bump: v0.8.6

Hotfix: DDG web search returning empty results.

- Switch dependency from duckduckgo-search (deprecated shim, empty
  results) to ddgs>=9.0 (actively maintained successor)
- Include ddg extra in Docker image for free web search fallback
- Update all user-facing install instructions to reference ddgs

.github/renovate.json

@@ -0,0 +1,208 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended",
+    "helpers:pinGitHubActionDigests",
+    ":separateMajorReleases"
+  ],
+  "labels": [
+    "dependencies"
+  ],
+  "prConcurrentLimit": 5,
+  "prHourlyLimit": 2,
+  "schedule": [
+    "before 9am on Monday"
+  ],
+  "timezone": "America/New_York",
+  "lockFileMaintenance": {
+    "enabled": true,
+    "schedule": [
+      "before 9am on Monday"
+    ]
+  },
+  "customManagers": [
+    {
+      "customType": "regex",
+      "description": "Track vendored KaTeX version",
+      "managerFilePatterns": [
+        "/pyproject\\.toml$/"
+      ],
+      "matchStrings": [
+        "katex-(?<currentValue>[\\d.]+)/"
+      ],
+      "depNameTemplate": "katex",
+      "datasourceTemplate": "npm"
+    },
+    {
+      "customType": "regex",
+      "description": "Track vendored Highlight.js version",
+      "managerFilePatterns": [
+        "/pyproject\\.toml$/"
+      ],
+      "matchStrings": [
+        "hljs-(?<currentValue>[\\d.]+)/"
+      ],
+      "depNameTemplate": "highlight.js",
+      "datasourceTemplate": "npm"
+    },
+    {
+      "customType": "regex",
+      "description": "Track vendored Mermaid version",
+      "managerFilePatterns": [
+        "/pyproject\\.toml$/"
+      ],
+      "matchStrings": [
+        "mermaid-(?<currentValue>[\\d.]+)/"
+      ],
+      "depNameTemplate": "mermaid",
+      "datasourceTemplate": "npm"
+    }
+  ],
+  "packageRules": [
+    {
+      "description": "LLM SDKs — always review manually",
+      "groupName": "LLM SDKs",
+      "matchPackageNames": [
+        "openai",
+        "anthropic",
+        "mcp"
+      ],
+      "schedule": [
+        "before 9am on Monday"
+      ],
+      "automerge": false
+    },
+    {
+      "description": "Web framework stack",
+      "groupName": "Web Framework",
+      "matchPackageNames": [
+        "starlette",
+        "uvicorn",
+        "sse-starlette",
+        "httpx",
+        "httpx-sse",
+        "pydantic"
+      ],
+      "schedule": [
+        "before 9am on Wednesday"
+      ],
+      "automerge": true,
+      "matchUpdateTypes": [
+        "patch"
+      ]
+    },
+    {
+      "description": "Database layer",
+      "groupName": "Database",
+      "matchPackageNames": [
+        "sqlalchemy",
+        "alembic",
+        "psycopg"
+      ],
+      "schedule": [
+        "before 9am on Wednesday"
+      ],
+      "automerge": true,
+      "matchUpdateTypes": [
+        "patch"
+      ]
+    },
+    {
+      "description": "Security-critical — always review manually",
+      "groupName": "Security",
+      "matchPackageNames": [
+        "PyJWT",
+        "pyjwt",
+        "bcrypt"
+      ],
+      "automerge": false
+    },
+    {
+      "description": "Infrastructure dependencies",
+      "groupName": "Infrastructure",
+      "matchPackageNames": [
+        "structlog",
+        "redis",
+        "croniter",
+        "discord.py"
+      ],
+      "schedule": [
+        "before 9am on the first day of the month"
+      ],
+      "automerge": true,
+      "matchUpdateTypes": [
+        "patch"
+      ]
+    },
+    {
+      "description": "Vendored JS — requires manual file download after merge",
+      "groupName": "Vendored JS",
+      "matchPackageNames": [
+        "katex",
+        "highlight.js",
+        "mermaid"
+      ],
+      "schedule": [
+        "before 9am on the first day of the month"
+      ],
+      "automerge": false,
+      "prBodyNotes": [
+        "This PR updates version references only.",
+        "After merging, run `scripts/update-vendored-js.sh <lib> <version>` to download the actual files."
+      ]
+    },
+    {
+      "description": "Dev/test tooling",
+      "groupName": "Tooling",
+      "matchPackageNames": [
+        "ruff",
+        "mypy",
+        "types-redis",
+        "pytest",
+        "pytest-cov",
+        "pre-commit"
+      ],
+      "schedule": [
+        "before 9am on the first day of the month"
+      ],
+      "automerge": true,
+      "matchUpdateTypes": [
+        "patch"
+      ]
+    },
+    {
+      "description": "Docker base images",
+      "groupName": "Docker Images",
+      "matchManagers": [
+        "dockerfile",
+        "docker-compose"
+      ],
+      "schedule": [
+        "before 9am on the first day of the month"
+      ],
+      "automerge": false
+    },
+    {
+      "description": "TypeScript SDK dev dependencies",
+      "groupName": "TypeScript SDK",
+      "matchFileNames": [
+        "sdk/typescript/**"
+      ],
+      "schedule": [
+        "before 9am on the first day of the month"
+      ],
+      "automerge": true,
+      "matchUpdateTypes": [
+        "patch"
+      ]
+    },
+    {
+      "description": "GitHub Actions — group all action updates",
+      "groupName": "GitHub Actions",
+      "matchManagers": [
+        "github-actions"
+      ],
+      "automerge": false
+    }
+  ]
+}

.github/workflows/ci.yml

@@ -10,21 +10,21 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
-          python-version: "3.13"
-      - run: pip install ruff
-      - run: ruff check turnstone/ tests/
-      - run: ruff format --check turnstone/ tests/
+          python-version: "3.14"
+      - run: pip install pre-commit
+      # mypy runs separately in typecheck job with full project deps
+      - run: SKIP=mypy pre-commit run --all-files
 
   typecheck:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
-          python-version: "3.13"
+          python-version: "3.14"
       - run: pip install mypy types-redis
       - run: pip install -e ".[mq]"
       - run: mypy turnstone/
@@ -35,14 +35,77 @@ jobs:
       matrix:
         python-version: ["3.11", "3.12", "3.13"]
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: ${{ matrix.python-version }}
       - run: pip install -e ".[test,mq]"
       - run: pytest tests/ -m "not live" --cov=turnstone --cov-report=term-missing --cov-report=xml -q
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
         with:
           name: coverage-${{ matrix.python-version }}
           path: coverage.xml
+
+  test-postgres:
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:18
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: turnstone_test
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd="pg_isready -U postgres"
+          --health-interval=10s
+          --health-timeout=5s
+          --health-retries=5
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+        with:
+          python-version: "3.12"
+      - run: pip install -e ".[test,mq,postgres]"
+      - run: pytest tests/ -m "not live" --storage-backend=postgresql -q
+        env:
+          TURNSTONE_TEST_PG_URL: postgresql+psycopg://postgres:postgres@localhost:5432/turnstone_test
+
+  lock-check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        with:
+          uv-version: "0.9.18"
+      - run: uv lock --check
+
+  security:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        with:
+          uv-version: "0.9.18"
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+        with:
+          python-version: "3.14"
+      - run: uv sync --frozen --all-extras
+      - run: uv pip install pip-audit
+      - name: Security audit (dependencies)
+        run: uv export --no-emit-project --frozen | uv run pip-audit --strict --desc -r /dev/stdin
+
+  security-ts:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: sdk/typescript
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
+        with:
+          node-version: "24"
+      - run: npm ci
+      - run: npm audit --audit-level=moderate

.github/workflows/docker-scan.yml

@@ -0,0 +1,22 @@
+name: Docker Security Scan
+
+on:
+  push:
+    branches: [main]
+  schedule:
+    - cron: "0 6 * * 1"  # Weekly Monday 06:00 UTC
+
+permissions:
+  contents: read
+
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - run: docker build -t turnstone:scan .
+      - uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # 0.35.0
+        with:
+          image-ref: "turnstone:scan"
+          severity: "HIGH,CRITICAL"
+          exit-code: "1"

.github/workflows/publish.yml

@@ -13,16 +13,16 @@ jobs:
     runs-on: ubuntu-latest
     environment: pypi
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
-          python-version: "3.13"
+          python-version: "3.14"
       - run: pip install build
       - run: python -m build
       - uses: pypa/gh-action-pypi-publish@release/v1
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2
         with:
           generate_release_notes: true
           draft: false

.gitignore

@@ -19,3 +19,5 @@ venv/
 .hypothesis/
 PROGRESS.md
 .coverage
+tools/skill_audit_analysis/data/
+tools/skill_audit_analysis/output/

.pre-commit-config.yaml

@@ -1,13 +1,13 @@
 repos:
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.9.10
+    rev: v0.15.6
     hooks:
       - id: ruff
         args: [--fix]
       - id: ruff-format
 
   - repo: https://github.com/pre-commit/mirrors-mypy
-    rev: v1.14.1
+    rev: v1.19.1
     hooks:
       - id: mypy
         additional_dependencies: [types-redis>=4.6, redis>=7.2]

Dockerfile

@@ -1,41 +1,39 @@
 # =============================================================================
-# Turnstone — multi-stage Docker build
+# Turnstone — Docker build with uv for reproducible, locked installs
 # Single image for all services: server, bridge, console, sim, eval
 # =============================================================================
 
-# ----------------------------------------------------------------------------
-# Stage 1: Builder — build the wheel
-# ----------------------------------------------------------------------------
-FROM python:3.13-slim AS builder
-
-WORKDIR /build
-
-RUN pip install --no-cache-dir hatchling
-
-COPY pyproject.toml README.md LICENSE ./
-COPY turnstone/ turnstone/
-
-RUN pip wheel --no-deps --wheel-dir /build/wheels .
-
-# ----------------------------------------------------------------------------
-# Stage 2: Runtime — slim image with the installed package
-# ----------------------------------------------------------------------------
-FROM python:3.13-slim
+FROM python:3.14-slim
 
 LABEL org.opencontainers.image.title="turnstone" \
       org.opencontainers.image.description="Multi-node AI orchestration platform"
 
+COPY --from=ghcr.io/astral-sh/uv:0.10.12 /uv /usr/local/bin/uv
+
 # System dependencies for psycopg (PostgreSQL client library)
-RUN apt-get update && apt-get install -y --no-install-recommends libpq5 \
+RUN apt-get update && apt-get upgrade -y && apt-get install -y --no-install-recommends libpq5 \
     && rm -rf /var/lib/apt/lists/*
 
 # Non-root user
 RUN useradd --create-home --shell /bin/bash turnstone
 
-# Install the wheel with all optional extras
-COPY --from=builder /build/wheels/*.whl /tmp/wheels/
-RUN pip install --no-cache-dir "$(ls /tmp/wheels/*.whl)[mq,console,sim,postgres,discord]" \
-    && rm -rf /tmp/wheels
+WORKDIR /app
+
+# Compile bytecode for faster startup
+ENV UV_COMPILE_BYTECODE=1
+
+# Install dependencies first (cached layer — only re-runs when deps change)
+COPY pyproject.toml uv.lock README.md LICENSE ./
+RUN uv sync --frozen --no-install-project --no-dev \
+    --extra mq --extra console --extra sim --extra postgres --extra discord --extra anthropic --extra ddg
+
+# Install the project itself
+COPY turnstone/ turnstone/
+RUN uv sync --frozen --no-dev \
+    --extra mq --extra console --extra sim --extra postgres --extra discord --extra anthropic --extra ddg
+
+# Add venv to PATH so entry points are found
+ENV PATH="/app/.venv/bin:$PATH"
 
 # Health check script (stdlib only, no pip deps needed)
 COPY docker/healthcheck.py /usr/local/bin/healthcheck.py

QUICKSTART.md

@@ -0,0 +1,92 @@
+# Bootstrap Wizard
+
+Interactive, AI-guided setup for Turnstone deployments. Instead of manually
+editing `.env` files and reading deployment docs, the wizard walks you through
+every decision conversationally and generates all the config files for you.
+
+## Quick Start
+
+```bash
+turnstone-bootstrap
+```
+
+That's it — no flags, no arguments. The wizard prompts for everything.
+
+## How It Works
+
+1. **Pick a model** — Choose OpenAI, Anthropic, or a local/vLLM endpoint to
+   power the wizard. Local endpoints auto-detect available models.
+2. **Answer questions** — The AI walks you through deployment mode, LLM
+   provider, database, authentication, ports, and optional features.
+3. **Review generated files** — Each file is previewed before writing. You
+   confirm or reject every write.
+4. **Start the stack** — The wizard prints the exact `docker compose` command
+   and a `setup.sh` script to create your first admin user, roles, and policies.
+
+## What Gets Generated
+
+| File | Purpose |
+|------|---------|
+| `.env` | All environment variables for `compose.yaml` |
+| `setup.sh` | Post-start script: creates admin user, roles, tool policies, prompt templates via the API |
+| `docker-compose.override.yaml` | Only if customizations beyond env vars are needed |
+
+## Requirements
+
+- **Python 3.11+** with turnstone installed (`pip install turnstone`)
+- **An LLM API key** — for the wizard itself (OpenAI, Anthropic, or a local
+  model). This can differ from the LLM your deployment will use.
+- **Docker & Docker Compose** — needed to run the stack. The wizard detects
+  whether Docker is installed and gives platform-specific install instructions
+  if it's missing. You can still generate config files without Docker.
+
+## Deployment Modes
+
+The wizard supports two deployment modes:
+
+- **Single-node production** (`docker compose --profile production up`) —
+  1 server + bridge + console + PostgreSQL + Redis. Good for most use cases.
+- **Multi-node cluster** (`docker compose --profile cluster up`) —
+  10-node server/bridge fleet + PostgreSQL + Redis. For high-throughput or
+  HA deployments.
+
+## Example Session
+
+```
+$ turnstone-bootstrap
+
+ Turnstone Bootstrap Wizard  v0.5.4
+ ────────────────────────────────────────────────
+
+ Which provider for this wizard?
+   [1] OpenAI
+   [2] Anthropic
+   [3] OpenAI-compatible (local/vLLM)
+
+ > 3
+
+ Base URL [http://localhost:8000/v1]:
+ API key (press Enter for 'none'):
+
+ Querying http://localhost:8000/v1 for available models...
+ Found model: Qwen/Qwen3-32B
+
+ Connected to Qwen/Qwen3-32B. Handing off to AI assistant...
+
+> (AI walks you through the rest interactively)
+```
+
+## Tips
+
+- **Re-run safely** — running the wizard again detects your existing `.env`
+  and offers to update it rather than overwriting.
+- **Duplicate writes are skipped** — if the LLM tries to write the same file
+  twice with identical content, it's silently ignored.
+- **Type `quit` to exit** at any time during the conversation.
+- **Ctrl+C** is handled gracefully — press once to interrupt, twice to exit.
+
+## See Also
+
+- [Docker Deployment](docker.md) — manual compose setup and profiles
+- [Security](security.md) — auth architecture and token types
+- [Governance](governance.md) — roles, policies, and templates

README.md

@@ -5,20 +5,26 @@
 [![Python](https://img.shields.io/pypi/pyversions/turnstone)](https://pypi.org/project/turnstone/)
 [![License](https://img.shields.io/badge/license-BSL--1.1-blue)](LICENSE)
 
-Multi-node AI orchestration platform. Deploy tool-using AI agents across a cluster of servers, driven by message queues or interactive interfaces.
+Experimental multi-node AI orchestration platform. Deploy tool-using AI agents across a cluster of servers, driven by message queues or interactive interfaces.
 
-Named after the [Ruddy Turnstone](https://en.wikipedia.org/wiki/Ruddy_turnstone) — a bird that flips rocks to expose what's hiding underneath.
+> **Beta — Use at your own risk.** Turnstone is under active development and has not reached a stable release. APIs, configuration formats, and database schemas may change between versions without migration paths. We make no guarantees of determinism, reliability, or backward compatibility. Evaluate thoroughly before deploying to any environment where these properties matter.
+
+Named after the [Ruddy Turnstone](https://en.wikipedia.org/wiki/Ruddy_turnstone) (*Arenaria interpres*) — a shorebird that flips stones to discover what's hiding underneath.
 
 ## What it does
 
-Turnstone gives LLMs tools — shell, files, search, web, planning — and orchestrates multi-turn conversations where the model investigates, acts, and reports. Native deferred tool loading for Anthropic and OpenAI APIs reduces token overhead and improves tool selection accuracy when MCP servers expose many tools; local models (vLLM, llama.cpp) get a transparent client-side BM25 fallback. It runs as:
+Turnstone gives LLMs tools — shell, files, search, web, planning — and orchestrates multi-turn conversations where the model investigates, acts, and reports. It runs as:
 
 - **Interactive sessions** — terminal CLI or browser UI with parallel workstreams
 - **Queue-driven agents** — trigger workstreams via message queue, stream progress, approve or auto-approve tool use
 - **Multi-node clusters** — generic work load-balances across nodes, directed work routes to a specific server
-- **Cluster dashboard** — real-time view of all nodes and workstreams, workstream creation with node targeting, reverse proxy for server UIs (only the console port needs network access)
+- **Cluster dashboard** — real-time view of all nodes and workstreams, reverse proxy for server UIs
+- **Intent validation** — an LLM judge evaluates every tool call before approval, presenting risk assessments and evidence-based recommendations so users can make informed decisions instead of blindly approving raw tool calls
+- **Governance & compliance** — RBAC, OIDC SSO (Okta, Azure AD, Google, Keycloak), tool policies, skills (reusable behavioral profiles with security scanning), usage tracking, and append-only audit logs
 - **Cluster simulator** — test the stack at scale (up to 1000 nodes) without an LLM backend
 
+Works with any OpenAI-compatible API (vLLM, llama.cpp, NVIDIA NIM) or Anthropic's native Messages API. Supports [MCP](https://modelcontextprotocol.io/) for external tool servers with native deferred tool loading on Anthropic and OpenAI APIs (BM25 fallback for local models).
+
 <p align="center">
   <img src="docs/diagrams/architecture-overview.svg" alt="Turnstone system architecture — data flow from clients through gateways, Redis MQ, cluster nodes, to LLM providers" width="960"/>
 </p>
@@ -103,8 +109,6 @@ turnstone-sim --nodes 100 --scenario steady --duration 60 --mps 10
 
 See [docs/simulator.md](docs/simulator.md) for scenarios, CLI reference, and metrics.
 
-All frontends connect to any OpenAI-compatible API (vLLM, NVIDIA NIM/NGC, llama.cpp, OpenAI, etc.) or Anthropic's native Messages API, and auto-detect the model.
-
 ## Architecture
 
 ### Diagrams
@@ -127,6 +131,54 @@ Detailed UML diagrams are available in [`docs/diagrams/`](docs/diagrams/):
 | [Deployment](docs/diagrams/png/12-deployment.png) | Docker Compose service topology |
 | [SDK Architecture](docs/diagrams/png/13-sdk-architecture.png) | Python + TypeScript client libraries |
 | [Storage Architecture](docs/diagrams/png/14-storage-architecture.png) | Pluggable database backends (SQLite + PostgreSQL) |
+| [Auth Architecture](docs/diagrams/png/15-auth-architecture.png) | JWT, scopes, token types, login flows |
+| [Channel Architecture](docs/diagrams/png/16-channel-architecture.png) | Discord/Slack adapter protocol and routing |
+| [Notify Flow](docs/diagrams/png/17-notify-flow.png) | Channel notification dispatch |
+| [Watch Architecture](docs/diagrams/png/18-watch-architecture.png) | Periodic command polling daemon |
+| [Governance Architecture](docs/diagrams/png/19-governance-architecture.png) | RBAC, policies, audit, usage enforcement flow |
+| [WS Template Architecture](docs/diagrams/png/21-ws-template-architecture.png) | Workstream template application and lifecycle |
+| [Judge Architecture](docs/diagrams/png/22-judge-architecture.png) | Intent validation two-tier evaluation pipeline |
+| [OIDC Architecture](docs/diagrams/png/25-oidc-architecture.png) | OIDC SSO authorization code flow with PKCE |
+
+### Governance
+
+Turnstone includes a built-in governance layer for enterprise deployments — manage who can do what, which tools run unattended, and where every token goes.
+
+- **RBAC** — 15 granular permissions, 3 built-in roles (admin / operator / viewer), custom roles, privilege escalation prevention
+- **OIDC SSO** — single sign-on via any OpenID Connect provider (Okta, Azure AD, Google, Keycloak); Authorization Code Flow with PKCE, auto-provisioning, claim-based role mapping with demotion propagation; see [docs/oidc.md](docs/oidc.md)
+- **Tool policies** — glob-pattern rules (`allow` / `deny` / `ask`) with priority ordering; automate approvals or lock down dangerous tools
+- **Skills** — reusable behavioral profiles with system prompts, `{{variable}}` substitution, session config (model, temperature, token budget), install-time security scanning, version history, external discovery (skills.sh / GitHub), and runtime `skill` tool for model-driven skill activation
+- **Usage tracking** — per-request token and tool metrics, aggregation by day / model / user, automatic 90-day pruning
+- **Audit logging** — append-only event trail for all admin mutations, IP-aware, 365-day retention
+
+All governance features are managed through the console admin panel (13 tabs) and the full REST API. Runtime settings (model, tools, rate limiting, health, judge, memory) are configurable via the admin Settings tab — no config file edits or restarts needed for most changes. See [docs/governance.md](docs/governance.md) for setup and [docs/settings.md](docs/settings.md) for the settings reference.
+
+### Intent Validation (LLM Judge)
+
+Every tool call that requires human approval is evaluated by an intent validation judge that provides a structured risk assessment alongside the approval prompt — so instead of "approve this bash command?", users see a verdict with risk level, confidence, recommendation, and reasoning.
+
+The system uses a two-tier evaluation pipeline:
+
+1. **Heuristic tier** (instant, free) — 36 pattern-based rules classify tool calls by severity. Catches destructive commands (`rm -rf /`, `DROP TABLE`), privilege escalation (`sudo`), credential access, supply chain risks, browser data export, cloud infrastructure mutations, and more. Results appear immediately.
+2. **LLM judge tier** (async) — A full LLM evaluation runs in the background with access to `read_file` and `list_directory` for evidence gathering. The judge can inspect files that a write would overwrite, check directory contents before a delete, and cite specific evidence in its reasoning. Results update the UI progressively when ready.
+
+The judge defaults to the same model as the session (self-consistency) but can be configured to use a separate model — useful when running a small local model for tasks but wanting a commercial model for safety evaluation.
+
+```toml
+[judge]
+enabled = true           # on by default
+model = ""               # empty = same as session model
+provider = ""            # empty = same as session provider
+timeout = 60.0           # generous for local models
+```
+
+Verdicts are persisted for audit and exposed via Prometheus metrics (`turnstone_judge_verdicts_total`, `turnstone_judge_llm_latency_seconds`).
+
+Skills are also scanned at install time — the scanner evaluates content, supply chain, vulnerability, and declared capability risk across four independent axes. Results populate `scan_status` (tier) and `scan_report` (structured JSON breakdown) on the skill record so administrators can assess risk before enabling a skill.
+
+Tool execution results are evaluated by an output guard before entering the conversation — detecting prompt injection payloads in fetched content, credential leakage in command output, and encoded payloads. Detected credentials are automatically redacted.
+
+See [docs/judge.md](docs/judge.md) for the full guide.
 
