{id}`.
 
-Agent access: `partial` — Owned-routine agent REST / CLI routine trigger commands.
+Agent access: `available` — Owned-routine agent REST / native `call_api` / CLI trigger
+commands.
 
 Policy: Agents may read company routines but only create/manage routines assigned to
 themselves; trigger secrets need secure handling.
@@ -57,8 +61,17 @@ credentials/run context; inspect its result and applicable persistence/attributi
 Assert the relevant denied actor, owner, company or mode from Policy. Review the
 remaining operations before qualifying the whole capability.
 
-Gaps: No production default native trigger-management binding. Webhook creation/rotation
-also returns credential material.
+Gaps: No dedicated production trigger-management binding; generic `call_api`
+provides the permitted REST path. Credential replies use inline delivery and encrypted
+mutation receipts rather than shared response assets.
+
+The host-only `GET /api/instance/task-drain?idleSleepSafety=1&scheduledWake=1`
+extension reports the earliest supported future routine deadline under an owned
+idle hold. It requires signed Cloud control authority; company agents and tenant
+admin tokens cannot use it. It does not grant routine management or execution
+authority. See the [hosting protocol](../../doc/idle-sleep-safety.md#scheduled-routine-wake-protocol)
+and [route authorization tests](../../server/src/__tests__/instance-settings-routes.test.ts).
+These are local contract checks, not a live provider sleep/wake qualification.
 
 ## `run-now`
 
@@ -68,7 +81,8 @@ API: `present` — representative operation IDs:
 
 - `POST /api/routines/{id}/run`.
 
-Agent access: `partial` — Owned-routine agent REST / CLI routine run.
+Agent access: `partial` — Owned-routine agent REST / CLI run; native `call_api` from
+an authorized active run.
 
 Policy: Agents may read company routines but only create/manage routines assigned to
 themselves; trigger secrets need secure handling.
@@ -81,8 +95,8 @@ credentials/run context; inspect its result and applicable persistence/attributi
 Assert the relevant denied actor, owner, company or mode from Policy. Review the
 remaining operations before qualifying the whole capability.
 
-Gaps: A scheduled/waiting native agent cannot use call_api for this eligible operation;
-a real control binding is missing.
+Gaps: Scheduled/waiting native agents cannot independently call this operation:
+native authority requires a running bound run. A separate control binding remains absent.
 
 ## `history`
 
@@ -117,8 +131,7 @@ API: `present` — representative operation IDs:
 
 - `PATCH /api/routines/{id}`.
 
-Agent access: `partial` — Owned-routine agent REST / CLI; normal native fallback can
-manage separate folder metadata where permitted.
+Agent access: `available` — Owned-routine agent REST / native `call_api` / CLI.
 
 Policy: Agents may read company routines but only create/manage routines assigned to
 themselves; trigger secrets need secure handling.
@@ -131,5 +144,11 @@ credentials/run context; inspect its result and applicable persistence/attributi
 Assert the relevant denied actor, owner, company or mode from Policy. Review the
 remaining operations before qualifying the whole capability.
 
-Gaps: Pause/archive routine mutation lacks a production native binding. Plugin-managed
-routine rules remain separate.
+Gaps: Pause/archive mutations have a generic native REST path under routine
+ownership rules. Plugin-managed routine rules remain separate.
+
+Execution resolves referenced project skills against agent/responsible-user access,
+then saves immutable version selections in the heartbeat execution context. New runs
+resolve latest installed content; resumed runs retain selections and recheck access.
+An unavailable explicit reference produces an actionable configuration error.
+Live agent execution across an upstream update remains required acceptance evidence.

maps/agent-access-map/runs-adapters.md

@@ -2,7 +2,9 @@
 
 Product map: [Runs, harnesses, and model accounts](../feature-map/runs-adapters.md).
 
-Review date: 2026-10-12. Source commit: `f981fa3cc10cb8663a87dec60345fbff46d54d0a`.
+Review date: 2026-10-12. Source commit: `58e16dbddfc9c8d0cf60867f9d9847f0feda055b`.
+Native REST transport reconciled in this change; see the
+[shared transport contract](README.md#native-rest-transport).
 
