SI file reads answer a locked or still-checking file in plain words
Every downstream read (mail and SMS attachments, chat files, documents and versions, resumes, binders) goes through DownstreamErrors, so the mapping lives there...
Commerce_request_rental names the renter's account
SecurityService now refuses a rental request without a customer account (every rental has a renter), so the tool takes a required accountUid and passes it on. T...
Test a connected tool server before it is saved, and name each tool as its server does (SIS9)
- POST /api/mcp/servers/probe?orgId= (internal auth, AIService only): lists the tools of an unsaved draft on a client of its own, closed at once. Nothing is ...
After outside content, risky acts need a person's OK unless a supervisor ordered them (SIE3 follow-up)
Owner decision 2026-11-07 on SIE3's finding: once a run has read outside content (email, web page, document, text, call, meeting), a send to a new recipient, a ...
Prompt-injection regression gate in the Docker build; outside content cannot close its block (SIE3)
InjectionRegressionGateTest holds the Tool Plane's real defenses against hidden instructions, under the most permissive charter: every tool that hands over cont...
Handoff_to_person — an SI hands the conversation to a person (SIE7)
A call back (also 'as soon as someone is free') or a place in line for the next free person, on any channel, so the customer never repeats themselves. kamoai-se...
One policy decision point for every SI channel, with one explainable decision record (SIE2)
PolicyDecisionPoint answers every authorization question the Tool Plane pipeline asks, in the same order: visibility + rights floor, No Insubordination order an...
Golden files over every existing SI authorization decision, before the policy decision point (SIE2)
Charter outcome matrix (1376 cases), every catalogue tool's static decisions (identity open/reply, on-behalf, order call scope, visibility for SI/floor/person s...
Read the address bar's text.content, and pass a shell secret in run_shell's env map (TPVAULT phase 2, live)
Live on a test SI's workstation the address bar's text sat 372 characters after its name; read the node's own content first so a longer states list can't push i...
Vault_list, vault_fill and vault_run_shell, fill-only by reference (TPVAULT phase 2)
The SI names an item; the Tool Plane reads the focused window and the browser's address bar from the machine itself, asks VaultService (which checks the site bi...
Inbox tools say a draft is in the SI's own personality, or the owner's SI Assistant's voice
No more owner's voice profile: si_inbox_next carries the owner's name and placeholder, and their own SI Assistant's voice when they chose it. The parity snapsho...
The assign tool names any deal role
mlos_assign_loan_officer keeps its name, so the charter and audit stay readable, and takes an optional role from the one catalog. Closing Scheduled leaves mlos_...
A floor duty's own bookkeeping asks no approval
A supervised SI asked a person to approve its briefing, which would mean an approval per email in triage. These writes are the duty the org set up; si_briefing_...
The SI's floor tools, and the optional loan statuses on the MCP tools
The on-behalf log flags patient information only for patient-record tools
Live: every notifications read was flagged as patient information (notifications_list is phiSensitive in general). The member-facing flag now follows the tool's...
MLOS tool writes carry the approval they run on
So SecurityService can tell a person's approval or order from an SI's own initiative, which the lender may have switched off (LOAN_SI_CHANGES).
Wake-up list carries ids, cancel one by id, never ask for a confirmation (TPWAKEUP)
Owner live test 2026-10-28: the SI asked him to approve before removing a duplicate wake-up. The tools say anyone may list and cancel for any number with no con...
Today:true answers only today's figures
Live (sp00verify 07:58Z): with today:true the answer carried receivedToday 0 beside the all-time total 12, and the SI reported 12. A today answer now holds rece...
Notifications_list today:true counts what arrived today in the owner's zone
TPONBEHALF live check (sp00verify 2026-10-28 07:27Z): asked "how many notifications did I get today?", the SI read the member's own account correctly (on behalf...
OnBehalfOf — an SI acts through its higher-up's own account on their authenticated request
TPONBEHALF (owner 2026-10-28): Sage asked Luna how many notifications HE got today and she could only read her own. On an authenticated request from anyone up t...
SI mortgage reads take View Own Mortgage Loans
Every MLOS staff right now implies View Own Mortgage Loans, and SecurityService narrows a member without View Mortgage Pipeline to the loans they are assigned l...
Phone_schedule_wakeup, phone_cancel_wakeup, phone_list_wakeups (TPWAKEUP)
Owner order 2026-10-28, the first SI easter egg: anyone, signed in or not, on any channel, may ask an SI for a wake-up call (or cancel the ones for any number)....
Cancelling its own outside-meeting join is the SI's bookkeeping, no approval (TPEXTMEET)
Found live in sp00verify: a teammate's "cancel that join" went to the owner for approval (UPDATE_RECORD). Also passes whenInInvitationZone through. Goldens rege...
Meetings_join_external, **************** meetings_cancel_external (TPEXTMEET)
An SI joins an outside meeting (Zoom, Teams, Meet, Webex, GoTo, any provider) from the details a teammate gave it, now or at the invitation's start, by phone. J...
A signed-in supervisor's meeting request is their order even when terse ("Nell email Cole, supervisor test")
TPMEETAUTH live (sp00verify call 8daf1817): the supervisor's line was attributed SOLE / SUPERVISOR from their own stream, but DirectOrder did not read "Nell ema...
