docs(maps): correct MCP transport and private voice boundaries

Restore existing chat provenance notes and enumerate private voice and phone operations. Record unsupported MCP GET transports and the authenticated device-session regression evidence.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

doc/plans/2026-10-13-connection-api-parity.md

@@ -120,3 +120,6 @@ The implementation was rebased onto `a1f77821b9cd5c9c846fdf7a0fa5cc620ad2b6bb`.
 - A one-call rate limit permits the admitted test and denies the next test without a second provider invocation. The final policy check carries the invocation's recorded admission. The first new test assertion used an incorrect response shape; the corrected assertion checks the existing `decision`/`error` contract and actual provider call count.
 - Current workspace typecheck and production build passed after these changes. The focused Slack retry authorization cases passed (**3 tests**) after sorting both ID reads. Their first local attempt raced the database package build's migration-directory replacement; after that build completed, normal migrations and all three cases passed.
 - The preceding CI head had several runner-shutdown cancellations and a browser strict-locator failure involving duplicate chat replies. The chat integration failure was an unordered ID comparison, corrected above. These failures remain part of the qualification history; only fresh current-head CI can establish the final check result.
+
+- A subsequent route review found a board-only owner helper left behind in the sandbox device-login path. It now uses the shared connection authority while keeping the responsible user as immutable session owner. A focused assembled-server case passed for actual key/JWT reads, cancellation, strict start validation, and another-owner denial. This fixture does not launch a sandbox/provider process; existing login service fixtures cover that contract.
+- Map review also corrected unsupported MCP GET handlers (405, POST required), restored private voice/phone consent boundaries and existing chat provenance notes, and distinguished saved device-session HTTP evidence from provider authentication.