 This is a source-reviewed baseline of representative operations and known gaps.
 Each capability needs operation-level review before its entire scope can be
@@ -28,8 +30,8 @@ API: `present` — representative operation IDs:
 - `GET /api/adapters`.
 - `GET /api/companies/{companyId}/adapters/{type}/models`.
 
-Agent access: `partial` — Agent company-model API and bound runtime context; board
-adapter/account inventories.
+Agent access: `partial` — Agent company-model REST / native `call_api` discovery and
+bound runtime context; adapter/account inventories remain board-only.
 
 Policy: Run/cost visibility and agent configuration policy; adapter installation/account
 login/session control require board/admin.
@@ -58,6 +60,11 @@ and explicit overrides follow the [shared runner contract](../../packages/shared
 Claude follows its qualified rollout described above. The board inventory does not grant a
 native agent an equivalent discovery binding. See
 [probe restrictions](./execution-environments.md#probe) for acquiring qualification.
+An absent forced-Kubernetes environment is an unqualified sandbox target, never
+a local target. Discovery and automatic creation keep the Legacy path without
+provisioning it; explicit Paperclip selection returns qualification guidance.
+The existing execution path owns lazy environment creation. Saved runners remain
+unchanged. This is source/control evidence, not live Kubernetes qualification.
 
 ## `validation`
 
@@ -67,8 +74,8 @@ API: `present` — representative operation IDs:
 
 - `POST /api/companies/{companyId}/adapters/{type}/test-environment`.
 
-Agent access: `partial` — Permitted agent-creation validation path / REST / CLI;
-operator account login.
+Agent access: `partial` — Permitted agent-creation validation through REST / native
+`call_api` / CLI; account login requires its operator.
 
 Policy: Run/cost visibility and agent configuration policy; adapter installation/account
 login/session control require board/admin.
@@ -94,6 +101,26 @@ or Legacy CLI check cannot replace that runtime evidence. Missing dependencies,
 credentials, invalid models and incompatible settings fail without silently
 changing runners. Account login remains board/owner-bound.
 
+For a linked Codex subscription with server-resolved managed credential provenance,
+setup checks the resolved owner and stages a private probe copy before local or
+remote isolation. Without a selected API key, an unbound linked `CODEX_HOME` is
+rejected with explicit Legacy
+or managed-account guidance. Caller configuration cannot supply that provenance. Selected `CODEX_API_KEY` and
+`OPENAI_API_KEY` authentication skips unrelated subscription reads and refresh
+bindings, matching task materialization. The fake-credential controls verify key
+precedence without changing the account source or exposing either credential.
+The general native
+home materializer retains its no-follow symlink guard. Refresh still targets the
+checked account source, and confirmed bounded retirement removes its private
+copy. Unconfirmed retirement retains the existing cleanup block and owned state.
+Failures before probe handoff remove only the owned temporary preparation root;
+local daemon resolution occurs before credential staging. Once a probe is handed
+off, unconfirmed retirement still retains its recovery state.
+[Existing fake-credential setup controls](../../server/src/services/native-runtime/setup-readiness.test.ts)
+exercise linked/regular sources and failure cleanup. This adds no credential-read
+API, agent login authority or cross-company account access. Its source-only
+evidence does not qualify a live permitted/denied agent operation.
+
 Verification for this scope remains `not-run`: use an admitted agent REST/CLI
 validation path, assert missing grants and cross-company targets/accounts are
 denied, then prove the useful task/follow-up separately. `hire_agent` inherits its
@@ -147,8 +174,26 @@ Verification: `not-run` — assert the documented agent denial with an owned tes
 verify any listed agent request/result path separately. A delegated operation needs its
 own policy and access review.
 
