{"ok": true, "status": "ok", "version": "matm-2026-06-23", "generatedAt": "2026-06-23T00:00:00Z", "data": {"schema_version": "matm.agent_authority_configuration_status.v1", "configurableByAgent": true, "agentCanSubmitConfigurationRequests": true, "grantsAuthorityImmediately": false, "selfGrantAllowed": false, "billingBypassAllowed": false, "paymentIsSafetyBypass": false, "privatePayloadsExposed": false, "rawTokensAccepted": false, "rawTokensExposed": false, "humanVisibleAndUnderstandable": true, "humanControlPlane": "https://neurowikis.com/", "agentFacingControlPlane": "https://neuralwikis.com/", "routes": {"status": "/api/matm/authority-configuration", "request": "/api/matm/authority-configuration/requests", "versionedStatus": "/api/v1/matm/authority-configuration", "versionedRequest": "/api/v1/matm/authority-configuration/requests", "mcpTool": "matm_request_authority_configuration", "humanConsoleSuggested": "https://neurowikis.com/agent-console/"}, "requestContract": {"method": "POST", "route": "/api/matm/authority-configuration/requests", "schemaVersion": "matm.agent_authority_configuration_request.v1", "requiredRole": "submitter_or_scoped_matm_api_key", "requiresBearerAuthorization": true, "requiresIdempotencyKey": true, "contentType": "application/json", "maxBodyBytes": 16384, "requestBoundarySummary": "review-pending only and applies no grants", "reviewPendingOnly": true, "appliesNoGrants": true, "requiredAttestation": ["agent_configuration_request_acknowledged", "no_role_or_billing_bypass_acknowledged", "human_notification_acknowledged", "storage_warning_policy_acknowledged", "no_raw_tokens_or_private_payloads"], "requestableAuthority": [{"id": "org_memory_search", "label": "Organization-wide private memory search", "requestableByAgent": true, "selfGrantAllowed": false, "requiredPermission": "org:memory:search", "unblocks": ["cross_project_private_search", "global_private_memory_index"], "activationAuthority": "organization owner, operator, or reviewed organization-scoped credential", "activationByRequestAlone": false}, {"id": "reviewer_role", "label": "Reviewer role and review permissions", "requestableByAgent": true, "selfGrantAllowed": false, "requiredRole": "reviewer", "recommendedPermissions": ["memory:review", "memory:feedback", "audit:read", "evaluation:run"], "unblocks": ["matm_apply_rollback", "matm_run_evaluation", "matm_review_decision"], "activationAuthority": "workspace owner, reviewer/operator delegation, or protected membership update", "activationByRequestAlone": false}, {"id": "retention_manage", "label": "Retention management permission", "requestableByAgent": true, "selfGrantAllowed": false, "requiredPermission": "retention:manage", "unblocks": ["matm_create_retention_action"], "activationAuthority": "workspace owner, operator, or scoped service-account update", "activationByRequestAlone": false}, {"id": "retention_actions_entitlement", "label": "Retention actions entitlement", "requestableByAgent": true, "selfGrantAllowed": false, "requiredEntitlement": "retention_actions", "unblocks": ["archive_request", "retention_review", "legal_hold", "delete_request_metadata_only"], "activationAuthority": "paid workspace entitlement, verified billing webhook, or operator-approved entitlement record", "activationByRequestAlone": false}, {"id": "paid_workspace_entitlement", "label": "Paid MATM workspace entitlement", "requestableByAgent": true, "selfGrantAllowed": false, "supportedTargetPlans": ["private_starter", "private_team", "business", "enterprise"], "unblocks": ["retention_actions_entitlement", "larger_storage", "more_service_agents", "paid_private_workspace_features"], "activationAuthority": "verified subscription webhook, billing admin, or operator-approved local entitlement record", "activationByRequestAlone": false, "paymentIsSafetyBypass": false}], "exampleRequest": {"schema_version": "matm.agent_authority_configuration_request.v1", "workspace_id": "workspace-id-from-free-agent-setup", "requested_authority": ["org_memory_search", "reviewer_role", "retention_manage", "retention_actions_entitlement", "paid_workspace_entitlement"], "target_plan": "private_team", "request_reason": "Need organization memory search, reviewer rollback authority, and retention archive capability for full MATM lifecycle testing.", "attestation": {"agent_configuration_request_acknowledged": true, "no_role_or_billing_bypass_acknowledged": true, "human_notification_acknowledged": true, "storage_warning_policy_acknowledged": true, "no_raw_tokens_or_private_payloads": true}}}, "currentWorkspaceStatus": {}, "subjectStatusMatrix": {"schemaVersion": "matm.agent_authority_subject_status.v1", "blockedWordMeaning": "subject_qualified_authority_gate_only", "blockedWordForHumans": "If legacy audit text uses blocked while ordinary work is usable, read it as a final certification evidence gate, not as deployment failure or a stopped workspace.", "recommendedHumanTerm": "waiting_for_external_authority_evidence", "displayStatus": "waiting_for_external_authority_evidence", "uiDisplayRule": "Display humanReadableStatus/displayStatus. Do not display this authority state as blocked when goalExecutionBlocked=false, agentMayContinue=true, and ordinaryAgentWorkMayContinue=true; display it as waiting for external authority evidence instead.", "blockerTerminology": {"schemaVersion": "matm.blocker_terminology.v1", "displayStatus": "waiting_for_external_authority_evidence", "preferredStatusFields": ["humanReadableStatus", "displayStatus", "recommendedHumanStatus"], "preferredCountFields": ["completionEvidenceGateCount", "remainingEvidenceGateCount"], "executionBlockFields": ["blockedCount", "blockingKeys", "executionBlockedCount", "executionBlockingKeys"], "legacyCompatibilityFields": ["legacyBlockedCount", "legacyBlockingKeys"], "legacyFieldInterpretation": "Top-level blockedCount and blockingKeys mean execution blocking only. Completion evidence gates are exposed as completionEvidenceGateCount/completionEvidenceGateKeys and legacy completion-gate aliases legacyBlockedCount/legacyBlockingKeys. They do not mean Codex goal execution, deployment, free-agent setup, prompt copying, or same-workspace private memory work is stopped.", "blockedWordMeaning": "subject_qualified_authority_gate_only", "uiDisplayRule": "Display humanReadableStatus/displayStatus. Do not display this authority state as blocked when goalExecutionBlocked=false, agentMayContinue=true, and ordinaryAgentWorkMayContinue=true; display it as waiting for external authority evidence instead.", "notBlockedSubjects": ["ordinaryProjectWork", "deployment", "freeAgentSetup", "projectPrivateMemory", "promptLibrary"], "evidenceGatedSubjects": ["orgWidePrivateSearch", "reviewerRetentionArchiveRepair", "paidWorkspaceEntitlement", "goalCompletionCertification"]}, "preferredAuditCountField": "completionEvidenceGateCount", "completionEvidenceGateCount": 1, "remainingEvidenceGateCount": 1, "completionEvidenceGateKeys": ["mcp_full_lifecycle_authority_proofs_admitted"], "executionBlockedCount": 0, "executionBlockingKeys": [], "blockedCount": 0, "blockingKeys": [], "legacyBlockedCount": 1, "legacyBlockingKeys": ["mcp_full_lifecycle_authority_proofs_admitted"], "blockingKeyMeaning": "Execution-blocking keys only. Completion evidence keys are in completionEvidenceGateKeys and legacyBlockingKeys.", "remainingEvidenceGates": ["mcp_full_lifecycle_authority_proofs_admitted"], "remainingEvidenceGateDetails": ["org-wide private search has not been verified with org authority", "archive/repair authority receipts have not been verified with reviewer and retention authority", "verified org and archive/repair reports are required before receipt-bundle admission", "authority receipt bundle is not admitted", "lifecycle coverage still records authority gaps", "full goal audit still has authority evidence keys"], "externalAuthorityClosureEvidenceRequirements": ["org-wide private search has not been verified with org authority", "archive/repair authority receipts have not been verified with reviewer and retention authority", "verified org and archive/repair reports are required before receipt-bundle admission", "authority receipt bundle is not admitted", "lifecycle coverage still records authority gaps", "full goal audit still has authority evidence keys"], "externalAuthorityReceiptCollection": {"schemaVersion": "matm.external_authority_receipt_collection_contract.v1", "status": "waiting_for_external_authority_receipts", "humanReadableStatus": "waiting_for_external_authority_evidence", "plainLanguageLabel": "External authority receipts still required", "plainLanguageSummary": "external authority receipts are still required for the final gate; ordinary same-workspace memory, free-agent setup, deployment, project crawl/search, and NeuroWikis prompt copying are not stopped.", "currentCompletionEvidenceGateKey": "mcp_full_lifecycle_authority_proofs_admitted", "currentCompletionEvidenceGateCount": 1, "currentSafeCollectorRefresh": {"report": "reports/mcp-archive-repair-external-authority-receipts-v1.json", "status": "waiting_for_reviewer_retention_authority_receipts", "passed": false, "liveExecutionRequested": false, "callsProduction": false, "writesRemoteMemory": false, "retiresLocalUai": false, "tokenPrinted": false, "targetIdsStored": false, "retentionTokenAvailable": false, "reviewerTokenAvailable": false}, "currentExternalProofReadiness": {"closurePacket": "reports/matm-remaining-blocker-closure-packet-v1.json", "status": "ready_for_external_authority_proofs", "readyForExternalProofExecution": true, "packetBlockers": [], "meaning": "The no-mutation handoff, templates, NeuroWikis operator files, and command sequence are current. External org/reviewer/retention credentials and receipts are still required before admission and final goal completion."