maps/agent-access-map/chat-channels.md

@@ -577,6 +577,155 @@ Policy: The provider verifies the payload signature and binds the endpoint/compa
 Evidence: `source-only` — [route](../../server/src/routes/email.ts); reviewed in the working tree based on the source commit above.
 Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
 Gaps: Provider ingress has no agent invocation path. Provider signature validation remains required.
+Monitor publication lineage uses the admitted wake and its source run's matching
+`set_task_monitor` receipt, including company, task, immutable agent, requester,
+and scheduled time. A source ID in context cannot grant publication. The normal
+delivery worker rechecks current endpoint and sender authority. Database fixtures
+exercise lineage and finalization recovery; live Slack qualification remains
+separate.
+
+Publication, provider-reply, and form-open 403/permission errors fail the rejected
+operation without removing unrelated assigned channel tools. Confirmed
+authentication failures still put the endpoint in attention, which blocks tool
+admission and provider sends; connection enabled intent is retained. Known
+resource denials and explicit revocation keep their narrower or installation-wide
+stops. PostgreSQL provider fixtures verify discovery after 403 and rejection after
+401, including signed installation removal after a 401; they do not establish
+live GitHub credential recovery.
+
+GitHub publication recovery (2026-10-14): assigned-agent `submit_review`, `comment`,
+and `update_comment` calls reuse their run-, task-, endpoint-, and argument-bound
+publication on an exact retry. Identity uses the complete durable request rather
+than the shortened audit preview. A changed suffix, changed nested entry, or
+missing publication cannot authorize another write. Exact retries only read the
+receipt; the worker owns pending provider retries. Fresh gateway policy and provider authority remain
+required. The durable worker resumes transient failures after restart and stops
+at its retry cap, revoked authority, or a superseded head. A pending receipt is
+not task completion. Source:
+[publication service](../../server/src/services/chat-github-reviews.ts) and
+[gateway](../../server/src/services/tool-gateway.ts). Verification uses
+PostgreSQL-backed provider fixtures; this entry does not claim live provider
+qualification for the new retry path.
+
+GitHub main-response identity (2026-10-19): PR requests share a company-, App-,
+repository- and PR-bound comment. Agents still supply no comment destination.
+Current sender, assignee, repository and publication authority are checked before
+edits, including maintenance failure notices. Leading mentions for another
+recipient are filtered before task work; explicit mentions of this bot still
+follow normal access checks. Provider-fixture coverage is not live GitHub proof.
+Native terminal reconciliation resolves the accepted run identity through the
+existing chat provenance resolver; an older run's reply cannot complete a newer
+request merely because both requests share the same PR comment.
+
+Speko browser sessions use `POST /api/companies/{companyId}/voice-sessions`,
+with GET inspection/notification and POST `/{sessionId}/end` operations below
+that collection. These routes require board identity; ordinary agent credentials
+cannot start a private voice session. Start and notification also require the
+experimental chat-connectors gate. Signed provider callbacks use the separate
+voice-webhook routes and their session capability. Evidence: `source-only` —
+[voice routes](../../server/src/routes/voice-sessions.ts). No live browser answer
+retrieval or telephone playback is established by the UI fixtures.
+
+Slack's **Require at-mention** policy applies to channel messages and channel
+thread replies, including queued work. DMs are exempt from mention checks;
+endpoint availability, **Allow direct messages**, and sender authorization still
+apply. Top-level DM replies retain their linear conversation destination. Source:
+[admission](../../server/src/services/chat-channels.ts) and
+[queued run policy](../../server/src/services/durable-chat-wakeup.ts). Live Slack
+verification of this exemption remains separate from provider-fixture coverage.
+
+Slack eyes acknowledge the authorized task/comment commit before attachment
+preparation or scheduler acceptance. This server-owned receipt grants no agent
+authority. Generation/credential fencing, durable retries and exact-source final
+cleanup still apply. PostgreSQL fixtures block attachments, subscription and
+wakeup independently to verify that none gates the reaction; live Slack latency
+remains a separate check. See [receipt worker](../../server/src/services/chat-channels/receipt-reactions.ts).
+
+Controller-owned receipt reactions accept the SDK's empty thread timestamp for
+linear DMs. Channel IDs and source message timestamps remain validated. This
+does not add an agent tool or change sender, task, or credential authorization.
+The pinned SDK transport regression is covered in
+[receipt tests](../../server/src/services/chat-slack-receipts.test.ts); live
+acknowledgement speed needs a separate provider test.
+
+Slack assignment and tool discovery bound concurrent endpoint preparation to
+two. Every endpoint keeps the live task, company, agent and linked-user checks;
+403 denials omit only that endpoint. Preparation waits for both active checks
+before it returns an ordered result or propagates an error. Tool authority reads
+the current bot token without resolving unrelated webhook credentials. See the
+[real-database preparation controls](../../server/src/__tests__/slack-tool-preparation.test.ts)
+and [batch failure controls](../../server/src/services/connectors/slack-endpoint-preparation.test.ts).
+These local controls do not establish live Slack latency or provider access.
+
+Native tool gateways use the durable run task binding for discovery and policy
+checks, with legacy JSON task fields as a fallback. GitHub and Slack follow
+accepted request provenance across task continuations. GitHub can retain the
+originating conversation after a board follow-up from the same accepted user.
+An inherited origin cannot cross a task, agent, company, or requester boundary.
+Cycle checks reject invalid history without a fixed limit on valid continuations.
