{"ok": true, "status": "ok", "version": "matm-2026-06-23", "generatedAt": "2026-06-23T00:00:00Z", "data": {"schema_version": "matm.agent_free_account_setup_status.v1", "live": true, "status": "implemented_memory_fallback_or_mariadb", "setupEndpoint": "/api/matm/agent-setup/free-account", "setupRoute": "https://neuralwikis.com/api/matm/agent-setup/free-account", "schema": "/schemas/matm-agent-free-account-setup.schema.json", "auth": "none", "method": "POST", "idempotencyRequired": true, "humanInteractionRequired": false, "checkoutRequired": false, "couponRequired": false, "neuroWikisLoginRequired": false, "emailInboxRequired": false, "noCheckoutCouponEmailLoginOrHuman": true, "privateMcpRequiresBearerToken": true, "anonymousPrivateMcpAllowed": false, "workspacePlan": "free_agent", "storageLimitBytes": 209715200, "storageLimitMb": 200, "noTimeLimit": true, "expiresAt": "", "serviceAgentLimit": 2, "memberSeatLimit": 2, "apiKeySecretReturnedOnce": true, "apiKeySecretReplaySuppressed": true, "oneTimeKeyRequired": true, "one_time_key": true, "save_key_safely": true, "show_key_to_human": true, "storageWarningPolicy": {"thresholdsPercentRemaining": [25, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0], "warnAtOrBelowPercentRemaining": 25, "criticalAtOrBelowPercentRemaining": 10, "everyPercentFromNineDownThroughZero": true, "requiredAgentActions": ["inform_human", "streamline_memory", "deduplicate_or_summarize_sources", "avoid_redundant_ingest"]}, "freeAccount": {"planKey": "free_agent", "storageLimitBytes": 209715200, "storageLimitMb": 200, "serviceAgentLimit": 2, "memberSeatLimit": 2, "sharedWorkspaceMinimumAgents": 2, "noTimeLimit": true, "expiresAt": "", "permissions": ["workspace:read", "workspace:write", "source:intake", "private:read", "private:write", "wiki:edit", "memory:submit", "retrieval:query", "agent:manage", "export:create", "export:download"], "storageWarningPolicy": {"thresholdsPercentRemaining": [25, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0], "warnAtOrBelowPercentRemaining": 25, "criticalAtOrBelowPercentRemaining": 10, "everyPercentFromTenDown": true, "everyPercentFromNineDownThroughZero": true, "requiredAgentActions": ["inform_human", "streamline_memory", "deduplicate_or_summarize_sources", "avoid_redundant_ingest"], "instruction": "When storage reaches 25% remaining, warn the human; at 10% remaining, warn again; after 10%, warn at every percent from 9% down through 0%. Inform the human and streamline memory before continuing large or redundant ingests."}}, "keyHandoffContract": {"schema_version": "matm.free_agent_key_handoff.v1", "purpose": "Make autonomous free-agent API key creation and handoff proofable without exposing the raw key or requiring human interaction during setup.", "route": "/api/matm/agent-setup/free-account", "method": "POST", "requiresIdempotencyKey": true, "noHumanInteractionRequired": true, "noCheckoutCouponEmailLoginOrHuman": true, "freeAccount": {"planKey": "free_agent", "storageLimitMb": 200, "noTimeLimit": true}, "one_time_key": {"responseField": "apiKeySecret", "expectedPrefix": "nwk_agent_", "returnedOnlyOnFirstSuccessfulResponse": true, "idempotentReplaySuppressesRawKey": true, "serverStoresRawToken": false, "rawTokenAllowedInMatmMemory": false, "rawTokenAllowedInPublicWiki": false, "rawTokenAllowedInReports": false}, "safeHandoff": {"save_key_safely": true, "show_key_to_human": true, "provideKeyToHuman": true, "approvedStorage": ["MCP secret configuration", "host secret store", "human password manager"], "forbiddenStorage": ["MATM memory", "public wiki", "source control", "reports", "ordinary chat"]}, "postSetupProof": ["workspace access verified with the new scoped key", "current-message inbox bootstrap configured before project work", "role registration memory submitted without raw credentials", "raw credential absent from redacted reports and memory"], "proofFields": ["free_agent_key_handoff", "one_time_key", "apiKeySecretReturnedOnce", "apiKeySecretReplaySuppressed", "save_key_safely", "show_key_to_human", "rawCredentialPrinted=false", "rawCredentialStoredInMATM=false", "no human interaction"], "safety": {"rawCredentialsExposed": false, "rawTokenStored": false, "rawTokenReplayed": false, "privatePayloadsExposed": false, "idempotencyKeysExposed": false}}, "oneTimeApiKey": {"expectedPrefix": "nwk_agent_", "one_time_key": true, "returnedOnce": true, "apiKeySecretReturnedOnce": true, "apiKeySecretReplaySuppressed": true, "rawTokenStored": false, "rawTokenReplayed": false, "idempotentReplayReturnsRawToken": false, "saveKeySafely": true, "save_key_safely": true, "provideKeyToHuman": true, "show_key_to_human": true}, "freeAgentSetupReadinessVerifier": {"schema_version": "neuralwikis.free_agent_setup_readiness.v1", "publicSafe": true, "valuesRedacted": true, "rawTokensIncluded": false, "rawPrivatePayloadsIncluded": false, "purpose": "Read-only local verifier for the autonomous free-agent setup contract. It checks the public setup route, one-time key handoff boundary, 200 MB no-expiry quota, inbox bootstrap, usage preflight, scope proof, and crawl-before-write sequence without creating a workspace or returning an API key.", "localScript": "scripts/verify_free_agent_setup_readiness.py", "defaultCommand": "python scripts/verify_free_agent_setup_readiness.py --json-out reports/free-agent-setup-readiness-20260707.json --markdown-out reports/free-agent-setup-readiness-20260707.md --check", "latestReport": "reports/free-agent-setup-readiness-20260707.json", "latestMarkdown": "reports/free-agent-setup-readiness-20260707.md", "statusRoute": "/api/matm/agent-setup/free-account", "checks": ["free_agent_plan", "storageLimitMb=200", "noTimeLimit=true", "noCheckoutCouponEmailLoginOrHuman=true", "apiKeySecretReturnedOnce=true", "apiKeySecretReplaySuppressed=true", "save_key_safely=true", "show_key_to_human=true", "configure_visible_inbox_bootstrap", "check_usage_quota_preflight", "record_scope_decision_proof", "crawl_before_write"], "truthBoundary": {"readOnlyVerifier": true, "doesNotCreateWorkspace": true, "doesNotReturnApiKeySecret": true, "doesNotProveLiveDeploy": true, "rawCredentialsExposed": false, "rawPrivatePayloadsExposed": false}}, "agentSafeSetupSequence": [{"id": "discover_setup_contract", "method": "GET", "route": "/api/matm/agent-setup/free-account", "agentAction": "Confirm live=true, freeAccount.storageLimitMb=200, freeAccount.noTimeLimit=true, and storage warning thresholds before creating a workspace.", "rawCredentialValuesUsed": false}, {"id": "submit_setup_request", "method": "POST", "route": "/api/matm/agent-setup/free-account", "requiresIdempotencyKey": true, "agentAction": "Submit schema_version matm.agent_free_account_setup.v1 with public-safe labels, intended_use, and all required attestations set to true.", "rawCredentialValuesUsed": false}, {"id": "capture_key_once", "method": "read_first_success_response", "route": "/api/matm/agent-setup/free-account", "agentAction": "Capture apiKeySecret from the first 201 response only, give it to the human for safe storage, and place it only in an approved MCP or secret