}, "currentAuthorityClosureWorkflow": {"report": "reports/mcp-authority-closure-workflow-v1.json", "status": "waiting_for_external_authority_inputs", "readyForOperatorExecution": true, "readyForGoalComplete": false}, "authorityReceiptClosureToolchain": {"schema_version": "neuralwikis.authority_receipt_closure_toolchain.v1", "publicSafe": true, "valuesRedacted": true, "rawTokensIncluded": false, "rawPrivatePayloadsIncluded": false, "rawIdempotencyKeysIncluded": false, "status": "waiting_for_verified_external_authority_reports", "plainLanguageLabel": "Authority receipt closure toolchain", "plainLanguageSummary": "The local no-secret toolchain for final authority proof intake is ready, but verified org, reviewer, and retention receipts are still required before a receipt bundle can be written, admitted, or used for goal completion.", "readyForExternalAuthorityProofIntake": true, "readyForReceiptBundleWrite": false, "readyForReceiptAdmission": false, "readyForLifecycleRefresh": false, "readyForGoalComplete": false, "localScripts": {"intakePreflight": "scripts/build_mcp_authority_proof_intake_preflight.py", "orgMemoryLiveProbe": "scripts/probe_mcp_org_memory_live.py", "archiveRepairExternalReceipts": "scripts/collect_mcp_archive_repair_external_authority_receipts.py", "receiptBundleBuilder": "scripts/build_mcp_authority_external_receipt_bundle.py", "proofAdmission": "scripts/build_mcp_authority_proof_admission.py", "closureWorkflow": "scripts/run_mcp_authority_closure_workflow.py"}, "defaultCommands": {"intakePreflight": "python scripts\\build_mcp_authority_proof_intake_preflight.py --write-defaults --check --require-ready", "orgMemoryLiveProbe": "Set NEURALWIKIS_ORG_MCP_TOKEN outside this report, then run python scripts\\probe_mcp_org_memory_live.py --execute-live --confirm RUN-LIVE-ORG-MEMORY-PROBE --check", "archiveRepairExternalReceipts": "Set NEURALWIKIS_RETENTION_MCP_TOKEN and NEURALWIKIS_REVIEWER_MCP_TOKEN outside this report, fill a private uncommitted safe-target config, then run python scripts\\collect_mcp_archive_repair_external_authority_receipts.py --target-config-json <private-safe-target-config.json> --execute-live --confirm RUN-LIVE-ARCHIVE-REPAIR-AUTHORITY-RECEIPTS --check --require-verified", "receiptBundleBuilder": "python scripts\\build_mcp_authority_external_receipt_bundle.py --write-defaults --write-receipt-bundle --check --require-ready", "proofAdmission": "python scripts\\build_mcp_authority_proof_admission.py --write-defaults --check --require-admitted", "closureWorkflow": "python scripts\\run_mcp_authority_closure_workflow.py --write-defaults --check"}, "latestReports": {"intakePreflight": "reports/mcp-authority-proof-intake-preflight-v1.json", "orgAuthorityReadiness": "reports/mcp-org-memory-authority-readiness-v1.json", "archiveRepairExternalReceipts": "reports/mcp-archive-repair-external-authority-receipts-v1.json", "receiptBundleBuilder": "reports/mcp-authority-external-receipt-bundle-builder-v1.json", "receiptBundle": "reports/mcp-authority-external-proof-receipts-v1.json", "proofAdmission": "reports/mcp-authority-proof-admission-v1.json", "closureWorkflow": "reports/mcp-authority-closure-workflow-v1.json", "lifecycleCoverage": "reports/mcp-memory-lifecycle-e2e-coverage-v1.json", "fullGoalAudit": "reports/matm-full-goal-completion-audit-v2.8.1.json"}, "latestStatuses": {"intakePreflight": "ready_for_external_authority_proof_intake", "orgAuthorityReadiness": "waiting_for_org_scoped_memory_credential", "archiveRepairExternalReceipts": "waiting_for_reviewer_retention_authority_receipts", "receiptBundleBuilder": "waiting_for_verified_external_authority_reports", "proofAdmission": "collect_org_memory_and_archive_repair_external_receipts", "closureWorkflow": "waiting_for_external_authority_inputs"}, "requiredExternalAuthorityReceipts": ["org_scoped_private_memory_search", "reviewer_authority_receipt", "retention_archive_repair_receipt", "authority_receipt_bundle_admission"], "requiredSecretEnvVars": ["NEURALWIKIS_ORG_MCP_TOKEN", "NEURALWIKIS_REVIEWER_MCP_TOKEN", "NEURALWIKIS_RETENTION_MCP_TOKEN"], "requiredPrivateInputs": ["private uncommitted safe-target config", "safe non-active archive target identifiers kept outside reports and memory", "safe non-active repair target identifiers kept outside reports and memory", "operator attestations recorded only as redacted evidence references"], "currentBlockers": ["org authority report is not verified for org-wide private search", "archive/repair external authority receipt report is missing or incomplete", "external authority receipt bundle is not present", "authority receipt bundle is not admitted"], "truthBoundary": {"doesNotRunLiveWorker": true, "doesNotExecuteOrgWideSearchWithoutOrgToken": true, "doesNotAttemptArchiveOrRepairWithoutReviewerRetentionTokens": true, "doesNotWriteReceiptBundleWithoutVerifiedInputs": true, "doesNotAdmitAuthorityReceipts": true, "doesNotRetireLocalUai": true, "doesNotMarkGoalComplete": true, "ordinaryAgentWorkMayContinue": true, "readyForGoalComplete": false}}, "requiredExternalAuthorityReceipts": ["org_scoped_private_memory_search", "reviewer_authority_receipt", "retention_archive_repair_receipt", "authority_receipt_bundle_admission"], "requiredSecretEnvVars": ["NEURALWIKIS_ORG_MCP_TOKEN", "NEURALWIKIS_REVIEWER_MCP_TOKEN", "NEURALWIKIS_RETENTION_MCP_TOKEN"], "requiredNonSecretInputs": ["reports/mcp-archive-repair-safe-target-config-template-v1.json", "private uncommitted <private-safe-target-config.json>", "safe non-active archive target id and state stored only in the private config", "safe non-active repair target id and state stored only in the private config", "operator safe-target attestations stored without raw ids in reports"], "safeCommandSequence": ["python scripts\\probe_mcp_org_memory_live.py --execute-live --confirm RUN-LIVE-ORG-MEMORY-PROBE --check", "python scripts\\collect_mcp_archive_repair_external_authority_receipts.py --write-target-config-template --target-config-template-out reports\\mcp-archive-repair-safe-target-config-template-v1.json --check", "copy reports\\mcp-archive-repair-safe-target-config-template-v1.json <private-safe-target-config.json>", "python scripts\\collect_mcp_archive_repair_external_authority_receipts.py --target-config-json <private-safe-target-config.json> --execute-live --confirm RUN-LIVE-ARCHIVE-REPAIR-AUTHORITY-RECEIPTS --check --require-verified", "python scripts\\build_mcp_authority_external_receipt_bundle.py --write-defaults --write-receipt-bundle --check --require-ready", "python scripts\\build_mcp_authority_proof_admission.py --write-defaults --check --require-admitted", "python scripts\\build_mcp_memory_lifecycle_e2e_coverage.py --write-defaults", "python scripts\\build_uai_cutover_apply_preflight.py --require-safe-waiting", "python scripts\\build_matm_remaining_blocker_closure_packet.py --write-defaults --check", "python scripts\\build_matm_full_goal_completion_audit.py --write-defaults --check"], "notEvidenceForThisGate": ["FTP credentials", "FTPS credentials", "FRP credentials", "package publish credentials", "normal workspace MCP token", "workspace.uai reconnect context", "review-pending authority request without admitted receipts"], "notBlockedSubjects": ["deployment", "free_agent_setup", "same_workspace_project_private_memory", "project_crawl_search", "NeuroWikis_prompt_library", "ordinary_agent_work"], "rawSecretPolicy": {"printRawTokens": false, "storeRawTokensInReports": false, "storeRawTokensInMemory": false, "pasteRawTokensIntoChat": false, "storePrivateSafeTargetConfigInMemory": false, "printRawTargetIds": false}, "safeFallbackAction": "If any required authority token, private safe-target config, or receipt is missing, report waiting_for_external_authority_evidence, keep ordinary same-workspace work active when goalExecutionBlocked=false, and do not claim final completion."}, "externalAuthorityReceiptsStillRequired": true, "externalAuthorityReceiptsPlainLanguage": "The only final completion gate is mcp_full_lifecycle_authority_proofs_admitted. It requires redacted external authority receipts for org-scoped private memory search plus reviewer and retention archive/repair authority. It is not an execution block.", "closureStepEvidenceGateCount": 6, "remainingClosureStepCount": 6, "closureStepEvidenceGates": ["org-wide private search has not been verified with org authority", "archive/repair authority receipts have not been verified with reviewer and retention authority", "verified org and archive/repair reports are required before receipt-bundle admission", "authority receipt bundle is not admitted", "lifecycle coverage still records authority gaps", "full goal audit still has authority evidence keys"], "legacyBlockedCountMeaning": "legacyBlockedCount preserves the old completion-audit count. Top-level blockedCount is execution-only and remains 0 when goalExecutionBlocked=false.", "humanSummary": "Free-agent setup, same-workspace project-private memory, ordinary project work, deployment, and the NeuroWikis prompt library are not blocked by an authority request. Org-wide private search, reviewer/retention actions, paid entitlement activation, and final completion certification require external approval or receipts.", "goalExecutionBlocked": false, "agentMayContinue": true, "ordinaryAgentWorkMayContinue": true, "workspaceUaiCredentialBoundary": {"schemaVersion": "matm.workspace_uai_credential_boundary.v1", "rootWorkspaceUaiPath": "E:\\workspace.uai", "workspaceUaiRole": "short_term_operational_and_reconnect_memory", "neuralWikisMatmRole": "durable_mid_long_term_searchable_memory", "workspaceUaiIsAuthorityCredentialStore": false, "workspaceUaiIsDeploymentCredentialStore": false, "rawAuthorityTokensAllowedInWorkspaceUai": false, "rawAuthorityTokensAllowedInReportsOrMemory": false, "doNotInferAuthorityFromWorkspaceUai": true, "deploymentCredentialBoundary": {"schemaVersion": "matm.deployment_vs_authority_credential_boundary.v1", "deploymentCredentialFilePath": "E:\\ftp_Deploy.txt", "deploymentCredentialCanDeploySites": true, "deploymentCredentialCanCloseMatmAuthorityGate": false, "deploymentCredentialValuesAllowedInReportsOrMemory": false, "authorityCredentialRequiredEnvVars": ["NEURALWIKIS_ORG_MCP_TOKEN", "NEURALWIKIS_REVIEWER_MCP_TOKEN", "NEURALWIKIS_RETENTION_MCP_TOKEN"], "interpretation": "Deployment credentials and external MATM authority credentials are separate. A deploy-capable workspace can still be waiting for org-wide private search, reviewer, and retention authority receipts."}, "requiredAuthorityCredentialChannel": "approved_secret_channel_or_reviewed_operator_provisioning", "requiredExternalAuthorityEnvVars": ["NEURALWIKIS_ORG_MCP_TOKEN", "NEURALWIKIS_REVIEWER_MCP_TOKEN", "NEURALWIKIS_RETENTION_MCP_TOKEN"], "safeAgentInstruction": "Consult workspace.uai for short-term operational and reconnect context, but do not assume it contains org, reviewer, retention, billing, archive/repair authority credentials, or deployment passwords. Deployment credential availability is separate from MATM authority proof. Use the current credential scope, submit review-pending authority requests when needed, and keep raw tokens out of prompts, reports, workspace.uai, and memory."