 ## Multi-node routing
 
@@ -164,10 +216,10 @@ Bridges BLPOP from their per-node queue (priority) then the shared queue. Direct
 | `man` | Read man pages | yes |
 | `web_fetch` | Fetch URL content | |
 | `web_search` | Web search (provider-native or Tavily) | |
-| `remember` | Save persistent facts | yes |
-| `recall` | Search memories and history | yes |
-| `forget` | Remove a memory | yes |
+| `memory` | Structured persistent memory (save/search/delete/list) | yes |
+| `recall` | Search conversation history | yes |
 | `notify` | Send notifications to linked channels | yes |
+| `watch` | Periodic command polling with conditions | |
 | `task` | Spawn autonomous sub-agent | |
 | `plan` | Explore codebase, write .plan.md | |
 | `mcp__*` | External tools from MCP servers | |
@@ -258,7 +310,7 @@ search_max_results = 5     # max tools returned per search query
 [server]
 host = "0.0.0.0"
 port = 8080
-max_workstreams = 10       # auto-evicts oldest idle when full
+max_workstreams = 50       # auto-evicts oldest idle when full
 
 [redis]
 host = "localhost"
@@ -290,7 +342,14 @@ burst = 20
 backend = "sqlite"     # "sqlite" (default) or "postgresql"
 path = ".turnstone.db" # SQLite file path (relative to working directory)
 # url = "postgresql+psycopg://user:pass@host:5432/turnstone"  # PostgreSQL
-# pool_size = 5        # PostgreSQL connection pool size
+# pool_size = 2        # PostgreSQL connection pool size (per process)
+
+[judge]
+enabled = true         # intent validation for tool approvals (--no-judge to disable)
+model = ""             # empty = same as session model (self-consistency)
+provider = ""          # empty = same as session provider
+timeout = 60.0         # LLM judge timeout in seconds
+confidence_threshold = 0.7
 
 [mcp]
 config_path = ""       # path to MCP JSON config file (alternative to TOML sections)
@@ -333,8 +392,11 @@ Idle workstreams are automatically cleaned up after 2 hours (configurable). In m
 - `turnstone_backend_up` — LLM backend reachability (0/1)
 - `turnstone_circuit_state` — circuit breaker state (0=closed, 1=open, 2=half_open)
 - `turnstone_workstreams_evicted_total` — workstreams auto-evicted at capacity
+- `turnstone_judge_verdicts_total{tier,risk_level}` — intent validation verdicts by tier and risk
+- `turnstone_judge_llm_latency_seconds` — LLM judge evaluation latency histogram
+- `turnstone_judge_enabled` — whether the intent validation judge is active (0/1)
 
-Per-workstream metrics are labeled by `ws_id` (bounded to 10 max workstreams).
+Per-workstream metrics are labeled by `ws_id` (bounded by `[server].max_workstreams`).
 
 ### Health & Rate Limiting
 
@@ -344,7 +406,7 @@ Per-workstream metrics are labeled by `ws_id` (bounded to 10 max workstreams).
 
 **Per-IP rate limiting.** When `[ratelimit].enabled` is true, each client IP is tracked with a token-bucket limiter (`requests_per_second` / `burst`). Rate limiting is applied in `do_GET`/`do_POST` after authentication but before route dispatch. `/health` and `/metrics` are exempt. Requests that exceed the limit receive HTTP 429 with a `Retry-After` header.
 
-**Workstream eviction.** When `WorkstreamManager.create()` would exceed `max_workstreams`, the oldest IDLE workstream is automatically evicted and the `turnstone_workstreams_evicted_total` counter is incremented. Configure via `[server].max_workstreams` (default 10).
+**Workstream eviction.** When `WorkstreamManager.create()` would exceed `max_workstreams`, the oldest IDLE workstream is automatically evicted and the `turnstone_workstreams_evicted_total` counter is incremented. Configure via `[server].max_workstreams` (default 50).
 
 ## Requirements
 

THIRD-PARTY-NOTICES

@@ -0,0 +1,97 @@
+Turnstone — Third-Party Notices
+
+This file contains the licenses and notices for third-party software bundled
+with Turnstone. Each bundled dependency retains its original license; the
+Turnstone BUSL-1.1 license does not apply to these components.
+
+================================================================================
+
+KaTeX 0.16.38
+https://katex.org/
+https://github.com/KaTeX/KaTeX
+
+The MIT License (MIT)
+
+Copyright (c) 2013-2020 Khan Academy and other contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+================================================================================
+
+highlight.js 11.11.1
+https://highlightjs.org/
+https://github.com/highlightjs/highlight.js
+
+BSD 3-Clause License
+
+Copyright (c) 2006, Ivan Sagalaev.
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its
+   contributors may be used to endorse or promote products derived from
+   this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+================================================================================
+
+Mermaid 11.13.0
+https://mermaid.js.org/
+https://github.com/mermaid-js/mermaid
+
+The MIT License (MIT)
+
+Copyright (c) 2014-2022 Knut Sveidqvist
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

deploy/helm/turnstone/Chart.yaml

@@ -7,10 +7,10 @@ appVersion: "0.3.0"
 
 dependencies:
   - name: postgresql
-    version: ~16.0
+    version: ~18.5.0
     repository: https://charts.bitnami.com/bitnami
     condition: postgresql.enabled
   - name: redis
-    version: ~20.0
+    version: ~25.3.0
     repository: https://charts.bitnami.com/bitnami
     condition: redis.enabled

deploy/openshell/routes.yaml

@@ -0,0 +1,49 @@
+# OpenShell inference routing for Turnstone.
+#
+# When using inference routing, the sandbox process connects to
+# https://inference.local instead of the real LLM API. The OpenShell
+# proxy intercepts, rewrites credentials, and forwards to the backend.
+#
+# This keeps real API keys out of the sandbox entirely — the process
+# only sees opaque placeholder tokens in its environment.
+#
+# Usage:
+#   openshell sandbox run \
+#     --inference-routes deploy/openshell/routes.yaml \
+#     ...
+#
+# Then start turnstone with:
+#   python3 -m turnstone.server --base-url https://inference.local
+#
+# CUSTOMIZE: uncomment one of the provider blocks below.
+
+routes:
+
+  # --- OpenAI ---
+  # - name: inference.local
+  #   endpoint: https://api.openai.com/v1
+  #   model: gpt-5
+  #   provider_type: openai
+  #   protocols:
+  #     - openai_chat_completions
+  #     - model_discovery
+  #   api_key_env: OPENAI_API_KEY
+
+  # --- Anthropic ---
+  # - name: inference.local
+  #   endpoint: https://api.anthropic.com
+  #   model: claude-sonnet-4-6
+  #   provider_type: anthropic
+  #   protocols:
+  #     - anthropic_messages
+  #   api_key_env: ANTHROPIC_API_KEY
+
+  # --- Local model server (vLLM / llama.cpp) ---
+  # No secret resolution needed — local servers typically have no auth.
+  # Omit both api_key and api_key_env to skip credential injection.
+  # - name: inference.local
+  #   endpoint: http://localhost:8000/v1
+  #   model: meta-llama/Llama-3.1-70B-Instruct
+  #   protocols:
+  #     - openai_chat_completions
+  #     - model_discovery

deploy/openshell/turnstone-policy.yaml

@@ -0,0 +1,333 @@
+# OpenShell sandbox policy for Turnstone AI orchestration platform.
+#
+# This policy wraps a turnstone-server process (the primary sandbox target).
+# The bridge, console, and channel gateway are separate processes that would
+# each need their own sandbox with a tailored policy variant.
+#
+# Usage:
+#   openshell sandbox run \
+#     --policy deploy/openshell/turnstone-policy.yaml \
+#     --workdir /project \
+#     -- python3 -m turnstone.server --host 0.0.0.0 --port 8080
+#
+# For inference routing (keeps real API keys out of the sandbox):
+#   openshell sandbox run \
+#     --policy deploy/openshell/turnstone-policy.yaml \
+#     --inference-routes deploy/openshell/routes.yaml \
+#     --workdir /project \
+#     -- python3 -m turnstone.server --host 0.0.0.0 --port 8080 \
+#         --base-url https://inference.local
+#
+# Note: inference.local is intercepted by the OpenShell proxy before
+# network policy evaluation — no network_policies entry is needed for it.
+#
+# Customization points (search for "CUSTOMIZE"):
+#   - OIDC issuer endpoint
+#   - Redis host/port (if not localhost)
+#   - MCP HTTP server endpoints
+#   - Additional tool binaries
+#   - web_fetch domain allowlist
+
+version: 1
+
+# ---------------------------------------------------------------------------
+# Filesystem: Landlock kernel enforcement
+# ---------------------------------------------------------------------------
+# Static — cannot be changed after sandbox creation.
+# include_workdir adds the --workdir path to read_write automatically.
+
+filesystem_policy:
+  include_workdir: true
+
+  read_only:
+    # Python runtime + installed packages (includes turnstone package)
+    - /usr
+    - /lib
+    - /lib64
+    # System essentials
+    - /etc
+    - /proc
+    - /dev/urandom
+    # Turnstone config (read-only — writes go to database)
+    # CUSTOMIZE: adjust if config lives elsewhere
+    - /home/sandbox/.config/turnstone
+
+  read_write:
+    # Working directory is added via include_workdir
+    # Temp files (bash tool scripts, eval workdirs)
+    - /tmp
+    # Shell redirections (2>/dev/null)
+    - /dev/null
+    # SQLite database (default location is workdir, covered by include_workdir)
+    # Logs
+    - /var/log
+
+landlock:
+  # best_effort: degrade gracefully on kernels without Landlock (< 5.13)
+  # Change to hard_requirement for production hardened deployments
+  compatibility: best_effort
+
+# ---------------------------------------------------------------------------
+# Process: privilege separation
+# ---------------------------------------------------------------------------
+
+process:
+  run_as_user: sandbox
+  run_as_group: sandbox
+
+# ---------------------------------------------------------------------------
+# Network: per-endpoint, per-binary allowlisting
+# ---------------------------------------------------------------------------
+# Default-deny. Only listed host:port pairs are reachable.
+# Child processes (MCP servers, bash subcommands) inherit the network
+# namespace — they cannot bypass the proxy.
+
+network_policies:
+
+  # --- LLM API providers ---
+
+  openai_api:
+    name: openai-api
+    endpoints:
+      - host: api.openai.com
+        port: 443
+    binaries:
+      - path: /usr/bin/python3*
+      - path: /usr/local/bin/python3*
+
+  anthropic_api:
+    name: anthropic-api
+    endpoints:
+      - host: api.anthropic.com
+        port: 443
+    binaries:
+      - path: /usr/bin/python3*
+      - path: /usr/local/bin/python3*
+
+  # --- Web search fallback (Tavily) ---
+
+  tavily_api:
+    name: tavily-search
+    endpoints:
+      - host: api.tavily.com
+        port: 443
+    binaries:
+      - path: /usr/bin/python3*
+      - path: /usr/local/bin/python3*
+
+  # --- Skill discovery ---
+
+  skills_registry:
+    name: skills-registry
+    endpoints:
+      - host: skills.sh
+        port: 443
+    binaries:
+      - path: /usr/bin/python3*
+      - path: /usr/local/bin/python3*
+
+  github_api:
+    name: github-api
+    endpoints:
+      - host: api.github.com
+        port: 443
+        protocol: rest
+        tls: terminate
+        enforcement: enforce
+        access: read-only
+      - host: raw.githubusercontent.com
+        port: 443
+    binaries:
+      - path: /usr/bin/python3*
+      - path: /usr/local/bin/python3*
+
+  mcp_registry:
+    name: mcp-registry
+    endpoints:
+      - host: registry.modelcontextprotocol.io
+        port: 443
+        protocol: rest
+        tls: terminate
+        enforcement: enforce
+        access: read-only
+    binaries:
+      - path: /usr/bin/python3*
+      - path: /usr/local/bin/python3*
+
+  # --- OIDC SSO ---
+  # CUSTOMIZE: replace with your identity provider's hostname
+
+  # oidc_provider:
+  #   name: oidc-provider
+  #   endpoints:
+  #     - host: login.example.com
+  #       port: 443
+  #   binaries:
+  #     - path: /usr/bin/python3*
+  #     - path: /usr/local/bin/python3*
+
+  # --- Redis (MQ) ---
+  # CUSTOMIZE: if Redis is not on localhost, add host + allowed_ips.
+  # localhost is blocked by default SSRF protection, so we need allowed_ips.
+
+  redis:
+    name: redis-mq
+    endpoints:
+      - port: 6379
+        allowed_ips:
+          - "127.0.0.1"
+    binaries:
+      - path: /usr/bin/python3*
+      - path: /usr/local/bin/python3*
+
+  # --- Discord (channel integration) ---
+  # Uncomment if using turnstone-channel with Discord adapter.
+
+  # discord:
+  #   name: discord
+  #   endpoints:
+  #     - host: discord.com
+  #       port: 443
+  #     - host: gateway.discord.gg
+  #       port: 443
+  #     - host: cdn.discordapp.com
+  #       port: 443
+  #   binaries:
+  #     - path: /usr/bin/python3*
+  #     - path: /usr/local/bin/python3*
+
+  # --- web_fetch tool: curated domain allowlist ---
+  #
+  # This is the hard tradeoff. Turnstone's web_fetch tool lets the LLM
+  # fetch arbitrary public URLs. OpenShell cannot allow "all HTTPS" —
+  # every domain must be enumerated.
+  #
+  # Strategy: allowlist the domains your workloads actually need.
+  # The web_fetch tool will return a connection error for unlisted domains,
+  # which the LLM handles gracefully (it tells the user it can't reach
+  # that site).
+  #
+  # CUSTOMIZE: add domains your workstreams need to fetch from.
+
+  web_fetch_common:
+    name: web-fetch-common
+    endpoints:
+      # Documentation sites
+      - host: "**.readthedocs.io"
+        port: 443
+      - host: docs.python.org
+        port: 443
+      - host: "**.github.io"
+        port: 443
+      # Package registries (metadata lookups)
+      - host: pypi.org
+        port: 443
+      - host: www.npmjs.com
+        port: 443
+      # Stack Overflow / reference
+      - host: stackoverflow.com
+        port: 443
+      - host: "**.stackexchange.com"
+        port: 443
+      # Wikipedia
+      - host: "**.wikipedia.org"
+        port: 443
+    binaries:
+      - path: /usr/bin/python3*
+      - path: /usr/local/bin/python3*
+
+  # --- MCP HTTP servers ---
+  # CUSTOMIZE: add endpoints for any MCP servers using streamable-http
+  # transport. stdio-transport MCP servers need no network entry (they
+  # communicate via stdin/stdout pipes within the sandbox).
+
+  # mcp_http_servers:
+  #   name: mcp-http
+  #   endpoints:
+  #     - host: mcp.internal.example.com
+  #       port: 443
+  #   binaries:
+  #     - path: /usr/bin/python3*
+  #     - path: /usr/local/bin/python3*
+
+  # --- Bash tool: curl/wget ---
+  # The bash tool can run curl/wget. These inherit the network namespace
+  # so they can only reach allowed endpoints. But they need binary entries
+  # to pass the proxy's identity check.
+
+  bash_network_tools:
+    name: bash-network-tools
+    endpoints:
+      # Mirrors web_fetch_common — curl/wget should have the same reach.
+      - host: "**.readthedocs.io"
+        port: 443
+      - host: docs.python.org
+        port: 443
+      - host: "**.github.io"
+        port: 443
+      - host: pypi.org
+        port: 443
+      - host: www.npmjs.com
+        port: 443
+      - host: stackoverflow.com
+        port: 443
+      - host: "**.stackexchange.com"
+        port: 443
+      - host: "**.wikipedia.org"
+        port: 443
+    binaries:
+      - path: /usr/bin/curl
+      - path: /usr/bin/wget
+
+  # --- Package installation ---
+  # pip install / uv add from the bash tool.
+
+  package_registries:
+    name: package-install
+    endpoints:
+      - host: pypi.org
+        port: 443
+      - host: files.pythonhosted.org
+        port: 443
+      - host: "**.pypi.org"
+        port: 443
+    binaries:
+      - path: /usr/bin/pip*
+      - path: /usr/local/bin/pip*
+      - path: /usr/bin/uv
+      - path: /usr/local/bin/uv
+      - path: /usr/bin/python3*
+      - path: /usr/local/bin/python3*
+
+  # --- Git operations ---
+  # read-only: clone, fetch, pull. No push (L7 enforcement).
+
+  git_operations:
+    name: git-read-only
+    endpoints:
+      - host: github.com
+        port: 443
+        protocol: rest
+        tls: terminate
+        enforcement: enforce
+        rules:
+          - allow:
+              method: GET
+              path: "/**/info/refs*"
+          - allow:
+              method: POST
+              path: "/**/git-upload-pack"
+      - host: gitlab.com
+        port: 443
+        protocol: rest
+        tls: terminate
+        enforcement: enforce
+        rules:
+          - allow:
+              method: GET
+              path: "/**/info/refs*"
+          - allow:
+              method: POST
+              path: "/**/git-upload-pack"
+    binaries:
+      - path: /usr/bin/git

docker/mcp-ddg.json

@@ -0,0 +1,7 @@
+{
+  "mcpServers": {
+    "ddg": {
+      "url": "http://ddg-search:3000/mcp"
+    }
+  }
+}

docs/api-reference.md

@@ -402,18 +402,22 @@ Each item in `items` (shared by `tool_info` and `approve_request`):
   "total_tokens": 1280,
   "context_window": 131072,
   "pct": 1.0,
-  "effort": "medium"
+  "effort": "medium",
+  "cache_creation_tokens": 800,
+  "cache_read_tokens": 200
 }
 ```
 
-| Field               | Type   | Description                                  |
-|---------------------|--------|----------------------------------------------|
-| `prompt_tokens`     | int    | Tokens in the prompt                         |
-| `completion_tokens` | int    | Tokens generated by the model                |
-| `total_tokens`      | int    | `prompt_tokens + completion_tokens`          |
-| `context_window`    | int    | Total context window size in tokens          |
-| `pct`               | float  | Percentage of context window used            |
-| `effort`            | string | Reasoning effort level (`low`/`medium`/`high`) |
+| Field                    | Type   | Description                                          |
+|--------------------------|--------|------------------------------------------------------|
+| `prompt_tokens`          | int    | Tokens in the prompt                                 |
+| `completion_tokens`      | int    | Tokens generated by the model                        |
+| `total_tokens`           | int    | `prompt_tokens + completion_tokens`                  |
+| `context_window`         | int    | Total context window size in tokens                  |
+| `pct`                    | float  | Percentage of context window used                    |
+| `effort`                 | string | Reasoning effort level (`low`/`medium`/`high`)       |
+| `cache_creation_tokens`  | int    | Tokens written to prompt cache (Anthropic)           |
+| `cache_read_tokens`      | int    | Tokens served from prompt cache (Anthropic + OpenAI) |
 
 **`plan_review`** -- the model is proposing a plan and wants feedback. The
 client must respond via `POST /v1/api/plan`.
@@ -448,6 +452,58 @@ after `/clear` or `/new` commands).
 {"type": "clear_ui"}
 ```
 
+**`cancelled`** -- the generation was cancelled by the user (via the Stop
+button or `POST /v1/api/cancel`). The client should finalize any in-progress
+assistant message with whatever partial content was streamed.
+
+```json
+{"type": "cancelled"}
+```
+
+**`intent_verdict`** -- delivered asynchronously when the LLM judge completes
+its evaluation of a pending tool call. Only sent when intent validation is
+enabled (`--judge` or `[judge] enabled = true`). The `call_id` correlates with
+the item in the preceding `approve_request` event.
+
+```json
+{
+  "type": "intent_verdict",
+  "verdict_id": "f7e8d9c0b1a2",
+  "call_id": "call_abc123",
+  "func_name": "bash",
+  "intent_summary": "Install Express.js web framework via npm",
+  "risk_level": "medium",
+  "confidence": 0.85,
+  "recommendation": "review",
+  "reasoning": "The command installs express from npm. This is a well-known package but will modify node_modules and package.json.",
+  "evidence": ["Checked package.json -- express is not currently a dependency"],
+  "tier": "llm",
+  "judge_model": "gpt-5",
+  "latency_ms": 2340
+}
+```
+
+| Field            | Type       | Description                                            |
+|------------------|------------|--------------------------------------------------------|
+| `verdict_id`     | string     | Unique verdict identifier                              |
+| `call_id`        | string     | Tool call ID (matches `approve_request` item)          |
+| `func_name`      | string     | Tool function name                                     |
+| `intent_summary` | string     | One-sentence description of the tool call's intent     |
+| `risk_level`     | string     | `"low"`, `"medium"`, `"high"`, or `"critical"`         |
+| `confidence`     | float      | 0.0--1.0 confidence in the assessment                  |
+| `recommendation` | string     | `"approve"`, `"review"`, or `"deny"`                   |
+| `reasoning`      | string     | Evidence-based explanation                             |
+| `evidence`       | list       | Supporting evidence (file excerpts, rule names)        |
+| `tier`           | string     | Always `"llm"` for this event                          |
+| `judge_model`    | string     | Model that produced the verdict                        |
+| `latency_ms`     | int        | Evaluation time in milliseconds                        |
+
+When intent validation is active, the `approve_request` event is also extended:
+each item in `items` gains a `verdict` field containing the heuristic verdict
+(same schema as above but with `tier: "heuristic"`), and the event gains a
+top-level `judge_pending` boolean indicating whether an LLM verdict is in
+flight.
+
 #### Keepalive
 
 The server sends an SSE comment every 5 seconds when no events are pending:
@@ -498,7 +554,7 @@ Possible `state` values:
 | `error`     | An error occurred                               |
 
 **Fan-out pattern:** Each connected client receives its own bounded queue
-(`maxsize=500`). A dedicated fan-out thread reads from the shared global queue
+(`maxsize=1000`). A dedicated fan-out thread reads from the shared global queue
 and copies each event to every client queue. If a client queue is full, the
 event is silently dropped for that client.
 
@@ -566,6 +622,38 @@ Each saved workstream object:
 
 ---
 
+### `GET /v1/api/skills`
+
+Returns a summary list of all available skills. This is a read-only
+endpoint (requires `read` scope) that exposes skill names and categories
+without revealing skill content. Useful for populating skill selectors
+in UIs or discovering available skills before creating a workstream.
+
+**Response:**
+
+```json
+{
+  "skills": [
+    {"name": "safety-guidelines", "category": "safety", "is_default": true, "origin": "manual"},
+    {"name": "mcp__server__code", "category": "", "is_default": false, "origin": "mcp"}
+  ]
+}
+```
+
+Each skill summary:
+
+| Field        | Type   | Description                                          |
+|--------------|--------|------------------------------------------------------|
+| `name`       | string | Skill name (used in `skill` field on workstream creation) |
+| `category`   | string | Skill category                                       |
+| `is_default` | bool   | Whether skill is auto-applied to all sessions        |
+| `origin`     | string | Skill origin: `manual` or `mcp`                      |
+
+> **Note:** For full skill management (create, update, delete, view content),
+> use the admin endpoints at `GET /v1/api/admin/skills` (requires `admin.skills` permission).
+
+---
+
 ### `POST /v1/api/send`
 
 Sends a user message to a workstream. Spawns a daemon worker thread that calls
@@ -701,6 +789,43 @@ containing the resumed session's messages.
 
 ---
 
+### `POST /v1/api/cancel`
+
+Cancels the active generation in a workstream. Sets a cooperative cancellation
+flag that is checked at multiple points in the generation loop (per streaming
+chunk, before tool execution, inside bash commands). The session transitions to
+`idle` state and preserves any partial content already streamed.
+
+If the workstream is waiting for tool approval or plan review, the pending
+prompt is automatically denied/rejected to unblock the worker thread.
+
+Calling this endpoint when the workstream is already idle is a harmless no-op.
+
+**Request body:**
+
+```json
+{"ws_id": "abc123"}
+```
+
+| Field  | Type   | Required | Description          |
+|--------|--------|----------|----------------------|
+| `ws_id`| string | yes      | Target workstream ID |
+
+**Response:**
+
+```json
+{"status": "ok"}
+```
+
+**Error responses:**
+
+| Status | Body                               | Condition              |
+|--------|------------------------------------|------------------------|
+| 400    | `{"error": "No session"}`          | Session not initialized|
+| 404    | `{"error": "Unknown workstream"}`  | `ws_id` not found      |
+
+---
+
 ### `POST /v1/api/workstreams/new`
 
 Creates a new workstream. The server supports up to 10 concurrent workstreams.
@@ -719,6 +844,9 @@ All fields are optional. The body can be empty or an empty JSON object.
 | `model`          | string | default | Model alias from the registry (`[models.*]`)                   |
 | `auto_approve`   | bool   | false   | Auto-approve all tool calls for this workstream                |
 | `resume_ws`      | string | ""      | Workstream ID to resume atomically during creation (empty = fresh)|
+| `skill`          | string | ""      | Skill name. Applies content (system prompt), model, temperature, reasoning effort, max tokens, auto-approve policy, token budget, and other session config from the skill. Returns 400 if not found or disabled. Ignored when `resume_ws` is set (resumed sessions restore their own skill). |
+
+> **Skill behavior:** When `skill` is specified, the skill's content is injected as a system message and its session config fields (model, temperature, auto-approve, token budget, etc.) override system defaults for the new workstream.
 