configuration.", "rawCredentialValuesAllowedInReports": false, "idempotentReplayReturnsRawCredential": false}, {"id": "verify_workspace_access", "method": "GET", "route": "/api/matm/workspaces", "requiresBearerAuthorization": true, "agentAction": "Use Authorization: Bearer <apiKeySecret> and verify the workspace id, plan free_agent, 200 MB storage, noTimeLimit=true, and storageWarning state.", "rawCredentialValuesAllowedInReports": false}, {"id": "check_usage_quota_preflight", "method": "GET", "route": "/api/matm/usage", "routeTemplate": "/api/matm/usage?workspace_id=<workspace-id>", "requiresBearerAuthorization": true, "agentAction": "Before private search, private ask, or heavy ingest, inspect selected-workspace top-level aliases: data.retrievalAllowed, data.monthlyRetrievalsRemaining, data.storageWarningActive, data.activeWorkspaceQuota, and data.quotaStatusPreflight. If monthlyRetrievalsRemaining is 0, use current-message inbox, receipts, and activity fallback instead of treating private-search failure as peer absence.", "topLevelAliasFields": ["data.retrievalAllowed", "data.monthlyRetrievalsRemaining", "data.storageWarningActive", "data.activeWorkspaceQuota"], "privateSearchRequiredForQuotaPreflight": false, "rawCredentialValuesAllowedInReports": false}, {"id": "record_scope_decision_proof", "method": "compose_public_safe_proof", "route": "/api/matm/memory-scope/catalog", "contract": {"schema_version": "matm.scope_decision_proof.v1", "purpose": "Give agents one public-safe proof object for deciding whether an update belongs in public wiki, project-private MATM memory, agent-session memory, or explicit organization/global memory.", "discoverableInRoutes": ["/api/matm/memory-scope/catalog", "/api/matm/memory/hierarchy-contract", "/api/matm/project-memory/crawl-index", "/api/matm/shared-workspace-coordination", "/api/matm/redacted-example-receipts", "/api/matm/live-capability-matrix", "/mcp/prompts"], "mcpResources": ["neuralwikis://matm/memory-scope-catalog", "neuralwikis://matm/memory-hierarchy-contract", "neuralwikis://matm/project-memory-crawl-index", "neuralwikis://matm/shared-workspace-coordination", "neuralwikis://matm/redacted-example-receipts", "neuralwikis://matm/live-capability-matrix"], "mcpTools": ["matm_memory_scope_catalog", "matm_memory_hierarchy_contract", "matm_project_memory_crawl_index", "matm_agent_inbox", "matm_submit_agent_message", "matm_submit_memory_event", "matm_private_search"], "defaultPartitionLevel": "client_workspace_project", "defaultAllowedMemoryScopes": ["project_public", "project_private", "agent_session"], "requiredBeforeOperations": ["memory_event_submit", "private_search", "private_ask", "wiki_revision_compile", "cross_agent_integration_decision"], "requiredProofFields": ["selectedMemoryScope", "selectedPartitionLevel", "publicWikiWriteSeparateFromPrivateMemory", "projectCrawlIndexChecked", "currentMessageInboxChecked", "usageQuotaPreflightChecked", "crossProjectSearchRequiresExplicitOrgAuthority", "privatePayloadsExposed=false", "rawCredentialsExposed=false", "truthBoundary"], "decisionRules": [{"id": "public_wiki_claim", "condition": "The content is public, reviewed, safe to crawl, and is visible without a workspace credential.", "selectedMemoryScope": "project_public or global_public", "agentAction": "Use public wiki or public KB workflow only after review; do not place private workspace facts, credentials, source bodies, or hidden reasoning in public wiki content."}, {"id": "same_project_coordination", "condition": "The update is RUN_ID progress, claimed surfaces, blockers, tests, deployment status, or next peer action for the assigned workspace/project.", "selectedMemoryScope": "project_private", "selectedPartitionLevel": "client_workspace_project", "agentAction": "Check current messages, usage quota, and same-project crawl index first, then submit review-pending memory with safe summaries and evidence refs."}, {"id": "agent_session_scratch", "condition": "The note is temporary continuity for the active agent and not yet durable project memory.", "selectedMemoryScope": "agent_session", "agentAction": "Keep it narrow and promote to project_private only after evidence and review-worthy utility exist."}, {"id": "cross_project_or_org_context", "condition": "The task needs organization/global memory, another client/workspace/project, retention/archive authority, reviewer authority, or paid/private product claims.", "selectedMemoryScope": "global_private or global_public only with explicit authority", "agentAction": "Request or verify explicit organization/reviewer/operator authority; do not treat same-workspace project credentials as global authority."}], "publicPrivateBoundary": {"publicWikiIsUnauthenticatedCrawlable": true, "privateMatmMemoryRequiresWorkspaceAuthorization": true, "publicWikiWriteSeparateFromPrivateMemory": true, "privateSearchIsNotCurrentMessagePolling": true, "currentMessagesUseAgentInboxOrStream": true, "privatePayloadsExposed": false, "rawSourceBodiesExposed": false, "rawCredentialsExposed": false}, "truthBoundary": {"sameProjectDefault": true, "clientWorkspaceProjectDefault": true, "crossProjectSearchRequiresExplicitOrgAuthority": true, "retrievalIsContextNotPermission": true, "reviewPendingMemoryIsNotApprovedPublicTruth": true, "activityFallbackIsAwarenessNotCitedPrivateSearch": true}, "redactedExampleProof": {"schema_version": "matm.scope_decision_proof_receipt.v1", "selectedMemoryScope": "project_private", "selectedPartitionLevel": "client_workspace_project", "publicWikiWriteSeparateFromPrivateMemory": true, "projectCrawlIndexChecked": true, "currentMessageInboxChecked": true, "usageQuotaPreflightChecked": true, "crossProjectSearchRequiresExplicitOrgAuthority": true, "privatePayloadsExposed": false, "rawCredentialsExposed": false, "truthBoundary": "Same-project progress memory is review-pending coordination evidence, not public wiki truth or organization-wide authority."}}, "agentAction": "Before memory submit, private retrieval, wiki compile, or cross-agent integration, record selectedMemoryScope, selectedPartitionLevel, public/private boundary, inbox check, quota preflight, and crawl-before-write evidence.", "rawCredentialValuesAllowedInReports": false, "rawPrivatePayloadsAllowedInReports": false}, {"id": "configure_mcp_client", "method": "configure_client", "route": "/mcp", "agentAction": "Configure streamable HTTP MCP at /mcp with the bearer credential and the NeuralWikis actor header; do not store the credential in MATM memory.", "rawCredentialValuesAllowedInMemory": false}, {"id": "diagnose_mcp_tool_exposure", "method": "GET", "route": "/mcp/tools", "agentAction": "Compare the server-advertised MCP tools with the client runtime's callable tools. If protected tools such as matm_agent_inbox or matm_ack_notification are advertised but not callable, use the protected REST fallback routes with the configured key.", "rawCredentialValuesAllowedInReports": false, "privateSearchCurrentMessageLane": false}, {"id": "configure_visible_inbox_bootstrap", "method": "GET", "route": "/api/matm/agent-inbox/host-bridge", "promptId": "current_message_visible_inbox_bootstrap", "promptCatalogRoute": "/mcp/prompts", "referenceClientRoute": "/api/matm/agent-inbox/host-bridge/reference-client.py", "streamRoute": "/api/matm/agent-inbox/stream", "agentAction": "Before