}, "currentWorkspaceOrgSearchBoundary": {"schemaVersion": "matm.current_workspace_org_search_boundary.v1", "status": "current_workspace_org_search_denied_waiting_for_org_scoped_credential", "currentWorkspaceOrgSearchDenied": true, "currentWorkspaceGlobalPrivateFiltered": true, "currentWorkspaceRequiresOrgMemorySearch": true, "normalWorkspaceTokenCanCloseAuthorityGate": false, "workspaceCredentialCanClaimOrgWidePrivateSearch": false, "safeToClaimOrgWidePrivateSearch": false, "liveOrgWidePrivateSearchVerified": false, "evidencePath": "reports/mcp-org-memory-live-probe-v1.json", "requiredFutureStatus": "org_wide_private_search_verified", "requiredFutureCredentialEnv": "NEURALWIKIS_ORG_MCP_TOKEN", "meaning": "The current workspace credential is correctly bounded: it can support same-workspace project memory when authorized, but it is denied org-wide/cross-project private search and cannot close the final MATM authority gate.", "safeNextAction": "Continue same-workspace project memory work with the current credential. Use an organization-scoped credential from an approved secret channel for the separate org-wide private-search receipt."}, "ordinaryWorkBlocked": false, "deploymentBlocked": false, "freeAgentSetupBlocked": false, "projectPrivateMemoryBlocked": false, "promptLibraryBlocked": false, "externalAuthorityReceiptsRequired": true, "finalCertificationEvidenceGate": true, "requestPendingIsApproval": false, "configurationDoesNotEqualApproval": true, "matm422RepairDiagnostics": {"statusCode": 422, "meaning": "repairable schema or Memory Firewall diagnostic, not proof that memory is unavailable", "fieldsToInspect": ["issues[].code", "issues[].path", "safeFallbackAction", "memoryFirewall.failed_stage", "memoryFirewall.retry_from_stage"], "retryRule": "Retry with corrected public-safe content and a fresh Idempotency-Key when the request body changes.", "rawPayloadRequiredForDebugging": false, "rawResponseRequiredForDebugging": false}, "subjects": {"ordinaryProjectWork": {"state": "active", "blocked": false, "meaning": "Agents can continue setup, same-workspace work, guidance, and verification."}, "deployment": {"state": "not_blocked_by_authority_request", "blocked": false, "meaning": "An authority configuration request is not a deployment credential or publish blocker."}, "freeAgentSetup": {"state": "usable", "blocked": false, "meaning": "Agents can create a no-human 200 MB free_agent workspace and one-time key."}, "projectPrivateMemory": {"state": "usable_when_authorized", "blocked": false, "meaning": "Workspace/project private search and memory writes are available within current credential scope."}, "authorityConfigurationRequest": {"state": "configurable_review_pending_only", "blocked": false, "meaning": "Agents can request missing authority, but the request applies no grants by itself."}, "orgWidePrivateSearch": {"state": "waiting_for_external_authority", "blocked": true, "meaning": "Cross-project/global private search requires org:memory:search authority.", "currentWorkspaceBoundaryStatus": "current_workspace_org_search_denied_waiting_for_org_scoped_credential", "currentWorkspaceCredentialCanClaimOrgWidePrivateSearch": false}, "reviewerRetentionArchiveRepair": {"state": "waiting_for_external_authority", "blocked": true, "meaning": "Rollback apply, reviewer transitions, and retention/archive receipts require reviewer and retention authority."}, "paidWorkspaceEntitlement": {"state": "waiting_for_verified_provider_or_operator", "blocked": true, "meaning": "Paid MATM entitlement activation requires a verified webhook, account confirmation, or operator-approved entitlement record."}, "goalCompletionCertification": {"state": "waiting_for_external_authority_receipts", "blocked": true, "meaning": "Final full-goal certification requires redacted org/reviewer/retention authority receipts."}}, "safeNextAction": "Use the current authorized workspace scope, submit a review-pending authority request for missing capabilities, inform the human when authority or storage is missing, and keep raw tokens/private payloads out of request text."}, "remainingEvidenceGates": ["mcp_full_lifecycle_authority_proofs_admitted"], "remainingEvidenceGateDetails": ["org-wide private search has not been verified with org authority", "archive/repair authority receipts have not been verified with reviewer and retention authority", "verified org and archive/repair reports are required before receipt-bundle admission", "authority receipt bundle is not admitted", "lifecycle coverage still records authority gaps", "full goal audit still has authority evidence keys"], "externalAuthorityClosureEvidenceRequirements": ["org-wide private search has not been verified with org authority", "archive/repair authority receipts have not been verified with reviewer and retention authority", "verified org and archive/repair reports are required before receipt-bundle admission", "authority receipt bundle is not admitted", "lifecycle coverage still records authority gaps", "full goal audit still has authority evidence keys"], "externalAuthorityReceiptCollection": {"schemaVersion": "matm.external_authority_receipt_collection_contract.v1", "status": "waiting_for_external_authority_receipts", "humanReadableStatus": "waiting_for_external_authority_evidence", "plainLanguageLabel": "External authority receipts still required", "plainLanguageSummary": "external authority receipts are still required for the final gate; ordinary same-workspace memory, free-agent setup, deployment, project crawl/search, and NeuroWikis prompt copying are not stopped.", "currentCompletionEvidenceGateKey": "mcp_full_lifecycle_authority_proofs_admitted", "currentCompletionEvidenceGateCount": 1, "currentSafeCollectorRefresh": {"report": "reports/mcp-archive-repair-external-authority-receipts-v1.json", "status": "waiting_for_reviewer_retention_authority_receipts", "passed": false, "liveExecutionRequested": false, "callsProduction": false, "writesRemoteMemory": false, "retiresLocalUai": false, "tokenPrinted": false, "targetIdsStored": false, "retentionTokenAvailable": false, "reviewerTokenAvailable": false}, "currentExternalProofReadiness": {"closurePacket": "reports/matm-remaining-blocker-closure-packet-v1.json", "status": "ready_for_external_authority_proofs", "readyForExternalProofExecution": true, "packetBlockers": [], "meaning": "The no-mutation handoff, templates, NeuroWikis operator files, and command sequence are current. External org/reviewer/retention credentials and receipts are still required before admission and final goal completion."}, "currentAuthorityClosureWorkflow": {"report": "reports/mcp-authority-closure-workflow-v1.json", "status": "waiting_for_external_authority_inputs", "readyForOperatorExecution": true, "readyForGoalComplete": false}, "authorityReceiptClosureToolchain": {"schema_version": "neuralwikis.authority_receipt_closure_toolchain.v1", "publicSafe": true, "valuesRedacted": true, "rawTokensIncluded": false, "rawPrivatePayloadsIncluded": false, "rawIdempotencyKeysIncluded": false, "status": "waiting_for_verified_external_authority_reports", "plainLanguageLabel": "Authority receipt closure toolchain", "plainLanguageSummary": "The local no-secret toolchain for final authority proof intake is ready, but verified org, reviewer, and retention receipts are still required before a receipt bundle can be written, admitted, or used for goal completion.", "readyForExternalAuthorityProofIntake": true, "readyForReceiptBundleWrite": false, "readyForReceiptAdmission": false, "readyForLifecycleRefresh": false, "readyForGoalComplete": false, "localScripts": {"intakePreflight": "scripts/build_mcp_authority_proof_intake_preflight.py", "orgMemoryLiveProbe": "scripts/probe_mcp_org_memory_live.py", "archiveRepairExternalReceipts": "scripts/collect_mcp_archive_repair_external_authority_receipts.py", "receiptBundleBuilder": "scripts/build_mcp_authority_external_receipt_bundle.py", "proofAdmission": "scripts/build_mcp_authority_proof_admission.py", "closureWorkflow": "scripts/run_mcp_authority_closure_workflow.py"}, "defaultCommands": {"intakePreflight": "python scripts\\build_mcp_authority_proof_intake_preflight.py --write-defaults --check --require-ready", "orgMemoryLiveProbe": "Set NEURALWIKIS_ORG_MCP_TOKEN outside this report, then run python scripts\\probe_mcp_org_memory_live.py --execute-live --confirm RUN-LIVE-ORG-MEMORY-PROBE --check", "archiveRepairExternalReceipts": "Set NEURALWIKIS_RETENTION_MCP_TOKEN and NEURALWIKIS_REVIEWER_MCP_TOKEN outside this report, fill a private uncommitted safe-target config, then run python scripts\\collect_mcp_archive_repair_external_authority_receipts.py --target-config-json <private-safe-target-config.json> --execute-live --confirm RUN-LIVE-ARCHIVE-REPAIR-AUTHORITY-RECEIPTS --check --require-verified", "receiptBundleBuilder": "python scripts\\build_mcp_authority_external_receipt_bundle.py --write-defaults --write-receipt-bundle --check --require-ready", "proofAdmission": "python scripts\\build_mcp_authority_proof_admission.py --write-defaults --check --require-admitted", "closureWorkflow": "python scripts\\run_mcp_authority_closure_workflow.py --write-defaults --check"}, "latestReports": {"intakePreflight": "reports/mcp-authority-proof-intake-preflight-v1.json", "orgAuthorityReadiness": "reports/mcp-org-memory-authority-readiness-v1.json", "archiveRepairExternalReceipts": "reports/mcp-archive-repair-external-authority-receipts-v1.json", "receiptBundleBuilder": "reports/mcp-authority-external-receipt-bundle-builder-v1.json", "receiptBundle": "reports/mcp-authority-external-proof-receipts-v1.json", "proofAdmission": "reports/mcp-authority-proof-admission-v1.json", "closureWorkflow": "reports/mcp-authority-closure-workflow-v1.json", "lifecycleCoverage": "reports/mcp-memory-lifecycle-e2e-coverage-v1.json", "fullGoalAudit": "reports/matm-full-goal-completion-audit-v2.8.1.json"}, "latestStatuses": {"intakePreflight": "ready_for_external_authority_proof_intake", "orgAuthorityReadiness": "waiting_for_org_scoped_memory_credential", "archiveRepairExternalReceipts": "waiting_for_reviewer_retention_authority_receipts", "receiptBundleBuilder": "waiting_for_verified_external_authority_reports", "proofAdmission": "collect_org_memory_and_archive_repair_external_receipts", "closureWorkflow": "waiting_for_external_authority_inputs"}, "requiredExternalAuthorityReceipts": ["org_scoped_private_memory_search", "reviewer_authority_receipt", "retention_archive_repair_receipt", "authority_receipt_bundle_admission"], "requiredSecretEnvVars": ["NEURALWIKIS_ORG_MCP_TOKEN", "NEURALWIKIS_REVIEWER_MCP_TOKEN", "NEURALWIKIS_RETENTION_MCP_TOKEN"], "requiredPrivateInputs": ["private