In a meeting, the line's own speaker decides authority (signed-in supervisor orders, teammate asks, guest is anyone)
TPMEETAUTH (owner order 2026-10-26). kamoai-voice names the meeting line a call answers (X-Kamo-Meeting-Turn, never the model); MeetingTurns asks kamoai-service...
A weak citation never hides the member's confirmation (order and approval stand-in)
Live 2026-10-27 (sp00verify, approval bc7dfe20): after KC Vera confirmed, the SI cited the unproven email it was asked in; that soft-refused and replaced both t...
A member's confirmation in Kamo is the request an outside send carries (no approval for what their rights allow)
Live 2026-10-27 (sp00verify, request db6fff36): KC Vera confirmed in Kamo and the run ran on her order, yet mail to an outside address still went to the SI's su...
Anti-impersonation guard — an unverified conversation gets only what anyone may ask until the member confirms in Kamo
Owner 2026-10-26 (TPCALLTOOLS B): someone who only CLAIMS to be a member, a supervisor or someone in authority must not get the SI to do anything harmful or tha...
Calendar_create_event invites teammates by member id, so 'put it on my calendar' reaches the person who asked
Nobody may write another member's calendar (EmailService: own calendars, the org calendar with the publish right), so a union of rights cannot either. inviteMem...
Identity checks about a named message; an unproven email whose sender confirmed is their order
identity_request_confirmation takes 'about' (email:<folder>/<uid>, chat:<guid>) for a message that is not the run's own wake (a check-in handling it). An email ...
Every notification kind decided (BILLING_INVOICE not offered to SIs); ClockPack names its Spring constructor
NotificationsPackTest and KnowledgeAndPeoplePacksTest were red on main since shared-lib added BILLING_INVOICE. ClockPack keeps its test constructor; the one Spr...
Audit the SI Assistant's calls as made on the member's behalf
The member's personal SI Assistant (TPASSIST) calls with the member's own session; its keys start assistant:, and such a call by a person is audited with author...
Holdem_* - an SI plays Texas Hold'em with members
SITP TPGAMES. Twelve tools over MediaService's Hold'em endpoints, gated as a member's seat is (Hold'em app + PLAY_HOLDEM, again downstream): holdem_list_tables,...
Tool-list snapshots regenerated with identity_request_confirmation after rebase
Identity_request_confirmation; a request the member confirmed in Kamo is their order
Owner 2026-10-26: direct orders must be authenticated. Someone who only claims to be a teammate (phone, text, unproven email, website chat, meeting) is asked, t...
Mail_send takes an HTML body's plain-text version and one text file written by the caller (TPRECAPS)
The SI's meeting recap now carries the meeting's full transcript; past the body's limit it goes as a .txt attachment. textBody (with bodyFormat HTML) becomes th...
Games_* - an SI plays chess with members
SITP TPGAMES. Eleven tools over MediaService's chess endpoints, gated as a member's board is (Chess app + PLAY_CHESS, again downstream): games_list, games_get_s...
Every SI has a clock: time_now, time_convert, time_calc
Owner report 2026-10-26: asked the time on a call, an SI said it had no clock. The clock and calendar every person has: the time now in the SI's zone or any oth...
A teammate's proven email to an SI is their request and their order
Owner report 2026-10-26: the owner emailed their SI to call them; the email was never an order ([ORDER] no order) and every later check-in read it as outside ma...
Declare every right a tool's service enforces; plain words for unseen records and numbers
Approval follow-up 2026-10-21 (controller review of the approvals UI). Rights (item 4): an audit of every tool's declared rights against the rights its downstr...
Honour standing permissions; offer Approve and always allow on the card
CharterPolicy reads resolved.toolApprovals and each rule's standing flag. A member's rule about one tool stands for its class's rule for that tool; a standing p...
An approval card sends every parameter its phrase names
next-intl refuses an ICU select or plural with no value, so a phrase about an argument the SI left out (a contact with no formatted name, a new document categor...
An approval about a record the reader may not see never leaves a dangling 'for'
Phrases that named a patient, a customer, a purchaser, an envelope or a document after a preposition now say 'for a patient' (or nothing) when the reader may no...
Approval cards say SI in every label, write phone numbers and choices as people do, and keep a note beside an action a field
A humanised field name said 'Ai companion…' (now SI, with a guard that no phrase, label, noun or risk sentence says AI); a US number reads (512) 555-0142 in the...
Plain-language approval cards, worded as the reader may see them
Owner order 2026-10-20: approvals showed members GUIDs and JSON. POST **************** (internal auth) words each approval for a non-technical person: one sente...
Sms_read_attachment, and sms_read_thread names what was texted in (SITP MMS)
TP11 deferred sms_read_attachment because VOIPService kept no inbound MMS media; it does now (voipservice@8eda899). So: - sms_read_thread lists each inbound pa...
An SI on a teammate's order can find and operate just the function the order needs; on god's order also unverified ones (IoT R7 round 3)
- IotPack.planSend: when the SI's own view lacks the device or the function (or may not OPERATE it) and the caller is on an order-scoped session, IoTService's...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.