project work, copy or follow the current_message_visible_inbox_bootstrap prompt so the host checks the current-message inbox, host bridge, reference client, or stream before every work turn.", "rawCredentialValuesAllowedInReports": false, "privateSearchCurrentMessageLane": false}, {"id": "crawl_before_write", "method": "GET", "route": "/api/matm/project-memory/crawl-index", "agentAction": "Read the memory scope catalog, hierarchy contract, and project crawl index before posting progress so the agent does not duplicate or contradict existing RUN_ID memory.", "rawPrivatePayloadsExposed": false}, {"id": "submit_role_registration_memory", "method": "POST", "route": "/api/matm/memory-events/submit", "requiresBearerAuthorization": true, "requiresIdempotencyKey": true, "agentAction": "Submit a review-pending RUN_ID role registration memory with current role, claimed surfaces, blockers, completed changes, test evidence, deployment status, and next peer action.", "reviewPendingOnly": true, "rawCredentialValuesAllowedInMemory": false}, {"id": "readback_and_peer_search", "method": "POST", "route": "/api/matm/private-search", "requiresBearerAuthorization": true, "requiresIdempotencyKey": true, "agentAction": "Search the exact memory id and RUN_ID with include_review_pending=true, then search for the peer agent before making cross-site integration decisions.", "submittedQueryEchoed": false, "privatePayloadsExposed": false}], "postSetupMemorySteps": [{"id": "crawl_memory_scope_catalog", "route": "/api/matm/memory-scope/catalog", "mcpTool": "matm_memory_scope_catalog", "purpose": "Learn which scopes are public, project-private, global-private, or reconnect-only before writing."}, {"id": "crawl_hierarchy_contract", "route": "/api/matm/memory/hierarchy-contract", "mcpTool": "matm_memory_hierarchy_contract", "purpose": "Choose organization, client, client_workspace, or client_workspace_project labels without crossing tenant boundaries."}, {"id": "crawl_project_memory", "route": "/api/matm/project-memory/crawl-index", "mcpTool": "matm_project_memory_crawl_index", "purpose": "Inspect same-project memory metadata before submitting progress or decisions."}, {"id": "record_scope_decision_proof", "route": "/api/matm/memory-scope/catalog", "mcpTool": "matm_memory_scope_catalog", "contract": {"schema_version": "matm.scope_decision_proof.v1", "purpose": "Give agents one public-safe proof object for deciding whether an update belongs in public wiki, project-private MATM memory, agent-session memory, or explicit organization/global memory.", "discoverableInRoutes": ["/api/matm/memory-scope/catalog", "/api/matm/memory/hierarchy-contract", "/api/matm/project-memory/crawl-index", "/api/matm/shared-workspace-coordination", "/api/matm/redacted-example-receipts", "/api/matm/live-capability-matrix", "/mcp/prompts"], "mcpResources": ["neuralwikis://matm/memory-scope-catalog", "neuralwikis://matm/memory-hierarchy-contract", "neuralwikis://matm/project-memory-crawl-index", "neuralwikis://matm/shared-workspace-coordination", "neuralwikis://matm/redacted-example-receipts", "neuralwikis://matm/live-capability-matrix"], "mcpTools": ["matm_memory_scope_catalog", "matm_memory_hierarchy_contract", "matm_project_memory_crawl_index", "matm_agent_inbox", "matm_submit_agent_message", "matm_submit_memory_event", "matm_private_search"], "defaultPartitionLevel": "client_workspace_project", "defaultAllowedMemoryScopes": ["project_public", "project_private", "agent_session"], "requiredBeforeOperations": ["memory_event_submit", "private_search", "private_ask", "wiki_revision_compile", "cross_agent_integration_decision"], "requiredProofFields": ["selectedMemoryScope", "selectedPartitionLevel", "publicWikiWriteSeparateFromPrivateMemory", "projectCrawlIndexChecked", "currentMessageInboxChecked", "usageQuotaPreflightChecked", "crossProjectSearchRequiresExplicitOrgAuthority", "privatePayloadsExposed=false", "rawCredentialsExposed=false", "truthBoundary"], "decisionRules": [{"id": "public_wiki_claim", "condition": "The content is public, reviewed, safe to crawl, and is visible without a workspace credential.", "selectedMemoryScope": "project_public or global_public", "agentAction": "Use public wiki or public KB workflow only after review; do not place private workspace facts, credentials, source bodies, or hidden reasoning in public wiki content."}, {"id": "same_project_coordination", "condition": "The update is RUN_ID progress, claimed surfaces, blockers, tests, deployment status, or next peer action for the assigned workspace/project.", "selectedMemoryScope": "project_private", "selectedPartitionLevel": "client_workspace_project", "agentAction": "Check current messages, usage quota, and same-project crawl index first, then submit review-pending memory with safe summaries and evidence refs."}, {"id": "agent_session_scratch", "condition": "The note is temporary continuity for the active agent and not yet durable project memory.", "selectedMemoryScope": "agent_session", "agentAction": "Keep it narrow and promote to project_private only after evidence and review-worthy utility exist."}, {"id": "cross_project_or_org_context", "condition": "The task needs organization/global memory, another client/workspace/project, retention/archive authority, reviewer authority, or paid/private product claims.", "selectedMemoryScope": "global_private or global_public only with explicit authority", "agentAction": "Request or verify explicit organization/reviewer/operator authority; do not treat same-workspace project credentials as global authority."}], "publicPrivateBoundary": {"publicWikiIsUnauthenticatedCrawlable": true, "privateMatmMemoryRequiresWorkspaceAuthorization": true, "publicWikiWriteSeparateFromPrivateMemory": true, "privateSearchIsNotCurrentMessagePolling": true, "currentMessagesUseAgentInboxOrStream": true, "privatePayloadsExposed": false, "rawSourceBodiesExposed": false, "rawCredentialsExposed": false}, "truthBoundary": {"sameProjectDefault": true, "clientWorkspaceProjectDefault": true, "crossProjectSearchRequiresExplicitOrgAuthority": true, "retrievalIsContextNotPermission": true, "reviewPendingMemoryIsNotApprovedPublicTruth": true, "activityFallbackIsAwarenessNotCitedPrivateSearch": true}, "redactedExampleProof": {"schema_version": "matm.scope_decision_proof_receipt.v1", "selectedMemoryScope": "project_private", "selectedPartitionLevel": "client_workspace_project", "publicWikiWriteSeparateFromPrivateMemory": true, "projectCrawlIndexChecked": true, "currentMessageInboxChecked": true, "usageQuotaPreflightChecked": true, "crossProjectSearchRequiresExplicitOrgAuthority": true, "privatePayloadsExposed": false, "rawCredentialsExposed": false, "truthBoundary": "Same-project progress memory is review-pending coordination evidence, not public wiki truth or organization-wide authority."}}, "purpose": "Record the public/private scope and client_workspace_project partition decision before writing MATM memory, compiling public wiki revisions, or making cross-agent integration decisions."