+Endpoint settings, linked identity, tool profiles, and invocation policy still
+apply on each call. The native tool contract rotates older provider sessions so
+an empty retained catalog is not reused. PostgreSQL fixtures cover discovery,
+review publication, Slack reads, and revocation in
+[channel integration](../../server/src/__tests__/chat-channels.integration.test.ts)
+and [provenance controls](../../server/src/services/chat-channels/run-origin.test.ts).
+The [voice gateway fixture](../../server/src/__tests__/voice-session-store.integration.test.ts)
+also verifies durable task binding for a later personal callback invocation.
+Failure replies cannot replace final answers inherited from an earlier run.
+These fixtures do not prove live provider delivery.
+
+Catalog authorization projection (2026-10-17): tool discovery uses the same live
+service-owned task, company, agent, requester, endpoint and credential checks as
+full authority resolution. It omits the revision digest and search-action token,
+which catalog descriptors do not consume. Connector assignments and governed
+operations retain full revision resolution; invocation policy is still checked
+by the gateway. Registry replacement and missing-service controls are in
+[authority registration tests](../../server/src/services/connectors/slack-authority.test.ts).
+This is a source and local-database contract; hosted latency needs live evidence.
+
+New conversations resolve typed project/workspace defaults from their endpoint
+and destination under the task-creation transaction. Defaults do not authorize
+private sources: admission checks the linked user's authority and assigned agent.
+An existing conversation keeps its task binding. See
+[creation service](../../server/src/services/chat-channels.ts) and
+[defaults contract](../../packages/shared/src/types/chat-channels.ts).
+
+### `post-voice-sessions`
+
+API: `present` — `POST /api/companies/{companyId}/voice-sessions`; JSON REST.
+Agent access: `operator-only` — the private voice caller must be an authenticated board user (or local operator); agent bearer credentials are rejected.
+Policy: Company access and the service's current caller/session/endpoint authority apply. Browser start, notification, and callback preferences also require experimental chat connectors. Private microphone access, callback preferences, and incoming-call approval remain human identity/consent steps; connection-management grants do not impersonate that caller.
+Evidence: `source-only` — [voice routes](../../server/src/routes/voice-sessions.ts), reviewed in this working tree.
+Verification: `not-run` — verify the board caller's own state and reject agent, wrong-user, and foreign-company calls. No live telephone or browser audio qualification is claimed.
+Gaps: This is an explicit human boundary. Authorized agents configure the underlying connection through its endpoint API; the human controls private calling and incoming-call consent.
+
+### `get-voice-session`
+
+API: `present` — `GET /api/companies/{companyId}/voice-sessions/{sessionId}`; JSON REST.
+Agent access: `operator-only` — the private voice caller must be an authenticated board user (or local operator); agent bearer credentials are rejected.
+Policy: Company access and the service's current caller/session/endpoint authority apply. Browser start, notification, and callback preferences also require experimental chat connectors. Private microphone access, callback preferences, and incoming-call approval remain human identity/consent steps; connection-management grants do not impersonate that caller.
+Evidence: `source-only` — [voice routes](../../server/src/routes/voice-sessions.ts), reviewed in this working tree.
+Verification: `not-run` — verify the board caller's own state and reject agent, wrong-user, and foreign-company calls. No live telephone or browser audio qualification is claimed.
+Gaps: This is an explicit human boundary. Authorized agents configure the underlying connection through its endpoint API; the human controls private calling and incoming-call consent.
+
+### `get-voice-notification`
+
+API: `present` — `GET /api/companies/{companyId}/voice-sessions/{sessionId}/notification`; JSON REST.
+Agent access: `operator-only` — the private voice caller must be an authenticated board user (or local operator); agent bearer credentials are rejected.
+Policy: Company access and the service's current caller/session/endpoint authority apply. Browser start, notification, and callback preferences also require experimental chat connectors. Private microphone access, callback preferences, and incoming-call approval remain human identity/consent steps; connection-management grants do not impersonate that caller.
+Evidence: `source-only` — [voice routes](../../server/src/routes/voice-sessions.ts), reviewed in this working tree.
+Verification: `not-run` — verify the board caller's own state and reject agent, wrong-user, and foreign-company calls. No live telephone or browser audio qualification is claimed.
+Gaps: This is an explicit human boundary. Authorized agents configure the underlying connection through its endpoint API; the human controls private calling and incoming-call consent.
+
+### `get-voice-report`
+
+API: `present` — `GET /api/companies/{companyId}/voice-sessions/{sessionId}/report`; JSON REST.
+Agent access: `operator-only` — the private voice caller must be an authenticated board user (or local operator); agent bearer credentials are rejected.
+Policy: Company access and the service's current caller/session/endpoint authority apply. Browser start, notification, and callback preferences also require experimental chat connectors. Private microphone access, callback preferences, and incoming-call approval remain human identity/consent steps; connection-management grants do not impersonate that caller.
+Evidence: `source-only` — [voice routes](../../server/src/routes/voice-sessions.ts), reviewed in this working tree.
+Verification: `not-run` — verify the board caller's own state and reject agent, wrong-user, and foreign-company calls. No live telephone or browser audio qualification is claimed.
+Gaps: This is an explicit human boundary. Authorized agents configure the underlying connection through its endpoint API; the human controls private calling and incoming-call consent.
+
 ## `attachments`
 