-Gaps: Execution context reset is not a permitted generic native API mutation or an
-ordinary agent management path.
+Gaps: Task-session listing and execution-context reset require board agent
+management at their HTTP routes. Native `call_api` preserves these denials; native
+continuation remains server-owned.
+
+Scoped source-only evidence: [configuration changes](../../server/src/services/agent-configuration.ts)
+and [native execution/recovery](../../server/src/services/native-runtime/native-session-executor.ts)
+retain existing execution on unrelated edits and use recorded run configuration
+for active/recovered runs. Explicit runner changes use revisions and session
+invalidation. Verify saved configuration, current versus historical run identity,
+restart and follow-up without granting session-reset authority to an agent.
+
+Scoped source review: 2026-10-13, the recovery correction against
+`ea6c8eb5e16d61111968f633a66748b397b64a3e` reuses
+[completed onboarding handoff validation](../../server/src/services/chat-completion-delivery.ts)
+before applying the issue-terminal backstop. The company, parent origin/status,
+assignee, completed child and remaining children must match. Only that backstop
+is suppressed for the validated report; process-death and controller/native
+ownership checks still apply. No agent gains session or recovery control.
+PostgreSQL regressions cover valid native/Legacy callbacks and rejected bindings;
+revised live execution and actor authorization remain `not-run`.
 
 Scoped source-only evidence: [configuration changes](../../server/src/services/agent-configuration.ts)
 and [native execution/recovery](../../server/src/services/native-runtime/native-session-executor.ts)
@@ -169,3 +214,13 @@ Scoped Verification: `not-run` — verify allowed/denied access using the actual
 actor independently from the credential-free ownership controls. This correction
 adds no account-setup, cleanup-override or session-reset authority. The real native
 readiness/recovery fixtures and installed provider acceptance remain separate gates.
+
+Scoped shutdown source review: 2026-10-14, against literal
+`651a3de64fc943216cc414b64b1443809f9499da`. The suspension barrier bounds remote
+state reads by its remaining deadline and rejects late proof. Intentional
+[provider ingress shutdown](../../server/src/realtime/runner-prp-outbound.ts)
+joins physical socket closure and retires the connection owner before endpoint
+release. Unconfirmed termination stays blocked. Existing fake-peer and delayed
+read controls are source evidence; this changes no actor, company, account or
+session-reset permission. Operation-level verification remains `not-run` and
+the failed Test setup does not qualify successful live cleanup.

maps/agent-access-map/secrets.md

@@ -2,7 +2,9 @@
 
 Product map: [Secrets, personal credentials, and proposals](../feature-map/secrets.md).
 
-Review date: 2026-10-12. Source commit: `f981fa3cc10cb8663a87dec60345fbff46d54d0a`.
+Review date: 2026-10-12. Source commit: `58e16dbddfc9c8d0cf60867f9d9847f0feda055b`.
+Native REST transport reconciled in this change; see the
+[shared transport contract](README.md#native-rest-transport).
 
 This is a source-reviewed baseline of representative operations and known gaps.
 Each capability needs operation-level review before its entire scope can be
@@ -18,8 +20,8 @@ API: `present` — representative operation IDs:
 - `GET /api/companies/{companyId}/secrets/catalog`.
 - `POST /api/companies/{companyId}/secrets`.
 
-Agent access: `partial` — Agent metadata catalog; board secret administration; agent
-secret proposal API.
+Agent access: `partial` — Agent REST / native `call_api` metadata catalog and secret
+proposals; company secret administration remains board-only.
 
 Policy: Board secret administration, active-run/self/report proposal policy, and scoped
 secret broker bindings; personal secret values belong to their user.
@@ -32,8 +34,8 @@ credentials/run context; inspect its result and applicable persistence/attributi
 Assert the relevant denied actor, owner, company or mode from Policy. Review the
 remaining operations before qualifying the whole capability.
 
-Gaps: Metadata and requesting a change exist; generic native API blocks secret
-management/value transport.
+Gaps: Native transport preserves board-only administration. Bound value retrieval
+is a separate scoped operation described under runtime-delivery.
 
 ## `user-secrets`
 
@@ -69,8 +71,8 @@ API: `present` — representative operation IDs:
 - `POST /api/agents/me/secret-proposals`.
 - `GET /api/agents/me/secret-proposals`.
 
-Agent access: `partial` — Active-run agent REST with redaction; board
-approval/rejection.
+Agent access: `partial` — Active-run agent REST / native `call_api` with redaction;
+approval/rejection remains board-only.
 