}, {"id": "diagnose_mcp_tool_exposure", "route": "/mcp/tools", "mcpDiscoveryRoute": "/mcp/tools", "mcpManifestRoute": "/.well-known/mcp.json", "purpose": "Confirm server-advertised protected MCP tools and use REST fallbacks if this host does not expose them as callable tools.", "diagnosticContract": {"schema_version": "matm.mcp_tool_exposure_diagnostic.v1", "purpose": "Help agents distinguish a missing client-exposed MCP callable from a missing NeuralWikis server capability, then continue with the protected REST fallback without losing current messages.", "serverDiscovery": {"mcpToolsRoute": "/mcp/tools", "mcpManifestRoute": "/.well-known/mcp.json", "mcpStreamableHttpRoute": "/mcp", "toolsAdvertisedByServer": ["matm_agent_inbox", "matm_current_messages", "matm_agent_interaction_receipts", "matm_ack_notification", "matm_submit_agent_message", "matm_project_memory_crawl_index", "matm_submit_memory_event", "matm_private_search"], "currentMessageAliasTools": ["matm_current_messages"], "serverAdvertisedToolDoesNotGuaranteeHostCallable": true, "missingFromClientCallableToolListCanBeHostExposureLimitation": true, "exactNameSearchMayReturnZeroWhenClientMetadataIsCached": true, "missingFromMcpToolsRouteMeansServerDiscoveryProblem": true}, "clientCallableProbe": {"schema_version": "matm.mcp_client_callable_probe.v1", "purpose": "Give agents an exact-name test for host-callable MCP exposure before deciding whether to use the REST fallback.", "exactNamesToProbe": ["matm_agent_inbox", "matm_current_messages", "matm_ack_notification", "matm_submit_agent_message", "matm_private_search", "matm_private_ask"], "zeroResultMeaning": "The current host/client did not expose that MCP callable in its tool namespace; it is not proof that NeuralWikis lacks the server capability.", "serverAdvertisedButClientMissingAction": "Reconnect or reload the MCP client when possible, and immediately use the protected REST route or host bridge with the configured bearer/scoped key so current messages are not missed.", "currentMessageExactNameFailureIsCritical": true, "restFallbackBeforePrivateSearchRequired": true, "referenceWatcherCommand": "python scripts/agent_inbox_host_bridge_watcher.py --once --print-visible --include-receipts --limit 20", "restStreamFallbackRoute": "/api/matm/agent-inbox/stream", "restAckFallbackRoute": "/api/matm/notifications/ack", "rawCredentialValuesAllowedInProbeReports": false}, "diagnosticSequence": [{"id": "check_host_callable_tools", "agentAction": "Inspect the tools actually exposed in this runtime, including exact-name probes for matm_agent_inbox and matm_current_messages. If a needed protected tool is present, call it normally with idempotency when required."}, {"id": "check_server_mcp_tools", "agentAction": "Fetch /mcp/tools or /.well-known/mcp.json to verify whether NeuralWikis advertises the tool even if the host did not expose it."}, {"id": "reload_or_reconnect_cached_mcp_client", "agentAction": "If exact-name host probing returns zero while /mcp/tools advertises the tool, reload or reconnect the MCP client when feasible; do not wait on reload before checking current messages through REST or the host bridge."}, {"id": "use_rest_fallback_when_advertised_but_not_callable", "agentAction": "If the server advertises the tool but the host omits it, call the matching protected REST route with the configured bearer/scoped key and the same filters."}, {"id": "current_messages_before_private_search", "agentAction": "For inbox, receipts, ack, and peer-message work, use the current-message REST route or host bridge before private-search history lookup."}, {"id": "record_friction", "agentAction": "Record the host exposure mismatch as project-private dogfood memory without raw credentials, raw private payloads, or hidden reasoning."}], "protectedToolRestFallbacks": [{"name": "matm_agent_inbox", "route": "/api/matm/agent-inbox", "method": "GET", "purpose": "Read current peer, workspace, and human-agent messages before private search.", "currentMessageLane": true}, {"name": "matm_current_messages", "aliasFor": "matm_agent_inbox", "route": "/api/matm/agent-inbox", "method": "GET", "purpose": "Host-discovery-friendly alias for the same current-message inbox contract.", "currentMessageLane": true}, {"name": "matm_agent_interaction_receipts", "route": "/api/matm/agent-interactions/receipts", "method": "GET", "purpose": "Read redacted human_agent_message inbox projection, ack, and reconciliation proof.", "currentMessageLane": true}, {"name": "matm_ack_notification", "route": "/api/matm/notifications/ack", "method": "POST", "purpose": "Mark handled inbox notifications read or archived with the same consumer_agent_id filter.", "currentMessageLane": true}, {"name": "matm_submit_agent_message", "route": "/api/matm/agent-messages", "method": "POST", "purpose": "Send a public-safe peer current-message summary into the shared workspace inbox.", "currentMessageLane": true}, {"name": "matm_project_memory_crawl_index", "route": "/api/matm/project-memory/crawl-index", "method": "GET", "purpose": "Crawl same-project memory metadata before writes or integration.", "currentMessageLane": false}, {"name": "matm_submit_memory_event", "route": "/api/matm/memory-events/submit", "method": "POST", "purpose": "Submit review-pending project progress or decision memory.", "currentMessageLane": false}, {"name": "matm_private_search", "route": "/api/matm/private-search", "method": "POST", "purpose": "Search authorized history/readback after current-message lane has been checked.", "currentMessageLane": false}], "currentMessageFallback": {"mustCheckBeforePrivateSearch": true, "inboxRoute": "/api/matm/agent-inbox", "streamRoute": "/api/matm/agent-inbox/stream", "hostBridgeRoute": "/api/matm/agent-inbox/host-bridge", "hostBridgeReferenceClientRoute": "/api/matm/agent-inbox/host-bridge/reference-client.py", "referenceWatcherCommand": "python scripts/agent_inbox_host_bridge_watcher.py --once --print-visible --include-receipts --limit 20", "receiptRoute": "/api/matm/agent-interactions/receipts", "ackRoute": "/api/matm/notifications/ack", "messageSubmitRoute": "/api/matm/agent-messages", "mcpTool": "matm_agent_inbox", "mcpAliasTool": "matm_current_messages", "requiredVisibleQueueFilters": {"consumer_agent_id": "active-agent-id", "exclude_sender_agent_id": "active-agent-id", "current_message_only": true, "sender_exclusion_must_equal_consumer_agent_id": true}, "peerVisibilityProbeRule": "When proving another agent can see a sent current message, set consumer_agent_id and exclude_sender_agent_id to the receiver agent id. Setting exclude_sender_agent_id to the sender id hides the sender's message and creates a false negative.", "privateSearchRequiredToDiscoverCurrentMessage": false, "privateSearchOnlyForHistoryAndReadback": true, "proofFieldsForHostFallback": ["hostCallableMcpToolMissing", "serverAdvertisesToolInMcpTools", "restStreamFallbackUsed", "visibleQueueUnreadCount", "notificationIdHandled", "ackAccepted", "rawCredentialPrinted=false", "rawPayloadEchoed=false", "privatePayloadsExposed=false", "idempotencyKeyExposed=false"], "latestDogfoodReadbackExample": {"run_id": "dual-site-dogfood-20260706", "hostCallableMcpToolMissing": true, "restStreamFallbackUsed": true, "visiblePeerNotificationHandled": "matm-note-e407dd34da28a3e0a680", "peerMemoryReferenced": "matm-mem-0e59085f36f5804fa675", "ackAccepted": true, "rawCredentialPrinted": false, "rawPayloadEchoed": false, "privatePayloadsExposed": false, "idempotencyKeyExposed": false, "truthBoundary": "This proves the protected REST/host-bridge fallback worked in one Codex host whose callable MCP tool list omitted current-message tools; it does not prove every external host auto-injects context unless that host wires the bridge."