 Capability ID: `chat-channels/attachments`.
@@ -723,6 +872,97 @@ Evidence: `source-only` — [route](../../server/src/routes/email.ts); reviewed
 Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
 Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
 
+GitHub review summary headings use the bot display name. Checks remain
+independently scoped by GitHub App and endpoint/PR/commit identity.
+
+After publishing a review, native agents can report `yielded` with
+`response_wake` and no attention requests. Current conversation authorization
+is checked again at commit. The task remains in review without a human card;
+real human dependencies retain the ordinary attention-request path. A timed
+wait requires a confirmed `set_task_monitor` schedule. Database coverage lives
+in `external-chat-wait.integration.test.ts`; this is not live model evidence.
+
+### `post-voice-end`
+
+API: `present` — `POST /api/companies/{companyId}/voice-sessions/{sessionId}/end`; JSON REST.
+Agent access: `operator-only` — the private voice caller must be an authenticated board user (or local operator); agent bearer credentials are rejected.
+Policy: Company access and the service's current caller/session/endpoint authority apply. Browser start, notification, and callback preferences also require experimental chat connectors. Private microphone access, callback preferences, and incoming-call approval remain human identity/consent steps; connection-management grants do not impersonate that caller.
+Evidence: `source-only` — [voice routes](../../server/src/routes/voice-sessions.ts), reviewed in this working tree.
+Verification: `not-run` — verify the board caller's own state and reject agent, wrong-user, and foreign-company calls. No live telephone or browser audio qualification is claimed.
+Gaps: This is an explicit human boundary. Authorized agents configure the underlying connection through its endpoint API; the human controls private calling and incoming-call consent.
+
+### `get-voice-callbacks`
+
+API: `present` — `GET /api/companies/{companyId}/voice-callbacks/{endpointId}`; JSON REST.
+Agent access: `operator-only` — the private voice caller must be an authenticated board user (or local operator); agent bearer credentials are rejected.
+Policy: Company access and the service's current caller/session/endpoint authority apply. Browser start, notification, and callback preferences also require experimental chat connectors. Private microphone access, callback preferences, and incoming-call approval remain human identity/consent steps; connection-management grants do not impersonate that caller.
+Evidence: `source-only` — [voice routes](../../server/src/routes/voice-sessions.ts), reviewed in this working tree.
+Verification: `not-run` — verify the board caller's own state and reject agent, wrong-user, and foreign-company calls. No live telephone or browser audio qualification is claimed.
+Gaps: This is an explicit human boundary. Authorized agents configure the underlying connection through its endpoint API; the human controls private calling and incoming-call consent.
+
+### `put-voice-callbacks`
+
+API: `present` — `PUT /api/companies/{companyId}/voice-callbacks/{endpointId}`; JSON REST.
+Agent access: `operator-only` — the private voice caller must be an authenticated board user (or local operator); agent bearer credentials are rejected.
+Policy: Company access and the service's current caller/session/endpoint authority apply. Browser start, notification, and callback preferences also require experimental chat connectors. Private microphone access, callback preferences, and incoming-call approval remain human identity/consent steps; connection-management grants do not impersonate that caller.
+Evidence: `source-only` — [voice routes](../../server/src/routes/voice-sessions.ts), reviewed in this working tree.
+Verification: `not-run` — verify the board caller's own state and reject agent, wrong-user, and foreign-company calls. No live telephone or browser audio qualification is claimed.
+Gaps: This is an explicit human boundary. Authorized agents configure the underlying connection through its endpoint API; the human controls private calling and incoming-call consent.
+
+### `get-voice-phone`
+
+API: `present` — `GET /api/companies/{companyId}/voice-phone/{endpointId}`; JSON REST.
+Agent access: `operator-only` — the private voice caller must be an authenticated board user (or local operator); agent bearer credentials are rejected.
+Policy: Company access and the service's current caller/session/endpoint authority apply. Browser start, notification, and callback preferences also require experimental chat connectors. Private microphone access, callback preferences, and incoming-call approval remain human identity/consent steps; connection-management grants do not impersonate that caller.
+Evidence: `source-only` — [voice routes](../../server/src/routes/voice-sessions.ts), reviewed in this working tree.
+Verification: `not-run` — verify the board caller's own state and reject agent, wrong-user, and foreign-company calls. No live telephone or browser audio qualification is claimed.
+Gaps: This is an explicit human boundary. Authorized agents configure the underlying connection through its endpoint API; the human controls private calling and incoming-call consent.
+
+### `put-voice-phone`
+
+API: `present` — `PUT /api/companies/{companyId}/voice-phone/{endpointId}`; JSON REST.