 Policy: Board secret administration, active-run/self/report proposal policy, and scoped
 secret broker bindings; personal secret values belong to their user.
@@ -83,8 +85,8 @@ credentials/run context; inspect its result and applicable persistence/attributi
 Assert the relevant denied actor, owner, company or mode from Policy. Review the
 remaining operations before qualifying the whole capability.
 
-Gaps: Native call_api blocks secret-proposals and no dedicated production proposal tool
-is in its default authority set.
+Gaps: No dedicated production proposal tool is required for the REST path.
+Native calls retain active-run, scope and skill-test JWT restrictions.
 
 ## `vault-import`
 
@@ -120,8 +122,8 @@ API: `present` — representative operation IDs:
 - `GET /api/agents/me/secrets`.
 - `POST /api/agents/me/secrets/{key}/value`.
 
-Agent access: `partial` — Authorized environment/broker delivery; eligible legacy agent
-REST access.
+Agent access: `available` — Authorized environment/broker delivery and scoped agent
+REST / native `call_api` value retrieval.
 
 Policy: Board secret administration, active-run/self/report proposal policy, and scoped
 secret broker bindings; personal secret values belong to their user.
@@ -134,5 +136,13 @@ credentials/run context; inspect its result and applicable persistence/attributi
 Assert the relevant denied actor, owner, company or mode from Policy. Review the
 remaining operations before qualifying the whole capability.
 
-Gaps: Native metadata reads exist; value call is blocked and scenario read_secret_value
-is unbound. Do not add raw secret-returning fallback tools.
+Server-only instance secrets are excluded from this path. They belong to the
+company, owning agent, and installed lifecycle plugin. The existing local lifecycle
+callback can save them through the native secret service; there is no agent API
+for their values. Source: [native secret coordinator](../../server/src/services/agent-instance-secrets.ts)
+and [scope/denial tests](../../server/src/__tests__/agent-instance-secrets.test.ts).
+No live agent execution is claimed for this exclusion.
+
+Gaps: Values remain restricted to the bound agent and active run. Credential
+responses stay inline and use encrypted mutation receipts; they are not saved as
+plaintext response assets. Dedicated scenario read_secret_value remains unbound.

maps/agent-access-map/skills.md

@@ -2,7 +2,9 @@
 
 Product map: [Skill discovery, authoring, and policy](../feature-map/skills.md).
 
-Review date: 2026-10-12. Source commit: `f981fa3cc10cb8663a87dec60345fbff46d54d0a`.
+Review date: 2026-10-12. Source commit: `58e16dbddfc9c8d0cf60867f9d9847f0feda055b`.
+Native REST transport reconciled in this change; see the
+[shared transport contract](README.md#native-rest-transport).
 
 This is a source-reviewed baseline of representative operations and known gaps.
 Each capability needs operation-level review before its entire scope can be
@@ -122,8 +124,8 @@ API: `present` — representative operation IDs:
 
 - `POST /api/companies/{companyId}/skills/{skillId}/test-runs`.
 
-Agent access: `partial` — Permitted agent REST; native read fallback for history; no
-dedicated CLI test command found.
+Agent access: `available` — Permitted agent REST / native `call_api` creation, control
+and history; no dedicated CLI test command found.
 
 Policy: Company skill policy by action/resource plus platform invariants; test execution
 additionally requires task-assignment authority.
@@ -137,5 +139,47 @@ credentials/run context; inspect its result and applicable persistence/attributi
 Assert the relevant denied actor, owner, company or mode from Policy. Review the
 remaining operations before qualifying the whole capability.
 