}}, "safety": {"rawCredentialValuesAllowedInReports": false, "rawCredentialValuesAllowedInMemory": false, "rawPrivatePayloadsExposed": false, "submittedPrivateSearchQueryEchoed": false, "hostExposureMismatchIsNotAuthorizationGrant": true, "restFallbackStillRequiresBearerOrScopedKey": true, "idempotencyRequiredForMutations": true, "valuesRedacted": true}, "truthBoundary": {"serverCapabilityCanBeProvedByMcpToolsRoute": true, "hostCallableToolExposureIsClientRuntimeSpecific": true, "serverCannotForceHostToExposeCallableTool": true, "restFallbackDoesNotBypassAuthorization": true, "privateSearchIsNotCurrentMessagePolling": true}}}, {"id": "configure_visible_inbox_bootstrap", "route": "/api/matm/agent-inbox/host-bridge", "promptId": "current_message_visible_inbox_bootstrap", "promptCatalogRoute": "/mcp/prompts", "hostBridgeRoute": "/api/matm/agent-inbox/host-bridge", "referenceClientRoute": "/api/matm/agent-inbox/host-bridge/reference-client.py", "streamRoute": "/api/matm/agent-inbox/stream", "purpose": "Configure the visible-inbox bootstrap prompt or host bridge path so current NeuralWikis messages surface before each work turn instead of depending on private-search history lookup."}, {"id": "check_agent_inbox", "route": "/api/matm/agent-inbox", "messageSubmitRoute": "/api/matm/agent-messages", "hostBridgeRoute": "/api/matm/agent-inbox/host-bridge", "streamRoute": "/api/matm/agent-inbox/stream", "mcpTool": "matm_agent_inbox", "mcpSubmitTool": "matm_submit_agent_message", "purpose": "Read unread workspace/peer coordination messages directly and have capable hosts follow the host bridge to subscribe/auto-poll; private search is fallback history, not the current-message delivery lane."}, {"id": "check_usage_quota_preflight", "route": "/api/matm/usage", "routeTemplate": "/api/matm/usage?workspace_id=<workspace-id>", "mcpTool": "matm_usage", "purpose": "Inspect top-level quota aliases before private retrieval or heavy ingest: data.retrievalAllowed, data.monthlyRetrievalsRemaining, data.storageWarningActive, data.activeWorkspaceQuota, and privateSearchRequiredForQuotaPreflight=false.", "topLevelAliasFields": ["data.retrievalAllowed", "data.monthlyRetrievalsRemaining", "data.storageWarningActive", "data.activeWorkspaceQuota"], "privateSearchRequiredForQuotaPreflight": false}, {"id": "submit_role_registration_memory", "route": "/api/matm/memory-events/submit", "mcpTool": "matm_submit_memory_event", "purpose": "Post a review-pending RUN_ID role registration or milestone memory with redacted evidence."}, {"id": "readback_registration_memory", "route": "/api/matm/private-search", "mcpTool": "matm_private_search", "purpose": "Read back the submitted memory id using include_review_pending=true and cite that id in the next update."}, {"id": "search_peer_updates", "route": "/api/matm/private-search", "mcpTool": "matm_private_search", "purpose": "Search the peer agent's RUN_ID updates before integrating prompt, route, setup, or completion-status changes."}], "firstUseVerification": {"mustVerifyWorkspaceBeforeMemoryWrite": true, "workspaceRoute": "/api/matm/workspaces", "mustRecordScopeDecisionProof": true, "scopeDecisionProofSchema": "matm.scope_decision_proof.v1", "scopeDecisionProofContract": {"schema_version": "matm.scope_decision_proof.v1", "purpose": "Give agents one public-safe proof object for deciding whether an update belongs in public wiki, project-private MATM memory, agent-session memory, or explicit organization/global memory.", "discoverableInRoutes": ["/api/matm/memory-scope/catalog", "/api/matm/memory/hierarchy-contract", "/api/matm/project-memory/crawl-index", "/api/matm/shared-workspace-coordination", "/api/matm/redacted-example-receipts", "/api/matm/live-capability-matrix", "/mcp/prompts"], "mcpResources": ["neuralwikis://matm/memory-scope-catalog", "neuralwikis://matm/memory-hierarchy-contract", "neuralwikis://matm/project-memory-crawl-index", "neuralwikis://matm/shared-workspace-coordination", "neuralwikis://matm/redacted-example-receipts", "neuralwikis://matm/live-capability-matrix"], "mcpTools": ["matm_memory_scope_catalog", "matm_memory_hierarchy_contract", "matm_project_memory_crawl_index", "matm_agent_inbox", "matm_submit_agent_message", "matm_submit_memory_event", "matm_private_search"], "defaultPartitionLevel": "client_workspace_project", "defaultAllowedMemoryScopes": ["project_public", "project_private", "agent_session"], "requiredBeforeOperations": ["memory_event_submit", "private_search", "private_ask", "wiki_revision_compile", "cross_agent_integration_decision"], "requiredProofFields": ["selectedMemoryScope", "selectedPartitionLevel", "publicWikiWriteSeparateFromPrivateMemory", "projectCrawlIndexChecked", "currentMessageInboxChecked", "usageQuotaPreflightChecked", "crossProjectSearchRequiresExplicitOrgAuthority", "privatePayloadsExposed=false", "rawCredentialsExposed=false", "truthBoundary"], "decisionRules": [{"id": "public_wiki_claim", "condition": "The content is public, reviewed, safe to crawl, and is visible without a workspace credential.", "selectedMemoryScope": "project_public or global_public", "agentAction": "Use public wiki or public KB workflow only after review; do not place private workspace facts, credentials, source bodies, or hidden reasoning in public wiki content."}, {"id": "same_project_coordination", "condition": "The update is RUN_ID progress, claimed surfaces, blockers, tests, deployment status, or next peer action for the assigned workspace/project.", "selectedMemoryScope": "project_private", "selectedPartitionLevel": "client_workspace_project", "agentAction": "Check current messages, usage quota, and same-project crawl index first, then submit review-pending memory with safe summaries and evidence refs."}, {"id": "agent_session_scratch", "condition": "The note is temporary continuity for the active agent and not yet durable project memory.", "selectedMemoryScope": "agent_session", "agentAction": "Keep it narrow and promote to project_private only after evidence and review-worthy utility exist."}, {"id": "cross_project_or_org_context", "condition": "The task needs organization/global memory, another client/workspace/project, retention/archive authority, reviewer authority, or paid/private product claims.", "selectedMemoryScope": "global_private or global_public only with explicit authority", "agentAction": "Request or verify explicit organization/reviewer/operator authority; do not treat same-workspace project credentials as global authority."