 **Response (success):**
 
@@ -847,6 +975,689 @@ Status code: `403`
 
 ---
 
+### `GET /v1/api/memories`
+
+List structured memories with optional filters. Requires `read` scope.
+
+**Query parameters:**
+
+| Parameter  | Type   | Required | Default | Description                  |
+|------------|--------|----------|---------|------------------------------|
+| `type`     | string | no       | `""`    | Filter by memory type (user, project, feedback, reference) |
+| `scope`    | string | no       | `""`    | Filter by scope (global, workstream, user) |
+| `scope_id` | string | no       | `""`    | Scope qualifier. Auto-resolved for `scope=user` when auth is active. |
+| `limit`    | int    | no       | `100`   | Max results (capped at 200)  |
+
+**Response:**
+
+```json
+{
+  "memories": [
+    {
+      "memory_id": "a1b2c3d4-e5f6-...",
+      "name": "project_architecture",
+      "description": "Core architecture patterns",
+      "type": "project",
+      "scope": "global",
+      "scope_id": "",
+      "content": "The project uses a hexagonal architecture...",
+      "created": "2026-03-10T10:00:00",
+      "updated": "2026-03-12T14:30:00"
+    }
+  ],
+  "total": 1
+}
+```
+
+---
+
+### `POST /v1/api/memories`
+
+Save or upsert a structured memory. Requires `write` scope. Returns `201` on
+create, `200` on update.
+
+**Request body:**
+
+```json
+{
+  "name": "deployment_process",
+  "content": "Deploy via GitHub Actions. Staging auto-deploys on push to main.",
+  "description": "CI/CD deployment workflow",
+  "type": "project",
+  "scope": "global",
+  "scope_id": ""
+}
+```
+
+| Field        | Type   | Required | Default     | Description                          |
+|--------------|--------|----------|-------------|--------------------------------------|
+| `name`       | string | yes      | --          | Memory name (max 256 chars)          |
+| `content`    | string | yes      | --          | Memory content (max 65536 chars)     |
+| `description`| string | no       | `""`        | Short description for search ranking |
+| `type`       | string | no       | `"project"` | One of: user, project, feedback, reference |
+| `scope`      | string | no       | `"global"`  | One of: global, workstream, user     |
+| `scope_id`   | string | no       | `""`        | Scope qualifier (auto-resolved for user scope) |
+
+**Response (created):** `201`
+
+```json
+{
+  "memory_id": "a1b2c3d4-e5f6-...",
+  "name": "deployment_process",
+  "description": "CI/CD deployment workflow",
+  "type": "project",
+  "scope": "global",
+  "scope_id": "",
+  "content": "Deploy via GitHub Actions...",
+  "created": "2026-03-14T10:00:00",
+  "updated": "2026-03-14T10:00:00"
+}
+```
+
+**Error responses:**
+
+| Status | Condition                                              |
+|--------|--------------------------------------------------------|
+| 400    | Missing name, empty content, invalid type/scope, name too long, content too long |
+
+---
+
+### `POST /v1/api/memories/search`
+
+Search memories by query. Uses POST for the request body but is non-mutating
+(requires only `read` scope).
+
+**Request body:**
+
+```json
+{
+  "query": "authentication",
+  "type": "project",
+  "scope": "",
+  "limit": 20
+}
+```
+
+| Field      | Type   | Required | Default | Description                    |
+|------------|--------|----------|---------|--------------------------------|
+| `query`    | string | yes      | --      | Search query                   |
+| `type`     | string | no       | `""`    | Filter by type                 |
+| `scope`    | string | no       | `""`    | Filter by scope                |
+| `scope_id` | string | no       | `""`    | Filter by scope ID             |
+| `limit`    | int    | no       | `20`    | Max results (capped at 50)     |
+
+**Response:**
+
+```json
+{
+  "memories": [
+    {
+      "memory_id": "a1b2c3d4-e5f6-...",
+      "name": "auth_patterns",
+      "description": "Authentication architecture",
+      "type": "project",
+      "scope": "global",
+      "scope_id": "",
+      "content": "JWT tokens with HS256...",
+      "created": "2026-03-10T10:00:00",
+      "updated": "2026-03-12T14:30:00"
+    }
+  ],
+  "total": 1
+}
+```
+
+**Error:** `400` with `{"error": "query is required"}` if `query` is empty.
+
+---
+
+### `DELETE /v1/api/memories/{name}`
+
+Delete a memory by name and scope. Requires `write` scope.
+
+**Path parameters:**
+
+| Parameter | Type   | Description          |
+|-----------|--------|----------------------|
+| `name`    | string | Memory name          |
+
+**Query parameters:**
+
+| Parameter  | Type   | Required | Default    | Description         |
+|------------|--------|----------|------------|---------------------|
+| `scope`    | string | no       | `"global"` | Scope of the memory |
+| `scope_id` | string | no       | `""`       | Scope qualifier     |
+
+**Response (success):** `200`
+
+```json
+{"status": "ok", "name": "deployment_process"}
+```
+
+**Error (not found):** `404`
+
+```json
+{"error": "Memory 'deployment_process' not found"}
+```
+
+---
+
+### `GET /v1/api/admin/memories` (Console)
+
+List structured memories across all scopes. Requires `admin.memories`
+permission.
+
+**Query parameters:**
+
+| Parameter  | Type   | Required | Default | Description                  |
+|------------|--------|----------|---------|------------------------------|
+| `type`     | string | no       | `""`    | Filter by type               |
+| `scope`    | string | no       | `""`    | Filter by scope              |
+| `scope_id` | string | no       | `""`    | Filter by scope ID           |
+| `limit`    | int    | no       | `100`   | Max results (capped at 200)  |
+
+**Response:** `200` -- same schema as `GET /v1/api/memories`.
+
+---
+
+### `GET /v1/api/admin/memories/search` (Console)
+
+Search memories by query. Requires `admin.memories` permission.
+
+**Query parameters:**
+
+| Parameter  | Type   | Required | Default | Description                   |
+|------------|--------|----------|---------|-------------------------------|
+| `q`        | string | yes      | --      | Search query                  |
+| `type`     | string | no       | `""`    | Filter by type                |
+| `scope`    | string | no       | `""`    | Filter by scope               |
+| `scope_id` | string | no       | `""`    | Filter by scope ID            |
+| `limit`    | int    | no       | `20`    | Max results (capped at 50)    |
+
+**Response:** `200` -- same schema as `GET /v1/api/memories`.
+
+**Error:** `400` with `{"error": "q is required"}` if `q` is empty.
+
+---
+
+### `GET /v1/api/admin/memories/{memory_id}` (Console)
+
+Get a single memory by ID. Requires `admin.memories` permission.
+
+**Path parameters:**
+
+| Parameter   | Type   | Description            |
+|-------------|--------|------------------------|
+| `memory_id` | string | Memory UUID            |
+
+**Response (success):** `200`
+
+```json
+{
+  "memory_id": "a1b2c3d4-e5f6-...",
+  "name": "project_architecture",
+  "description": "Core architecture patterns",
+  "type": "project",
+  "scope": "global",
+  "scope_id": "",
+  "content": "The project uses...",
+  "created": "2026-03-10T10:00:00",
+  "updated": "2026-03-12T14:30:00"
+}
+```
+
+**Error (not found):** `404`
+
+```json
+{"error": "Memory not found"}
+```
+
+---
+
+### `DELETE /v1/api/admin/memories/{memory_id}` (Console)
+
+Delete a memory by ID. Records an audit event (`memory.delete`). Requires
+`admin.memories` permission.
+
+**Path parameters:**
+
+| Parameter   | Type   | Description            |
+|-------------|--------|------------------------|
+| `memory_id` | string | Memory UUID            |
+
+**Response (success):** `200`
+
+```json
+{"status": "ok"}
+```
+
+**Error (not found):** `404`
+
+```json
+{"error": "Memory not found"}
+```
+
+---
+
+### `GET /v1/api/admin/verdicts` (Console)
+
+List intent validation verdicts from the `intent_verdicts` table. This endpoint
+is on the **console** server and requires the `admin.judge` permission.
+
+**Query parameters:**
+
+| Parameter    | Type   | Required | Description                                        |
+|--------------|--------|----------|----------------------------------------------------|
+| `ws_id`      | string | no       | Filter by workstream ID                            |
+| `since`      | string | no       | ISO timestamp lower bound                          |
+| `until`      | string | no       | ISO timestamp upper bound                          |
+| `risk_level` | string | no       | Filter by risk level (`low`/`medium`/`high`/`critical`) |
+| `limit`      | int    | no       | Max results (default 100, max 500)                 |
+| `offset`     | int    | no       | Pagination offset (default 0)                      |
+
+**Response:**
+
+```json
+{
+  "verdicts": [
+    {
+      "verdict_id": "a1b2c3d4e5f6",
+      "ws_id": "ws-1",
+      "call_id": "call_abc123",
+      "func_name": "bash",
+      "func_args": "{\"command\": \"npm install express\"}",
+      "intent_summary": "Package installation: npm install express",
+      "risk_level": "medium",
+      "confidence": 0.70,
+      "recommendation": "review",
+      "reasoning": "Command installs a software package which may modify the environment.",
+      "evidence": "[\"Matched rule: package-install\"]",
+      "tier": "heuristic",
+      "judge_model": "",
+      "latency_ms": 0,
+      "user_decision": "approved",
+      "created": "2026-03-13T10:00:00"
+    }
+  ],
+  "total": 42
+}
+```
+
+---
+
+### `GET /v1/api/admin/output-assessments` (Console)
+
+List output guard assessments from the `output_assessments` table. This endpoint
+is on the **console** server and requires the `admin.judge` permission.
+
+**Query parameters:**
+
+| Parameter    | Type   | Required | Description                                        |
+|--------------|--------|----------|----------------------------------------------------|
+| `ws_id`      | string | no       | Filter by workstream ID                            |
+| `risk_level` | string | no       | Filter by risk level (`low`/`medium`/`high`)       |
+| `since`      | string | no       | ISO timestamp lower bound                          |
+| `until`      | string | no       | ISO timestamp upper bound                          |
+| `limit`      | int    | no       | Max results (default 100, max 500)                 |
+| `offset`     | int    | no       | Pagination offset (default 0)                      |
+
+**Response:**
+
+```json
+{
+  "assessments": [
+    {
+      "assessment_id": "a1b2c3d4e5f6",
+      "ws_id": "ws-1",
+      "call_id": "call_abc123",
+      "func_name": "bash",
+      "flags": "[\"credential_leak\"]",
+      "risk_level": "high",
+      "annotations": "[\"API key detected (sk-proj-...)\"]",
+      "output_length": 1024,
+      "redacted": 1,
+      "created": "2026-03-16T10:00:00"
+    }
+  ],
+  "total": 7
+}
+```
+
+---
+
+### `POST /v1/api/admin/skills/{skill_id}/rescan` (Console)
+
+Re-scan a skill's content for security signals using the current scanner
+version. Requires the `admin.skills` permission.
+
+**Path parameters:**
+
+| Parameter  | Type   | Description |
+|------------|--------|-------------|
+| `skill_id` | string | Skill (prompt template) ID |
+
+**Response:**
+
+```json
+{
+  "scan_status": "medium",
+  "scan_report": "{\"composite\": 1.75, \"details\": {...}}",
+  "scan_version": "1"
+}
+```
+
+**Error:** `404` if skill not found.
+
+---
+
+### `GET /v1/api/admin/skills/discover` (Console)
+
+Search external skill registries for available skills. Requires the
+`admin.skills` permission.
+
+**Query parameters:**
+
+| Parameter | Type   | Default | Description |
+|-----------|--------|---------|-------------|
+| `q`       | string | `""`    | Search query |
+| `limit`   | int    | `20`    | Max results (1–100) |
+
+**Response:**
+
+```json
+{
+  "skills": [
+    {
+      "id": "owner/repo/skill-name",
+      "name": "skill-name",
+      "description": "A skill description",
+      "author": "Author Name",
+      "source": "skills.sh",
+      "source_url": "https://github.com/owner/repo",
+      "install_count": 42,
+      "tags": ["coding", "review"],
+      "installed": false
+    }
+  ]
+}
+```
+
+**Error:** `502` if the registry is unreachable.
+
+---
+
+### `POST /v1/api/admin/skills/install` (Console)
+
+Install a skill from an external source (skills.sh registry or GitHub).
+Requires the `admin.skills` permission.
+
+**Request body:**
+
+```json
+{
+  "source": "github",
+  "url": "https://github.com/owner/skill-repo"
+}
+```
+
+Or for skills.sh:
+
+```json
+{
+  "source": "skills.sh",
+  "skill_id": "owner/skill-name"
+}
+```
+
+**Response:** Same as `GET /v1/api/admin/skills/{skill_id}` — the created
+skill object.
+
+**Errors:** `400` invalid source or missing fields, `404` SKILL.md not found,
+`409` skill already installed (duplicate source_url or name), `502` source
+unreachable.
+
+---
+
+### `GET /v1/api/admin/settings` (Console)
+
+List all settings with their effective values, defaults, and metadata. Requires
+the `admin.settings` permission.
+
+**Response:** `200`
+
+```json
+{
+  "settings": [
+    {
+      "key": "model.temperature",
+      "value": 0.7,
+      "source": "storage",
+      "type": "float",
+      "description": "Sampling temperature",
+      "section": "model",
+      "is_secret": false,
+      "node_id": "",
+      "changed_by": "admin",
+      "updated": "2026-03-14T10:00:00",
+      "restart_required": false
+    }
+  ]
+}
+```
+
+---
+
+### `GET /v1/api/admin/settings/schema` (Console)
+
+Return the full registry catalog (all defined settings with metadata). Requires
+the `admin.settings` permission. Useful for building dynamic admin UIs.
+
+**Response:** `200`
+
+```json
+{
+  "schema": [
+    {
+      "key": "model.temperature",
+      "type": "float",
+      "default": 0.5,
+      "description": "Sampling temperature",
+      "section": "model",
+      "is_secret": false,
+      "min_value": 0.0,
+      "max_value": 2.0,
+      "choices": null,
+      "restart_required": false
+    }
+  ]
+}
+```
+
+---
+
+### `PUT /v1/api/admin/settings/{key}` (Console)
+
+Update a setting. Requires the `admin.settings` permission. The value is
+validated against the registry definition (type coercion, range checks, choices).
+Secret settings (`is_secret=true`) return `403`.
+
+**Path parameters:**
+
+| Parameter | Type   | Description |
+|-----------|--------|-------------|
+| `key`     | string | Dotted setting key (e.g. `model.temperature`) |
+
+**Request body:**
+
+```json
+{
+  "value": 0.7,
+  "node_id": ""
+}
+```
+
+| Field     | Type   | Required | Default | Description |
+|-----------|--------|----------|---------|-------------|
+| `value`   | any    | yes      | --      | New value (type-coerced against registry) |
+| `node_id` | string | no       | `""`    | Node ID for per-node override |
+
+**Response (success):** `200`
+
+```json
+{
+  "key": "model.temperature",
+  "value": 0.7,
+  "source": "storage",
+  "type": "float",
+  "description": "Sampling temperature",
+  "section": "model",
+  "is_secret": false,
+  "node_id": "",
+  "changed_by": "admin",
+  "updated": "",
+  "restart_required": false
+}
+```
+
+**Errors:**
+
+| Status | Condition |
+|--------|-----------|
+| 400    | Unknown key, invalid value, type mismatch, out of range, missing `value` field |
+| 403    | Secret setting (must use config.toml or env) |
+
+---
+
+### `DELETE /v1/api/admin/settings/{key}` (Console)
+
+Reset a setting to its registry default by removing it from storage. Requires
+the `admin.settings` permission.
+
+**Path parameters:**
+
+| Parameter | Type   | Description |
+|-----------|--------|-------------|
+| `key`     | string | Dotted setting key |
+
+**Query parameters:**
+
+| Parameter | Type   | Required | Default | Description |
+|-----------|--------|----------|---------|-------------|
+| `node_id` | string | no       | `""`    | Node ID (empty = global) |
+
+**Response (success):** `200`
+
+```json
+{"status": "ok", "key": "model.temperature", "default": 0.5}
+```
+
+**Response (not found):** `404`
+
+```json
+{"error": "Setting 'model.temperature' has no stored value"}
+```
+
+---
+
+### MCP Servers
+
+| Method | Path | Description |
+|--------|------|-------------|
+| GET | `/v1/api/admin/mcp-servers` | List all MCP server definitions with live node status. Query: `?reveal=true` to show env/header secrets. |
+| POST | `/v1/api/admin/mcp-servers` | Create an MCP server definition. Body: `{name, transport, command?, args?, url?, headers?, env?, auto_approve?, enabled?}` |
+| GET | `/v1/api/admin/mcp-servers/{server_id}` | Get a single MCP server with per-node connection status. |
+| PUT | `/v1/api/admin/mcp-servers/{server_id}` | Update an MCP server definition. Partial updates supported. |
+| DELETE | `/v1/api/admin/mcp-servers/{server_id}` | Delete an MCP server definition. |
+| POST | `/v1/api/admin/mcp-servers/reload` | Tell all cluster nodes to re-read the `mcp_servers` DB table and reconcile (add new, remove stale, reconnect changed). |
+| POST | `/v1/api/admin/mcp-servers/import` | Import servers from a pasted JSON config. Body: `{config: {mcpServers: {...}}}`. Skips existing names. |
+
+Permission: `admin.mcp`
+
+Secrets (`env`, `headers` fields) are masked with `***` by default. Use `?reveal=true` on GET endpoints to see actual values.
+
+---
+
+### MCP Registry
+
+#### Search Registry
+
+`GET /v1/api/admin/mcp-registry/search`
+
+Search the official MCP Registry for available servers. Permission: `admin.mcp`.
+
+**Query parameters:**
+
+| Parameter | Type | Default | Description |
+|-----------|------|---------|-------------|
+| `search` | string | `""` | Search query. Empty returns a browsable listing. |
+| `limit` | integer | `20` | Results per page (max 100). |
+| `cursor` | string | — | Opaque cursor for pagination. |
+
+**Response:** `200`
+
+```json
+{
+  "servers": [
+    {
+      "name": "io.example/mcp-server",
+      "description": "...",
+      "title": "Example Server",
+      "version": "1.0.0",
+      "website_url": "https://example.com",
+      "repository": {"url": "...", "source": "github"},
+      "icons": [],
+      "remotes": [{"type": "streamable-http", "url": "...", "headers": [...], "variables": {...}}],
+      "packages": [{"registry_type": "npm", "identifier": "@example/server", "version": "1.0.0", "transport_type": "stdio", "environment_variables": [...]}],
+      "meta": {"status": "active", "is_latest": true},
+      "installed": false,
+      "installed_server_id": "",
+      "installed_version": "",
+      "update_available": false
+    }
+  ],
+  "total": 100,
+  "next_cursor": "abc123"
+}
+```
+
+**Errors:** `502` (registry unreachable).
+
+#### Install from Registry
+
+`POST /v1/api/admin/mcp-registry/install`
+
+Install an MCP server from the registry. Auto-reloads all cluster nodes. Permission: `admin.mcp`.
+
+**Request body:**
+
+```json
+{
+  "registry_name": "io.example/mcp-server",
+  "source": "remote",
+  "index": 0,
+  "name": "",
+  "variables": {},
+  "env": {"API_KEY": "sk-..."},
+  "headers": {"Authorization": "Bearer ..."}
+}
+```
+
+| Field | Type | Required | Description |
+|-------|------|----------|-------------|
+| `registry_name` | string | yes | Server name from registry search results. |
+| `source` | string | yes | `"remote"` (streamable-http) or `"package"` (npm/pypi). |
+| `index` | integer | no (default `0`) | Which remote or package entry to use. |
+| `name` | string | no | Custom server name. Auto-derived from registry name if empty. |
+| `variables` | object | no | Values for URL template `{var}` placeholders. |
+| `env` | object | no | Environment variable values for package servers. |
+| `headers` | object | no | Header values for remote servers. |
+
+**Response:** Same as `POST /v1/api/admin/mcp-servers` (McpServerDetail).
+
+**Errors:** `400` (validation), `404` (not in registry), `409` (already installed or name collision), `502` (registry unreachable).
+
+---
+
 ### `OPTIONS` (any path)
 
 Handles CORS preflight requests.

docs/architecture.md

@@ -3,7 +3,7 @@
 Turnstone is an AI orchestration platform with tool use, parallel workstreams, and persistent
 memory. It connects to any OpenAI-compatible API (local vLLM, OpenAI, etc.) or
 Anthropic's native Messages API via pluggable provider adapters, and gives the
-model 14 built-in tools plus external tools via MCP (Model Context Protocol) for
+model 17 built-in tools plus external tools via MCP (Model Context Protocol) for
 reading, writing, searching, planning, and executing code.
 
 The core design principle is a **UI-agnostic engine with pluggable frontends**.
@@ -45,8 +45,12 @@ turnstone/
     mcp_client.py     MCPClientManager — MCP server connections, tool discovery, dynamic refresh, async-sync bridge
     tool_search.py    Dynamic tool search — BM25 index, session-scoped tool visibility
     watch.py          WatchRunner daemon — periodic command polling, condition DSL, result dispatch
+    judge.py          Intent validation — heuristic rules + LLM judge, advisory verdicts
     model_registry.py ModelRegistry — named model configs, lazy client creation, fallback routing
-    memory.py         Persistence facade (delegates to storage backend)
+    memory.py         Persistence facade + structured memory API (delegates to storage backend)
+    config.py         Config file loader (config.toml), apply_config(), warn_migrated_settings()
+    config_store.py   ConfigStore — database-backed settings with in-memory cache, thread-safe get/set
+    settings_registry.py  SettingDef catalog (~40 settings), validation, type coercion, serialization
     storage/          Pluggable storage: StorageBackend protocol, SQLite + PostgreSQL
     metrics.py        Prometheus-compatible metrics collector (MetricsCollector)
     healthcheck.py    BackendHealthMonitor — periodic probe + circuit breaker
@@ -87,14 +91,16 @@ turnstone/
     _config.py        Base ChannelConfig dataclass
     discord/          Discord adapter (bot, cog, views, streaming, config)
   shared_static/      Shared design system (base.css, auth.js, theme.js, toast.js, utils.js, kb.js)
+    katex-0.16.40/    Vendored KaTeX math rendering library (MIT, woff2 fonts)
   ui/
     colors.py         ANSI color constants with NO_COLOR support
     markdown.py       Streaming terminal markdown renderer (line-buffered)
     spinner.py        Braille character spinner (daemon thread)
     static/
       index.html      Single-page app shell (links to CSS and JS)
-      style.css       Page-specific UI styles (dashboard layout, approval blocks)
-      app.js          Page-specific client-side JavaScript (SSE, workstreams, markdown)
+      style.css       Page-specific UI styles (dashboard, markdown elements, approval blocks)
+      renderer.js     Markdown + LaTeX renderer (tables, nested lists, blockquotes, KaTeX math)
+      app.js          Split-pane UI (Pane class, binary layout tree, SSE, tool approval)
   tools/
     *.json            15 tool schemas (OpenAI function-calling format + turnstone metadata)
 ```
@@ -129,6 +135,7 @@ A user message flows through the system as follows:
      |                                  on_reasoning_token() / on_content_token()
      |                                  accumulate tool_calls from deltas
      |                                  track finish_reason
+     |                                  _check_cancelled() per chunk (cooperative cancel)
      v
  finish_reason check:
      +--- "length"  --> warn, discard partial tool_calls
@@ -174,11 +181,13 @@ Phase 2: APPROVE (serial, blocking)
   _emit_state("running")
 
 Phase 3: EXECUTE (parallel)
+  _check_cancelled()  <-- cancellation checkpoint before execution starts
   if len(items) == 1:
     run_one(items[0])
   else:
     ThreadPoolExecutor(max_workers=4).map(run_one, items)
   Bash tool streams stdout line-by-line via ui.on_tool_output_chunk(call_id, line)
+    (cancel_event also checked per line — kills process group on cancel)
   Final output (stdout + stderr) delivered via ui.on_tool_result(call_id, name, output)
   call_id links tool_info items → streaming chunks → final result
   For plan tool: post-execution gate via ui.on_plan_review()
@@ -209,6 +218,11 @@ The engine emits state changes via `_emit_state()` which calls
   "idle"       --->  no more tool calls, turn complete
       |
   (or "error"  --->  exception or KeyboardInterrupt)
+
+  cancel() may be called from any state. It sets a cooperative flag
+  checked at each streaming chunk, before tool execution, and inside
+  bash commands. The session transitions to "idle" with partial
+  content preserved, emitting on_info("[Generation cancelled]").
 ```
 
 ---
@@ -339,7 +353,7 @@ remove the tab immediately. Controlled by `--workstream-idle-timeout` (default:
 
 **Workstream eviction at capacity:** When `WorkstreamManager.create()` would
 exceed `max_workstreams` (configurable via `[server].max_workstreams`, default
-10), the oldest IDLE workstream is automatically evicted to make room. The
+50), the oldest IDLE workstream is automatically evicted to make room. The
 `turnstone_workstreams_evicted_total` counter is incremented on each eviction.
 If no IDLE workstream is available the create request fails as before.
 