-Gaps: Native call_api rejects test-run creation/control while the route can authorize
-agents. No default native orchestration binding.
+Gaps: No dedicated native orchestration binding; generic REST calls retain
+skills.test policy, task-assignment authorization, responsible-user intersection and
+admitted skill-test JWT scope.
+
+Project-source API additions: GET `/api/companies/{companyId}/skill-sources/project-repositories`,
+POST `/api/companies/{companyId}/skill-sources/adopt-project` with `workspaceId`, and
+PATCH `/api/companies/{companyId}/skill-sources/{sourceId}/settings` with expected revision
+and update/connection preferences. `trackingRef` accepts a branch or explicit ref;
+`"HEAD"` keeps default-branch tracking. GET `/api/companies/{companyId}/skill-sources/{sourceId}/branches`
+returns a bounded branch list and the default branch, with optional `connectionId` for
+connection repair. It requires source access and `skills.edit`, and reads only through
+the caller's authorized GitHub grant. Saving validates the requested ref before changing
+an independent source; active project bindings must be edited through their
+project configuration. Responses identify branch, connection, or retry repair and distinguish
+queued imports from imports under an active worker lease. Native API discovery uses the OpenAPI registration.
+
+Project-derived read/use permission follows current project authorization, with access
+through either originating project. File/version reads, source metadata, mutations,
+editable copies, tests and runtime delivery retain that boundary. Unattended refresh
+uses the revalidated setup identity and connection, not the requesting agent's token.
+These additions need actual permitted/denied agent-run acceptance; service tests alone
+are not live credential proof.
+
+Direct GitHub source imports share the project setup-identity boundary. API-key
+agents may import permitted public content, but their responsible-user field
+does not authorize unattended credential use. They need human connection repair
+for automatic refresh. Authenticated agent runs derive the setup person from
+the persisted active run. Legacy agent activity without a matching run cannot
+recover a refresh person. Route and database tests cover these distinctions;
+this addition makes no new live-provider acceptance claim.
+
+Initial project imports check skills.import before provider reads; denied jobs
+do not retry automatically. Deferred jobs remain durable behind per-project and
+company admission limits. Scheduled refresh compares immutable tree identity and
+uses a persistent work allowance; manual refresh still requires its existing
+policy/access checks. These limits grant no content or execution access.
+
+Agent repository setup preserves the active run's selected GitHub connection/grant
+IDs. Missing selections require human repair; the worker never searches the
+responsible person's other grants for an agent-created source.
+
+Initial automatic imports reserve company work credits before provider reads.
+Failures retain the reservation; completed jobs cannot replenish the queue's
+work allowance. Jobs remain durable and resume as company credits refill.

maps/agent-access-map/steering.md

@@ -2,7 +2,9 @@
 
 Product map: [Steering and queued messages](../feature-map/steering.md).
 
-Review date: 2026-10-12. Source commit: `f981fa3cc10cb8663a87dec60345fbff46d54d0a`.
+Review date: 2026-10-12. Source commit: `58e16dbddfc9c8d0cf60867f9d9847f0feda055b`.
+Native REST transport reconciled in this change; see the
+[shared transport contract](README.md#native-rest-transport).
 
 This is a source-reviewed baseline of representative operations and known gaps.
 Each capability needs operation-level review before its entire scope can be
@@ -80,8 +82,8 @@ Verification: `not-run` — assert the documented agent denial with an owned tes
 verify any listed agent request/result path separately. A delegated operation needs its
 own policy and access review.
 
-Gaps: Generic native API blocks this execution control; no authority to impersonate the
-steering user.
+Gaps: Steering requires a board user at the HTTP route. Native `call_api`
+preserves this denial and cannot impersonate the steering user.
 
 ## `interrupt`
 

maps/agent-access-map/task-coordination.md

@@ -3,7 +3,9 @@
 Product map: [Delegation, dependencies, and
 signoff](../feature-map/task-coordination.md).
 
-Review date: 2026-10-12. Source commit: `f981fa3cc10cb8663a87dec60345fbff46d54d0a`.
+Review date: 2026-10-12. Source commit: `58e16dbddfc9c8d0cf60867f9d9847f0feda055b`.
+Native REST transport reconciled in this change; see the
+[shared transport contract](README.md#native-rest-transport).
 
 This is a source-reviewed baseline of representative operations and known gaps.
 Each capability needs operation-level review before its entire scope can be
@@ -43,8 +45,8 @@ API: `present` — representative operation IDs:
 
 - `PATCH /api/issues/{id}`.
 