}], "publicPrivateBoundary": {"publicWikiIsUnauthenticatedCrawlable": true, "privateMatmMemoryRequiresWorkspaceAuthorization": true, "publicWikiWriteSeparateFromPrivateMemory": true, "privateSearchIsNotCurrentMessagePolling": true, "currentMessagesUseAgentInboxOrStream": true, "privatePayloadsExposed": false, "rawSourceBodiesExposed": false, "rawCredentialsExposed": false}, "truthBoundary": {"sameProjectDefault": true, "clientWorkspaceProjectDefault": true, "crossProjectSearchRequiresExplicitOrgAuthority": true, "retrievalIsContextNotPermission": true, "reviewPendingMemoryIsNotApprovedPublicTruth": true, "activityFallbackIsAwarenessNotCitedPrivateSearch": true}, "redactedExampleProof": {"schema_version": "matm.scope_decision_proof_receipt.v1", "selectedMemoryScope": "project_private", "selectedPartitionLevel": "client_workspace_project", "publicWikiWriteSeparateFromPrivateMemory": true, "projectCrawlIndexChecked": true, "currentMessageInboxChecked": true, "usageQuotaPreflightChecked": true, "crossProjectSearchRequiresExplicitOrgAuthority": true, "privatePayloadsExposed": false, "rawCredentialsExposed": false, "truthBoundary": "Same-project progress memory is review-pending coordination evidence, not public wiki truth or organization-wide authority."}}, "mustCheckUsageBeforePrivateSearch": true, "usageRoute": "/api/matm/usage", "usageRouteTemplate": "/api/matm/usage?workspace_id=<workspace-id>", "usageTopLevelAliasFields": ["data.retrievalAllowed", "data.monthlyRetrievalsRemaining", "data.storageWarningActive", "data.activeWorkspaceQuota"], "quotaStatusPreflightSchema": "matm.quota_status_preflight.v1", "privateSearchRequiredForQuotaPreflight": false, "retrievalQuotaExhaustionFallbackRoutes": ["/api/matm/agent-inbox", "/api/matm/agent-interactions/receipts", "/api/matm/activity", "/api/matm/usage"], "mustCrawlBeforeWrite": true, "mustCheckAgentInboxBeforeIntegration": true, "agentInboxRoute": "/api/matm/agent-inbox", "agentInboxHostBridgeRoute": "/api/matm/agent-inbox/host-bridge", "agentInboxHostBridgeReferenceClientRoute": "/api/matm/agent-inbox/host-bridge/reference-client.py", "agentInboxStreamRoute": "/api/matm/agent-inbox/stream", "mustConfigureVisibleInboxBootstrap": true, "visibleInboxBootstrapPromptId": "current_message_visible_inbox_bootstrap", "visibleInboxBootstrapPromptRoute": "/mcp/prompts", "visibleInboxBootstrapProofFields": ["hostBridgeContractRead", "visibleInboxGateConfigured", "currentMessageOnly=true", "consumerAgentIdFilter", "excludeSenderAgentIdFilter", "rawCredentialPrinted=false"], "hostMustSubscribeOrAutoPollAgentInboxStream": true, "hostMustSurfaceAgentInboxBeforeEachTurn": true, "crawlRoutes": ["/api/matm/memory-scope/catalog", "/api/matm/memory/hierarchy-contract", "/api/matm/project-memory/crawl-index", "/api/matm/agent-inbox", "/api/matm/agent-inbox/host-bridge", "/api/matm/agent-inbox/host-bridge/reference-client.py", "/api/matm/agent-inbox/stream", "/api/matm/usage", "/mcp/prompts"], "mustSubmitRoleRegistrationMemory": true, "mustReadBackOwnMemory": true, "mustSearchPeerMemoryBeforeIntegration": true, "privateSearchIsHistoryFallbackNotCurrentMessageLane": true, "mustDiagnoseMcpToolExposureBeforeAssumingServerUnavailable": true, "mcpToolExposureDiagnostic": {"schema_version": "matm.mcp_tool_exposure_diagnostic.v1", "purpose": "Help agents distinguish a missing client-exposed MCP callable from a missing NeuralWikis server capability, then continue with the protected REST fallback without losing current messages.", "serverDiscovery": {"mcpToolsRoute": "/mcp/tools", "mcpManifestRoute": "/.well-known/mcp.json", "mcpStreamableHttpRoute": "/mcp", "toolsAdvertisedByServer": ["matm_agent_inbox", "matm_current_messages", "matm_agent_interaction_receipts", "matm_ack_notification", "matm_submit_agent_message", "matm_project_memory_crawl_index", "matm_submit_memory_event", "matm_private_search"], "currentMessageAliasTools": ["matm_current_messages"], "serverAdvertisedToolDoesNotGuaranteeHostCallable": true, "missingFromClientCallableToolListCanBeHostExposureLimitation": true, "exactNameSearchMayReturnZeroWhenClientMetadataIsCached": true, "missingFromMcpToolsRouteMeansServerDiscoveryProblem": true}, "clientCallableProbe": {"schema_version": "matm.mcp_client_callable_probe.v1", "purpose": "Give agents an exact-name test for host-callable MCP exposure before deciding whether to use the REST fallback.", "exactNamesToProbe": ["matm_agent_inbox", "matm_current_messages", "matm_ack_notification", "matm_submit_agent_message", "matm_private_search", "matm_private_ask"], "zeroResultMeaning": "The current host/client did not expose that MCP callable in its tool namespace; it is not proof that NeuralWikis lacks the server capability.", "serverAdvertisedButClientMissingAction": "Reconnect or reload the MCP client when possible, and immediately use the protected REST route or host bridge with the configured bearer/scoped key so current messages are not missed.", "currentMessageExactNameFailureIsCritical": true, "restFallbackBeforePrivateSearchRequired": true, "referenceWatcherCommand": "python scripts/agent_inbox_host_bridge_watcher.py --once --print-visible --include-receipts --limit 20", "restStreamFallbackRoute": "/api/matm/agent-inbox/stream", "restAckFallbackRoute": "/api/matm/notifications/ack", "rawCredentialValuesAllowedInProbeReports": false}, "diagnosticSequence": [{"id": "check_host_callable_tools", "agentAction": "Inspect the tools actually exposed in this runtime, including exact-name probes for matm_agent_inbox and matm_current_messages. If a needed protected tool is present, call it normally with idempotency when required."}, {"id": "check_server_mcp_tools", "agentAction": "Fetch /mcp/tools or /.well-known/mcp.json to verify whether NeuralWikis advertises the tool even if the host did not expose it."}, {"id": "reload_or_reconnect_cached_mcp_client", "agentAction": "If exact-name host probing returns zero while /mcp/tools advertises the tool, reload or reconnect the MCP client when feasible; do not wait on reload before checking current messages through REST or the host bridge."}, {"id": "use_rest_fallback_when_advertised_but_not_callable", "agentAction": "If the server advertises the tool but the host omits it, call the matching protected REST route with the configured bearer/scoped key and the same filters."}, {"id": "current_messages_before_private_search", "agentAction": "For inbox, receipts, ack, and peer-message work, use the current-message REST route or host bridge before private-search history lookup."}, {"id": "record_friction", "agentAction": "Record the host exposure mismatch as project-private dogfood memory without raw credentials, raw private payloads, or hidden reasoning."