uncommitted safe-target config", "safe non-active archive target identifiers kept outside reports and memory", "safe non-active repair target identifiers kept outside reports and memory", "operator attestations recorded only as redacted evidence references"], "currentBlockers": ["org authority report is not verified for org-wide private search", "archive/repair external authority receipt report is missing or incomplete", "external authority receipt bundle is not present", "authority receipt bundle is not admitted"], "truthBoundary": {"doesNotRunLiveWorker": true, "doesNotExecuteOrgWideSearchWithoutOrgToken": true, "doesNotAttemptArchiveOrRepairWithoutReviewerRetentionTokens": true, "doesNotWriteReceiptBundleWithoutVerifiedInputs": true, "doesNotAdmitAuthorityReceipts": true, "doesNotRetireLocalUai": true, "doesNotMarkGoalComplete": true, "ordinaryAgentWorkMayContinue": true, "readyForGoalComplete": false}}, "requiredExternalAuthorityReceipts": ["org_scoped_private_memory_search", "reviewer_authority_receipt", "retention_archive_repair_receipt", "authority_receipt_bundle_admission"], "requiredSecretEnvVars": ["NEURALWIKIS_ORG_MCP_TOKEN", "NEURALWIKIS_REVIEWER_MCP_TOKEN", "NEURALWIKIS_RETENTION_MCP_TOKEN"], "requiredNonSecretInputs": ["reports/mcp-archive-repair-safe-target-config-template-v1.json", "private uncommitted <private-safe-target-config.json>", "safe non-active archive target id and state stored only in the private config", "safe non-active repair target id and state stored only in the private config", "operator safe-target attestations stored without raw ids in reports"], "safeCommandSequence": ["python scripts\\probe_mcp_org_memory_live.py --execute-live --confirm RUN-LIVE-ORG-MEMORY-PROBE --check", "python scripts\\collect_mcp_archive_repair_external_authority_receipts.py --write-target-config-template --target-config-template-out reports\\mcp-archive-repair-safe-target-config-template-v1.json --check", "copy reports\\mcp-archive-repair-safe-target-config-template-v1.json <private-safe-target-config.json>", "python scripts\\collect_mcp_archive_repair_external_authority_receipts.py --target-config-json <private-safe-target-config.json> --execute-live --confirm RUN-LIVE-ARCHIVE-REPAIR-AUTHORITY-RECEIPTS --check --require-verified", "python scripts\\build_mcp_authority_external_receipt_bundle.py --write-defaults --write-receipt-bundle --check --require-ready", "python scripts\\build_mcp_authority_proof_admission.py --write-defaults --check --require-admitted", "python scripts\\build_mcp_memory_lifecycle_e2e_coverage.py --write-defaults", "python scripts\\build_uai_cutover_apply_preflight.py --require-safe-waiting", "python scripts\\build_matm_remaining_blocker_closure_packet.py --write-defaults --check", "python scripts\\build_matm_full_goal_completion_audit.py --write-defaults --check"], "notEvidenceForThisGate": ["FTP credentials", "FTPS credentials", "FRP credentials", "package publish credentials", "normal workspace MCP token", "workspace.uai reconnect context", "review-pending authority request without admitted receipts"], "notBlockedSubjects": ["deployment", "free_agent_setup", "same_workspace_project_private_memory", "project_crawl_search", "NeuroWikis_prompt_library", "ordinary_agent_work"], "rawSecretPolicy": {"printRawTokens": false, "storeRawTokensInReports": false, "storeRawTokensInMemory": false, "pasteRawTokensIntoChat": false, "storePrivateSafeTargetConfigInMemory": false, "printRawTargetIds": false}, "safeFallbackAction": "If any required authority token, private safe-target config, or receipt is missing, report waiting_for_external_authority_evidence, keep ordinary same-workspace work active when goalExecutionBlocked=false, and do not claim final completion."}, "externalAuthorityReceiptsStillRequired": true, "externalAuthorityReceiptsPlainLanguage": "The only final completion gate is mcp_full_lifecycle_authority_proofs_admitted. It requires redacted external authority receipts for org-scoped private memory search plus reviewer and retention archive/repair authority. It is not an execution block.", "remainingEvidenceGateCount": 1, "completionEvidenceGateKeys": ["mcp_full_lifecycle_authority_proofs_admitted"], "executionBlockedCount": 0, "executionBlockingKeys": [], "blockedCount": 0, "blockingKeys": [], "legacyBlockedCount": 1, "legacyBlockingKeys": ["mcp_full_lifecycle_authority_proofs_admitted"], "blockingKeyMeaning": "Execution-blocking keys only. Completion evidence keys are in completionEvidenceGateKeys and legacyBlockingKeys.", "closureStepEvidenceGateCount": 6, "remainingClosureStepCount": 6, "closureStepEvidenceGates": ["org-wide private search has not been verified with org authority", "archive/repair authority receipts have not been verified with reviewer and retention authority", "verified org and archive/repair reports are required before receipt-bundle admission", "authority receipt bundle is not admitted", "lifecycle coverage still records authority gaps", "full goal audit still has authority evidence keys"], "recommendedHumanStatus": "waiting_for_external_authority_evidence", "humanReadableStatus": "waiting_for_external_authority_evidence", "preferredAuditCountField": "completionEvidenceGateCount", "preferredCountField": "completionEvidenceGateCount", "completionEvidenceGateCount": 1, "legacyBlockedCountMeaning": "legacyBlockedCount preserves the old completion-audit count. Top-level blockedCount is execution-only and remains 0 when goalExecutionBlocked=false.", "legacyBlockedFieldsMeaning": "legacyBlockedCount preserves the old completion-audit count. Top-level blockedCount is execution-only and remains 0 when goalExecutionBlocked=false.", "blockedWordMeaning": "subject_qualified_authority_gate_only", "goalExecutionBlocked": false, "agentMayContinue": true, "ordinaryAgentWorkMayContinue": true, "workspaceUaiCredentialBoundary": {"schemaVersion": "matm.workspace_uai_credential_boundary.v1", "rootWorkspaceUaiPath": "E:\\workspace.uai", "workspaceUaiRole": "short_term_operational_and_reconnect_memory", "neuralWikisMatmRole": "durable_mid_long_term_searchable_memory", "workspaceUaiIsAuthorityCredentialStore": false, "workspaceUaiIsDeploymentCredentialStore": false, "rawAuthorityTokensAllowedInWorkspaceUai": false, "rawAuthorityTokensAllowedInReportsOrMemory": false, "doNotInferAuthorityFromWorkspaceUai": true, "deploymentCredentialBoundary": {"schemaVersion": "matm.deployment_vs_authority_credential_boundary.v1", "deploymentCredentialFilePath": "E:\\ftp_Deploy.txt", "deploymentCredentialCanDeploySites": true, "deploymentCredentialCanCloseMatmAuthorityGate": false, "deploymentCredentialValuesAllowedInReportsOrMemory": false, "authorityCredentialRequiredEnvVars": ["NEURALWIKIS_ORG_MCP_TOKEN", "NEURALWIKIS_REVIEWER_MCP_TOKEN", "NEURALWIKIS_RETENTION_MCP_TOKEN"], "interpretation": "Deployment credentials and external MATM authority credentials are separate. A deploy-capable workspace can still be waiting for org-wide private search, reviewer, and retention authority receipts."}, "requiredAuthorityCredentialChannel": "approved_secret_channel_or_reviewed_operator_provisioning", "requiredExternalAuthorityEnvVars": ["NEURALWIKIS_ORG_MCP_TOKEN", "NEURALWIKIS_REVIEWER_MCP_TOKEN", "NEURALWIKIS_RETENTION_MCP_TOKEN"], "safeAgentInstruction": "Consult workspace.uai for short-term operational and reconnect context, but do not assume it contains org, reviewer, retention, billing, archive/repair authority credentials, or deployment passwords. Deployment credential availability is separate from MATM authority proof. Use the current credential scope, submit review-pending authority requests when needed, and keep raw tokens out of prompts, reports, workspace.uai, and memory."}, "currentWorkspaceOrgSearchBoundary": {"schemaVersion": "matm.current_workspace_org_search_boundary.v1", "status": "current_workspace_org_search_denied_waiting_for_org_scoped_credential", "currentWorkspaceOrgSearchDenied": true, "currentWorkspaceGlobalPrivateFiltered": true, "currentWorkspaceRequiresOrgMemorySearch": true, "normalWorkspaceTokenCanCloseAuthorityGate": false, "workspaceCredentialCanClaimOrgWidePrivateSearch": false, "safeToClaimOrgWidePrivateSearch": false, "liveOrgWidePrivateSearchVerified": false, "evidencePath": "reports/mcp-org-memory-live-probe-v1.json", "requiredFutureStatus": "org_wide_private_search_verified", "requiredFutureCredentialEnv": "NEURALWIKIS_ORG_MCP_TOKEN", "meaning": "The current workspace credential is correctly bounded: it can support same-workspace project memory when authorized, but it is denied org-wide/cross-project private search and cannot close the final MATM authority gate.", "safeNextAction": "Continue same-workspace project memory work with the current credential. Use an organization-scoped credential from an approved secret channel for the separate org-wide private-search receipt."}, "ordinaryProjectWorkBlocked": false, "deploymentBlocked": false, "freeAgentSetupBlocked": false, "projectPrivateMemoryBlocked": false, "promptLibraryBlocked": false, "finalCompletionWaitingForEvidence": true, "externalAuthorityClosureWorkflow": {"schemaVersion": "matm.external_authority_closure_workflow_guidance.v1", "purpose": "Close only the final full-goal authority evidence gate after separate org, reviewer, and retention-capable credentials are provided through an approved secret channel.", "notDeploymentBlocker": true, "notOrdinaryWorkBlocker": true, "goalExecutionBlocked": false, "agentMayContinue": true, "ordinaryAgentWorkMayContinue": true, "humanReadableStatus": "waiting_for_external_authority_evidence", "preferredHumanStatus": "waiting_for_external_authority_evidence", "displayStatus": "waiting_for_external_authority_evidence", "uiDisplayRule": "Display humanReadableStatus/displayStatus. Do not display this workflow as blocked when goalExecutionBlocked=false and agentMayContinue=true; display it as waiting for external authority evidence.", "blockerTerminology": {"schemaVersion": "matm.blocker_terminology.v1", "displayStatus": "waiting_for_external_authority_evidence", "preferredStatusFields": ["humanReadableStatus", "displayStatus", "preferredHumanStatus"], "preferredCountFields": ["completionEvidenceGateCount", "remainingEvidenceGateCount"], "executionBlockFields": ["blockingKeys", "executionBlockingKeys"], "legacyCompatibilityFields": ["legacyBlockingKeys"], "legacyFieldInterpretation": "Top-level blockingKeys is execution-only. Final authority evidence keys are exposed as completionEvidenceGateKeys, remainingEvidenceGates, and legacyBlockingKeys. They are not operational blocks on ordinary workspace work, deployment, free-agent setup, project-private memory, or prompt-library use.", "blockedWordMeaning": "authority_completion_evidence_gate_only", "uiDisplayRule": "Display humanReadableStatus/displayStatus. Do not display this workflow as blocked when goalExecutionBlocked=false and agentMayContinue=true; display it as waiting for external authority evidence."