@@ -361,12 +375,19 @@ non-idle background workstreams above the input prompt.
 ### Web Workstreams
 
 - **Tab bar**: Each workstream renders as a tab with a colored state indicator
-  (CSS `@keyframes pulse` animation per state).
-- **Per-tab SSE**: `connectContentSSE(wsId)` opens
-  `/v1/api/events?ws_id=<id>` for the active tab's event stream.
+  (CSS `@keyframes pulse` animation per state). Clicking a tab switches the
+  focused pane's workstream (or focuses an existing pane showing that ws).
+- **Split panes**: The UI supports tiling multiple workstreams side-by-side or
+  stacked via a binary layout tree. Each `Pane` instance encapsulates its own
+  SSE connection, message area, input, and state (busy, approval, streaming).
+  Split via right-click context menu, pane header buttons, or keyboard
+  (`Ctrl+\`, `Ctrl+Shift+\`). Max 6 panes; no duplicate workstreams across panes.
+  Layout persisted to `localStorage`.
+- **Per-pane SSE**: `Pane.connectSSE(wsId)` opens
+  `/v1/api/events?ws_id=<id>` for each pane's event stream independently.
 - **Global SSE**: `connectGlobalSSE()` opens `/v1/api/events/global` which
   receives `ws_state` broadcasts from all workstreams, used to update tab
-  indicators without switching.
+  indicators and pane headers without switching.
 - **New tab / close**: POST `/v1/api/workstreams/new`, POST `/v1/api/workstreams/close`.
 
 ### Thread Safety
@@ -427,13 +448,13 @@ from each schema and builds:
 - `PRIMARY_KEY_MAP` -- `{name: primary_key}` for JSON fallback recovery
 - `merge_mcp_tools(builtin, mcp_tools)` -- merges built-in + MCP tools at session init
 
-### 14 Tools by Category
+### 13 Tools by Category
 
 **Read-only (auto-approve)**:
 - `read_file` -- read file contents with optional offset/limit
 - `search` -- ripgrep-based codebase search
 - `man` -- read man pages
-- `recall` -- retrieve stored memories
+- `recall` -- search conversation history
 
 **Write (requires approval)**:
 - `bash` -- execute shell commands (with safety checks via `turnstone.core.safety`)
@@ -447,9 +468,8 @@ from each schema and builds:
 - `task` -- delegate to a sub-agent with full tool access (`TASK_AGENT_TOOLS`)
 - `plan` -- explore codebase and write a structured plan (`AGENT_TOOLS`)
 
-**Memory (persistent key-value store)**:
-- `remember` -- save a fact
-- `forget` -- delete a fact
+**Memory (structured persistent store)**:
+- `memory` -- save, search, delete, or list memories (typed and scoped)
 
 ### Prepare / Execute Pattern
 
@@ -495,8 +515,18 @@ independently, then returns the final content as the tool result.
 and exposes their tools alongside built-in tools. The MCP SDK is fully async; turnstone
 bridges this with a background asyncio event loop in a daemon thread.
 
+**Configuration sources:** MCP servers can be defined in config files (TOML/JSON)
+or in the database via the admin UI. Database-backed definitions are managed
+through the console admin panel's MCP Servers tab and stored in the
+`mcp_servers` table. On startup, `load_mcp_config(storage=)` uses
+first-match-wins priority: DB rows (if any enabled) take precedence over
+config files. The console can trigger a cluster-wide reload (`POST
+/_internal/mcp-reload`) that causes each node to call `reconcile_sync()`,
+which diffs the running MCP connections against the current DB state and
+adds, removes, or reconnects servers as needed.
+
 **Lifecycle:**
-1. `create_mcp_client()` reads server configs from TOML or JSON
+1. `create_mcp_client()` reads server configs from TOML/JSON and database
 2. `MCPClientManager.start()` launches the background event loop thread
 3. `_connect_all()` connects to each server (stdio subprocess or HTTP), runs
    `initialize()` + `list_tools()`, converts schemas to OpenAI format, detects
@@ -527,6 +557,17 @@ at connection time (server names with `__` are rejected).
 servers are unaffected. Tool execution errors return error strings to the LLM
 rather than crashing the session.
 
+**Registry discovery:** The console admin panel provides a registry discovery
+surface backed by the official MCP Registry (registry.modelcontextprotocol.io).
+`MCPRegistryClient` (`turnstone/core/mcp_registry.py`) is a standalone httpx
+async client that queries the registry's v0.1 API for server discovery. Search
+results are annotated with installed status by cross-referencing the
+`mcp_servers` table. Installation creates a DB row with `registry_name`,
+`registry_version`, and `registry_meta` columns (migration 019), then triggers
+cluster-wide node reload via `_notify_nodes_mcp_reload()`. The registry URL is
+configurable via the `mcp.registry_url` setting for enterprise/private
+registries.
+
 ### Provider Adapter Layer
 
 > See also: [Core Engine Classes diagram](diagrams/png/03-core-engine-classes.png)
@@ -562,7 +603,7 @@ LLMProvider (protocol)
 | `StreamChunk` | `content_delta`, `reasoning_delta`, `tool_call_deltas`, `info_delta`, `usage`, `finish_reason` |
 | `CompletionResult` | `content`, `tool_calls`, `finish_reason`, `usage` |
 | `ModelCapabilities` | `context_window`, `max_output_tokens`, `supports_temperature`, `token_param`, `thinking_mode`, `supports_effort`, `supports_web_search`, `supports_tool_search`, `supports_vision` |
-| `UsageInfo` | `prompt_tokens`, `completion_tokens`, `total_tokens` |
+| `UsageInfo` | `prompt_tokens`, `completion_tokens`, `total_tokens`, `cache_creation_tokens`, `cache_read_tokens` |
 
 **OpenAIProvider** (`_openai.py`): passes messages through unchanged (they are
 already in OpenAI format), including multi-part content blocks (text + images)
@@ -570,7 +611,10 @@ in tool results. Model capability lookup table covers GPT-5/5.1/5.2/5.3/5.4,
 O-series, and search models (`gpt-5-search-api`) — all with `supports_vision`.
 For search models, injects `web_search_options` and removes the `web_search`
 function tool (the model always searches). Citations from `url_citation`
-annotations are formatted as footnotes. Unknown models (local servers) get
+annotations are formatted as footnotes. Extended prompt cache retention
+(`prompt_cache_retention: "24h"`) is enabled for GPT-5.x models at no
+additional cost. Cached token counts are extracted from
+`usage.prompt_tokens_details.cached_tokens`. Unknown models (local servers) get
 permissive defaults with `supports_vision=False` and use Tavily for web search.
 
 **AnthropicProvider** (`_anthropic.py`): converts OpenAI-format messages to
@@ -584,8 +628,14 @@ Sonnet 4.6. Replaces the `web_search` function tool with Anthropic's native
 `web_search_20250305` server-side tool — Claude decides when to search, the
 API executes it, and results stream back as `server_tool_use` /
 `web_search_tool_result` content blocks (emitted as `info_delta` for UI
-display). The `anthropic` SDK is imported lazily so it remains an optional
-dependency (`pip install turnstone[anthropic]`).
+display). Automatic prompt caching is enabled via top-level `cache_control:
+{"type": "ephemeral"}` — the API places the cache breakpoint on the last
+cacheable block and advances it as conversations grow (90% input cost
+reduction on cache hits, 1.25x write on first turn). Cache metrics
+(`cache_creation_input_tokens`, `cache_read_input_tokens`) are extracted from
+both streaming and non-streaming responses. The `anthropic` SDK is imported
+lazily so it remains an optional dependency (`pip install
+turnstone[anthropic]`).
 
 **Factory functions** (`__init__.py`): `create_provider(name)` returns a
 singleton provider instance (thread-safe). `create_client(name, base_url,
@@ -655,7 +705,8 @@ supports_vision = true
 
 **Per-workstream selection:** `POST /v1/api/workstreams/new` accepts an optional
 `"model"` field. The bridge `CreateWorkstreamMessage` carries the same field
-through the MQ protocol.
+through the MQ protocol, along with `skill` (skill name)
+which can override the model before workstream creation.
 
 ### Tool Output Truncation
 
@@ -784,10 +835,16 @@ and are the single source of truth for both backends and Alembic migrations.
 backend = "sqlite"                  # "sqlite" | "postgresql"
 path = ".turnstone.db"              # SQLite file path
 url = ""                            # PostgreSQL connection URL
-pool_size = 5                       # PostgreSQL connection pool size
+pool_size = 2                       # PostgreSQL connection pool size (per process)
 ```
 
-Environment variables: `TURNSTONE_DB_BACKEND`, `TURNSTONE_DB_URL`, `TURNSTONE_DB_PATH`.
+Environment variables: `TURNSTONE_DB_BACKEND`, `TURNSTONE_DB_URL`, `TURNSTONE_DB_PATH`,
+`TURNSTONE_DB_POOL_SIZE`.
+
+The default pool is intentionally small (2 base + 3 overflow = 5 per process)
+because all database operations are short-burst queries that hold connections for
+milliseconds. For clusters with many nodes sharing a PostgreSQL instance, use
+[PgBouncer](pgbouncer.md) in transaction pooling mode.
 
 ### Persistence and Resume
 
@@ -909,6 +966,9 @@ warns if the summary was truncated.
   seeded with `history.replaceState({turnstone: 'dashboard'})` on load. The
   `popstate` listener restores the correct tab or shows the dashboard,
   guarded by `_historyNavigation = true` to prevent re-entrant pushState.
+- **Pane focus**: `mousedown` and `focusin` events on pane containers update
+  `focusedPaneId`. Approval shortcuts (y/n/a) apply to the focused pane.
+  `Ctrl+Alt+Arrow` cycles focus between panes.
 
 ### Eval Resilience
 
@@ -1006,8 +1066,8 @@ Three hierarchical scopes control endpoint access:
 - **Console** is the auth management hub — it hosts the admin endpoints for
   creating users, issuing API tokens, and managing channel mappings. User
   records and token hashes live in the shared storage backend. The console
-  dashboard includes an **admin panel** (Users and Tokens tabs) for managing
-  credentials through the browser.
+  dashboard includes an **admin panel** (14 tabs) for managing
+  credentials, governance, MCP servers, and runtime settings through the browser.
 - **Server** is a JWT validator only — it validates tokens on each request but
   never creates users or tokens. Both processes share the same `jwt_secret`
   (via `TURNSTONE_JWT_SECRET` env var or `[auth].jwt_secret` config).
@@ -1173,9 +1233,18 @@ bridge auto-approves via `POST /v1/api/approve`. Otherwise, it publishes an
 `BLPOP` of a Redis response queue (`turnstone:resp:{request_id}`) until the client pushes
 a response or the approval timeout (default 3600s / 1 hour) expires.
 
+**Cancellation:** The `CancelMessage` (type `"cancel"`) is a routed inbound message.
+The bridge dispatches it to `POST /v1/api/cancel` on the server owning the workstream,
+which sets the cooperative cancel flag and unblocks any pending approval/plan waits.
+
 **Completion detection:** The bridge tracks which `correlation_id` maps to which
-`ws_id` for active sends. When the global SSE reports `ws_state → idle` for a tracked
-workstream, the bridge emits a synthetic `TurnCompleteEvent` with the correlation ID.
+`ws_id` for active sends. The server accumulates content tokens in the WebUI and
+piggybacks the full response text onto the `ws_state → idle` global SSE event.
+When the bridge receives this event, it emits a synthetic `TurnCompleteEvent`
+carrying the correlation ID and the server-provided `content`. This lets downstream
+consumers (e.g. the Discord bot) recover the full response when individual
+`ContentEvent`s were missed, and serves as the primary delivery path for
+bidirectional notification DM forwarding.
 
 **Multi-node routing:** Each bridge retrieves its `node_id` from the server's
 `/health` endpoint on startup (with exponential backoff retry). The server
@@ -1225,7 +1294,11 @@ The console has two write-path capabilities:
 1. **Workstream creation** — pushes `CreateWorkstreamMessage` to Redis inbound
    queues targeting specific nodes. The bridge on each node picks up the message
    and creates the workstream on the local server. Auto-selects the node with
-   the most available capacity if no target is specified.
+   the most available capacity if no target is specified. When a `skill`
+   field is present, the server resolves the skill BEFORE `mgr.create()`
+   (applying the model override to the creation request) and snapshot-applies
+   remaining settings (auto-approve, token budget, temperature, etc.) to the
+   workstream config AFTER creation.
 
 2. **Reverse proxy** — serves each node's server UI through the console port at
    `/node/{node_id}/`. Uses `httpx.AsyncClient` to proxy HTTP and SSE traffic.
@@ -1335,8 +1408,86 @@ directly over HTTP for lower latency: `_exec_notify()` queries the
 `services` database table for healthy channel gateways (heartbeat within
 120 seconds), authenticates with a service JWT (`aud: turnstone-channel`),
 and POSTs to `POST /v1/api/notify` on the first healthy gateway. The
-gateway validates the JWT, resolves the target (username lookup via
+payload includes the originating `ws_id` for reply routing. The gateway
+validates the JWT, resolves the target (username lookup via
 `channel_users` or direct `channel_type`+`channel_id`), and delegates to
-the appropriate `ChannelAdapter.send()`. Delivery retries up to 3 times
-with backoff, re-querying the service registry on each attempt. See
-[Notification Flow diagram](diagrams/png/17-notify-flow.png).
+`ChannelAdapter.send_notification()` which sends the message and tracks
+the outgoing message ID → `(ws_id, target_user_id)` mapping. Delivery
+retries up to 3 times with backoff, re-querying the service registry on
+each attempt. See [Notification Flow diagram](diagrams/png/17-notify-flow.png).
+
+**Bidirectional replies:** When a user replies to a notification DM, the
+Discord bot looks up the originating `ws_id` from the tracked message ID,
+verifies the replying user matches the notification recipient, and routes
+the reply to the workstream via `router.send_message()`. The workstream's
+response is forwarded back to the DM via a temporary entry in
+`_notify_reply_channels`. On `TurnCompleteEvent`, the response message is
+itself tracked for further replies, enabling multi-turn DM conversations
+without requiring the user to open the web UI. Tracking entries are capped
+at 100 (FIFO eviction) and cleaned up on workstream close.
+
+---
+
+## Governance
+
+> See also: [Governance documentation](governance.md) | [Governance Architecture diagram](diagrams/19-governance-architecture.puml)
+
+Turnstone governance extends the Phase 1 auth system with role-based access
+control (RBAC), tool execution policies, skills, usage tracking,
+and audit logging. The permission model has two layers: legacy scopes
+(`read`, `write`, `approve`) checked by `AuthMiddleware`, and 15 granular
+permissions checked per-endpoint by `require_permission()`. Three built-in
+roles (admin, operator, viewer) are seeded by migration 008; custom roles
+can be created with any permission subset. JWTs carry both `scopes` and
+`permissions` claims for backward compatibility.
+
+Tool policies use glob pattern matching (`fnmatch`) with priority-ordered
+first-match-wins evaluation to control tool execution (allow/deny/ask).
+Skills provide reusable system messages with `{{variable}}` substitution
+plus session configuration (model, temperature, auto-approve, token budget,
+etc.). Usage events are recorded per-LLM-request for token accounting.
+An append-only audit log captures all admin mutations.
+
+Skills are snapshot-applied once at workstream creation — not a live binding.
+The `prompt_templates` table (which stores skills) supports auto-versioning,
+and workstreams record which skill and version spawned them. Token budget
+enforcement tracks consumption in `session.send()` with 80% warning and
+100% approval gate via the `__budget_override__` synthetic tool name.
+
+The console admin panel adds 5 governance tabs (Roles, Policies, Skills,
+Usage, Audit), a Memories tab, a Settings tab (form-based editor for all
+ConfigStore settings), and an MCP Servers tab (database-backed server
+definitions with live connection status and cluster-wide reload) for a
+total of 13 tabs, all permission-gated.
+Both Python and TypeScript SDKs expose governance methods on the console
+client.
+
+## Intent Validation
+
+> See also: [Intent Validation guide](judge.md) | [Judge Architecture diagram](diagrams/png/22-judge-architecture.png)
+
+Intent validation provides advisory risk assessments for tool calls that
+require human approval. The system runs a two-tier evaluation pipeline
+implemented in `turnstone/core/judge.py`:
+
+1. **Heuristic tier** (synchronous, sub-millisecond) -- A priority-ordered
+   rule table using fnmatch tool patterns and regex argument patterns. Four
+   severity levels: critical (deny), high (review), medium (review), low
+   (approve). First match wins. The heuristic verdict is attached to the
+   `approve_request` SSE event immediately.
+
+2. **LLM judge tier** (asynchronous, daemon thread) -- A multi-turn evaluation
+   where the judge LLM receives conversation context and tool call details,
+   optionally uses `read_file`/`list_directory` to gather evidence (with
+   security-hardened path blocking), and produces a structured JSON verdict.
+   If the LLM verdict has higher confidence than the heuristic, it replaces
+   it via an `intent_verdict` SSE event.
+
+The judge is session-scoped (`IntentJudge`), lazy-initialized on first
+approval, and configured via the `[judge]` config section or `--judge` CLI
+flags. By default it uses self-consistency (same model), but supports
+cross-model and cross-provider configurations. Sub-agents (plan, task)
+are exempt. All verdicts are persisted to the `intent_verdicts` table
+(migration 012) with the user's final decision, enabling future calibration.
+The console exposes `GET /v1/api/admin/verdicts` for audit queries
+(requires `admin.judge` permission).

docs/channels.md

@@ -30,8 +30,8 @@ Key components:
 
 - **ChannelAdapter protocol** (`turnstone/channels/_protocol.py`) — generic
   interface for any messaging platform. Defines `start()`, `stop()`,
-  `send()`, `edit_message()`, `send_approval_request()`,
-  `send_plan_review()`, and `create_thread()`.
+  `send()`, `send_notification()`, `edit_message()`,
+  `send_approval_request()`, `send_plan_review()`, and `create_thread()`.
 - **ChannelRouter** (`turnstone/channels/_routing.py`) — maps
   channel/thread IDs to turnstone workstream IDs. Handles workstream
   creation via MQ, stale route detection, and user identity resolution.
@@ -271,13 +271,43 @@ gateway directly over HTTP:
 2. `_exec_notify()` queries the `services` table for healthy channel
    gateways (heartbeat within the last 120 seconds)
 3. The server mints a service JWT (`aud: turnstone-channel`) via
-   `ServiceTokenManager` and POSTs to the first healthy gateway
+   `ServiceTokenManager` and POSTs to the first healthy gateway. The
+   payload includes the originating `ws_id` for reply routing.
 4. The gateway validates the JWT, resolves the target, and calls
-   `adapter.send()` on the appropriate platform adapter
+   `adapter.send_notification()` which sends the message and tracks
+   the outgoing message ID for reply routing
 5. On failure, the server tries the next gateway. If all fail, it
    retries up to 2 more times (delays: 1s, 3s), re-querying the
    service registry on each attempt
 
+### Bidirectional Replies
+
+Notifications support multi-turn DM conversations. When a user replies
+to a notification DM:
+
+1. The bot looks up the originating `ws_id` from the tracked message ID
+   (`_notify_ws_map`)
+2. Verifies the replying user matches the original notification
+   recipient (defence in depth — Discord DMs are already private)
+3. Routes the reply to the workstream via `router.send_message()`
+4. Registers the DM channel for response forwarding
+   (`_notify_reply_channels`)
+5. When the workstream responds (`TurnCompleteEvent`), the response is
+   forwarded to the DM
+6. The response message is itself tracked, so the user can reply again
+   for another turn
+
+This enables scenarios like an oncall engineer responding to a CI/CD
+failure notification from their phone before opening a laptop.
+
+**Limits:**
+
+- Tracking map capped at 100 entries (FIFO eviction of oldest)
+- Entries cleaned up on workstream close/unsubscribe
+- Replying to an expired notification sends
+  *"This notification is no longer active."*
+- DM reply content capped at 4096 characters
+
 ### Service Registry
 
 The channel gateway registers itself in the `services` database table
@@ -328,12 +358,18 @@ class ChannelAdapter(Protocol):
     async def start(self) -> None: ...
     async def stop(self) -> None: ...
     async def send(self, channel_id: str, content: str) -> str: ...
+    async def send_notification(self, channel_id: str, content: str, ws_id: str) -> str: ...
     async def edit_message(self, channel_id: str, message_id: str, content: str) -> None: ...
     async def send_approval_request(self, channel_id: str, ws_id: str, correlation_id: str, items: list[dict]) -> None: ...
     async def send_plan_review(self, channel_id: str, ws_id: str, correlation_id: str, content: str) -> None: ...
     async def create_thread(self, parent_channel_id: str, name: str, message_id: str = "") -> str: ...
 ```
 
+`send_notification()` is like `send()` but associates the outgoing
+message with a `ws_id` so that user replies can be routed back to the
+originating workstream. Adapters must track the mapping from outgoing
+message ID to `(ws_id, target_user_id)` and handle DM replies.
+
 To add a new platform:
 
 1. Create `turnstone/channels/<platform>/` package

docs/console.md

@@ -69,10 +69,11 @@ All reads and writes to the node/workstream map are protected by a single `threa
 
 ### Scale Considerations
 
-- **10,000 workstreams** at ~500 bytes each = ~5 MB in memory
-- **1,000 nodes** polled in parallel with 50 threads at ~100ms each = ~2 second poll cycle
+- **50,000 workstreams** (1,000 nodes × 50 per node) at ~500 bytes each = ~25 MB in memory
+- **1,000 nodes** polled in parallel — fan-out concurrency is configurable via `cluster.node_fan_out_limit` (default 200), yielding 5 batches at ~100ms each = ~0.5 second poll cycle
 - **Filtering and pagination** run in-memory on the full workstream list — sub-millisecond at this scale
-- **SSE fan-out** uses the same per-client queue pattern as the per-node server — backed-up clients get events dropped, not blocking
+- **SSE fan-out** uses per-client queues (2,000 events) — backed-up clients get events dropped, not blocking
+- **Database** — for clusters sharing PostgreSQL, use [PgBouncer](pgbouncer.md) in transaction pooling mode
 
 ---
 
@@ -395,6 +396,7 @@ Breadcrumb: `Cluster > Running` or `Cluster > db-west-04`. Server-side paginated
 Triggered by the "+ new" header button. A modal dialog with:
 
 - **Node selector** — dropdown with three targeting modes: "Auto (best available)" picks the node with the most headroom, "General pool (any node)" pushes to the shared queue for any bridge to pick up, or a specific node from the list (showing capacity).
+- **Profile** — optional dropdown listing enabled skills. Applies the skill's model, auto-approve policy, token budget, and other behavioral settings at creation time.
 - **Name** — optional text input. Auto-generated if left empty.
 - **Model** — optional text input for a model alias from the target node's registry.
 