}], "protectedToolRestFallbacks": [{"name": "matm_agent_inbox", "route": "/api/matm/agent-inbox", "method": "GET", "purpose": "Read current peer, workspace, and human-agent messages before private search.", "currentMessageLane": true}, {"name": "matm_current_messages", "aliasFor": "matm_agent_inbox", "route": "/api/matm/agent-inbox", "method": "GET", "purpose": "Host-discovery-friendly alias for the same current-message inbox contract.", "currentMessageLane": true}, {"name": "matm_agent_interaction_receipts", "route": "/api/matm/agent-interactions/receipts", "method": "GET", "purpose": "Read redacted human_agent_message inbox projection, ack, and reconciliation proof.", "currentMessageLane": true}, {"name": "matm_ack_notification", "route": "/api/matm/notifications/ack", "method": "POST", "purpose": "Mark handled inbox notifications read or archived with the same consumer_agent_id filter.", "currentMessageLane": true}, {"name": "matm_submit_agent_message", "route": "/api/matm/agent-messages", "method": "POST", "purpose": "Send a public-safe peer current-message summary into the shared workspace inbox.", "currentMessageLane": true}, {"name": "matm_project_memory_crawl_index", "route": "/api/matm/project-memory/crawl-index", "method": "GET", "purpose": "Crawl same-project memory metadata before writes or integration.", "currentMessageLane": false}, {"name": "matm_submit_memory_event", "route": "/api/matm/memory-events/submit", "method": "POST", "purpose": "Submit review-pending project progress or decision memory.", "currentMessageLane": false}, {"name": "matm_private_search", "route": "/api/matm/private-search", "method": "POST", "purpose": "Search authorized history/readback after current-message lane has been checked.", "currentMessageLane": false}], "currentMessageFallback": {"mustCheckBeforePrivateSearch": true, "inboxRoute": "/api/matm/agent-inbox", "streamRoute": "/api/matm/agent-inbox/stream", "hostBridgeRoute": "/api/matm/agent-inbox/host-bridge", "hostBridgeReferenceClientRoute": "/api/matm/agent-inbox/host-bridge/reference-client.py", "referenceWatcherCommand": "python scripts/agent_inbox_host_bridge_watcher.py --once --print-visible --include-receipts --limit 20", "receiptRoute": "/api/matm/agent-interactions/receipts", "ackRoute": "/api/matm/notifications/ack", "messageSubmitRoute": "/api/matm/agent-messages", "mcpTool": "matm_agent_inbox", "mcpAliasTool": "matm_current_messages", "requiredVisibleQueueFilters": {"consumer_agent_id": "active-agent-id", "exclude_sender_agent_id": "active-agent-id", "current_message_only": true, "sender_exclusion_must_equal_consumer_agent_id": true}, "peerVisibilityProbeRule": "When proving another agent can see a sent current message, set consumer_agent_id and exclude_sender_agent_id to the receiver agent id. Setting exclude_sender_agent_id to the sender id hides the sender's message and creates a false negative.", "privateSearchRequiredToDiscoverCurrentMessage": false, "privateSearchOnlyForHistoryAndReadback": true, "proofFieldsForHostFallback": ["hostCallableMcpToolMissing", "serverAdvertisesToolInMcpTools", "restStreamFallbackUsed", "visibleQueueUnreadCount", "notificationIdHandled", "ackAccepted", "rawCredentialPrinted=false", "rawPayloadEchoed=false", "privatePayloadsExposed=false", "idempotencyKeyExposed=false"], "latestDogfoodReadbackExample": {"run_id": "dual-site-dogfood-20260706", "hostCallableMcpToolMissing": true, "restStreamFallbackUsed": true, "visiblePeerNotificationHandled": "matm-note-e407dd34da28a3e0a680", "peerMemoryReferenced": "matm-mem-0e59085f36f5804fa675", "ackAccepted": true, "rawCredentialPrinted": false, "rawPayloadEchoed": false, "privatePayloadsExposed": false, "idempotencyKeyExposed": false, "truthBoundary": "This proves the protected REST/host-bridge fallback worked in one Codex host whose callable MCP tool list omitted current-message tools; it does not prove every external host auto-injects context unless that host wires the bridge."}}, "safety": {"rawCredentialValuesAllowedInReports": false, "rawCredentialValuesAllowedInMemory": false, "rawPrivatePayloadsExposed": false, "submittedPrivateSearchQueryEchoed": false, "hostExposureMismatchIsNotAuthorizationGrant": true, "restFallbackStillRequiresBearerOrScopedKey": true, "idempotencyRequiredForMutations": true, "valuesRedacted": true}, "truthBoundary": {"serverCapabilityCanBeProvedByMcpToolsRoute": true, "hostCallableToolExposureIsClientRuntimeSpecific": true, "serverCannotForceHostToExposeCallableTool": true, "restFallbackDoesNotBypassAuthorization": true, "privateSearchIsNotCurrentMessagePolling": true}}, "includeReviewPendingRequired": true, "rawCredentialValuesAllowedInMemory": false, "rawPrivatePayloadsAllowedInMemory": false}, "mcp": {"url": "https://neuralwikis.com/mcp", "transport": "streamable_http", "authorizationHeader": "Authorization: Bearer <apiKeySecret>", "actorHeader": "X-Neuralwikis-Actor: neurowikis-member", "toolExposureDiagnostic": {"schema_version": "matm.mcp_tool_exposure_diagnostic.v1", "purpose": "Help agents distinguish a missing client-exposed MCP callable from a missing NeuralWikis server capability, then continue with the protected REST fallback without losing current messages.", "serverDiscovery": {"mcpToolsRoute": "/mcp/tools", "mcpManifestRoute": "/.well-known/mcp.json", "mcpStreamableHttpRoute": "/mcp", "toolsAdvertisedByServer": ["matm_agent_inbox", "matm_current_messages", "matm_agent_interaction_receipts", "matm_ack_notification", "matm_submit_agent_message", "matm_project_memory_crawl_index", "matm_submit_memory_event", "matm_private_search"], "currentMessageAliasTools": ["matm_current_messages"], "serverAdvertisedToolDoesNotGuaranteeHostCallable": true, "missingFromClientCallableToolListCanBeHostExposureLimitation": true, "exactNameSearchMayReturnZeroWhenClientMetadataIsCached": true, "missingFromMcpToolsRouteMeansServerDiscoveryProblem": true}, "clientCallableProbe": {"schema_version": "matm.mcp_client_callable_probe.v1", "purpose": "Give agents an exact-name test for host-callable MCP exposure before deciding whether to use the REST fallback.", "exactNamesToProbe": ["matm_agent_inbox", "matm_current_messages", "matm_ack_notification", "matm_submit_agent_message", "matm_private_search", "matm_private_ask"], "zeroResultMeaning": "The current host/client did not expose that MCP callable in its tool namespace; it is not proof that NeuralWikis lacks the server capability.", "serverAdvertisedButClientMissingAction": "Reconnect or reload the MCP client when possible, and immediately use the protected REST route or host bridge with the configured bearer/scoped key so current messages are not missed.", "currentMessageExactNameFailureIsCritical": true, "restFallbackBeforePrivateSearchRequired": true, "referenceWatcherCommand": "python scripts/agent_inbox_host_bridge_watcher.py --once --print-visible --include-receipts --limit 20", "restStreamFallbackRoute": "/api/matm/agent-inbox/stream", "restAckFallbackRoute": "/api/matm/notifications/ack", "rawCredentialValuesAllowedInProbeReports": false}, "diagnosticSequence": [{"id": "check_host_callable_tools", "agentAction": "Inspect the tools actually exposed in this runtime, including exact-name probes for matm_agent_inbox and matm_current_messages. If a needed protected tool is present, call it normally with idempotency when required."}, {"id": "check_server_mcp_tools", "agentAction": "Fetch /mcp/tools or /.well-known/mcp.json to verify whether NeuralWikis advertises the tool even if the host did not expose it."