-Agent access: `available` — Native set_dependencies for current task; agent REST under
-mutation/checkout policy.
+Agent access: `available` — Native set_dependencies for the current task; agent REST
+/ native `call_api` under mutation and checkout policy.
 
 Policy: Task visibility/mutation, task-assignment and ownership policy; review audience
 independent; tree controls board-only.
@@ -58,7 +60,8 @@ credentials/run context; inspect its result and applicable persistence/attributi
 Assert the relevant denied actor, owner, company or mode from Policy. Review the
 remaining operations before qualifying the whole capability.
 
-Gaps: Generic native PATCH rejects blockedByIssueIds so use its real dedicated tool.
+Gaps: Dedicated set_dependencies is current-task scoped. Generic `call_api`
+forwards blockedByIssueIds to the REST route and retains its ownership checks.
 
 ## `signoff`
 

maps/agent-access-map/tasks.md

@@ -2,7 +2,9 @@
 
 Product map: [Task creation and lifecycle](../feature-map/tasks.md).
 
-Review date: 2026-10-12. Source commit: `f981fa3cc10cb8663a87dec60345fbff46d54d0a`.
+Review date: 2026-10-12. Source commit: `58e16dbddfc9c8d0cf60867f9d9847f0feda055b`.
+Native REST transport reconciled in this change; see the
+[shared transport contract](README.md#native-rest-transport).
 
 This is a source-reviewed baseline of representative operations and known gaps.
 Each capability needs operation-level review before its entire scope can be
@@ -35,6 +37,17 @@ narrower/different APIs.
 
 ## `organize`
 
+The issue-list API accepts optional `includeAgentCreatedTasks`; false restricts
+independent results to human creation before search/pagination. Omission retains
+existing agent/API behavior. `includeParticipatedTasks=true` requires a board user
+and retains only that authenticated user's existing participation as a creation
+visibility exception. Company/private-task access checks still apply. Collection
+preferences and hierarchy presentation are browser state, not additional authority.
+Source-reviewed behavior; live agent access verification remains separate.
+
+All `chat_channel` origins count as bot-created for creation visibility, including
+human-initiated conversations. Existing inbox participation remains independent.
+
 Review: `baseline`.
 
 API: `present` — representative operation IDs:
@@ -67,8 +80,8 @@ API: `present` — representative operation IDs:
 - `PATCH /api/issues/{id}`.
 - `PUT /api/issues/{id}/title`.
 
-Agent access: `partial` — Native set_task_title/reassign_task/set_dependencies; fallback
-for permitted non-lifecycle fields; REST.
+Agent access: `available` — Native set_task_title/reassign_task/set_dependencies and
+`call_api` for REST-authorized fields; agent REST.
 
 Policy: Company/task visibility, assignment/change policy, active-run checkout ownership
 and lifecycle rules. A legacy run can assign its own task to a human without
@@ -89,8 +102,8 @@ regressions in [ownership tests](../../server/src/__tests__/issue-agent-mutation
 cover a human handoff and stop enforcement for other actors, runtimes and targets;
 they use mocked services and do not claim live execution proof.
 
-Gaps: Native fallback blocks status/assignment/dependency policy fields. Dedicated tools
-differ in scope and supported fields.
+Gaps: Dedicated tools differ in scope and fields. Generic `call_api` forwards
+status, assignment and dependency fields to existing route authorization.
 
 ## `discussion`
 
@@ -115,8 +128,9 @@ credentials/run context; inspect its result and applicable persistence/attributi
 Assert the relevant denied actor, owner, company or mode from Policy. Review the
 remaining operations before qualifying the whole capability.
 
-Gaps: Other-task comments and active-task progress have separate scopes; explicit
-reopen/interrupt is not a generic comment capability.
+Gaps: Other-task comments and active-task progress have separate scopes. Generic
+`call_api` forwards explicit reopen/resume/interrupt fields to the existing route
+checks; it cannot impersonate a user.
 
 ## `completion`
 
@@ -127,7 +141,7 @@ API: `present` — representative operation IDs:
 - `PATCH /api/issues/{id}`.
 