@@ -407,8 +409,11 @@ The browser maintains a local `clusterState` object that mirrors the cluster sna
 ### 5. Admin Panel
 
 Accessed via the "admin" button in the header (visible when authenticated
-with `approve` scope). Provides user, API token, and channel link management
-with three tabs:
+with `approve` scope). Provides user, API token, channel link, MCP server,
+and skill management with 13 tabs (see also
+[Governance](governance.md) for
+the Roles, Policies, Skills, Usage, and Audit tabs, and
+[Settings](settings.md) for the database-backed configuration editor):
 
 **Users tab:**
 
@@ -444,6 +449,22 @@ with three tabs:
 - Admins can force-link users who have not self-linked via `/link` in
   Discord
 
+**MCP Servers tab:**
+
+The tab has two views toggled via a pill control: **Servers** and
+**Registry**.
+
+- **Servers view** -- lists all installed MCP servers with source badges
+  (CONFIG, MANUAL, REGISTRY), transport badges, tool/resource/prompt
+  counts, per-node connection status, and CRUD actions for DB-managed
+  servers
+- **Registry view** -- search the official MCP Registry to discover and
+  install servers. Results show server name, description, version, source
+  type badges (remote/npm/pypi), and Install/Installed/Update buttons.
+  Remote servers without required configuration are installed with one
+  click; servers needing env vars, headers, or URL variables open an
+  install modal for configuration
+
 **Accessibility:**
 
 - Full keyboard navigation: focus traps in modals, Escape to close, arrow

docs/diagrams/02-package-structure.puml

@@ -75,6 +75,7 @@ package "turnstone/ui/" <<Rectangle>> {
     component [colors.py\nANSI colors] as colors <<ui>>
     component [markdown.py\nMD rendering] as markdown <<ui>>
     component [spinner.py\nTerminal spinner] as spinner <<ui>>
+    component [renderer.js\nBrowser MD + LaTeX] as renderer <<ui>>
 }
 
 ' API schemas
@@ -96,7 +97,7 @@ package "turnstone/sdk/" <<Rectangle>> {
 
 ' Tool schemas
 package "turnstone/tools/" <<Rectangle>> {
-    component [*.json\n15 tool schemas] as schemas <<artifact>>
+    component [*.json\n18 tool schemas] as schemas <<artifact>>
 }
 
 ' Entry point dependencies

docs/diagrams/03-core-engine-classes.puml

@@ -84,6 +84,8 @@ class "OpenAIProvider" as OpenAIProv {
     in OpenAI format.
     Search models: web_search_options
     + url_citation annotations.
+    Extended cache: 24h retention
+    for GPT-5.x (free).
     --
     core/providers/_openai.py
 }
@@ -94,6 +96,8 @@ class "AnthropicProvider" as AnthropicProv {
     Adaptive + manual thinking.
     Native web search via
     web_search_20250305 server tool.
+    Auto prompt caching via
+    cache_control: ephemeral.
     Lazy anthropic SDK import.
     --
     core/providers/_anthropic.py
@@ -211,15 +215,23 @@ enum "WorkstreamState" as WsState {
 class "MCPClientManager" as MCPMgr {
     - _sessions: dict[str, ClientSession]
     - _per_server_tools: dict[str, list[dict]]
+    - _per_server_resources: dict[str, list[dict]]
+    - _per_server_prompts: dict[str, list[dict]]
     - _tools: list[dict]
     - _tool_map: dict[str, tuple]
+    - _resource_map: dict[str, tuple]
+    - _prompt_map: dict[str, tuple]
     - _supports_list_changed: dict[str, bool]
     - _listeners: list[Callable]
     --
     + start()
     + get_tools() → list[dict]
+    + get_resources() → list[dict]
+    + get_prompts() → list[dict]
     + is_mcp_tool(name) → bool
     + call_tool_sync(name, args) → str
+    + read_resource_sync(uri) → str
+    + get_prompt_sync(name, args?) → list[dict]
     + refresh_sync(server?) → dict
     + add_listener(callback)
     + remove_listener(callback)
@@ -230,19 +242,19 @@ class "MCPClientManager" as MCPMgr {
     bridges async MCP SDK to
     sync ChatSession dispatch.
     Push + periodic + manual refresh.
+    Resources + prompts discovered
+    alongside tools at startup.
     --
     core/mcp_client.py
 }
 
 ' ToolSearchManager
 class "ToolSearchManager" as ToolSearchMgr {
-    - _all_tools: list[dict]
     - _always_on: list[dict]
     - _deferred: list[dict]
     - _expanded: dict[str, None]
     - _index: BM25Index
     --
-    + should_activate() → bool
     + get_visible_tools() → list[dict]
     + get_deferred_tools() → list[dict]
     + get_expanded_names() → list[str]

docs/diagrams/04-conversation-turn.puml

@@ -57,6 +57,14 @@ group loop [while tool_calls present]
         end
     end
 
+        note right of CS
+          **Cancellation checkpoint:**
+          _check_cancelled() runs per chunk.
+          If cancel_event is set, raises
+          GenerationCancelled — preserves
+          partial content, emits idle state.
+        end note
+
     LLM --> CS : stream complete (usage stats)
     deactivate LLM
 
@@ -119,7 +127,7 @@ group loop [while tool_calls present]
           math → sandboxed subprocess
           web_fetch → httpx + LLM summarize
           web_search → provider-native or Tavily fallback
-          remember/recall/forget → SQLite
+          memory/recall → SQLite
         end note
 
         note right of TP
@@ -144,6 +152,12 @@ group loop [while tool_calls present]
         end
 
         note right of CS : Loop back for next LLM call
+
+    else GenerationCancelled
+        CS -> CS : Preserve partial content\nor roll back incomplete tools
+        CS -> UI : on_info("[Generation cancelled]")
+        CS -> UI : on_state_change("idle")
+        CS --> User : return (no re-raise)
     end
 
 end

docs/diagrams/05-tool-pipeline.puml

@@ -24,29 +24,30 @@ partition "Phase 1: Prepare" #E8F5E9 {
         :Dispatch to _prepare_{func_name}();
 
         note right
-            **Dispatch table (16 tools):**
-            ┌──────────────┬──────────────────┐
-            │ Tool         │ Needs Approval?  │
-            ├──────────────┼──────────────────┤
-            │ bash         │ ✓ Yes            │
-            │ read_file    │ ✗ Auto-approve   │
-            │ write_file   │ ✓ Yes            │
-            │ edit_file    │ ✓ Yes            │
-            │ search       │ ✗ Auto-approve   │
-            │ math         │ ✓ Yes            │
-            │ man          │ ✗ Auto-approve   │
-            │ web_fetch    │ ✓ Yes            │
-            │ web_search   │ ✓ Yes            │
-            │ tool_search  │ ✗ Auto-approve   │
-            │ task         │ ✓ Yes            │
-            │ plan         │ ✓ Yes            │
-            │ remember     │ ✗ Auto-approve   │
-            │ recall       │ ✗ Auto-approve   │
-            │ forget       │ ✗ Auto-approve   │
-            │ notify       │ ✗ Auto-approve   │
-            ├──────────────┼──────────────────┤
-            │ mcp__*       │ ✓ Yes (external) │
-            └──────────────┴──────────────────┘
+            **Dispatch table (17 tools):**
+            ┌───────────────┬──────────────────┐
+            │ Tool          │ Needs Approval?  │
+            ├───────────────┼──────────────────┤
+            │ bash          │ ✓ Yes            │
+            │ read_file     │ ✗ Auto-approve   │
+            │ write_file    │ ✓ Yes            │
+            │ edit_file     │ ✓ Yes            │
+            │ search        │ ✗ Auto-approve   │
+            │ math          │ ✗ Auto-approve   │
+            │ man           │ ✗ Auto-approve   │
+            │ web_fetch     │ ✗ Auto-approve   │
+            │ web_search    │ ✗ Auto-approve   │
+            │ tool_search   │ ✗ Auto-approve   │
+            │ task          │ ✓ Yes            │
+            │ plan          │ ✓ Yes            │
+            │ memory        │ ✗ Auto-approve   │
+            │ recall        │ ✗ Auto-approve   │
+            │ notify        │ ✗ Auto-approve   │
+            │ read_resource │ ✓ Yes            │
+            │ use_prompt    │ ✓ Yes            │
+            ├───────────────┼──────────────────┤
+            │ mcp__*        │ ✓ Yes (external) │
+            └───────────────┴──────────────────┘
         end note
 
         :Build item dict:
@@ -68,8 +69,8 @@ partition "Phase 2: Approve" #FFF3E0 {
             **TerminalUI**: Print headers/previews,
             prompt [y/n/a, optional message]
             If user chose "always":
-              Set ui.auto_approve = True
-              (auto-approve all future tools in this session)
+              Add pending tool names to auto_approve_tools
+              (auto-approve these tool types going forward)
             **WebUI**: Enqueue approve_request,
             block on _approval_event.wait()
             **NullUI**: Return (True, None)
@@ -88,6 +89,8 @@ partition "Phase 2: Approve" #FFF3E0 {
 }
 
 partition "Phase 3: Execute" #E3F2FD {
+    :_check_cancelled();
+    note right: Cancellation checkpoint:\nraises GenerationCancelled if\ncancel event is set
     if (single tool call?) then (yes)
         :Execute sequentially:\nrun_one(items[0]);
     else (multiple)
@@ -112,9 +115,10 @@ partition "Phase 3: Execute" #E3F2FD {
           ├─ _exec_task: _run_agent(TASK_AGENT_TOOLS)
           ├─ _exec_plan: _run_agent(AGENT_TOOLS, read-only)
           ├─ _exec_notify: HTTP POST to channel gateway
-          ├─ _exec_remember: SQLite INSERT OR REPLACE
-          ├─ _exec_recall: SQLite FTS5/LIKE search
-          ├─ _exec_forget: SQLite DELETE
+          ├─ _exec_memory: structured memory save/search/delete/list
+          ├─ _exec_recall: conversation history FTS5 search
+          ├─ _exec_read_resource: MCPClientManager.read_resource_sync()
+          ├─ _exec_use_prompt: MCPClientManager.get_prompt_sync()
           └─ _exec_mcp_tool: MCPClientManager.call_tool_sync()
     end note
 

docs/diagrams/06-mq-protocol.puml

@@ -3,8 +3,9 @@
 title Turnstone — Message Queue Protocol Types
 skinparam classAttributeIconSize 0
 skinparam packageStyle rectangle
+skinparam packageBorderThickness 2
 
-package "Inbound Messages (Client → Bridge)" #FFF3E0 {
+package "Inbound Messages (Client → Bridge)" as InPkg #FFF3E0 {
 
     abstract class "InboundMessage" as IM {
         + type: str
@@ -59,6 +60,7 @@ package "Inbound Messages (Client → Bridge)" #FFF3E0 {
         + auto_approve_tools: list[str] = []
         + target_node: str = ""
         + initial_message: str = ""
+        + skill: str = ""
     }
 
     class CloseWorkstreamMessage {
@@ -79,6 +81,12 @@ package "Inbound Messages (Client → Bridge)" #FFF3E0 {
         type = "list_nodes"
     }
 
+    class CancelMessage {
+        type = "cancel"
+        --
+        + ws_id: str
+    }
+
     IM <|-- SendMessage
     IM <|-- ApproveMessage
     IM <|-- PlanFeedbackMessage
@@ -88,9 +96,10 @@ package "Inbound Messages (Client → Bridge)" #FFF3E0 {
     IM <|-- ListWorkstreamsMessage
     IM <|-- HealthMessage
     IM <|-- ListNodesMessage
+    IM <|-- CancelMessage
 }
 
-package "Outbound Events (Bridge → Client)" #E3F2FD {
+package "Outbound Events (Bridge → Client)" as OutPkg #E3F2FD {
 
     abstract class "OutboundEvent" as OE {
         + type: str
@@ -158,6 +167,8 @@ package "Outbound Events (Bridge → Client)" #E3F2FD {
             + context_window: int
             + pct: float
             + effort: str
+            + cache_creation_tokens: int
+            + cache_read_tokens: int
         }
         class StateChangeEvent {
             type = "state_change"
@@ -165,6 +176,7 @@ package "Outbound Events (Bridge → Client)" #E3F2FD {
         }
         class TurnCompleteEvent {
             type = "turn_complete"
+            + content: str
         }
     }
 
@@ -236,6 +248,8 @@ package "Outbound Events (Bridge → Client)" #E3F2FD {
     OE <|-- ClusterStateEvent
 }
 
+SendMessage -[hidden]down- OE
+
 note bottom of IM
   **Deserialization**: Strict type-dispatch via _INBOUND_REGISTRY.
   Unknown type raises ValueError.

docs/diagrams/07-message-routing.puml

@@ -39,8 +39,8 @@ BridgeA -> Redis : PUBLISH turnstone:events:abc12345\nAckEvent(status:"ok")
 ... SSE events flow: content, tool_output_chunk, tool_result, status, state_change ...
 
 BridgeA -> Redis : PUBLISH turnstone:events:abc12345\nContentEvent, ToolResultEvent, ...
-BridgeA -> Redis : PUBLISH turnstone:events:global\nStateChangeEvent(state:"idle")
-BridgeA -> Redis : PUBLISH turnstone:events:abc12345\nTurnCompleteEvent
+BridgeA -> Redis : PUBLISH turnstone:events:global\nStateChangeEvent(state:"idle", content:"...")
+BridgeA -> Redis : PUBLISH turnstone:events:abc12345\nTurnCompleteEvent(content:"...")
 
 == Scenario B: Directed Message to Specific Node ==
 
@@ -79,7 +79,7 @@ note right of BridgeA
   1. _ws_auto_approve[ws_id]? → auto
   2. All tools in safe set? → auto
      (read_file, search, man,
-      remember, recall, forget)
+      memory, recall)
   3. Otherwise → manual approval
 end note
 

docs/diagrams/09-workstream-states.puml

@@ -40,6 +40,12 @@ running --> error : Exception during\ntool execution
 
 error --> thinking : New send() call\n_emit_state("thinking")
 
+thinking --> idle : cancel() called\n_emit_state("idle")
+
+running --> idle : cancel() called\n_emit_state("idle")
+
+attention --> idle : cancel() unblocks\napproval/plan wait\n_emit_state("idle")
+
 note right of thinking
   **Emitted via:**
   session._emit_state(state)

docs/diagrams/11-console-data-flow.puml

@@ -105,7 +105,7 @@ Server -> CC : get_snapshot()
 CC --> Server : ClusterSnapshot\n(full current state)
 
 Server -> CC : register_listener(queue)
-note right : Per-client queue.Queue(maxsize=500)\nSSE via EventSourceResponse + run_in_executor()
+note right : Per-client queue.Queue(maxsize=2000)\nSSE via EventSourceResponse + run_in_executor()
 
 Server -> Browser : data: {"type":"snapshot",...}\n(full state as first SSE event)
 

docs/diagrams/12-deployment.puml

@@ -56,6 +56,26 @@ node "Docker Host" as host {
             end note
         }
 
+        node "postgres (profile: production)" <<pgautoupgrade>> as pg_node {
+            component [PostgreSQL\nport 5432] as postgres
+            note bottom of postgres
+                Healthcheck: pg_isready
+                Volume: postgres-data
+                Required for cluster
+                  and production profiles
+            end note
+        }
+
+        node "pgbouncer (optional)" <<bitnami/pgbouncer>> as pgb_node {
+            component [PgBouncer\nport 6432] as pgbouncer
+            note bottom of pgbouncer
+                pool_mode: transaction
+                Recommended for clusters
+                  > 50 nodes
+                See docs/pgbouncer.md
+            end note
+        }
+
         node "sim (profile: sim)" <<turnstone image>> as sim_node {
             component [turnstone-sim] as sim
             note bottom of sim
@@ -92,6 +112,11 @@ console --> server : HTTP polling + proxy\n(GET /v1/api/dashboard,\nproxy /node/
 
 sim --> redis : Redis protocol\n(queues + pubsub + keys)
 
+' Database connections (production/cluster profiles)
+server ..> pgbouncer : PostgreSQL\n(pool_size=2)
+console ..> pgbouncer : PostgreSQL\n(auth/admin)
+pgbouncer --> postgres : transaction\npooling
+
 ' Environment variables
 note right of host
     **Environment Variables:**
@@ -99,13 +124,17 @@ note right of host
     • OPENAI_API_KEY — API key
     • REDIS_PASSWORD — Redis auth
     • TURNSTONE_AUTH_TOKEN — API auth
+    • TURNSTONE_DB_URL — PostgreSQL URL
+    • POSTGRES_PASSWORD — DB password
 end note
 
 ' Volumes
 database "redis-data" as rv
 database "turnstone-data" as tv
+database "postgres-data" as pv
 
 redis_node --> rv
 server_node --> tv
+pg_node --> pv
 
 @enduml

docs/diagrams/13-sdk-architecture.puml

@@ -32,6 +32,7 @@ package "turnstone/sdk/ (Python)" {
         + approve()
         + plan_feedback()
         + command()
+        + cancel(ws_id)
         + stream_events(ws_id)
         + stream_global_events()
         + send_and_wait()

docs/diagrams/14-storage-architecture.puml

@@ -53,10 +53,10 @@ class "SQLiteBackend" as SQLite <<sqlite>> {
 
 class "PostgreSQLBackend" as PG <<postgres>> {
     -_engine: sa.Engine
-    +__init__(url: str, pool_size: int)
+    +__init__(url: str, pool_size: int = 2,\n    max_overflow: int = 3)
     --
     tsvector + ILIKE search
-    Connection pooling
+    Connection pooling (5 max per process)
 }
 
 ' -- Schema --
@@ -64,11 +64,12 @@ class "_schema.py" as Schema <<schema>> {
     +metadata: MetaData
     +memories: Table
     +conversations: Table
-    +workstreams: Table (node_id, alias, title, state)
+    +workstreams: Table (node_id, alias, title,\n    state, skill_id)
     +workstream_config: Table
     +users: Table (username, password_hash)
     +api_tokens: Table (token_hash, scopes)
     +channel_users: Table (channel_type)
+    +scheduled_tasks: Table (..., skill)
     --
     SQLAlchemy Core
     Single source of truth
@@ -150,7 +151,7 @@ note right of Registry
   backend = "sqlite" | "postgresql"
   url = "postgresql+psycopg://..."
   path = ".turnstone.db"
-  pool_size = 5
+  pool_size = 2 (+ 3 overflow)
 end note
 
 note bottom of SQLite
@@ -161,8 +162,9 @@ end note
 
 note bottom of PG
   Production backend.
-  Multi-node / Docker
-  default.
+  Multi-node / Docker default.
+  Use PgBouncer (transaction mode)
+  for clusters > 50 nodes.
 end note
 
 @enduml

docs/diagrams/16-channel-architecture.puml

@@ -53,6 +53,7 @@ class "DiscordBot" as Bot <<service>> {
     +on_message(msg)
     +on_interaction(interaction)
     +send(channel_id, content)
+    +send_notification(channel_id, content, ws_id)
     +run(token)
     --
     discord.py Client
@@ -61,6 +62,9 @@ class "DiscordBot" as Bot <<service>> {
     Creates threads for workstreams
     Renders approval buttons
     escape_mentions() on send
+    --
+    _notify_ws_map: msg_id → (ws_id, user_id)
+    _notify_reply_channels: ws_id → (dm, user_id)
 }
 
 class "ChannelRouter" as Router <<service>> {
@@ -240,11 +244,20 @@ note bottom of SVC
   3. Queries services table for healthy gateways
   4. Mints JWT (aud: turnstone-channel) via
      ServiceTokenManager
-  5. POSTs to first healthy gateway
+  5. POSTs to first healthy gateway (incl. ws_id)
   6. Gateway validates JWT, resolves target
-  7. adapter.send() → Discord API
+  7. adapter.send_notification() → Discord API
+     (tracks msg_id → ws_id for reply routing)
   8. On failure: retry up to 3× (1s, 3s backoff)
   9. SSRF: only http(s) URLs allowed
+
+  **Bidirectional DM Replies**
+  1. User replies to notification DM
+  2. Bot looks up ws_id from _notify_ws_map
+  3. Verifies author == notification recipient
+  4. Routes reply via router.send_message()
+  5. Response forwarded to DM on TurnCompleteEvent
+  6. Response tracked for multi-turn conversation
 end note
 
 @enduml

docs/diagrams/17-notify-flow.puml

@@ -103,6 +103,41 @@ alt all retries exhausted
     Session --> Session : "Error: notification delivery failed"
 end
 
+== Bidirectional Reply (User responds to notification DM) ==
+
+Discord -> Adapter : user replies to\nnotification message
+Adapter -> Adapter : lookup message_id\nin _notify_ws_map
+note right
+  Maps message_id →
+  (ws_id, target_user_id)
+  Atomic pop prevents TOCTOU
+end note
+
+alt message not tracked
+    Adapter -> Discord : "This notification\nis no longer active."
+else tracked
+    Adapter -> Adapter : verify author ==\ntarget_user_id
+    Adapter -> Adapter : resolve_user()\n(unlinked → drop)
+    Adapter -> Adapter : router.send_message(ws_id, content)
+    note right
+      Routes reply via MQ to
+      the originating workstream.
+      Registers DM channel in
+      _notify_reply_channels[ws_id]
+    end note
+
+    ... workstream processes reply ...
+
+    Adapter <- Adapter : TurnCompleteEvent\n(with content)
+    Adapter -> Discord : forward response to DM
+    Adapter -> Adapter : track response message\nfor multi-turn replies
+    note right
+      Response message_id added
+      to _notify_ws_map — user can
+      reply again indefinitely
+    end note
+end
+
 == Service Registry (Background) ==
 
 note over Gateway, Storage

docs/diagrams/19-governance-architecture.puml

@@ -0,0 +1,100 @@
+@startuml
+!theme plain
+skinparam backgroundColor #FFFFFF
+skinparam defaultFontName "IBM Plex Mono"
+skinparam componentStyle rectangle
+
+title Turnstone Governance Architecture
+
+package "Auth Flow" {
+  [Login/Token Auth] as auth
+  [_load_user_permissions()] as perms
+  [_permissions_to_scopes()] as scopes
+  [create_jwt()] as jwt
+}
+
+package "Middleware" {
+  [AuthMiddleware\n(scope check)] as mw
+  [require_permission()\n(granular check)] as rp
+}
+
+package "Governance Storage" {
+  database "roles" as roles_db
+  database "user_roles" as ur_db
+  database "orgs" as orgs_db
+  database "tool_policies" as tp_db
+  database "prompt_templates\n(skills)" as pt_db
+  database "usage_events" as ue_db
+  database "audit_events" as ae_db
+  database "skills" as wt_db
+}
+
+package "Runtime Enforcement" {
+  [evaluate_tool_policies_batch()] as eval
+  [WebUI.approve_tools()] as approve
+  [record_usage_event()\n+cache_creation/read_tokens] as usage
+  [record_audit()] as audit
+}
+
+package "Template Runtime" {
+  [_load_templates()] as tload
+  [_render_template()\n{{model}}, {{ws_id}}, {{node_id}}] as trender
+  [_init_system_messages()] as tsys
+  [set_template() / /template] as tset
+}
+
+package "Skill Runtime" {
+  [resolve_skill()] as wtr
+  [apply settings\n(model, budget, prompt)] as wta
+  [budget gate\n(session.send)] as wtb
+}
+
+package "Console UI" {
+  [Admin Panel\n10 tabs] as ui
+  [governance.js] as govjs
+  [sessionStorage\npermissions] as ss
+}
+
+auth --> perms : user_id
+perms --> roles_db : JOIN user_roles + roles
+perms --> scopes : permission set
+scopes --> jwt : scopes + permissions
+
+jwt --> mw : JWT in cookie/header
+mw --> rp : scope OK → check permission
+
+rp --> ui : 403 or allow
+
+eval --> tp_db : list_tool_policies()
+approve --> eval : tool names
+approve --> ae_db : (via audit)
+
+usage --> ue_db : on_status()
+audit --> ae_db : admin handlers
+
+govjs --> roles_db : /v1/api/admin/roles
+govjs --> tp_db : /v1/api/admin/policies
+govjs --> pt_db : /v1/api/admin/skills
+govjs --> ue_db : /v1/api/admin/usage
+govjs --> ae_db : /v1/api/admin/audit
+
+tload --> pt_db : list_default_templates()\nor get_by_name()
+tload --> trender : template content
+trender --> tsys : rendered content
+tset --> tload : name or None
+
+note right of pt_db
+  Read-only listing:
+  GET /v1/api/skills
+  (read scope, summary only)
+end note
+
+govjs --> wt_db : /v1/api/admin/skills
+wtr --> wt_db : get_skill_by_name()
+wtr --> wta : skill settings
+wta --> pt_db : skill lookup
+wtb --> approve : __budget_override__
+
+auth -[hidden]-> mw
+mw -[hidden]-> approve
+@enduml