}, "completionEvidenceGateCount": 1, "remainingEvidenceGateCount": 1, "completionEvidenceGateKeys": ["mcp_full_lifecycle_authority_proofs_admitted"], "executionBlockingKeys": [], "blockingKeys": [], "legacyBlockingKeys": ["mcp_full_lifecycle_authority_proofs_admitted"], "remainingEvidenceGates": ["mcp_full_lifecycle_authority_proofs_admitted"], "externalAuthorityReceiptCollection": {"schemaVersion": "matm.external_authority_receipt_collection_contract.v1", "status": "waiting_for_external_authority_receipts", "humanReadableStatus": "waiting_for_external_authority_evidence", "plainLanguageLabel": "External authority receipts still required", "plainLanguageSummary": "external authority receipts are still required for the final gate; ordinary same-workspace memory, free-agent setup, deployment, project crawl/search, and NeuroWikis prompt copying are not stopped.", "currentCompletionEvidenceGateKey": "mcp_full_lifecycle_authority_proofs_admitted", "currentCompletionEvidenceGateCount": 1, "currentSafeCollectorRefresh": {"report": "reports/mcp-archive-repair-external-authority-receipts-v1.json", "status": "waiting_for_reviewer_retention_authority_receipts", "passed": false, "liveExecutionRequested": false, "callsProduction": false, "writesRemoteMemory": false, "retiresLocalUai": false, "tokenPrinted": false, "targetIdsStored": false, "retentionTokenAvailable": false, "reviewerTokenAvailable": false}, "currentExternalProofReadiness": {"closurePacket": "reports/matm-remaining-blocker-closure-packet-v1.json", "status": "ready_for_external_authority_proofs", "readyForExternalProofExecution": true, "packetBlockers": [], "meaning": "The no-mutation handoff, templates, NeuroWikis operator files, and command sequence are current. External org/reviewer/retention credentials and receipts are still required before admission and final goal completion."}, "currentAuthorityClosureWorkflow": {"report": "reports/mcp-authority-closure-workflow-v1.json", "status": "waiting_for_external_authority_inputs", "readyForOperatorExecution": true, "readyForGoalComplete": false}, "authorityReceiptClosureToolchain": {"schema_version": "neuralwikis.authority_receipt_closure_toolchain.v1", "publicSafe": true, "valuesRedacted": true, "rawTokensIncluded": false, "rawPrivatePayloadsIncluded": false, "rawIdempotencyKeysIncluded": false, "status": "waiting_for_verified_external_authority_reports", "plainLanguageLabel": "Authority receipt closure toolchain", "plainLanguageSummary": "The local no-secret toolchain for final authority proof intake is ready, but verified org, reviewer, and retention receipts are still required before a receipt bundle can be written, admitted, or used for goal completion.", "readyForExternalAuthorityProofIntake": true, "readyForReceiptBundleWrite": false, "readyForReceiptAdmission": false, "readyForLifecycleRefresh": false, "readyForGoalComplete": false, "localScripts": {"intakePreflight": "scripts/build_mcp_authority_proof_intake_preflight.py", "orgMemoryLiveProbe": "scripts/probe_mcp_org_memory_live.py", "archiveRepairExternalReceipts": "scripts/collect_mcp_archive_repair_external_authority_receipts.py", "receiptBundleBuilder": "scripts/build_mcp_authority_external_receipt_bundle.py", "proofAdmission": "scripts/build_mcp_authority_proof_admission.py", "closureWorkflow": "scripts/run_mcp_authority_closure_workflow.py"}, "defaultCommands": {"intakePreflight": "python scripts\\build_mcp_authority_proof_intake_preflight.py --write-defaults --check --require-ready", "orgMemoryLiveProbe": "Set NEURALWIKIS_ORG_MCP_TOKEN outside this report, then run python scripts\\probe_mcp_org_memory_live.py --execute-live --confirm RUN-LIVE-ORG-MEMORY-PROBE --check", "archiveRepairExternalReceipts": "Set NEURALWIKIS_RETENTION_MCP_TOKEN and NEURALWIKIS_REVIEWER_MCP_TOKEN outside this report, fill a private uncommitted safe-target config, then run python scripts\\collect_mcp_archive_repair_external_authority_receipts.py --target-config-json <private-safe-target-config.json> --execute-live --confirm RUN-LIVE-ARCHIVE-REPAIR-AUTHORITY-RECEIPTS --check --require-verified", "receiptBundleBuilder": "python scripts\\build_mcp_authority_external_receipt_bundle.py --write-defaults --write-receipt-bundle --check --require-ready", "proofAdmission": "python scripts\\build_mcp_authority_proof_admission.py --write-defaults --check --require-admitted", "closureWorkflow": "python scripts\\run_mcp_authority_closure_workflow.py --write-defaults --check"}, "latestReports": {"intakePreflight": "reports/mcp-authority-proof-intake-preflight-v1.json", "orgAuthorityReadiness": "reports/mcp-org-memory-authority-readiness-v1.json", "archiveRepairExternalReceipts": "reports/mcp-archive-repair-external-authority-receipts-v1.json", "receiptBundleBuilder": "reports/mcp-authority-external-receipt-bundle-builder-v1.json", "receiptBundle": "reports/mcp-authority-external-proof-receipts-v1.json", "proofAdmission": "reports/mcp-authority-proof-admission-v1.json", "closureWorkflow": "reports/mcp-authority-closure-workflow-v1.json", "lifecycleCoverage": "reports/mcp-memory-lifecycle-e2e-coverage-v1.json", "fullGoalAudit": "reports/matm-full-goal-completion-audit-v2.8.1.json"}, "latestStatuses": {"intakePreflight": "ready_for_external_authority_proof_intake", "orgAuthorityReadiness": "waiting_for_org_scoped_memory_credential", "archiveRepairExternalReceipts": "waiting_for_reviewer_retention_authority_receipts", "receiptBundleBuilder": "waiting_for_verified_external_authority_reports", "proofAdmission": "collect_org_memory_and_archive_repair_external_receipts", "closureWorkflow": "waiting_for_external_authority_inputs"}, "requiredExternalAuthorityReceipts": ["org_scoped_private_memory_search", "reviewer_authority_receipt", "retention_archive_repair_receipt", "authority_receipt_bundle_admission"], "requiredSecretEnvVars": ["NEURALWIKIS_ORG_MCP_TOKEN", "NEURALWIKIS_REVIEWER_MCP_TOKEN", "NEURALWIKIS_RETENTION_MCP_TOKEN"], "requiredPrivateInputs": ["private uncommitted safe-target config", "safe non-active archive target identifiers kept outside reports and memory", "safe non-active repair target identifiers kept outside reports and memory", "operator attestations recorded only as redacted evidence references"], "currentBlockers": ["org authority report is not verified for org-wide private search", "archive/repair external authority receipt report is missing or incomplete", "external authority receipt bundle is not present", "authority receipt bundle is not admitted"], "truthBoundary": {"doesNotRunLiveWorker": true, "doesNotExecuteOrgWideSearchWithoutOrgToken": true, "doesNotAttemptArchiveOrRepairWithoutReviewerRetentionTokens": true, "doesNotWriteReceiptBundleWithoutVerifiedInputs": true, "doesNotAdmitAuthorityReceipts": true, "doesNotRetireLocalUai": true, "doesNotMarkGoalComplete": true, "ordinaryAgentWorkMayContinue": true, "readyForGoalComplete": false}}, "requiredExternalAuthorityReceipts": ["org_scoped_private_memory_search", "reviewer_authority_receipt", "retention_archive_repair_receipt", "authority_receipt_bundle_admission"], "requiredSecretEnvVars": ["NEURALWIKIS_ORG_MCP_TOKEN", "NEURALWIKIS_REVIEWER_MCP_TOKEN", "NEURALWIKIS_RETENTION_MCP_TOKEN"], "requiredNonSecretInputs": ["reports/mcp-archive-repair-safe-target-config-template-v1.json", "private uncommitted <private-safe-target-config.json>", "safe non-active archive target id and state stored only in the private config", "safe non-active repair target id and state stored only in the private config", "operator safe-target attestations stored without raw ids in reports"], "safeCommandSequence": ["python scripts\\probe_mcp_org_memory_live.py --execute-live --confirm RUN-LIVE-ORG-MEMORY-PROBE --check", "python scripts\\collect_mcp_archive_repair_external_authority_receipts.py --write-target-config-template --target-config-template-out reports\\mcp-archive-repair-safe-target-config-template-v1.json --check", "copy reports\\mcp-archive-repair-safe-target-config-template-v1.json <private-safe-target-config.json>", "python scripts\\collect_mcp_archive_repair_external_authority_receipts.py --target-config-json <private-safe-target-config.json> --execute-live --confirm RUN-LIVE-ARCHIVE-REPAIR-AUTHORITY-RECEIPTS --check --require-verified", "python scripts\\build_mcp_authority_external_receipt_bundle.py --write-defaults --write-receipt-bundle --check --require-ready", "python scripts\\build_mcp_authority_proof_admission.py --write-defaults --check --require-admitted", "python scripts\\build_mcp_memory_lifecycle_e2e_coverage.py --write-defaults", "python scripts\\build_uai_cutover_apply_preflight.py --require-safe-waiting", "python scripts\\build_matm_remaining_blocker_closure_packet.py --write-defaults --check", "python scripts\\build_matm_full_goal_completion_audit.py --write-defaults --check"], "notEvidenceForThisGate": ["FTP credentials", "FTPS credentials", "FRP credentials", "package publish credentials", "normal workspace MCP token", "workspace.uai reconnect context", "review-pending authority request without admitted receipts"], "notBlockedSubjects": ["deployment", "free_agent_setup", "same_workspace_project_private_memory", "project_crawl_search", "NeuroWikis_prompt_library", "ordinary_agent_work"], "rawSecretPolicy": {"printRawTokens": false, "storeRawTokensInReports": false, "storeRawTokensInMemory": false, "pasteRawTokensIntoChat": false, "storePrivateSafeTargetConfigInMemory": false, "printRawTargetIds": false}, "safeFallbackAction": "If any required authority token, private safe-target config, or receipt is missing, report waiting_for_external_authority_evidence, keep ordinary same-workspace work active when goalExecutionBlocked=false, and do not claim final completion."