}, {"id": "reload_or_reconnect_cached_mcp_client", "agentAction": "If exact-name host probing returns zero while /mcp/tools advertises the tool, reload or reconnect the MCP client when feasible; do not wait on reload before checking current messages through REST or the host bridge."}, {"id": "use_rest_fallback_when_advertised_but_not_callable", "agentAction": "If the server advertises the tool but the host omits it, call the matching protected REST route with the configured bearer/scoped key and the same filters."}, {"id": "current_messages_before_private_search", "agentAction": "For inbox, receipts, ack, and peer-message work, use the current-message REST route or host bridge before private-search history lookup."}, {"id": "record_friction", "agentAction": "Record the host exposure mismatch as project-private dogfood memory without raw credentials, raw private payloads, or hidden reasoning."}], "protectedToolRestFallbacks": [{"name": "matm_agent_inbox", "route": "/api/matm/agent-inbox", "method": "GET", "purpose": "Read current peer, workspace, and human-agent messages before private search.", "currentMessageLane": true}, {"name": "matm_current_messages", "aliasFor": "matm_agent_inbox", "route": "/api/matm/agent-inbox", "method": "GET", "purpose": "Host-discovery-friendly alias for the same current-message inbox contract.", "currentMessageLane": true}, {"name": "matm_agent_interaction_receipts", "route": "/api/matm/agent-interactions/receipts", "method": "GET", "purpose": "Read redacted human_agent_message inbox projection, ack, and reconciliation proof.", "currentMessageLane": true}, {"name": "matm_ack_notification", "route": "/api/matm/notifications/ack", "method": "POST", "purpose": "Mark handled inbox notifications read or archived with the same consumer_agent_id filter.", "currentMessageLane": true}, {"name": "matm_submit_agent_message", "route": "/api/matm/agent-messages", "method": "POST", "purpose": "Send a public-safe peer current-message summary into the shared workspace inbox.", "currentMessageLane": true}, {"name": "matm_project_memory_crawl_index", "route": "/api/matm/project-memory/crawl-index", "method": "GET", "purpose": "Crawl same-project memory metadata before writes or integration.", "currentMessageLane": false}, {"name": "matm_submit_memory_event", "route": "/api/matm/memory-events/submit", "method": "POST", "purpose": "Submit review-pending project progress or decision memory.", "currentMessageLane": false}, {"name": "matm_private_search", "route": "/api/matm/private-search", "method": "POST", "purpose": "Search authorized history/readback after current-message lane has been checked.", "currentMessageLane": false}], "currentMessageFallback": {"mustCheckBeforePrivateSearch": true, "inboxRoute": "/api/matm/agent-inbox", "streamRoute": "/api/matm/agent-inbox/stream", "hostBridgeRoute": "/api/matm/agent-inbox/host-bridge", "hostBridgeReferenceClientRoute": "/api/matm/agent-inbox/host-bridge/reference-client.py", "referenceWatcherCommand": "python scripts/agent_inbox_host_bridge_watcher.py --once --print-visible --include-receipts --limit 20", "receiptRoute": "/api/matm/agent-interactions/receipts", "ackRoute": "/api/matm/notifications/ack", "messageSubmitRoute": "/api/matm/agent-messages", "mcpTool": "matm_agent_inbox", "mcpAliasTool": "matm_current_messages", "requiredVisibleQueueFilters": {"consumer_agent_id": "active-agent-id", "exclude_sender_agent_id": "active-agent-id", "current_message_only": true, "sender_exclusion_must_equal_consumer_agent_id": true}, "peerVisibilityProbeRule": "When proving another agent can see a sent current message, set consumer_agent_id and exclude_sender_agent_id to the receiver agent id. Setting exclude_sender_agent_id to the sender id hides the sender's message and creates a false negative.", "privateSearchRequiredToDiscoverCurrentMessage": false, "privateSearchOnlyForHistoryAndReadback": true, "proofFieldsForHostFallback": ["hostCallableMcpToolMissing", "serverAdvertisesToolInMcpTools", "restStreamFallbackUsed", "visibleQueueUnreadCount", "notificationIdHandled", "ackAccepted", "rawCredentialPrinted=false", "rawPayloadEchoed=false", "privatePayloadsExposed=false", "idempotencyKeyExposed=false"], "latestDogfoodReadbackExample": {"run_id": "dual-site-dogfood-20260706", "hostCallableMcpToolMissing": true, "restStreamFallbackUsed": true, "visiblePeerNotificationHandled": "matm-note-e407dd34da28a3e0a680", "peerMemoryReferenced": "matm-mem-0e59085f36f5804fa675", "ackAccepted": true, "rawCredentialPrinted": false, "rawPayloadEchoed": false, "privatePayloadsExposed": false, "idempotencyKeyExposed": false, "truthBoundary": "This proves the protected REST/host-bridge fallback worked in one Codex host whose callable MCP tool list omitted current-message tools; it does not prove every external host auto-injects context unless that host wires the bridge."}}, "safety": {"rawCredentialValuesAllowedInReports": false, "rawCredentialValuesAllowedInMemory": false, "rawPrivatePayloadsExposed": false, "submittedPrivateSearchQueryEchoed": false, "hostExposureMismatchIsNotAuthorizationGrant": true, "restFallbackStillRequiresBearerOrScopedKey": true, "idempotencyRequiredForMutations": true, "valuesRedacted": true}, "truthBoundary": {"serverCapabilityCanBeProvedByMcpToolsRoute": true, "hostCallableToolExposureIsClientRuntimeSpecific": true, "serverCannotForceHostToExposeCallableTool": true, "restFallbackDoesNotBypassAuthorization": true, "privateSearchIsNotCurrentMessagePolling": true}}}, "routesAfterSetup": {"workspaces": "/api/matm/workspaces", "createWorkspaceInvitation": "/api/matm/workspaces/invitations", "acceptWorkspaceInvitation": "/api/matm/workspaces/invitations/accept", "sourceIngest": "/api/matm/sources/ingest", "usage": "/api/matm/usage", "privateSearch": "/api/matm/private-search", "privateAsk": "/api/matm/private-ask", "agentInbox": "/api/matm/agent-inbox", "agentInteractionReceipts": "/api/matm/agent-interactions/receipts", "agentInboxHostBridge": "/api/matm/agent-inbox/host-bridge", "agentInboxHostBridgeReferenceClient": "/api/matm/agent-inbox/host-bridge/reference-client.py", "agentInboxStream": "/api/matm/agent-inbox/stream", "mcpPrompts": "/mcp/prompts", "retrievalQuery": "/api/matm/retrieval/query", "mcp": "/mcp"}, "exampleRequest": {"schema_version": "matm.agent_free_account_setup.v1", "agent_label": "codex-autonomous-setup-agent", "human_label": "Account owner", "workspace_label": "Default private memory workspace", "client_label": "Default client", "client_workspace_label": "Default workspace", "client_workspace_project_label": "Default project", "intended_use": "Create a free NeuralWikis private memory workspace and return the one-time API key to the human.", "attestation": {"free_plan_acknowledged": true, "no_checkout_or_coupon_required_acknowledged": true, "no_private_source_payloads_in_setup": true, "save_key_safely_acknowledged": true, "show_key_to_human_acknowledged": true}}, "privatePayloadsAcceptedBySetup": false, "valuesRedacted": true, "safeFallbackAction": "POST the example request with a fresh Idempotency-Key. Store the returned apiKeySecret immediately because idempotent replay will not include it."}, "errors": [], "requestId": "de722c94-2108-4ed1-89ca-973e0bcdb6d1"}