docs/diagrams/20-mcp-architecture.puml

@@ -0,0 +1,203 @@
+@startuml
+!theme plain
+title Turnstone — MCP Architecture (Resources, Prompts, Tools)
+
+skinparam participant {
+    BackgroundColor<<mcp>> #E1BEE7
+    BackgroundColor<<session>> #C8E6C9
+    BackgroundColor<<storage>> #B3E5FC
+    BackgroundColor<<server>> #FFE0B2
+    BackgroundColor<<ui>> #E8EAF6
+    BackgroundColor<<registry>> #F8BBD0
+}
+
+participant "MCP Server\n(external)" as MCPSrv <<mcp>>
+participant "MCPClientManager\n(mcp_client.py)" as MCPMgr <<mcp>>
+participant "ChatSession\n(session.py)" as Session <<session>>
+participant "StorageBackend\n(governance)" as Storage <<storage>>
+participant "Server / Console\n(health + UI)" as UI <<server>>
+
+participant "Console Admin UI\n(admin panel)" as Admin <<ui>>
+participant "Database\n(mcp_servers table)" as DB <<storage>>
+
+participant "MCPRegistryClient\n(mcp_registry.py)" as RegClient <<mcp>>
+participant "MCP Registry\n(registry.modelcontextprotocol.io)" as Registry <<registry>>
+
+== Admin-Driven Configuration ==
+
+Admin -> DB : CRUD MCP server definitions\n(POST/PUT/DELETE /v1/api/admin/mcp-servers)
+
+Admin -> UI : POST /v1/api/admin/mcp-servers/reload
+UI -> MCPMgr : POST /_internal/mcp-reload\n(forwarded to each node)
+MCPMgr -> MCPMgr : reconcile_sync()
+note right
+  Diffs running servers against DB:
+  - New entries → connect
+  - Removed entries → disconnect
+  - Changed entries → reconnect
+end note
+
+== Registry Discovery & Install ==
+
+Admin -> UI : GET /v1/api/admin/mcp-registry/search?search=...
+UI -> RegClient : search(q, limit, cursor)
+RegClient -> Registry : GET /v0.1/servers?search=...&latest=true
+Registry --> RegClient : Server entries\n(remotes, packages, meta)
+RegClient --> UI : RegistrySearchResult\n(annotated with installed status)
+UI --> Admin : Search results\n(Install / Installed badges)
+
+Admin -> UI : POST /v1/api/admin/mcp-registry/install
+UI -> DB : create_mcp_server()\n(registry_name, version, meta)
+UI -> MCPMgr : POST /_internal/mcp-reload\n(fan-out to nodes)
+MCPMgr -> MCPMgr : reconcile_sync()
+MCPMgr -> MCPSrv : connect to new server
+
+note over RegClient, Registry
+  MCPRegistryClient is an async httpx client
+  targeting registry.modelcontextprotocol.io/v0.1.
+  resolve_install_config() translates registry
+  remotes/packages into mcp_servers rows.
+end note
+
+== Startup: Connection & Discovery ==
+
+MCPMgr -> DB : load_mcp_config(storage=)\n(merge config file + DB)
+
+MCPMgr -> MCPSrv : initialize (stdio or HTTP)
+MCPSrv --> MCPMgr : capabilities\n(tools, resources, prompts)
+
+MCPMgr -> MCPSrv : tools/list
+MCPSrv --> MCPMgr : Tool[]
+
+opt resources capability
+  MCPMgr -> MCPSrv : resources/list
+  MCPSrv --> MCPMgr : Resource[]
+  MCPMgr -> MCPSrv : resources/templates/list
+  MCPSrv --> MCPMgr : ResourceTemplate[]
+end
+
+opt prompts capability
+  MCPMgr -> MCPSrv : prompts/list
+  MCPSrv --> MCPMgr : Prompt[]
+end
+
+note over MCPMgr
+  Per-server storage:
+  _per_server_tools, _per_server_resources, _per_server_prompts
+  Copy-on-write rebuild into _tools, _resources, _prompts
+  Prefix: mcp__{server}__{name}
+end note
+
+MCPMgr -> Session : notify tool listeners
+MCPMgr -> Session : notify resource listeners
+
+== Governance Sync (on connect & refresh) ==
+
+MCPMgr -> Storage : sync_prompts_to_storage()
+note right
+  For each MCP prompt:
+  - Manual template exists? → skip
+  - MCP template exists? → update
+    (reset is_default=False)
+  - New? → create (origin="mcp",
+    readonly=True, is_default=False)
+  Removed prompts → delete
+  Protected by _sync_lock
+end note
+
+== set_storage() from entry point ==
+
+UI -> MCPMgr : set_storage(backend)
+note right
+  If servers already connected,
+  triggers immediate sync
+end note
+
+== Runtime: Tool Execution ==
+
+Session -> Session : _prepare_mcp_tool(func_name, args)
+note right
+  approval_label = func_name
+  (e.g. mcp__github__search)
+  needs_approval = True
+end note
+Session -> MCPMgr : call_tool_sync(name, args)
+MCPMgr -> MCPSrv : tools/call
+MCPSrv --> MCPMgr : ToolResult
+MCPMgr --> Session : output (text)
+
+== Runtime: Resource Read ==
+
+Session -> Session : _prepare_read_resource(uri)
+note right
+  approval_label = mcp_resource__{normalized_uri}
+  URI normalized (.. resolved)
+  needs_approval = True
+end note
+Session -> MCPMgr : read_resource_sync(uri)
+MCPMgr -> MCPSrv : resources/read
+MCPSrv --> MCPMgr : ReadResourceResult
+MCPMgr --> Session : content (text/blob)
+
+== Runtime: Prompt Invocation ==
+
+Session -> Session : _prepare_use_prompt(name, arguments)
+note right
+  approval_label = mcp__srv__prompt
+  Validated via is_mcp_prompt()
+  needs_approval = True
+end note
+Session -> MCPMgr : get_prompt_sync(name, args)
+MCPMgr -> MCPSrv : prompts/get
+MCPSrv --> MCPMgr : GetPromptResult
+MCPMgr --> Session : messages [{role, content}]
+
+== Three-Tier Refresh ==
+
+group Push Notifications
+  MCPSrv -> MCPMgr : ToolListChangedNotification
+  MCPMgr -> MCPMgr : _refresh_server_tools()
+
+  MCPSrv -> MCPMgr : ResourceListChangedNotification
+  MCPMgr -> MCPMgr : _refresh_server_resources()
+
+  MCPSrv -> MCPMgr : PromptListChangedNotification
+  MCPMgr -> MCPMgr : _refresh_server_prompts()
+  MCPMgr -> Storage : sync_prompts_to_storage()
+end
+
+group Periodic Polling (default 4h)
+  MCPMgr -> MCPMgr : _periodic_refresh()
+  note right
+    Only polls capabilities
+    without push support.
+    Staggered per-server.
+  end note
+end
+
+group Manual Refresh
+  Session -> MCPMgr : refresh_sync()
+  note right: /mcp refresh [server]
+end
+
+== Policy Evaluation ==
+
+note over Session
+  Tool policies use fnmatch on approval_label:
+  - mcp__github__* → allow (all GitHub tools/prompts)
+  - mcp_resource__file:///docs/* → allow
+  - mcp_resource__* → deny (block all resource reads)
+  - mcp__untrusted__* → ask
+end note
+
+== UI Visibility ==
+
+UI -> MCPMgr : server_count, get_resources(), get_prompts()
+note over UI
+  /health → mcp.servers, mcp.resources, mcp.prompts
+  Server UI: magenta status badge
+  Console: cluster status bar + node detail
+  System message: <mcp-resources> + <mcp-prompts> catalogs
+end note
+
+@enduml

docs/diagrams/22-judge-architecture.puml

@@ -0,0 +1,218 @@
+@startuml
+!theme plain
+title Turnstone — Intent Validation (Judge) Architecture
+
+skinparam participant {
+    BackgroundColor<<session>> #C8E6C9
+    BackgroundColor<<judge>> #FFE0B2
+    BackgroundColor<<storage>> #B3E5FC
+    BackgroundColor<<ui>> #E8EAF6
+    BackgroundColor<<fs>> #F5F5F5
+}
+
+participant "ChatSession\n(session.py)" as Session <<session>>
+participant "IntentJudge\n(judge.py)" as Judge <<judge>>
+participant "LLM Provider\n(provider)" as LLM <<judge>>
+participant "StorageBackend\n(SQLite)" as Storage <<storage>>
+participant "WebUI / SSE\n(server.py)" as UI <<ui>>
+participant "Filesystem" as FS <<fs>>
+
+== Tool Call Requires Approval ==
+
+Session -> Session : _prepare_tool_calls()
+note right
+  Tool calls parsed from
+  LLM response. Auto-approved
+  tools dispatched immediately.
+  Remaining items need approval.
+end note
+
+Session -> Session : _evaluate_intent(pending_items)
+
+== Tier 1: Heuristic (synchronous, sub-ms) ==
+
+Session -> Judge : evaluate(items, messages, callback)
+
+Judge -> Judge : evaluate_heuristic()\nfor each item
+note right
+  **36 rules (first match wins):**
+  Critical (0.90, deny): rm /, mkfs,
+    dd, pipe-to-shell, chmod 777 /,
+    write/edit /etc/ .ssh/,
+    download-then-execute chains
+  High (0.80, review): sudo, kill -9,
+    destructive git, DROP TABLE,
+    secrets, HTTP mutations, ssh/scp,
+    browser+data-export, transitive
+    install, control-plane mutation
+  Medium (0.70, review): content
+    ingestion, interpreter exec,
+    cloud CLI mutations, pkg install,
+    write_file, MCP tools, docker ops
+  Low (0.85, approve): read_file,
+    list_directory, search, recall,
+    tool_search, read_resource,
+    web_search, read-only bash
+  Default: medium, 0.50, review
+end note
+
+Judge --> Session : heuristic_verdicts[]
+
+Session -> Session : attach _heuristic_verdict\nto each pending item
+
+Session -> UI : SSE: approve_request\n{items: [{verdict: ...}],\n judge_pending: true}
+note right
+  Heuristic verdict displayed
+  immediately as risk badge.
+  Spinner shown while LLM
+  judge evaluates.
+end note
+
+Session -> Storage : create_intent_verdict()\nfor each heuristic verdict
+
+== Tier 2: LLM Judge (daemon thread, async) ==
+
+Judge -> Judge : spawn daemon thread\n"intent-judge"
+
+note over Judge, LLM
+  **Context preparation:**
+  1. FIFO-truncate conversation history
+     to max_context_ratio of context window
+  2. Append tool call details as user message
+  3. System prompt defines judge role + JSON schema
+end note
+
+loop up to 3 turns (timeout budget)
+
+    Judge -> LLM : create_completion(\nmodel, judge_messages,\ntools=[read_file, list_directory])
+    LLM --> Judge : CompletionResult
+
+    alt tool_calls present (turn < 3)
+        Judge -> Judge : _exec_read_only_tool()
+        note right
+          **Security hardening:**
+          Blocked: /etc/, /root/,
+          /proc/, /sys/, /dev/,
+          .ssh, .gnupg, .aws,
+          *.pem, *.key, *.p12
+          File cap: 32KB
+          Dir cap: 200 entries
+        end note
+        Judge -> FS : read_file / list_directory
+        FS --> Judge : file contents
+        Judge -> Judge : append tool result\nto judge_messages
+    else text response (final verdict)
+        Judge -> Judge : _parse_verdict()
+        note right
+          **4-stage JSON parsing:**
+          1. Direct JSON.loads
+          2. Markdown code block
+          3. Brace-counting
+          4. Regex field extraction
+        end note
+    end
+
+end
+
+== Tier 3: Arbitration ==
+
+Judge -> Judge : compare confidence:\nLLM vs heuristic
+note right
+  Only deliver LLM verdict
+  if confidence > heuristic.
+  Otherwise heuristic stands.
+end note
+
+alt LLM confidence > heuristic confidence
+    Judge -> Session : callback(llm_verdict)
+    Session -> UI : SSE: intent_verdict\n{tier: "llm", ...}
+    note right
+      UI replaces heuristic badge
+      with LLM verdict. Spinner
+      resolves to final assessment.
+    end note
+    Session -> Storage : create_intent_verdict()\nfor LLM verdict
+end
+
+== User Decision ==
+
+UI -> Session : resolve_approval(\napproved, feedback)
+
+Session -> Storage : update_intent_verdict(\nverdict_id, user_decision)
+note right
+  All tracked verdicts
+  (heuristic + LLM) updated
+  with "approved" or "denied".
+  Swap-and-clear avoids racing
+  with daemon judge thread.
+end note
+
+== Tool Execution ==
+
+Session -> Session : _execute_tools()
+note right
+  Tools execute with
+  user approval.
+end note
+
+== Output Guard (synchronous, time-budgeted) ==
+
+Session -> Session : _evaluate_output()\nfor each tool result
+note right
+  **Priority-ordered checks (5s budget):**
+  P1: Prompt injection (role injection,
+    override phrases, instruction tags)
+  P2: Credential leakage (API keys,
+    PEM blocks, connection strings)
+  P3: Encoded payloads (data URIs,
+    hex shellcode)
+  P4: Adversarial URLs (cloud metadata,
+    credential query params)
+  P5: System info disclosure (private
+    IPs, sensitive paths)
+
+  Annotates + optionally redacts.
+  Does NOT gate.
+end note
+
+alt output_warning flags detected
+    Session -> UI : SSE: output_warning\n{call_id, risk_level, flags,\nfunc_name, redacted}
+    note right
+      Credential values replaced
+      with [REDACTED:<type>] before
+      output enters conversation.
+      sanitized text excluded from
+      SSE payload (defense in depth).
+    end note
+    UI -> Storage : record_output_assessment()\nfire-and-forget persistence
+    note right
+      Stored: flags, risk_level,
+      annotations, output_length,
+      redacted (bool). Raw tool
+      output is never stored.
+    end note
+end
+
+== Lifecycle ==
+
+note over Session, Judge
+  **Lazy initialization:**
+  IntentJudge created on first approval if judge_config.enabled.
+  Re-uses session's provider/client by default (self-consistency).
+  Cross-model: separate provider/client from [judge] config.
+
+  **Sub-agent exemption:**
+  Plan agent and task agent skip intent validation entirely.
+
+  **Output guard:**
+  Runs when judge_config.output_guard is true (default).
+  Credential redaction when judge_config.redact_secrets is true.
+
+  **Storage:**
+  intent_verdicts table (migration 012), output_assessments table
+  (migration 022). Both queryable via admin API endpoints
+  (requires admin.judge permission). Skills store scan_status,
+  scan_report, scan_version for install-time risk assessment.
+end note
+
+@enduml

docs/diagrams/23-memory-architecture.puml

@@ -0,0 +1,159 @@
+@startuml
+!theme plain
+title Turnstone — Structured Memory Architecture
+
+skinparam participant {
+    BackgroundColor<<session>> #C8E6C9
+    BackgroundColor<<facade>> #FFE0B2
+    BackgroundColor<<storage>> #B3E5FC
+    BackgroundColor<<api>> #E8EAF6
+    BackgroundColor<<sdk>> #F5F5F5
+}
+
+participant "ChatSession\n(session.py)" as Session <<session>>
+participant "MemoryFacade\n(memory.py)" as Facade <<facade>>
+participant "MemoryRelevance\n(memory_relevance.py)" as Relevance <<facade>>
+participant "StorageBackend\n(SQLite)" as Storage <<storage>>
+participant "Server API\n(server.py)" as API <<api>>
+participant "Console Admin\n(console/server.py)" as Admin <<api>>
+participant "SDK Client\n(sdk/)" as SDK <<sdk>>
+
+== Phase 1: Tool Path (session.send) ==
+
+Session -> Session : _prepare_tool_calls()\nparse memory(action=...)
+note right
+  Tool schema: 4 actions
+  save, search, delete, list
+  Auto-approved (no approval needed)
+end note
+
+Session -> Session : _exec_memory(item)
+
+alt action = save
+    Session -> Facade : save_structured_memory(\nname, content, description,\nmem_type, scope, scope_id)
+    Facade -> Facade : normalize_key(name)
+    Facade -> Storage : create_structured_memory()
+    alt unique constraint violation
+        Storage --> Facade : IntegrityError
+        Facade -> Storage : get_structured_memory_by_name()
+        Storage --> Facade : existing row
+        Facade -> Storage : update_structured_memory()
+    end
+    Storage --> Facade : memory_id
+    Facade --> Session : (memory_id, old_content)
+    Session -> Session : _init_system_messages()\nrefresh BM25 context
+end
+
+alt action = search
+    Session -> Facade : search_structured_memories(\nquery, mem_type, scope,\nscope_id, limit)
+    Facade -> Storage : search_structured_memories()
+    Storage --> Session : matched rows
+end
+
+alt action = delete
+    Session -> Facade : delete_structured_memory(\nname, scope, scope_id)
+    Facade -> Storage : delete_structured_memory()
+    Storage --> Session : bool (existed)
+    Session -> Session : _init_system_messages()\nrefresh BM25 context
+end
+
+== Phase 2: BM25 Relevance Injection ==
+
+Session -> Session : _init_system_messages()\nevery conversation turn
+
+Session -> Session : _get_visible_memories(\nlimit=fetch_limit)
+note right
+  **Scope resolution:**
+  1. global scope (always)
+  2. workstream scope (ws_id)
+  3. user scope (user_id, if auth)
+  Combined and deduplicated.
+end note
+
+Session -> Facade : list_structured_memories()\nper scope
+Facade -> Storage : list_structured_memories()
+Storage --> Session : up to fetch_limit rows
+
+Session -> Relevance : extract_recent_context(\nmessages, max_messages=3)
+Relevance --> Session : user text context
+
+Session -> Relevance : score_memories(\nmemories, context,\nk=relevance_k)
+note right
+  **BM25 scoring:**
+  Index over name + description
+  + content[:200] for each memory.
+  Returns top-k by relevance.
+  Empty query returns most recent k.
+end note
+Relevance --> Session : top-k memories
+
+Session -> Relevance : build_memory_context(\nrelevant_memories)
+note right
+  Formats as XML block:
+  <memories>
+    <memory name="..." type="..."
+     scope="..." description="...">
+      content (max 500 chars)
+    </memory>
+  </memories>
+end note
+Relevance --> Session : XML string
+
+Session -> Session : inject into\nsystem message
+
+== Phase 3: Server API Path ==
+
+SDK -> API : GET /v1/api/memories\n?type=project&limit=20
+API -> Facade : list_structured_memories()
+Facade -> Storage : list_structured_memories()
+Storage --> API : rows
+API --> SDK : {"memories": [...], "total": N}
+
+SDK -> API : POST /v1/api/memories\n{name, content, ...}
+API -> API : validate type, scope,\nname length, content length
+API -> Facade : save_structured_memory()
+Facade -> Storage : create / update
+Storage --> API : memory row
+API --> SDK : 201 (created) / 200 (updated)
+
+SDK -> API : POST /v1/api/memories/search\n{query, type, ...}
+API -> Facade : search_structured_memories()
+Facade -> Storage : search_structured_memories()
+Storage --> API : matched rows
+API --> SDK : {"memories": [...], "total": N}
+
+SDK -> API : DELETE /v1/api/memories/{name}\n?scope=global
+API -> Facade : delete_structured_memory()
+Facade -> Storage : delete row
+API --> SDK : {"status": "ok"}
+
+== Phase 4: Console Admin Path ==
+
+SDK -> Admin : GET /v1/api/admin/memories\n?type=&scope=&limit=
+Admin -> Admin : require_permission(\n"admin.memories")
+Admin -> Storage : list_structured_memories()
+Storage --> Admin : rows
+Admin --> SDK : {"memories": [...], "total": N}
+
+SDK -> Admin : GET /v1/api/admin/memories/{id}
+Admin -> Storage : get_structured_memory(id)
+Storage --> Admin : memory row
+Admin --> SDK : memory JSON
+
+SDK -> Admin : DELETE /v1/api/admin/memories/{id}
+Admin -> Storage : delete_structured_memory_by_id()
+Admin -> Admin : record_audit(\n"memory.delete")
+Admin --> SDK : {"status": "ok"}
+
+== Configuration ==
+
+note over Session, Relevance
+  **MemoryConfig** (from [memory] in config.toml):
+  relevance_k = 5       -- top-k memories per turn
+  fetch_limit = 50       -- max memories fetched for scoring
+  max_content = 32768    -- max content length per memory
+  nudge_cooldown = 300   -- seconds between metacognitive nudges
+  nudges = true          -- enable/disable memory nudges
+end note
+
+@enduml

docs/diagrams/24-settings-architecture.puml

@@ -0,0 +1,151 @@
+@startuml
+!theme plain
+title Turnstone — Settings Architecture
+
+skinparam participant {
+    BackgroundColor<<session>> #C8E6C9
+    BackgroundColor<<config>> #FFE0B2
+    BackgroundColor<<storage>> #B3E5FC
+    BackgroundColor<<api>> #E8EAF6
+    BackgroundColor<<sdk>> #F5F5F5
+}
+
+participant "Server\n(main)" as Server <<session>>
+participant "ConfigStore\n(config_store.py)" as Store <<config>>
+participant "SettingsRegistry\n(settings_registry.py)" as Registry <<config>>
+participant "StorageBackend\n(SQLite)" as Storage <<storage>>
+participant "Console Admin\n(console/server.py)" as Admin <<api>>
+participant "SDK Client\n(sdk/)" as SDK <<sdk>>
+participant "ChatSession\n(session.py)" as Session <<session>>
+
+== Phase 1: Server Startup ==
+
+Server -> Server : parse_args()\nCLI flags override defaults
+Server -> Server : init_storage()\nSQLite / PostgreSQL
+
+Server -> Store ** : ConfigStore(storage, node_id)
+Store -> Storage : get_system_settings_bulk(node_id)
+note right
+  1. Load global settings (node_id="")
+  2. Overlay per-node settings
+  Returns {key: json_value} dict
+end note
+Storage --> Store : raw settings
+Store -> Registry : deserialize_value(key, json)\nper entry
+Registry --> Store : typed values
+Store -> Store : swap _cache atomically\nincrement _version
+
+Server -> Server : warn_migrated_settings()
+note right
+  Scans config.toml for keys
+  now managed by ConfigStore.
+  Logs warning for each overlap.
+end note
+
+Server -> Server : session_factory captures\nConfigStore reference
+
+== Phase 2: Settings Read (session creation) ==
+
+Server -> Session : session_factory(ws_id)
+Session -> Store : get("model.temperature")
+Store -> Store : cache[key] lookup\n(lock-free)
+alt key in cache
+    Store --> Session : stored value
+else key not in cache
+    Store -> Registry : SETTINGS[key].default
+    Registry --> Store : default value
+    Store --> Session : default value
+end
+note right of Session
+  Settings are captured once
+  at workstream creation.
+  Not re-read on every turn.
+end note
+
+== Phase 3: Admin API — List / Schema ==
+
+SDK -> Admin : GET /v1/api/admin/settings
+Admin -> Admin : require_permission(\n"admin.settings")
+Admin -> Store : all_effective()
+Store -> Store : merge cache with\nregistry defaults
+Store --> Admin : {key: effective_value}
+Admin -> Registry : SETTINGS (metadata)
+note right
+  Annotates each setting with:
+  type, default, description,
+  is_stored, is_secret, constraints,
+  changed_by, updated
+end note
+Admin --> SDK : {"settings": [...], "total": N}
+
+SDK -> Admin : GET /v1/api/admin/settings/schema
+Admin -> Admin : require_permission(\n"admin.settings")
+Admin -> Registry : SETTINGS catalog
+Admin --> SDK : {"settings": [...], "total": N}
+
+== Phase 4: Admin API — Update ==
+
+SDK -> Admin : PUT /v1/api/admin/settings/\nmodel.temperature\n{"value": 0.7}
+Admin -> Admin : require_permission(\n"admin.settings")
+Admin -> Registry : validate_key("model.temperature")
+Registry --> Admin : SettingDef
+alt is_secret == true
+    Admin --> SDK : 403 Forbidden
+else
+    Admin -> Registry : validate_value(key, 0.7)
+    note right
+      Type coercion: float(0.7)
+      Range check: 0.0 <= 0.7 <= 2.0
+      Choices check: (none for this key)
+    end note
+    Registry --> Admin : typed value
+    Admin -> Store : set(key, 0.7, changed_by="admin")
+    Store -> Registry : serialize_value(0.7)\n=> "0.7"
+    Store -> Storage : upsert_system_setting(\nkey, "0.7", node_id, ...)
+    Storage --> Store : ok
+    Store -> Store : swap _cache atomically
+    Admin -> Admin : record_audit(\n"setting.update")
+    Admin --> SDK : {"key": "...", "value": 0.7,\n"previous": 0.5}
+end
+
+== Phase 5: Admin API — Delete (reset to default) ==
+
+SDK -> Admin : DELETE /v1/api/admin/settings/\nmodel.temperature
+Admin -> Admin : require_permission(\n"admin.settings")
+Admin -> Store : delete("model.temperature")
+Store -> Registry : validate_key(key)
+Store -> Storage : delete_system_setting(key, node_id)
+Storage --> Store : bool (existed)
+Store -> Store : remove from cache,\nswap atomically
+Admin -> Admin : record_audit(\n"setting.delete")
+Admin --> SDK : {"status": "ok",\n"key": "...", "default": 0.5}
+
+== Phase 6: Hot Reload ==
+
+SDK -> Admin : POST /v1/api/_internal/\nconfig-reload
+Admin -> Store : reload()
+Store -> Storage : get_system_settings_bulk(node_id)
+Storage --> Store : all settings
+Store -> Store : rebuild cache,\nswap atomically,\nincrement _version
+note right
+  Existing sessions: unchanged
+  (frozen at creation time).
+  New sessions: pick up
+  updated values immediately.
+end note
+Admin --> SDK : {"status": "ok"}
+
+== Precedence Summary ==
+
+note over Server, Registry
+  **Server entry point:**
+  CLI flag  >  ConfigStore (database)  >  registry default
+
+  **CLI entry point:**
+  CLI flag  >  config.toml  >  argparse default
+
+  **Bootstrap settings** (database, Redis, auth, server bind):
+  Always from config.toml / env vars — never in ConfigStore.
+end note
+
+@enduml