}, "externalAuthorityReceiptsStillRequired": true, "externalAuthorityReceiptsPlainLanguage": "The current completion gate mcp_full_lifecycle_authority_proofs_admitted requires redacted external authority receipts; it is not an execution blocker for deployment, free-agent setup, same-workspace memory, project crawl/search, or prompt-library use.", "closureStepEvidenceGateCount": 6, "remainingClosureStepCount": 6, "closureStepEvidenceGates": ["org-wide private search has not been verified with org authority", "archive/repair authority receipts have not been verified with reviewer and retention authority", "verified org and archive/repair reports are required before receipt-bundle admission", "authority receipt bundle is not admitted", "lifecycle coverage still records authority gaps", "full goal audit still has authority evidence keys"], "closureStepEvidenceRequirements": ["org-wide private search has not been verified with org authority", "archive/repair authority receipts have not been verified with reviewer and retention authority", "verified org and archive/repair reports are required before receipt-bundle admission", "authority receipt bundle is not admitted", "lifecycle coverage still records authority gaps", "full goal audit still has authority evidence keys"], "blockedWordInterpretation": "The remaining key is a final completion evidence gate. It is not an operational block on ordinary workspace work, deployment, free-agent setup, project-private memory, or prompt-library use.", "operatorWorkspaceRequired": true, "workspaceUaiCredentialBoundary": {"schemaVersion": "matm.workspace_uai_credential_boundary.v1", "rootWorkspaceUaiPath": "E:\\workspace.uai", "workspaceUaiRole": "short_term_operational_and_reconnect_memory", "neuralWikisMatmRole": "durable_mid_long_term_searchable_memory", "workspaceUaiIsAuthorityCredentialStore": false, "workspaceUaiIsDeploymentCredentialStore": false, "rawAuthorityTokensAllowedInWorkspaceUai": false, "rawAuthorityTokensAllowedInReportsOrMemory": false, "doNotInferAuthorityFromWorkspaceUai": true, "deploymentCredentialBoundary": {"schemaVersion": "matm.deployment_vs_authority_credential_boundary.v1", "deploymentCredentialFilePath": "E:\\ftp_Deploy.txt", "deploymentCredentialCanDeploySites": true, "deploymentCredentialCanCloseMatmAuthorityGate": false, "deploymentCredentialValuesAllowedInReportsOrMemory": false, "authorityCredentialRequiredEnvVars": ["NEURALWIKIS_ORG_MCP_TOKEN", "NEURALWIKIS_REVIEWER_MCP_TOKEN", "NEURALWIKIS_RETENTION_MCP_TOKEN"], "interpretation": "Deployment credentials and external MATM authority credentials are separate. A deploy-capable workspace can still be waiting for org-wide private search, reviewer, and retention authority receipts."}, "requiredAuthorityCredentialChannel": "approved_secret_channel_or_reviewed_operator_provisioning", "requiredExternalAuthorityEnvVars": ["NEURALWIKIS_ORG_MCP_TOKEN", "NEURALWIKIS_REVIEWER_MCP_TOKEN", "NEURALWIKIS_RETENTION_MCP_TOKEN"], "safeAgentInstruction": "Consult workspace.uai for short-term operational and reconnect context, but do not assume it contains org, reviewer, retention, billing, archive/repair authority credentials, or deployment passwords. Deployment credential availability is separate from MATM authority proof. Use the current credential scope, submit review-pending authority requests when needed, and keep raw tokens out of prompts, reports, workspace.uai, and memory."}, "currentWorkspaceOrgSearchBoundary": {"schemaVersion": "matm.current_workspace_org_search_boundary.v1", "status": "current_workspace_org_search_denied_waiting_for_org_scoped_credential", "currentWorkspaceOrgSearchDenied": true, "currentWorkspaceGlobalPrivateFiltered": true, "currentWorkspaceRequiresOrgMemorySearch": true, "normalWorkspaceTokenCanCloseAuthorityGate": false, "workspaceCredentialCanClaimOrgWidePrivateSearch": false, "safeToClaimOrgWidePrivateSearch": false, "liveOrgWidePrivateSearchVerified": false, "evidencePath": "reports/mcp-org-memory-live-probe-v1.json", "requiredFutureStatus": "org_wide_private_search_verified", "requiredFutureCredentialEnv": "NEURALWIKIS_ORG_MCP_TOKEN", "meaning": "The current workspace credential is correctly bounded: it can support same-workspace project memory when authorized, but it is denied org-wide/cross-project private search and cannot close the final MATM authority gate.", "safeNextAction": "Continue same-workspace project memory work with the current credential. Use an organization-scoped credential from an approved secret channel for the separate org-wide private-search receipt."}, "rawSecretsAllowedInReports": false, "rawSecretsAllowedInChat": false, "rawSecretsAllowedInMemory": false, "requiredSecretEnvVars": [{"name": "NEURALWIKIS_ORG_MCP_TOKEN", "requiredAuthority": ["org:memory:search", "global:memory:read", "cross_project:memory:search"], "purpose": "Run the org-wide private memory search receipt probe."}, {"name": "NEURALWIKIS_REVIEWER_MCP_TOKEN", "requiredAuthority": ["reviewer"], "purpose": "Prove reviewer-gated archive/repair lifecycle receipts."}, {"name": "NEURALWIKIS_RETENTION_MCP_TOKEN", "requiredAuthority": ["retention:manage"], "purpose": "Prove retention-management and archive authority receipts."}], "requiredNonSecretInputs": ["public-safe safe-target config template at reports/mcp-archive-repair-safe-target-config-template-v1.json", "private uncommitted <private-safe-target-config.json>", "safe non-active archive target id and state stored only in the private config", "safe non-active repair target id and state stored only in the private config", "operator safe-target attestations stored without raw ids in reports"], "commands": [{"step": "org_memory_live_probe", "command": "python scripts\\probe_mcp_org_memory_live.py --execute-live --confirm RUN-LIVE-ORG-MEMORY-PROBE --check", "requiresEnv": ["NEURALWIKIS_ORG_MCP_TOKEN"], "expectedReport": "reports/mcp-org-memory-live-probe-v1.json", "printsRawToken": false}, {"step": "prepare_archive_repair_safe_target_config_template", "command": "python scripts\\collect_mcp_archive_repair_external_authority_receipts.py --write-target-config-template --target-config-template-out reports\\mcp-archive-repair-safe-target-config-template-v1.json --check", "requiresEnv": [], "expectedReport": "reports/mcp-archive-repair-safe-target-config-template-v1.json", "printsRawToken": false, "printsRawTargetId": false}, {"step": "archive_repair_external_receipts", "command": "python scripts\\collect_mcp_archive_repair_external_authority_receipts.py --target-config-json <private-safe-target-config.json> --execute-live --confirm RUN-LIVE-ARCHIVE-REPAIR-AUTHORITY-RECEIPTS --check --require-verified", "requiresEnv": ["NEURALWIKIS_RETENTION_MCP_TOKEN", "NEURALWIKIS_REVIEWER_MCP_TOKEN"], "requiresSafeTargetConfigTemplate": "reports/mcp-archive-repair-safe-target-config-template-v1.json", "requiresPrivateUncommittedTargetConfig": "<private-safe-target-config.json>", "requiresSafeTargetInputs": "private_config_only", "expectedReport": "reports/mcp-archive-repair-external-authority-receipts-v1.json", "printsRawToken": false, "printsRawTargetId": false, "reportsStoreOnlyTargetHashes": true}, {"step": "build_authority_receipt_bundle", "command": "python scripts\\build_mcp_authority_external_receipt_bundle.py --write-defaults --write-receipt-bundle --check --require-ready", "requiresEnv": [], "expectedReport": "reports/mcp-authority-external-proof-receipts-v1.json", "printsRawToken": false}, {"step": "admit_authority_receipt_bundle", "command": "python scripts\\build_mcp_authority_proof_admission.py --write-defaults --check --require-admitted", "requiresEnv": [], "expectedReport": "reports/mcp-authority-proof-admission-v1.json", "printsRawToken": false}, {"step": "refresh_lifecycle_and_audit", "command": "python scripts\\build_mcp_memory_lifecycle_e2e_coverage.py --write-defaults; python scripts\\build_uai_cutover_apply_preflight.py --require-safe-waiting; python scripts\\build_matm_remaining_blocker_closure_packet.py --write-defaults --check; python scripts\\build_matm_full_goal_completion_audit.py --write-defaults --check", "requiresEnv": [], "expectedReport": "reports/matm-full-goal-completion-audit-v2.8.1.json", "printsRawToken": false}], "successCriteria": ["authority receipt bundle is admitted", "org-wide private search proof is admitted", "reviewer and retention archive/repair receipts are admitted", "full audit readyForGoalComplete is true", "full audit blockingKeys is empty", "reports are redacted and contain no raw tokens, private payloads, source bodies, idempotency keys, or hidden reasoning"], "safeFallbackAction": "If any required authority token or safe target input is missing, keep ordinary same-workspace work active, submit or update the review-pending authority request, and report waiting_for_external_authority_evidence without claiming final completion."}, "external_authority_closure_workflow": {"schemaVersion": "matm.external_authority_closure_workflow_guidance.v1", "purpose": "Close only the final full-goal authority evidence gate after separate org, reviewer, and retention-capable credentials are provided through an approved secret channel.", "notDeploymentBlocker": true, "notOrdinaryWorkBlocker": true, "goalExecutionBlocked": false, "agentMayContinue": true, "ordinaryAgentWorkMayContinue": true, "humanReadableStatus": "waiting_for_external_authority_evidence", "preferredHumanStatus": "waiting_for_external_authority_evidence", "displayStatus": "waiting_for_external_authority_evidence", "uiDisplayRule": "Display humanReadableStatus/displayStatus. Do not display this workflow as blocked when goalExecutionBlocked=false and agentMayContinue=true; display it as waiting for external authority evidence.", "blockerTerminology": {"schemaVersion": "matm.blocker_terminology.v1", "displayStatus": "waiting_for_external_authority_evidence", "preferredStatusFields": ["humanReadableStatus", "displayStatus", "preferredHumanStatus"], "preferredCountFields": ["completionEvidenceGateCount", "remainingEvidenceGateCount"], "executionBlockFields": ["blockingKeys", "executionBlockingKeys"], "legacyCompatibilityFields": ["legacyBlockingKeys"], "legacyFieldInterpretation": "Top-level blockingKeys is execution-only. Final authority evidence keys are exposed as completionEvidenceGateKeys, remainingEvidenceGates, and legacyBlockingKeys. They are not operational blocks on ordinary workspace work, deployment, free-agent setup, project-private memory, or prompt-library use.", "blockedWordMeaning": "authority_completion_evidence_gate_only", "uiDisplayRule": "Display humanReadableStatus/displayStatus. Do not display this workflow as blocked when goalExecutionBlocked=false and agentMayContinue=true; display it as waiting for external authority evidence."