+Agent access: `operator-only` — the private voice caller must be an authenticated board user (or local operator); agent bearer credentials are rejected.
+Policy: Company access and the service's current caller/session/endpoint authority apply. Browser start, notification, and callback preferences also require experimental chat connectors. Private microphone access, callback preferences, and incoming-call approval remain human identity/consent steps; connection-management grants do not impersonate that caller.
+Evidence: `source-only` — [voice routes](../../server/src/routes/voice-sessions.ts), reviewed in this working tree.
+Verification: `not-run` — verify the board caller's own state and reject agent, wrong-user, and foreign-company calls. No live telephone or browser audio qualification is claimed.
+Gaps: This is an explicit human boundary. Authorized agents configure the underlying connection through its endpoint API; the human controls private calling and incoming-call consent.
+
+### `get-voice-incoming`
+
+API: `present` — `GET /api/companies/{companyId}/voice-phone/{endpointId}/incoming`; JSON REST.
+Agent access: `operator-only` — the private voice caller must be an authenticated board user (or local operator); agent bearer credentials are rejected.
+Policy: Company access and the service's current caller/session/endpoint authority apply. Browser start, notification, and callback preferences also require experimental chat connectors. Private microphone access, callback preferences, and incoming-call approval remain human identity/consent steps; connection-management grants do not impersonate that caller.
+Evidence: `source-only` — [voice routes](../../server/src/routes/voice-sessions.ts), reviewed in this working tree.
+Verification: `not-run` — verify the board caller's own state and reject agent, wrong-user, and foreign-company calls. No live telephone or browser audio qualification is claimed.
+Gaps: This is an explicit human boundary. Authorized agents configure the underlying connection through its endpoint API; the human controls private calling and incoming-call consent.
+
+### `post-voice-incoming-decision`
+
+API: `present` — `POST /api/companies/{companyId}/voice-phone/{endpointId}/incoming/{callId}`; JSON REST.
+Agent access: `operator-only` — the private voice caller must be an authenticated board user (or local operator); agent bearer credentials are rejected.
+Policy: Company access and the service's current caller/session/endpoint authority apply. Browser start, notification, and callback preferences also require experimental chat connectors. Private microphone access, callback preferences, and incoming-call approval remain human identity/consent steps; connection-management grants do not impersonate that caller.
+Evidence: `source-only` — [voice routes](../../server/src/routes/voice-sessions.ts), reviewed in this working tree.
+Verification: `not-run` — verify the board caller's own state and reject agent, wrong-user, and foreign-company calls. No live telephone or browser audio qualification is claimed.
+Gaps: This is an explicit human boundary. Authorized agents configure the underlying connection through its endpoint API; the human controls private calling and incoming-call consent.
+
+### `get-voice-phone-history`
+
+API: `present` — `GET /api/companies/{companyId}/voice-phone/{endpointId}/history`; JSON REST.
+Agent access: `operator-only` — the private voice caller must be an authenticated board user (or local operator); agent bearer credentials are rejected.
+Policy: Company access and the service's current caller/session/endpoint authority apply. Browser start, notification, and callback preferences also require experimental chat connectors. Private microphone access, callback preferences, and incoming-call approval remain human identity/consent steps; connection-management grants do not impersonate that caller.
+Evidence: `source-only` — [voice routes](../../server/src/routes/voice-sessions.ts), reviewed in this working tree.
+Verification: `not-run` — verify the board caller's own state and reject agent, wrong-user, and foreign-company calls. No live telephone or browser audio qualification is claimed.
+Gaps: This is an explicit human boundary. Authorized agents configure the underlying connection through its endpoint API; the human controls private calling and incoming-call consent.
+
+### `get-voice-history`
+
+API: `present` — `GET /api/companies/{companyId}/voice-history/{endpointId}`; JSON REST.
+Agent access: `operator-only` — the private voice caller must be an authenticated board user (or local operator); agent bearer credentials are rejected.
+Policy: Company access and the service's current caller/session/endpoint authority apply. Browser start, notification, and callback preferences also require experimental chat connectors. Private microphone access, callback preferences, and incoming-call approval remain human identity/consent steps; connection-management grants do not impersonate that caller.
+Evidence: `source-only` — [voice routes](../../server/src/routes/voice-sessions.ts), reviewed in this working tree.
+Verification: `not-run` — verify the board caller's own state and reject agent, wrong-user, and foreign-company calls. No live telephone or browser audio qualification is claimed.
+Gaps: This is an explicit human boundary. Authorized agents configure the underlying connection through its endpoint API; the human controls private calling and incoming-call consent.
+
 ## `outbound-email`
 