docs/diagrams/25-oidc-architecture.puml

@@ -0,0 +1,147 @@
+@startuml
+!theme plain
+title Turnstone — OIDC Authorization Code Flow with PKCE
+
+skinparam participant {
+    BackgroundColor<<browser>> #E8EAF6
+    BackgroundColor<<server>> #FFE0B2
+    BackgroundColor<<storage>> #B3E5FC
+    BackgroundColor<<idp>> #C8E6C9
+}
+
+participant "Browser" as Browser <<browser>>
+participant "Turnstone\n(Server / Console)" as Server <<server>>
+database "SQLite /\nPostgreSQL" as DB <<storage>>
+participant "Identity Provider\n(IdP)" as IdP <<idp>>
+
+== Page Load ==
+
+Browser -> Server : GET /v1/api/auth/status
+Server --> Browser : {oidc_enabled: true,\noidc_provider_name: "...",\npassword_enabled: true}
+
+note right of Browser
+  Login screen renders
+  "Continue with {provider_name}"
+  button alongside password form.
+  If password_enabled=false,
+  only the SSO button is shown.
+end note
+
+== Authorization Request ==
+
+Browser -> Server : GET /v1/api/auth/oidc/authorize
+
+Server -> Server : Generate state (random)\nnonce (random)\nPKCE code_verifier + code_challenge
+
+Server -> DB : create_oidc_pending_state(\nstate, nonce, code_verifier, audience)
+note right of DB
+  Stored with created_at timestamp.
+  Expires after 5 minutes.
+end note
+
+Server --> Browser : 302 Redirect to IdP\nauthorization_endpoint
+
+Browser -> IdP : GET /authorize?\nresponse_type=code&\nclient_id=...&\nredirect_uri=...&\nscope=openid email profile&\nstate=...&nonce=...&\ncode_challenge=...&\ncode_challenge_method=S256
+
+== User Authentication (at IdP) ==
+
+IdP -> Browser : Login page (if no\nexisting IdP session)
+Browser -> IdP : User authenticates\n(username/password, MFA, etc.)
+
+IdP --> Browser : 302 Redirect to callback\n?code=AUTH_CODE&state=STATE
+
+== Callback Processing ==
+
+Browser -> Server : GET /v1/api/auth/oidc/callback\n?code=AUTH_CODE&state=STATE
+
+Server -> Server : Rate limit check\n(5 per 5min per IP)
+
+Server -> DB : cleanup_expired_oidc_states(300)
+note right of DB
+  Lazy cleanup of states
+  older than 5 minutes.
+end note
+
+Server -> DB : pop_oidc_pending_state(state)
+DB --> Server : {nonce, code_verifier, audience}
+note right of Server
+  Atomic fetch-and-delete.
+  Returns None if state is
+  expired or unknown.
+end note
+
+== Token Exchange ==
+
+Server -> IdP : POST /token\ngrant_type=authorization_code&\ncode=AUTH_CODE&\nclient_id=...&\nclient_secret=...&\ncode_verifier=...&\nredirect_uri=...
+note right of Server
+  Client secret + PKCE verifier
+  sent server-side only.
+  Never exposed to browser.
+end note
+
+IdP --> Server : {id_token: "eyJ...",\naccess_token: "..."}
+
+== ID Token Validation ==
+
+Server -> IdP : Fetch JWKS public keys\n(cached at startup, refreshed\non-demand when unknown kid\nencountered — key rotation)
+
+Server -> Server : Validate ID token:\n1. Verify signature (RS256/ES256)\n2. Check iss == configured issuer\n3. Check aud == client_id\n4. Check exp (not expired)\n5. Verify nonce matches
+
+== User Provisioning ==
+
+Server -> DB : get_oidc_identity(issuer, sub)
+
+alt Existing identity found
+    DB --> Server : {user_id, ...}
+    Server -> DB : update_oidc_identity_login()\nupdate last_login timestamp
+    Server -> DB : get_user(user_id)
+    DB --> Server : user record
+else New user (first login)
+    Server -> Server : Derive username from\npreferred_username / email
+    Server -> DB : create_user(user_id, username,\ndisplay_name, "!oidc")
+    note right of DB
+      Password hash set to sentinel
+      value "!oidc" — not a valid
+      bcrypt hash, so password login
+      is always rejected.
+    end note
+    Server -> DB : create_oidc_identity(\nissuer, sub, user_id, email)
+end
+
+opt Role mapping configured
+    Server -> Server : Read role_claim from ID token\nMap values via role_map
+    Server -> DB : Sync roles: add new,\nrevoke stale OIDC-assigned,\npreserve manually assigned
+end
+
+== Issue Turnstone JWT ==
+
+Server -> Server : Load user permissions\nDerive scopes from permissions
+Server -> Server : Create JWT (HS256)\nsub: user_id\nscopes: read,write,...\nsrc: "oidc"\naud: turnstone-server\nexp: +24h
+
+Server --> Browser : 302 Redirect to /?oidc_success=1\nSet-Cookie: session=JWT\n(HttpOnly, SameSite=Lax, Secure)
+
+== Browser Success Detection ==
+
+Browser -> Browser : Detect ?oidc_success=1\nStrip param from URL\n(history.replaceState)
+Browser -> Browser : Hide login overlay\nCall onLoginSuccess()
+
+note right of Browser
+  Browser is now authenticated.
+  JWT cookie sent on all
+  subsequent requests.
+end note
+
+== Error Paths ==
+
+note over Browser, IdP
+  **Error handling:**
+  - IdP returns error param → redirect to /?oidc_error=...
+  - State missing/expired → redirect to /?oidc_error=Login+session+expired
+  - Token exchange fails → redirect to /?oidc_error=...
+  - ID token validation fails → redirect to /?oidc_error=...
+  - No admin user exists → redirect to /?oidc_error=Initial+setup+required
+  - Rate limit exceeded → redirect to /?oidc_error=Too+many+login+attempts
+  All errors are shown as toast messages on the login screen.
+end note
+
+@enduml

docs/diagrams/26-skills-discovery-architecture.puml

@@ -0,0 +1,100 @@
+@startuml
+!include https://raw.githubusercontent.com/plantuml-stdlib/C4-PlantUML/master/C4_Component.puml
+LAYOUT_LEFT_RIGHT()
+
+title Skills Discovery & Runtime Architecture
+
+skinparam backgroundColor #1e1e2e
+skinparam defaultFontColor #cdd6f4
+skinparam defaultFontName "JetBrains Mono"
+skinparam arrowColor #89b4fa
+skinparam rectangleBorderColor #585b70
+skinparam rectangleBackgroundColor #313244
+skinparam noteBorderColor #585b70
+skinparam noteBackgroundColor #45475a
+skinparam packageBorderColor #585b70
+
+package "External Sources" as ext #181825 {
+  rectangle "skills.sh\nRegistry" as skillssh
+  rectangle "GitHub\nRepositories" as github
+}
+
+package "Console Server" as console #181825 {
+  rectangle "admin_skill_discover\nGET /v1/api/admin/skills/discover" as discover
+  rectangle "admin_skill_install\nPOST /v1/api/admin/skills/install" as install
+  rectangle "_get_discovery_url\nsettings fallback" as settings
+}
+
+package "Core Modules" as core #181825 {
+  rectangle "SkillsShClient\nskill_sources.py" as client
+  rectangle "fetch_skill_from_github\nskill_sources.py" as fetcher
+  rectangle "parse_skill_md\nskill_parser.py" as parser
+  rectangle "scan_skill_content\nstorage/_utils.py" as scanner
+}
+
+package "Session Runtime" as runtime #181825 {
+  rectangle "skill tool\nsession.py" as loadtool
+  rectangle "set_skill()\nsession.py" as setskill
+  rectangle "_load_skills()\nsession.py" as loadskills
+}
+
+package "Storage" as storage #181825 {
+  rectangle "prompt_templates\n(skills)" as skills_table
+  rectangle "skill_resources\n(bundled files)" as resources_table
+  rectangle "system_settings\n(discovery_url)" as settings_table
+}
+
+package "Admin UI" as ui #181825 {
+  rectangle "Skills Tab\nInstalled / Discover pill" as pill
+  rectangle "Discovery View\nsearch + cards" as discoverui
+  rectangle "GitHub Import\nmodal" as importui
+}
+
+' External discovery flow
+discover --> settings : resolve URL
+settings --> settings_table : DB -> config -> default
+discover --> client : search(query)
+client --> skillssh : GET /api/search
+
+install --> client : resolve_github_url()
+client --> skillssh : GET /api/skills/{id}
+install --> fetcher : fetch SKILL.md + resources
+fetcher --> github : raw.githubusercontent.com
+fetcher --> github : api.github.com/git/trees
+fetcher --> parser : parse frontmatter
+install --> scanner : auto-scan on create
+install --> skills_table : create_prompt_template
+install --> resources_table : create_skill_resource
+
+' Runtime skill loading flow
+loadtool --> skills_table : search (BM25 ranking)
+loadtool --> setskill : load (name)
+setskill --> loadskills : reload + reinit system messages
+loadskills --> skills_table : get_skill_by_name
+
+' UI flow
+pill --> discoverui : switch view
+discoverui --> discover : authFetch()
+importui --> install : POST (github source)
+
+' Annotations
+note right of parser
+  YAML frontmatter -> ParsedSkill
+  allowed-tools (standard) -> allowed_tools (internal)
+  Anthropic + Hermes tag formats
+  Name validation (lowercase+hyphens)
+end note
+
+note right of loadtool
+  search: auto-approved (read-only)
+  load: requires user approval
+  Main session only (no sub-agents)
+end note
+
+note right of scanner
+  4 risk axes (content, supply chain,
+  vulnerability, capability)
+  Auto-triggers on create/update
+end note
+
+@enduml

docs/diagrams/png/02-package-structure.png

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:0ee0a9391bd19d92e9271bf6bd531e9c2e18baf8c5a11ead49b3c10db4d8939b
-size 329625
+oid sha256:efcc7cbe8161a54b5ec24bdfd47e8a142f70029e6e66c707e811b99369f85ebf
+size 310079

docs/diagrams/png/03-core-engine-classes.png

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:760c37e67736588dadee21d500419a48e9fc50f8bdc5667e686c580022bd40e2
-size 554869
+oid sha256:0e605963c649574c7bf987b2d338257c78bc1fc68b524ac8276bb25365035e06
+size 594096

docs/diagrams/png/04-conversation-turn.png

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:e3044c738d6d6853aab5c4990e6c67bab0165eba991a4f5bebdfc4d4a0b305ee
-size 289165
+oid sha256:da9d32000e3d92d92ce621661ced60f276f9b5be652f5ed6123b400505415f4a
+size 319702

docs/diagrams/png/05-tool-pipeline.png

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:282820fe416961e735d050f86ecdc079e29824d2b3c4d5c8c174d0533d41f211
-size 258045
+oid sha256:43844b07d36beb04db871f6795a3f3be17852a6a484fdc0ea207403bd7f512a6
+size 274286

docs/diagrams/png/06-mq-protocol.png

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:32a0665cceffcc0517265bde12cfb227688aa8585284b5e946ab23bcc52daee6
-size 187650
+oid sha256:2636e2d4d2f84f26f93de6e984b780f6ad5bf8d3618a0202ea0a2ee80859c5b5
+size 312409

docs/diagrams/png/09-workstream-states.png

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:e0a3f48cca1b8408862dc4ba04fd340703346f44d84048c99e9900f48e9c7e22
-size 158867
+oid sha256:7896c6e041b6dbb89d034468fa980c8fe645df5eb969d45ef966ccc6399edac2
+size 200083

docs/diagrams/png/11-console-data-flow.png

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:a74b4b8b5dbfb1a51a01100b731477968942b01218bad9451a3d5a9cb3003294
-size 411665
+oid sha256:e3f1ad0fcd55eaca3b8ad9c5abc07432803641c54ede9fc93c79df144cf77d1c
+size 407761

docs/diagrams/png/12-deployment.png

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:84524f4bc900708ac8adf081591d336f862830188eb8505e71a0f071b339d923
-size 252599
+oid sha256:09065fef028d05e6df425fd8abefaf5a2ca04b66802f2e3975f289fa597f63ed
+size 309656

docs/diagrams/png/13-sdk-architecture.png

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:435a58aa09d0e6615e78c0be62e5fd9aa6d7329b1e96619744355c42ade649c9
-size 196502
+oid sha256:e7c3e40c10425d721f833390ae3531c09af501157fd3142531ba4eba86ff719d
+size 197112

docs/diagrams/png/14-storage-architecture.png

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:5faa5335152685cf1c8bf77ed93847d751cde59e1afed651e5991113f2f0f31b
-size 242670
+oid sha256:b047cdc318c505f0f0895a65e14c5cc7552716053055cca57fa0a77db150e618
+size 255458

docs/diagrams/png/16-channel-architecture.png

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:1380065cbb5f95b5ea7dc6b2a00986c455b82888af60784980dffbd936460dcf
-size 431129
+oid sha256:6fc99bb8d84d6e9f3dac9d5c12ac7f569a041b29431c57612c24b50f332982ed
+size 462992

docs/diagrams/png/17-notify-flow.png

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:f0f6097840fccdbfe16cd5e4c9f5d063b2c36942460a944df68b8ec947e63ea3
-size 221452
+oid sha256:cc4c511c34a2e5d286fd128c3509405a5b240ca02a4bafb395d2e94d002a5b8b
+size 293203

docs/diagrams/png/19-governance-architecture.png

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:98ba80fa1dab4d37299e61be079a6fbc8740fc3ab92196f828a765f74caf4556
+size 200720

docs/diagrams/png/20-mcp-architecture.png

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:a6b7769aa7e732ffbeb1eb7f5b65273a135fb3a78d9802ec36d3b92801c34f6b
+size 427745

docs/diagrams/png/22-judge-architecture.png

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:79a690c466a5d6f6d4292d78a27b9474e9e9c1373fa80e17dfe37700238c8af8
+size 382508

docs/diagrams/png/23-memory-architecture.png

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:c89628ed917dfd576c1af75c68fe5fed9beadaaee9dcea7aa7a1643867c4f1b9
+size 344323

docs/diagrams/png/24-settings-architecture.png

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:83c0e6aad3eb19f6bc475a30a77215e801da3da5930f0462417fe7eb6eda6be2
+size 347144

docs/diagrams/png/25-oidc-architecture.png

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:1c21910e3916be789b0377c8a0dcc8f47d66a967861a543d5bdd0c26da185259
+size 309584

docs/diagrams/png/26-skills-discovery-architecture.png

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:ba14003062fec7eb9eaca7a3de945767e40bdd821468e19e7d1edcfa7ce1eb41
+size 193581

docs/docker.md

@@ -109,9 +109,12 @@ All configuration is via environment variables in `.env` (copy from `.env.exampl
 |----------|---------|-------------|
 | `TURNSTONE_DB_BACKEND` | `sqlite` | Storage backend: `sqlite` or `postgresql` |
 | `TURNSTONE_DB_URL` | — | Database URL (e.g. `postgresql://user:pass@db:5432/turnstone`). For SQLite, defaults to `/data/.turnstone.db` |
+| `TURNSTONE_DB_POOL_SIZE` | `2` | PostgreSQL connection pool size per process (default: 2 base + 3 overflow = 5 max) |
 
 The database stores workstream history, user accounts, and API tokens. When using JWT auth, a database backend is required for user storage.
 
+> **Large clusters:** Each turnstone process maintains a small connection pool (5 max). At hundreds of nodes this adds up — use [PgBouncer](pgbouncer.md) in transaction pooling mode between turnstone and PostgreSQL.
+
 > **First-time setup:** After deploying with auth enabled, create an initial admin user by running `turnstone-admin create-user` inside the container:
 >
 > ```bash
@@ -151,6 +154,8 @@ POSTGRES_PASSWORD=secret docker compose --profile cluster up
 
 The default `server` and `bridge` also run alongside the cluster nodes (11 total). All nodes are accessible via the console dashboard at `:8090`.
 
+For production clusters beyond ~50 nodes, add PgBouncer between turnstone services and PostgreSQL. See [PgBouncer Connection Pooling](pgbouncer.md) for Docker Compose and Helm configuration.
+
 ## Volumes
 