}, "completionEvidenceGateCount": 1, "remainingEvidenceGateCount": 1, "completionEvidenceGateKeys": ["mcp_full_lifecycle_authority_proofs_admitted"], "executionBlockingKeys": [], "blockingKeys": [], "legacyBlockingKeys": ["mcp_full_lifecycle_authority_proofs_admitted"], "remainingEvidenceGates": ["mcp_full_lifecycle_authority_proofs_admitted"], "externalAuthorityReceiptCollection": {"schemaVersion": "matm.external_authority_receipt_collection_contract.v1", "status": "waiting_for_external_authority_receipts", "humanReadableStatus": "waiting_for_external_authority_evidence", "plainLanguageLabel": "External authority receipts still required", "plainLanguageSummary": "external authority receipts are still required for the final gate; ordinary same-workspace memory, free-agent setup, deployment, project crawl/search, and NeuroWikis prompt copying are not stopped.", "currentCompletionEvidenceGateKey": "mcp_full_lifecycle_authority_proofs_admitted", "currentCompletionEvidenceGateCount": 1, "currentSafeCollectorRefresh": {"report": "reports/mcp-archive-repair-external-authority-receipts-v1.json", "status": "waiting_for_reviewer_retention_authority_receipts", "passed": false, "liveExecutionRequested": false, "callsProduction": false, "writesRemoteMemory": false, "retiresLocalUai": false, "tokenPrinted": false, "targetIdsStored": false, "retentionTokenAvailable": false, "reviewerTokenAvailable": false}, "currentExternalProofReadiness": {"closurePacket": "reports/matm-remaining-blocker-closure-packet-v1.json", "status": "ready_for_external_authority_proofs", "readyForExternalProofExecution": true, "packetBlockers": [], "meaning": "The no-mutation handoff, templates, NeuroWikis operator files, and command sequence are current. External org/reviewer/retention credentials and receipts are still required before admission and final goal completion."}, "currentAuthorityClosureWorkflow": {"report": "reports/mcp-authority-closure-workflow-v1.json", "status": "waiting_for_external_authority_inputs", "readyForOperatorExecution": true, "readyForGoalComplete": false}, "authorityReceiptClosureToolchain": {"schema_version": "neuralwikis.authority_receipt_closure_toolchain.v1", "publicSafe": true, "valuesRedacted": true, "rawTokensIncluded": false, "rawPrivatePayloadsIncluded": false, "rawIdempotencyKeysIncluded": false, "status": "waiting_for_verified_external_authority_reports", "plainLanguageLabel": "Authority receipt closure toolchain", "plainLanguageSummary": "The local no-secret toolchain for final authority proof intake is ready, but verified org, reviewer, and retention receipts are still required before a receipt bundle can be written, admitted, or used for goal completion.", "readyForExternalAuthorityProofIntake": true, "readyForReceiptBundleWrite": false, "readyForReceiptAdmission": false, "readyForLifecycleRefresh": false, "readyForGoalComplete": false, "localScripts": {"intakePreflight": "scripts/build_mcp_authority_proof_intake_preflight.py", "orgMemoryLiveProbe": "scripts/probe_mcp_org_memory_live.py", "archiveRepairExternalReceipts": "scripts/collect_mcp_archive_repair_external_authority_receipts.py", "receiptBundleBuilder": "scripts/build_mcp_authority_external_receipt_bundle.py", "proofAdmission": "scripts/build_mcp_authority_proof_admission.py", "closureWorkflow": "scripts/run_mcp_authority_closure_workflow.py"}, "defaultCommands": {"intakePreflight": "python scripts\\build_mcp_authority_proof_intake_preflight.py --write-defaults --check --require-ready", "orgMemoryLiveProbe": "Set NEURALWIKIS_ORG_MCP_TOKEN outside this report, then run python scripts\\probe_mcp_org_memory_live.py --execute-live --confirm RUN-LIVE-ORG-MEMORY-PROBE --check", "archiveRepairExternalReceipts": "Set NEURALWIKIS_RETENTION_MCP_TOKEN and NEURALWIKIS_REVIEWER_MCP_TOKEN outside this report, fill a private uncommitted safe-target config, then run python scripts\\collect_mcp_archive_repair_external_authority_receipts.py --target-config-json <private-safe-target-config.json> --execute-live --confirm RUN-LIVE-ARCHIVE-REPAIR-AUTHORITY-RECEIPTS --check --require-verified", "receiptBundleBuilder": "python scripts\\build_mcp_authority_external_receipt_bundle.py --write-defaults --write-receipt-bundle --check --require-ready", "proofAdmission": "python scripts\\build_mcp_authority_proof_admission.py --write-defaults --check --require-admitted", "closureWorkflow": "python scripts\\run_mcp_authority_closure_workflow.py --write-defaults --check"}, "latestReports": {"intakePreflight": "reports/mcp-authority-proof-intake-preflight-v1.json", "orgAuthorityReadiness": "reports/mcp-org-memory-authority-readiness-v1.json", "archiveRepairExternalReceipts": "reports/mcp-archive-repair-external-authority-receipts-v1.json", "receiptBundleBuilder": "reports/mcp-authority-external-receipt-bundle-builder-v1.json", "receiptBundle": "reports/mcp-authority-external-proof-receipts-v1.json", "proofAdmission": "reports/mcp-authority-proof-admission-v1.json", "closureWorkflow": "reports/mcp-authority-closure-workflow-v1.json", "lifecycleCoverage": "reports/mcp-memory-lifecycle-e2e-coverage-v1.json", "fullGoalAudit": "reports/matm-full-goal-completion-audit-v2.8.1.json"}, "latestStatuses": {"intakePreflight": "ready_for_external_authority_proof_intake", "orgAuthorityReadiness": "waiting_for_org_scoped_memory_credential", "archiveRepairExternalReceipts": "waiting_for_reviewer_retention_authority_receipts", "receiptBundleBuilder": "waiting_for_verified_external_authority_reports", "proofAdmission": "collect_org_memory_and_archive_repair_external_receipts", "closureWorkflow": "waiting_for_external_authority_inputs"}, "requiredExternalAuthorityReceipts": ["org_scoped_private_memory_search", "reviewer_authority_receipt", "retention_archive_repair_receipt", "authority_receipt_bundle_admission"], "requiredSecretEnvVars": ["NEURALWIKIS_ORG_MCP_TOKEN", "NEURALWIKIS_REVIEWER_MCP_TOKEN", "NEURALWIKIS_RETENTION_MCP_TOKEN"], "requiredPrivateInputs": ["private uncommitted safe-target config", "safe non-active archive target identifiers kept outside reports and memory", "safe non-active repair target identifiers kept outside reports and memory", "operator attestations recorded only as redacted evidence references"], "currentBlockers": ["org authority report is not verified for org-wide private search", "archive/repair external authority receipt report is missing or incomplete", "external authority receipt bundle is not present", "authority receipt bundle is not admitted"], "truthBoundary": {"doesNotRunLiveWorker": true, "doesNotExecuteOrgWideSearchWithoutOrgToken": true, "doesNotAttemptArchiveOrRepairWithoutReviewerRetentionTokens": true, "doesNotWriteReceiptBundleWithoutVerifiedInputs": true, "doesNotAdmitAuthorityReceipts": true, "doesNotRetireLocalUai": true, "doesNotMarkGoalComplete": true, "ordinaryAgentWorkMayContinue": true, "readyForGoalComplete": false}}, "requiredExternalAuthorityReceipts": ["org_scoped_private_memory_search", "reviewer_authority_receipt", "retention_archive_repair_receipt", "authority_receipt_bundle_admission"], "requiredSecretEnvVars": ["NEURALWIKIS_ORG_MCP_TOKEN", "NEURALWIKIS_REVIEWER_MCP_TOKEN", "NEURALWIKIS_RETENTION_MCP_TOKEN"], "requiredNonSecretInputs": ["reports/mcp-archive-repair-safe-target-config-template-v1.json", "private uncommitted <private-safe-target-config.json>", "safe non-active archive target id and state stored only in the private config", "safe non-active repair target id and state stored only in the private config", "operator safe-target attestations stored without raw ids in reports"], "safeCommandSequence": ["python scripts\\probe_mcp_org_memory_live.py --execute-live --confirm RUN-LIVE-ORG-MEMORY-PROBE --check", "python scripts\\collect_mcp_archive_repair_external_authority_receipts.py --write-target-config-template --target-config-template-out reports\\mcp-archive-repair-safe-target-config-template-v1.json --check", "copy reports\\mcp-archive-repair-safe-target-config-template-v1.json <private-safe-target-config.json>", "python scripts\\collect_mcp_archive_repair_external_authority_receipts.py --target-config-json <private-safe-target-config.json> --execute-live --confirm RUN-LIVE-ARCHIVE-REPAIR-AUTHORITY-RECEIPTS --check --require-verified", "python scripts\\build_mcp_authority_external_receipt_bundle.py --write-defaults --write-receipt-bundle --check --require-ready", "python scripts\\build_mcp_authority_proof_admission.py --write-defaults --check --require-admitted", "python scripts\\build_mcp_memory_lifecycle_e2e_coverage.py --write-defaults", "python scripts\\build_uai_cutover_apply_preflight.py --require-safe-waiting", "python scripts\\build_matm_remaining_blocker_closure_packet.py --write-defaults --check", "python scripts\\build_matm_full_goal_completion_audit.py --write-defaults --check"], "notEvidenceForThisGate": ["FTP credentials", "FTPS credentials", "FRP credentials", "package publish credentials", "normal workspace MCP token", "workspace.uai reconnect context", "review-pending authority request without admitted receipts"], "notBlockedSubjects": ["deployment", "free_agent_setup", "same_workspace_project_private_memory", "project_crawl_search", "NeuroWikis_prompt_library", "ordinary_agent_work"], "rawSecretPolicy": {"printRawTokens": false, "storeRawTokensInReports": false, "storeRawTokensInMemory": false, "pasteRawTokensIntoChat": false, "storePrivateSafeTargetConfigInMemory": false, "printRawTargetIds": false}, "safeFallbackAction": "If any required authority token, private safe-target config, or receipt is missing, report waiting_for_external_authority_evidence, keep ordinary same-workspace work active when goalExecutionBlocked=false, and do not claim final completion."