 Capability ID: `chat-channels/outbound-email`.

maps/agent-access-map/connection-setup.md

@@ -264,11 +264,11 @@ Gaps: Agent invocation is denied by the stated policy. The authorized human or o
 ### `get-mcp-runtime-tools`
 
 API: `present` — `GET /mcp/runtime-tools`; browser/provider/MCP protocol.
-Agent access: `available` — existing authenticated MCP/provider protocol; not callable as JSON REST.
-Policy: Provider state/signature or gateway-token verification, company and resource binding; browser returns require the configuring human. Agent-issued durable gateway tokens retain both issuer and responsible-user authority.
+Agent access: `restricted` — GET always returns HTTP 405 with `Allow: POST`. Use the corresponding POST MCP operation.
+Policy: GET streaming is unsupported; this is a transport boundary independent of principal permissions. POST still requires the documented MCP authentication and resource policy.
 Evidence: `source-only` — [route](../../server/src/routes/connection-intents.ts); reviewed in the working tree based on the source commit above.
-Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
-Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
+Verification: `not-run` — source-reviewed fixed 405 handler. A protocol check should assert status 405 and `Allow: POST`; use POST to exercise authenticated MCP calls.
+Gaps: No GET event stream is implemented. This entry does not advertise a usable GET client connection.
 
 ### `post-mcp-runtime-tools`
 

maps/agent-access-map/gateways-profiles.md

@@ -158,11 +158,11 @@ Review: `operation-reviewed`.
 ### `get-mcp-gateways`
 
 API: `present` — `GET /mcp/gateways/{gatewayPublicId}`; browser/provider/MCP protocol.
-Agent access: `available` — existing authenticated MCP/provider protocol; not callable as JSON REST.
-Policy: Provider state/signature or gateway-token verification, company and resource binding; browser returns require the configuring human. Agent-issued durable gateway tokens retain both issuer and responsible-user authority.
+Agent access: `restricted` — GET always returns HTTP 405 with `Allow: POST`. Use the corresponding POST MCP operation.
+Policy: GET streaming is unsupported; this is a transport boundary independent of principal permissions. POST still requires the documented MCP authentication and resource policy.
 Evidence: `source-only` — [route](../../server/src/routes/tool-gateway.ts); reviewed in the working tree based on the source commit above.
-Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
-Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
+Verification: `not-run` — source-reviewed fixed 405 handler. A protocol check should assert status 405 and `Allow: POST`; use POST to exercise authenticated MCP calls.
+Gaps: No GET event stream is implemented. This entry does not advertise a usable GET client connection.
 