 Agent access: `available` — Native paperclip_finish/paperclip_block through runner
-protocol; legacy agent REST disposition.
+protocol; agent REST / native `call_api` disposition under route permissions.
 
 Policy: Company/task visibility, assignment/change policy, active-run checkout ownership
 and lifecycle rules.
@@ -140,5 +154,5 @@ credentials/run context; inspect its result and applicable persistence/attributi
 Assert the relevant denied actor, owner, company or mode from Policy. Review the
 remaining operations before qualifying the whole capability.
 
-Gaps: Server governs whether a reported result becomes done/review/blocked. A generic
-lifecycle PATCH is intentionally rejected for native runs.
+Gaps: The server governs whether a reported result becomes done/review/blocked.
+Generic lifecycle PATCH uses existing REST authorization, checkout and approval rules.

maps/agent-access-map/workspaces.md

@@ -2,7 +2,9 @@
 
 Product map: [Execution workspaces, services, and files](../feature-map/workspaces.md).
 
-Review date: 2026-10-12. Source commit: `f981fa3cc10cb8663a87dec60345fbff46d54d0a`.
+Review date: 2026-10-12. Source commit: `58e16dbddfc9c8d0cf60867f9d9847f0feda055b`.
+Native REST transport reconciled in this change; see the
+[shared transport contract](README.md#native-rest-transport).
 
 This is a source-reviewed baseline of representative operations and known gaps.
 Each capability needs operation-level review before its entire scope can be
@@ -37,6 +39,24 @@ workspace write authority. Accepting a new pending choice advances its binding
 revision; superseded retries fail while current-choice retries remain idempotent.
 Binding revisions and request keys fence retries;
 selection applies at the next normal admission without interrupting a live run.
+
+Fresh standard-trust tasks with an implicit repository default can use an owned
+remote clone when the shared default source fails the restricted-task workspace
+guard. This does not grant access to the private local checkout or its Git metadata.
+The normal admitted Git identity must already authorize the configured remote.
+Creation of a fallback source is unavailable for explicit, parent/channel, reused
+or low-trust selections, or branch templates without a task-derived placeholder;
+an existing verified owned source remains reusable. Literal branch selections
+retain the original denial without cloning or replacing their unpublished commits.
+New implicit Git defaults record project-source provenance. Untyped explicit,
+inherited and older ambiguous checkout bindings retain the denial; admission reads
+the current company-scoped binding before considering the fallback.
+Local paths, unsupported transports and credential-bearing URLs are not fallback
+sources. Company/task/remote bindings, real paths, Git storage and the exact origin
+are revalidated for reuse, cleanup and reopening. A failed save removes only the
+owned task worktree. The [isolated-source service](../../server/src/services/isolated-remote-workspace-source.ts)
+and its local regression tests establish source and lifecycle boundaries; live
+agent/provider qualification remains separate.
 Writable aliases must also be compatible with current and retained physical
 source projects' trust boundaries. Incompatible choices are rejected before
 dispatch; a projectless alias cannot bypass required sandbox containment.
@@ -119,8 +139,8 @@ API: `present` — representative operation IDs:
 
 - `POST /api/execution-workspaces/{id}/runtime-services/{action}`.
 
-Agent access: `partial` — Authorized agent REST / CLI workspace runtime-service /
-existing stdio MCP controls.
+Agent access: `available` — Authorized agent REST / native `call_api` / CLI runtime
+service controls and existing stdio MCP controls.
 
 Policy: Company/project/workspace visibility and runtime authority; active run, trust
 preset and task ownership where required.
@@ -134,8 +154,9 @@ credentials/run context; inspect its result and applicable persistence/attributi
 Assert the relevant denied actor, owner, company or mode from Policy. Review the
 remaining operations before qualifying the whole capability.
 
-Gaps: Native call_api blocks runtime-service mutation; control_workspace_service is not
-in the production authority set. Optional MCP availability must be recorded.
+Gaps: No dedicated production control_workspace_service binding. Generic native
+calls retain runtime trust and workspace/task scope checks. Optional MCP availability
+must be recorded.
 
 ## `files-git`