}, "externalAuthorityReceiptsStillRequired": true, "externalAuthorityReceiptsPlainLanguage": "The current completion gate mcp_full_lifecycle_authority_proofs_admitted requires redacted external authority receipts; it is not an execution blocker for deployment, free-agent setup, same-workspace memory, project crawl/search, or prompt-library use.", "closureStepEvidenceGateCount": 6, "remainingClosureStepCount": 6, "closureStepEvidenceGates": ["org-wide private search has not been verified with org authority", "archive/repair authority receipts have not been verified with reviewer and retention authority", "verified org and archive/repair reports are required before receipt-bundle admission", "authority receipt bundle is not admitted", "lifecycle coverage still records authority gaps", "full goal audit still has authority evidence keys"], "closureStepEvidenceRequirements": ["org-wide private search has not been verified with org authority", "archive/repair authority receipts have not been verified with reviewer and retention authority", "verified org and archive/repair reports are required before receipt-bundle admission", "authority receipt bundle is not admitted", "lifecycle coverage still records authority gaps", "full goal audit still has authority evidence keys"], "blockedWordInterpretation": "The remaining key is a final completion evidence gate. It is not an operational block on ordinary workspace work, deployment, free-agent setup, project-private memory, or prompt-library use.", "operatorWorkspaceRequired": true, "workspaceUaiCredentialBoundary": {"schemaVersion": "matm.workspace_uai_credential_boundary.v1", "rootWorkspaceUaiPath": "E:\\workspace.uai", "workspaceUaiRole": "short_term_operational_and_reconnect_memory", "neuralWikisMatmRole": "durable_mid_long_term_searchable_memory", "workspaceUaiIsAuthorityCredentialStore": false, "workspaceUaiIsDeploymentCredentialStore": false, "rawAuthorityTokensAllowedInWorkspaceUai": false, "rawAuthorityTokensAllowedInReportsOrMemory": false, "doNotInferAuthorityFromWorkspaceUai": true, "deploymentCredentialBoundary": {"schemaVersion": "matm.deployment_vs_authority_credential_boundary.v1", "deploymentCredentialFilePath": "E:\\ftp_Deploy.txt", "deploymentCredentialCanDeploySites": true, "deploymentCredentialCanCloseMatmAuthorityGate": false, "deploymentCredentialValuesAllowedInReportsOrMemory": false, "authorityCredentialRequiredEnvVars": ["NEURALWIKIS_ORG_MCP_TOKEN", "NEURALWIKIS_REVIEWER_MCP_TOKEN", "NEURALWIKIS_RETENTION_MCP_TOKEN"], "interpretation": "Deployment credentials and external MATM authority credentials are separate. A deploy-capable workspace can still be waiting for org-wide private search, reviewer, and retention authority receipts."}, "requiredAuthorityCredentialChannel": "approved_secret_channel_or_reviewed_operator_provisioning", "requiredExternalAuthorityEnvVars": ["NEURALWIKIS_ORG_MCP_TOKEN", "NEURALWIKIS_REVIEWER_MCP_TOKEN", "NEURALWIKIS_RETENTION_MCP_TOKEN"], "safeAgentInstruction": "Consult workspace.uai for short-term operational and reconnect context, but do not assume it contains org, reviewer, retention, billing, archive/repair authority credentials, or deployment passwords. Deployment credential availability is separate from MATM authority proof. Use the current credential scope, submit review-pending authority requests when needed, and keep raw tokens out of prompts, reports, workspace.uai, and memory."}, "currentWorkspaceOrgSearchBoundary": {"schemaVersion": "matm.current_workspace_org_search_boundary.v1", "status": "current_workspace_org_search_denied_waiting_for_org_scoped_credential", "currentWorkspaceOrgSearchDenied": true, "currentWorkspaceGlobalPrivateFiltered": true, "currentWorkspaceRequiresOrgMemorySearch": true, "normalWorkspaceTokenCanCloseAuthorityGate": false, "workspaceCredentialCanClaimOrgWidePrivateSearch": false, "safeToClaimOrgWidePrivateSearch": false, "liveOrgWidePrivateSearchVerified": false, "evidencePath": "reports/mcp-org-memory-live-probe-v1.json", "requiredFutureStatus": "org_wide_private_search_verified", "requiredFutureCredentialEnv": "NEURALWIKIS_ORG_MCP_TOKEN", "meaning": "The current workspace credential is correctly bounded: it can support same-workspace project memory when authorized, but it is denied org-wide/cross-project private search and cannot close the final MATM authority gate.", "safeNextAction": "Continue same-workspace project memory work with the current credential. Use an organization-scoped credential from an approved secret channel for the separate org-wide private-search receipt."}, "rawSecretsAllowedInReports": false, "rawSecretsAllowedInChat": false, "rawSecretsAllowedInMemory": false, "requiredSecretEnvVars": [{"name": "NEURALWIKIS_ORG_MCP_TOKEN", "requiredAuthority": ["org:memory:search", "global:memory:read", "cross_project:memory:search"], "purpose": "Run the org-wide private memory search receipt probe."}, {"name": "NEURALWIKIS_REVIEWER_MCP_TOKEN", "requiredAuthority": ["reviewer"], "purpose": "Prove reviewer-gated archive/repair lifecycle receipts."}, {"name": "NEURALWIKIS_RETENTION_MCP_TOKEN", "requiredAuthority": ["retention:manage"], "purpose": "Prove retention-management and archive authority receipts."}], "requiredNonSecretInputs": ["public-safe safe-target config template at reports/mcp-archive-repair-safe-target-config-template-v1.json", "private uncommitted <private-safe-target-config.json>", "safe non-active archive target id and state stored only in the private config", "safe non-active repair target id and state stored only in the private config", "operator safe-target attestations stored without raw ids in reports"], "commands": [{"step": "org_memory_live_probe", "command": "python scripts\\probe_mcp_org_memory_live.py --execute-live --confirm RUN-LIVE-ORG-MEMORY-PROBE --check", "requiresEnv": ["NEURALWIKIS_ORG_MCP_TOKEN"], "expectedReport": "reports/mcp-org-memory-live-probe-v1.json", "printsRawToken": false}, {"step": "prepare_archive_repair_safe_target_config_template", "command": "python scripts\\collect_mcp_archive_repair_external_authority_receipts.py --write-target-config-template --target-config-template-out reports\\mcp-archive-repair-safe-target-config-template-v1.json --check", "requiresEnv": [], "expectedReport": "reports/mcp-archive-repair-safe-target-config-template-v1.json", "printsRawToken": false, "printsRawTargetId": false}, {"step": "archive_repair_external_receipts", "command": "python scripts\\collect_mcp_archive_repair_external_authority_receipts.py --target-config-json <private-safe-target-config.json> --execute-live --confirm RUN-LIVE-ARCHIVE-REPAIR-AUTHORITY-RECEIPTS --check --require-verified", "requiresEnv": ["NEURALWIKIS_RETENTION_MCP_TOKEN", "NEURALWIKIS_REVIEWER_MCP_TOKEN"], "requiresSafeTargetConfigTemplate": "reports/mcp-archive-repair-safe-target-config-template-v1.json", "requiresPrivateUncommittedTargetConfig": "<private-safe-target-config.json>", "requiresSafeTargetInputs": "private_config_only", "expectedReport": "reports/mcp-archive-repair-external-authority-receipts-v1.json", "printsRawToken": false, "printsRawTargetId": false, "reportsStoreOnlyTargetHashes": true}, {"step": "build_authority_receipt_bundle", "command": "python scripts\\build_mcp_authority_external_receipt_bundle.py --write-defaults --write-receipt-bundle --check --require-ready", "requiresEnv": [], "expectedReport": "reports/mcp-authority-external-proof-receipts-v1.json", "printsRawToken": false}, {"step": "admit_authority_receipt_bundle", "command": "python scripts\\build_mcp_authority_proof_admission.py --write-defaults --check --require-admitted", "requiresEnv": [], "expectedReport": "reports/mcp-authority-proof-admission-v1.json", "printsRawToken": false}, {"step": "refresh_lifecycle_and_audit", "command": "python scripts\\build_mcp_memory_lifecycle_e2e_coverage.py --write-defaults; python scripts\\build_uai_cutover_apply_preflight.py --require-safe-waiting; python scripts\\build_matm_remaining_blocker_closure_packet.py --write-defaults --check; python scripts\\build_matm_full_goal_completion_audit.py --write-defaults --check", "requiresEnv": [], "expectedReport": "reports/matm-full-goal-completion-audit-v2.8.1.json", "printsRawToken": false}], "successCriteria": ["authority receipt bundle is admitted", "org-wide private search proof is admitted", "reviewer and retention archive/repair receipts are admitted", "full audit readyForGoalComplete is true", "full audit blockingKeys is empty", "reports are redacted and contain no raw tokens, private payloads, source bodies, idempotency keys, or hidden reasoning"], "safeFallbackAction": "If any required authority token or safe target input is missing, keep ordinary same-workspace work active, submit or update the review-pending authority request, and report waiting_for_external_authority_evidence without claiming final completion."}, "storageWarningPolicy": {"thresholdsPercentRemaining": [25, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0], "warnAtOrBelowPercentRemaining": 25, "criticalAtOrBelowPercentRemaining": 10, "everyPercentFromTenDown": true, "everyPercentFromNineDownThroughZero": true, "requiredAgentActions": ["inform_human", "streamline_memory", "deduplicate_or_summarize_sources", "avoid_redundant_ingest"], "instructions": ["At 25% remaining, inform the human that workspace storage is running low.", "At 10% remaining, inform the human again and treat storage pressure as critical.", "From 9% down through 0%, warn on every remaining-percent threshold.", "Before large or redundant ingest, streamline memory by summarizing, deduplicating, archiving, deleting obsolete material through approved retention paths, or upgrading the workspace."]}, "matm422RepairDiagnostics": {"statusCode": 422, "meaning": "repairable schema or Memory Firewall diagnostic, not proof that memory is unavailable", "fieldsToInspect": ["issues[].code", "issues[].path", "safeFallbackAction", "memoryFirewall.failed_stage", "memoryFirewall.retry_from_stage"], "retryRule": "Retry with corrected public-safe content and a fresh Idempotency-Key when the request body changes.", "rawPayloadRequiredForDebugging": false, "rawResponseRequiredForDebugging": false}, "humanNotificationInstruction": "When storage warning thresholds are active, inform the human and streamline memory before continuing large or redundant ingestion.", "safeFallbackAction": "If the requested authority is missing, submit a configuration request and continue only with currently authorized same-workspace reads/writes until a reviewer, owner, operator, or verified billing event activates the missing capability."}, "errors": [], "requestId": "00a5a604-ae67-437e-a1e8-23ecc07f29cc"}