 ### `post-mcp-gateways`
 
@@ -176,11 +176,11 @@ Gaps: Provider fixtures do not qualify live provider setup or availability.
 ### `get-tool-gateway-gateways-mcp`
 
 API: `present` — `GET /api/tool-gateway/gateways/{gatewayId}/mcp`; browser/provider/MCP protocol.
-Agent access: `available` — existing authenticated MCP/provider protocol; not callable as JSON REST.
-Policy: Provider state/signature or gateway-token verification, company and resource binding; browser returns require the configuring human. Agent-issued durable gateway tokens retain both issuer and responsible-user authority.
+Agent access: `restricted` — GET always returns HTTP 405 with `Allow: POST`. Use the corresponding POST MCP operation.
+Policy: GET streaming is unsupported; this is a transport boundary independent of principal permissions. POST still requires the documented MCP authentication and resource policy.
 Evidence: `source-only` — [route](../../server/src/routes/tool-gateway.ts); reviewed in the working tree based on the source commit above.
-Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
-Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
+Verification: `not-run` — source-reviewed fixed 405 handler. A protocol check should assert status 405 and `Allow: POST`; use POST to exercise authenticated MCP calls.
+Gaps: No GET event stream is implemented. This entry does not advertise a usable GET client connection.
 
 ### `post-tool-gateway-gateways-mcp`
 

maps/agent-access-map/runs-adapters.md

@@ -507,27 +507,27 @@ Gaps: This individual operation has source review but no recorded HTTP verificat
 API: `present` — `GET /api/companies/{companyId}/adapters/{type}/login-sessions/active`; JSON REST.
 Agent access: `available` — agent REST and default native `search_api` / `call_api`.
 Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
-Evidence: `source-only` — [route](../../server/src/routes/agents.ts); reviewed in the working tree based on the source commit above.
-Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
-Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
+Evidence: `verified` — [production-authenticated integration fixture](../../server/src/__tests__/connection-management.integration.test.ts), with a saved database session and deterministic registered adapter capability.
+Verification: `passed` — actual persistent-key/run-JWT management reads, cancellation, and denial for another saved owner. Session ownership is the responsible human; no device provider or sandbox process was launched in this fixture.
+Gaps: Live device authentication remains unqualified. The start route retains strict managed-account, approved adapter command, sandbox, and provider availability checks; human consent completes authentication.
 
 ### `get-companies-adapters-login-sessions`
 
 API: `present` — `GET /api/companies/{companyId}/adapters/{type}/login-sessions/{sessionId}`; JSON REST.
 Agent access: `available` — agent REST and default native `search_api` / `call_api`.
 Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
-Evidence: `source-only` — [route](../../server/src/routes/agents.ts); reviewed in the working tree based on the source commit above.
-Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
-Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
+Evidence: `verified` — [production-authenticated integration fixture](../../server/src/__tests__/connection-management.integration.test.ts), with a saved database session and deterministic registered adapter capability.
+Verification: `passed` — actual persistent-key/run-JWT management reads, cancellation, and denial for another saved owner. Session ownership is the responsible human; no device provider or sandbox process was launched in this fixture.
+Gaps: Live device authentication remains unqualified. The start route retains strict managed-account, approved adapter command, sandbox, and provider availability checks; human consent completes authentication.
 
 ### `post-companies-adapters-login-sessions-cancel`
 
 API: `present` — `POST /api/companies/{companyId}/adapters/{type}/login-sessions/{sessionId}/cancel`; JSON REST.
 Agent access: `available` — agent REST and default native `search_api` / `call_api`.
 Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
-Evidence: `source-only` — [route](../../server/src/routes/agents.ts); reviewed in the working tree based on the source commit above.
-Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
-Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
+Evidence: `verified` — [production-authenticated integration fixture](../../server/src/__tests__/connection-management.integration.test.ts), with a saved database session and deterministic registered adapter capability.
+Verification: `passed` — actual persistent-key/run-JWT management reads, cancellation, and denial for another saved owner. Session ownership is the responsible human; no device provider or sandbox process was launched in this fixture.
+Gaps: Live device authentication remains unqualified. The start route retains strict managed-account, approved adapter command, sandbox, and provider availability checks; human consent completes authentication.
 
 ### `post-agents-claude-login`