 | Volume | Mount | Purpose |

docs/governance.md

@@ -0,0 +1,232 @@
+# Governance
+
+Turnstone governance provides role-based access control (RBAC), tool execution
+policies, skills, usage tracking, and audit logging for the admin console.
+
+## Architecture
+
+See [diagram: 19-governance-architecture.puml](diagrams/19-governance-architecture.puml).
+
+### RBAC (Roles & Permissions)
+
+The permission model has two layers:
+
+1. **Scopes** (legacy) — `read`, `write`, `approve`. Checked by `AuthMiddleware`
+   on every request based on URL path classification.
+2. **Permissions** (granular) — 15 permission strings checked per-endpoint by
+   `require_permission()`.
+
+**Built-in roles** (seeded by migration 008):
+
+| Role | Permissions |
+|------|-------------|
+| admin | read, write, approve, admin.users, admin.roles, admin.orgs, admin.policies, admin.skills, admin.audit, admin.usage, admin.schedules, admin.watches, tools.approve, workstreams.create, workstreams.close |
+| operator | read, write, workstreams.create, workstreams.close |
+| viewer | read |
+
+Custom roles can be created with any subset of the 15 valid permissions.
+
+**Auth flow:**
+1. User logs in (password or API token) → `_load_user_permissions()` aggregates
+   permissions from all assigned roles
+2. `_permissions_to_scopes()` derives legacy scopes (any `admin.*` → `approve`)
+3. JWT created with both `scopes` and `permissions` claims
+4. Middleware checks scope → handler checks permission via `require_permission()`
+
+### Tool Policies
+
+Admin-defined rules that control tool execution:
+
+- **Pattern matching**: Glob syntax via `fnmatch` (e.g., `bash*`, `file_write`, `*`)
+- **Actions**: `allow` (auto-approve), `deny` (block), `ask` (normal approval flow)
+- **Priority**: Higher priority evaluated first, first match wins
+- **Enforcement**: `evaluate_tool_policies_batch()` called in `WebUI.approve_tools()`
+  before the `auto_approve` check
+- **MCP granular policies**: MCP resources and prompts are evaluated using their
+  `approval_label` for fine-grained control:
+  - Resource reads: `mcp_resource__{uri}` (e.g., `mcp_resource__file:///docs/*` to allow,
+    `mcp_resource__*` to deny all)
+  - Prompt invocations: `mcp__{server}__{prompt}` (e.g., `mcp__trusted__*` to allow,
+    `mcp__*` to require approval for all)
+  - Built-in tools continue to use `func_name` for backward compatibility
+
+### Skills
+
+Admin-curated system message skills injected at workstream startup. Skills also
+include session configuration (model, temperature, auto-approve, token budget,
+etc.) since workstream templates were merged into the skills system in v0.8.0.
+
+- **Runtime behavior**: Skills are loaded once at session creation and injected
+  into the system message *before* user `instructions`. Skills set the baseline;
+  instructions customize per-workstream behavior.
+- **Default skills**: All `is_default=true` skills auto-apply to new
+  workstreams, concatenated in alphabetical order by name. Use name prefixes
+  (e.g. `01-safety`, `02-style`) to control ordering.
+- **Explicit selection**: `--template <name>` CLI flag, `template` field on
+  `POST /v1/api/workstreams/new`, console creation modal dropdown, scheduled task
+  config, and channel adapter config. An explicit skill *replaces* defaults.
+- **Variables**: Three built-in placeholders resolved at load time:
+  `{{model}}` (active model name), `{{ws_id}}` (workstream ID),
+  `{{node_id}}` (server node ID). Unrecognized placeholders are kept as-is.
+- **Runtime switching**: `/template <name>` to switch, `/template clear` to revert
+  to defaults, `/template` to show current. Persisted across resume.
+- **Model-driven loading**: The `skill` built-in tool lets the model
+  discover and activate skills mid-conversation. `search` action finds skills
+  by query (auto-approved); `load` action activates by name (requires user
+  approval since it changes session behavior). Main session only.
+- **Categories**: general, engineering, support, custom, mcp
+- **Content limit**: 32 KB per skill (enforced on create/update)
+- **Storage**: `prompt_templates` table (stores skills) with JSON `variables`
+  array. Migration 010 adds `template` column to `scheduled_tasks`.
+- **MCP sync**: MCP server prompts auto-sync into the `prompt_templates` table
+  with `origin="mcp"`, `mcp_server` set, and `readonly=True`. Manual skills take
+  precedence on name collision. MCP-synced content updates reset `is_default` to
+  prevent compromised servers from injecting defaults. Admin UI shows origin badge
+  and disables edit/delete for MCP-sourced skills.
+- **Spec fields**: Skills support the full Agent Skills standard frontmatter:
+  `name`, `description`, `license`, `compatibility`, `metadata` (author, version),
+  `allowed-tools`. The `license` and `compatibility` fields are preserved on import
+  and editable in the admin UI. See https://agentskills.io/specification.
+- **Security scanning**: Skills are automatically scanned at creation and update
+  time. The scanner evaluates four risk axes: content risk (command execution,
+  data exfiltration), supply chain risk (pipe-to-shell, transitive installs),
+  vulnerability risk (prompt injection, insecure credentials), and declared
+  capability risk (from `allowed-tools` in SKILL.md). Results populate the `scan_status`
+  (safe/low/medium/high/critical) and `scan_report` (JSON breakdown) columns.
+  These fields are system-managed and cannot be overwritten via the admin API.
+- **Discovery**: External skills can be discovered and installed from registries:
+  - `GET /v1/api/admin/skills/discover?q=...` — search the skills.sh registry
+    (or a custom registry via `skills.discovery_url` setting)
+  - `POST /v1/api/admin/skills/install` — install from skills.sh or GitHub.
+    Fetches the `SKILL.md` file, parses YAML frontmatter, creates a skill with
+    `origin="source"` and `readonly=True`, stores bundled resources.
+  - Admin UI: Skills tab has "Installed" / "Discover" pill toggle.
+    Discovery view has search bar, result cards, and "Import from GitHub" modal.
+  - SDK: `discover_skills(q)` and `install_skill(source, skill_id=..., url=...)`
+    on both Python and TypeScript console clients.
+- **Runtime config on installed skills**: Installed (readonly) skills can have
+  their runtime configuration edited — model, temperature, reasoning effort,
+  token budget, max tokens, agent max turns, auto-approve, allowed tools,
+  and enabled flag. The server restricts updates to these fields only via
+  `_SKILL_RUNTIME_CONFIG_FIELDS` filtering; spec/content fields (name,
+  description, tags, license, compatibility, content, activation) remain
+  immutable. The admin UI shows "Save Config" instead of "Save" for these
+  skills. Audit action: `skill.update.config`.
+- **Admin UI**: Create/Edit skill modals use a two-column spec manifest layout
+  (left: Identity / Manifest / Deployment; right: Skill Content editor with
+  monospace font). Runtime Config is a collapsible 3-column grid below.
+  License uses an SPDX identifier dropdown (MIT, Apache-2.0, GPL-3.0, etc.).
+  Installed skills show a cyan origin badge with source URL, spec fields are
+  disabled, and all collapsible sections auto-expand in view mode.
+
+### Usage Tracking
+
+Per-LLM-request token and tool call metrics:
+
+- **Recording**: `on_status()` in `WebUI` records a `usage_event` after each
+  LLM response with prompt/completion tokens, cache tokens, tool call count,
+  model, ws_id
+- **Prompt caching**: Anthropic automatic caching (`cache_control: ephemeral`)
+  and OpenAI extended retention (`prompt_cache_retention: 24h` for GPT-5.x)
+  are enabled by default. `cache_creation_tokens` and `cache_read_tokens` are
+  tracked per request in `usage_events` and surfaced in the Usage admin tab
+- **Querying**: `GET /v1/api/admin/usage` with `group_by` (day/hour/model/user)
+  and time range filtering — includes cache token aggregates
+- **Prometheus**: `turnstone_tokens_total{type="cache_creation|cache_read"}`
+  counters on `/metrics`
+- **Pruning**: `prune_usage_events(retention_days=90)` and
+  `prune_audit_events(retention_days=365)` run automatically via the
+  console scheduler's periodic cleanup cycle
+
+### Audit Logging
+
+Append-only trail of admin actions:
+
+- **Recording**: `record_audit()` helper called from all admin mutation handlers
+- **Events captured**: user.create, user.delete, token.create, token.revoke,
+  channel.link, channel.unlink, role.create, role.update, role.delete,
+  role.assign, role.unassign, policy.create, policy.update, policy.delete,
+  template.create, template.update, template.delete,
+  skill.create, skill.update, skill.delete, org.update
+- **Querying**: `GET /v1/api/admin/audit` with action/user/time filters + pagination
+
+## Database Schema
+
+Migration 008 adds 7 tables:
+
+| Table | Purpose |
+|-------|---------|
+| `orgs` | Organizations (single default org for now) |
+| `roles` | Named permission bundles (3 builtin + custom) |
+| `user_roles` | User-to-role assignments (composite PK) |
+| `tool_policies` | Per-tool approve/deny/ask rules |
+| `prompt_templates` | Reusable system message skills |
+| `usage_events` | Per-request token/tool/cache metrics |
+| `audit_events` | Admin action log |
+
+Also adds `org_id` column to `users` table.
+
+## API Endpoints
+
+All under `/v1/api/admin/` (requires `approve` scope + granular permission).
+
+| Group | Endpoints | Permission |
+|-------|-----------|------------|
+| Users / Tokens / Channels | 9 (CRUD) | `admin.users` |
+| Roles | 7 (CRUD + assignment) | `admin.roles` / `admin.users` |
+| Orgs | 3 (list, get, update) | `admin.orgs` |
+| Tool Policies | 4 (CRUD) | `admin.policies` |
+| Skills | 4 (CRUD) | `admin.skills` |
+| Schedules | 6 (CRUD + runs) | `admin.schedules` |
+| Watches | 3 (list, create, cancel) | `admin.watches` |
+| Usage | 1 (aggregated query) | `admin.usage` |
+| Audit | 1 (paginated, filtered) | `admin.audit` |
+
+Full OpenAPI spec at `/openapi.json` and Swagger UI at `/docs`.
+
+## Admin Console UI
+
+6 new tabs added to the admin panel (11 total):
+
+- **Roles** — CRUD roles, permission checkbox grid, user role assignment modal
+- **Policies** — CRUD tool policies with colored action badges (green/red/amber)
+- **Skills** — CRUD skills with wide modal, textarea editor
+- **Usage** — Summary readouts + CSS bar chart, time range + group-by selectors
+- **Audit** — Filterable log with relative timestamps, load-more pagination
+
+Tabs are permission-gated: hidden if the user lacks the required permission.
+
+## SDK
+
+Both Python and TypeScript console SDKs expose governance methods:
+
+**Python** (`TurnstoneConsole` / `AsyncTurnstoneConsole`):
+- `list_roles()`, `create_role()`, `update_role()`, `delete_role()`
+- `list_user_roles()`, `assign_role()`, `unassign_role()`
+- `list_orgs()`, `get_org()`, `update_org()`
+- `list_policies()`, `create_policy()`, `update_policy()`, `delete_policy()`
+- `list_templates()`, `create_template()`, `update_template()`, `delete_template()`
+- `get_usage(since, group_by=...)`, `get_audit(action=..., limit=...)`
+
+**TypeScript** (`TurnstoneConsole`):
+- Same methods with camelCase naming and typed interfaces
+
+## Security Considerations
+
+- **Privilege escalation prevented**: `admin_assign_role` blocks self-assignment
+  and requires caller to hold a superset of the target role's permissions
+- **Permission validation**: Role create/update validates permissions against
+  a 15-item allowlist (`_VALID_PERMISSIONS`)
+- **Self-deletion blocked**: `admin_delete_user` rejects attempts to delete
+  your own account (matching the self-assignment guard on role endpoints)
+- **Field allowlists**: Storage `update_*` methods filter fields against
+  allowlists (`_ROLE_MUTABLE`, `_POLICY_MUTABLE`, etc.) — handler bugs
+  cannot overwrite `role_id`, `builtin`, `created`, or other protected columns
+- **Bootstrap safety**: `handle_auth_setup` fails and rolls back if admin role
+  assignment fails, preventing locked-out first user
+- **API token RBAC**: `_authenticate_api_token` loads permissions from user's
+  roles, ensuring API tokens are subject to RBAC enforcement
+- **Policy evaluation is fail-open**: If storage is unavailable, tool policies
+  degrade to the existing approval flow (not auto-approve)
+- **Audit IP resolution**: `_audit_context()` prefers `X-Forwarded-For` for
+  client IP when behind a reverse proxy, falling back to `request.client.host`

docs/judge.md

@@ -0,0 +1,429 @@
+# Intent Validation (Judge)
+
+> See also: [Judge Architecture diagram](diagrams/png/22-judge-architecture.png)
+
+Intent validation provides advisory risk assessments for tool calls that require
+human approval. An LLM judge evaluates each tool call and presents a structured
+verdict alongside the approval prompt, helping users make informed decisions.
+
+## Overview
+
+When a tool call requires approval, the intent validation system runs a two-tier
+evaluation:
+
+1. **Heuristic tier** (instant) -- Pattern-based risk classification using a
+   rule table. Zero cost, sub-millisecond latency.
+2. **LLM judge tier** (async) -- Semantic evaluation using an LLM with
+   read-only tool access. Runs on a daemon thread and delivers its verdict
+   progressively.
+
+The verdict is purely advisory -- the user always makes the final decision.
+
+The heuristic verdict is attached to the `approve_request` SSE event immediately.
+The LLM verdict arrives later via an `intent_verdict` SSE event, allowing the
+UI to show a spinner that resolves into a richer assessment. Both verdicts are
+persisted to the `intent_verdicts` table for audit and future calibration.
+
+---
+
+## Configuration
+
+### config.toml
+
+```toml
+[judge]
+enabled = true
+model = ""                    # empty = same as session model
+provider = ""                 # empty = same as session provider
+base_url = ""
+api_key = ""
+confidence_threshold = 0.7   # reserved for v2 smart approvals (not used in v1)
+max_context_ratio = 0.5       # max % of judge context window for history
+timeout = 60.0                # seconds (generous for local models)
+read_only_tools = true        # judge can use read_file/list_directory
+```
+
+All fields are optional. The judge is enabled by default; use `enabled = false`
+(or `--no-judge` on the command line) to disable it.
+
+### CLI flags
+
+```
+--judge / --no-judge           Enable/disable (default: enabled)
+--judge-model MODEL            Model for judge
+--judge-provider PROVIDER      Provider for judge
+--judge-timeout SECONDS        LLM judge timeout (default: 60)
+--judge-confidence FLOAT       Confidence threshold (default: 0.7)
+```
+
+CLI flags override `config.toml` values.
+
+---
+
+## Judge Model Selection
+
+- **Default (self-consistency)**: When `model` is empty, the session model
+  evaluates its own tool calls. Research shows self-consistency achieves
+  comparable accuracy to multi-agent debate at a fraction of the cost.
+- **Cross-model**: Use a different model for the judge (e.g. local model for
+  the session, commercial model for the judge). Set `model` and `provider`
+  in the `[judge]` config section, or use `--judge-model` / `--judge-provider`
+  CLI flags.
+- **Cross-provider**: When both `model` and `provider` are set, the judge
+  creates its own LLM client. You can optionally specify `base_url` and
+  `api_key` for non-default endpoints.
+
+---
+
+## Heuristic Rules
+
+The heuristic tier scans a priority-ordered rule table (critical first, low
+last) and returns the first matching rule. Each rule has:
+
+- **Tool pattern**: fnmatch glob matched against `func_name` and `approval_label`
+- **Argument patterns**: Regex patterns matched against the tool's primary
+  argument text (command string for bash, path for file tools, JSON for others)
+- **Risk level, confidence, and recommendation**: Pre-assigned per rule
+
+### Rule tiers (36 rules)
+
+| Tier     | Confidence | Recommendation | Examples |
+|----------|-----------|----------------|----------|
+| Critical | 0.90      | deny           | `rm -rf /`, `mkfs`, `dd if=`, pipe-to-shell, chmod 777 on root, write/edit to `/etc/` or `.ssh/`, download-then-execute chains (`curl -o file && chmod +x && bash`) |
+| High     | 0.80      | review         | `sudo`, `kill -9`, destructive git, DROP TABLE, write/edit secrets, HTTP mutations, `ssh`/`scp`, credential file access, browser automation + data export, transitive installs (`npx skills add`, `pip install git+`), control plane mutations (`crontab`, `systemctl enable/start/stop`) |
+| Medium   | 0.70      | review         | Content ingestion pipelines (`curl \| python3`), interpreter execution (`python3 script.py`, `node build.js`), cloud CLI mutations (`az/gcloud/aws/kubectl/terraform` with create/delete/destroy verbs), package installs, `write_file`, MCP tools, Docker operations |
+| Low      | 0.85      | approve        | `read_file`, `list_directory`, `search`, `recall`, `man`, `use_prompt`, `tool_search`, `read_resource`, `web_search`, read-only bash (`ls`, `cat`, `head`, `grep`, `find`, etc.) |
+
+When no rule matches, the heuristic returns a default verdict: medium risk,
+0.50 confidence, "review" recommendation.
+
+The bash "read-only" rule handles simple pipelines and command chains by
+splitting on `|`, `&&`, `||`, and `;`, then checking each segment individually.
+
+### Rules derived from audit data
+
+Several rules were calibrated using analysis of 25K public agent skill
+security audits across three independent auditors:
+
+- **`download-exec`**: Two-step download-then-execute chains that bypass the
+  existing `pipe-to-shell` rule. 8% of critical-tier skills use this pattern.
+- **`transitive-install`**: Installing packages from URLs or git repos rather
+  than vetted registries. Socket flags this as supply-chain critical in 36%
+  of dangerous skills.
+- **`browser-data-export`**: Browser automation combined with cookie/session/
+  profile export. OpenClaw treats browser profile access as operator-level
+  capability.
+- **`control-plane-mutation`**: Persistent system changes (crontab, systemd)
+  that outlive the session. OpenClaw denies control-plane tools by default.
+- **`content-ingestion`**: Fetch-and-process pipelines where remote content
+  feeds into an interpreter (Snyk W011 pattern — indirect prompt injection
+  surface).
+- **`interpreter-exec`**: Running a script file whose content hasn't been
+  inspected. Opaque to command-level heuristics.
+- **`cloud-infra-mutation`**: Distinguishes destructive cloud CLI verbs
+  (`create`, `delete`, `destroy`) from read-only ones (`show`, `list`, `get`).
+
+---
+
+## LLM Judge
+
+The LLM judge runs on a daemon thread and performs a multi-turn evaluation:
+
+1. **Context preparation**: Recent conversation history is FIFO-truncated to
+   fit within `max_context_ratio` of the judge's context window. The tool call
+   details (name, approval label, full arguments) are appended as a user message.
+2. **Multi-turn loop** (up to 5 turns): The judge can use `read_file` and
+   `list_directory` to gather evidence before rendering its verdict. Each tool
+   result is appended to the conversation and the judge is called again. On
+   the final turn, tools are stripped and a forcing message instructs the
+   judge to render its verdict immediately.
+3. **Verdict parsing**: The judge's final text response is parsed as JSON using
+   a four-stage strategy: direct parse, markdown code block extraction,
+   brace-counting, and regex field extraction as a last resort.
+4. **Arbitration**: If the LLM verdict has higher confidence than the heuristic,
+   it replaces the heuristic via the `intent_verdict` SSE event.
+
+### Read-only tools
+
+When `read_only_tools` is enabled (default), the judge can use two tools:
+
+- **`read_file`**: Read file contents (capped at 32 KB)
+- **`list_directory`**: List directory entries (capped at 200 entries)
+
+Security hardening blocks access to sensitive paths:
+
+| Category | Blocked patterns |
+|----------|-----------------|
+| System directories | `/etc/`, `/root/`, `/proc/`, `/sys/`, `/dev/` |
+| Credential directories | `.ssh`, `.gnupg`, `.aws`, `.config` |
+| Key files | `*.pem`, `*.key`, `*.p12`, `*.pfx` |
+
+### Timeout
+
+The `timeout` setting (default 60 seconds) is a total budget across all judge
+turns. Time is decremented after each LLM call. If the budget expires mid-turn,
+the judge attempts to parse whatever partial response is available.
+
+---
+
+## Verdict Structure
+
+Each verdict (heuristic or LLM) is an `IntentVerdict` with these fields:
+
+| Field            | Type       | Description |
+|------------------|------------|-------------|
+| `verdict_id`     | string     | Unique identifier (UUID prefix) |
+| `call_id`        | string     | Correlates with the tool call's `call_id` |
+| `func_name`      | string     | Tool function name |
+| `intent_summary` | string     | One-sentence description of what the tool call does |
+| `risk_level`     | string     | `"low"`, `"medium"`, `"high"`, or `"critical"` |
+| `confidence`     | float      | 0.0--1.0, how certain the assessment is |
+| `recommendation` | string     | `"approve"`, `"review"`, or `"deny"` |
+| `reasoning`      | string     | Explanation of the assessment |
+| `evidence`       | list[str]  | Supporting evidence (rule name or file excerpts) |
+| `tier`           | string     | `"heuristic"` or `"llm"` |
+| `judge_model`    | string     | Model used (empty for heuristic tier) |
+| `latency_ms`     | int        | Evaluation time in milliseconds |
+
+---
+
+## Session Integration
+
+The judge is lazy-initialized on first use. When `ChatSession` prepares tool
+calls for approval, it calls `_evaluate_intent()` which:
+
+1. Instantiates `IntentJudge` if not already created
+2. Extracts `func_name`, `func_args`, and `approval_label` from each pending item
+3. Calls `judge.evaluate()` which returns heuristic verdicts immediately
+4. Attaches each heuristic verdict to its item as `_heuristic_verdict`
+5. The daemon thread runs the LLM judge and delivers results via `ui.on_intent_verdict()`
+
+Sub-agents (plan agent, task agent) are exempt from intent validation -- they
+always get full tool visibility without judge evaluation.
+
+---
+
+## Storage and Audit
+
+All verdicts are persisted to the `intent_verdicts` table (migration 012):
+
+- Heuristic verdicts are stored when the `approve_request` event is emitted
+- LLM verdicts are stored when the `intent_verdict` event is delivered
+- The `user_decision` column is updated when the user approves or denies
+
+The console admin panel exposes verdict history via:
+
+```
+GET /v1/api/admin/verdicts?ws_id=&since=&until=&risk_level=&limit=100&offset=0
+```
+
+This endpoint requires the `admin.judge` permission.
+
+---
+
+## SSE Events
+
+### `approve_request` (extended)
+
+When the judge is active, `approve_request` items include a `verdict` field
+with the heuristic verdict, and the event includes a `judge_pending` flag
+indicating that an LLM verdict is in flight:
+
+```json
+{
+  "type": "approve_request",
+  "judge_pending": true,
+  "items": [
+    {
+      "call_id": "call_abc123",
+      "header": "bash: npm install express",
+      "preview": "",
+      "func_name": "bash",
+      "approval_label": "bash",
+      "needs_approval": true,
+      "error": null,
+      "verdict": {
+        "verdict_id": "a1b2c3d4e5f6",
+        "call_id": "call_abc123",
+        "func_name": "bash",
+        "intent_summary": "Package installation: npm install express",
+        "risk_level": "medium",
+        "confidence": 0.70,
+        "recommendation": "review",
+        "reasoning": "Command installs a software package which may modify the environment.",
+        "evidence": ["Matched rule: package-install"],
+        "tier": "heuristic",
+        "judge_model": "",
+        "latency_ms": 0
+      }
+    }
+  ]
+}
+```
+
+### `intent_verdict`
+
+Delivered asynchronously when the LLM judge completes. The UI replaces the
+heuristic verdict badge with the LLM verdict:
+
+```json
+{
+  "type": "intent_verdict",
+  "verdict_id": "f7e8d9c0b1a2",
+  "call_id": "call_abc123",
+  "func_name": "bash",
+  "intent_summary": "Install Express.js web framework via npm",
+  "risk_level": "medium",
+  "confidence": 0.85,
+  "recommendation": "review",
+  "reasoning": "The command installs express from npm. This is a well-known package but will modify node_modules and package.json.",
+  "evidence": ["Checked package.json — express is not currently a dependency"],
+  "tier": "llm",
+  "judge_model": "gpt-5",
+  "latency_ms": 2340
+}
+```
+
+---
+
+## Skill Scanner
+
+Skills are evaluated by a content scanner at creation and update time. The
+scanner runs the same class of pattern analysis as the heuristic rules but
+operates on SKILL.md content rather than individual tool calls. It evaluates
+four independent risk axes:
+
+1. **Content risk** — command execution scope, external downloads, credential
+   handling, eval/exec, sudo, data exfiltration, browser automation
+2. **Supply chain risk** — pipe-to-shell, transitive installs (`npx skills add`),
+   obfuscation, download-execute chains, executable URLs from untrusted domains
+3. **Vulnerability risk** — prompt injection patterns, insecure credential
+   handling, third-party content exposure (indirect prompt injection surface)
+4. **Declared capability risk** — parsed from `allowed-tools` in the skill's SKILL.md.
+   `Bash(*)` (unrestricted shell) is high risk. `Bash(git:*)` is low.
+   Read-only tools are safe.
+
+Results are stored in `scan_status` (tier: safe/low/medium/high/critical) and
+`scan_report` (JSON breakdown) on the `prompt_templates` table. These fields are
+system-managed and not editable via the admin API.
+
+The scanner is a pure function (~2ms) with no I/O. It runs synchronously in
+the storage layer. Scanner failures are silently caught to never block skill
+creation.
+
+See [docs/governance.md](governance.md) for the skill governance model.
+
+---
+
+## Output Guard
+
+The output guard evaluates tool execution results *after* execution but *before*
+they enter the conversation context. It catches content-level threats that the
+input heuristic (which evaluates commands) cannot see — prompt injection
+payloads in fetched web pages, credential leakage in command output, encoded
+payloads, and adversarial URLs.
+
+The guard runs as a synchronous heuristic on the tool result text with a
+configurable time budget (default 5 seconds). Pattern checks run in priority
+order: prompt injection first, then credentials, then encoded payloads, then
+lower-priority checks. If the budget is exhausted mid-evaluation, whatever
+flags have been found so far are returned.
+
+The guard **annotates but does not gate** — it surfaces warnings via the
+`on_output_warning` SSE event and optionally redacts detected credentials
+from the output before it enters the conversation.
+
+### Detection priorities
+
+| Priority | Category | Risk | Examples |
+|----------|----------|------|----------|
+| 1 | Prompt injection | high | Override phrases, role injection (`{"role":"system"}`), instruction override markers |
+| 2 | Credential leakage | high | API keys, private key blocks, connection strings, `.env` format secrets |
+| 3 | Encoded payloads | medium | Script data URIs, hex shellcode sequences |
+| 4 | Adversarial URLs | medium | Cloud metadata endpoints, credential-bearing query parameters |
+| 5 | System info disclosure | low | Private IP addresses, sensitive file paths |
+
+### Credential redaction
+
+When `redact_secrets` is enabled (default), detected credentials in tool output
+are replaced with `[REDACTED:<type>]` markers before the output enters the
+conversation. The original unredacted output is never shown to the model.
+Redaction types: `api_key`, `private_key`, `password`, `secret`.
+
+### Configuration
+
+```toml
+[judge]
+output_guard = true    # enable output evaluation (default)
+redact_secrets = true  # auto-redact detected credentials (default)
+```
+
+Configurable at runtime via the admin Settings tab.
+
+### SSE event: `output_warning`
+
+When the output guard detects risk signals, an `output_warning` SSE event is
+emitted to the frontend:
+
+```json
+{
+  "type": "output_warning",
+  "call_id": "call_abc123",
+  "func_name": "bash",
+  "risk_level": "high",
+  "flags": ["credential_leak"],
+  "annotations": ["API key detected (sk-proj-...)"],
+  "output_length": 1024,
+  "redacted": true
+}
+```
+
+The web UI renders this as an inline warning after the tool result. The CLI
+shows a colored terminal warning. The MQ bridge forwards it as an
+`OutputWarningEvent` for console subscribers.
+
+Assessments are persisted to the `output_assessments` table for v2
+calibration. Raw tool output is never stored — only metadata (flags, risk
+level, annotations, output length, redaction status).
+
+### Session-level skill scan warning
+
+When a skill with `scan_status` of `high` or `critical` is loaded into a
+session, a warning is emitted via `on_info`:
+
+```
+⚠ Skill 'my-skill' has scan status: high.
+Review scan report in admin panel before enabling in production.
+```
+
+This ensures operators see a warning even if they missed the scan badge in
+the admin skills tab.
+
+---
+
+## Data Collection for v2 Calibration
+
+All three evaluation systems persist their assessments for future calibration:
+
+| Table | Source | Key columns |
+|-------|--------|-------------|
+| `intent_verdicts` | Intent judge (heuristic + LLM) | `func_name`, `risk_level`, `confidence`, `user_decision` |
+| `output_assessments` | Output guard | `func_name`, `risk_level`, `flags`, `redacted` |
+| `prompt_templates` | Skill scanner | `scan_status`, `scan_report`, `scan_version` |
+
+Run v1 with all tools requiring manual approval to build a local dataset.
+In v2, calibration tooling will analyze this data to:
+
+- Identify tools that are always approved (candidates for auto-approve policies)
+- Detect false positives in heuristic rules (intent + output guard)
+- Measure LLM judge accuracy against human decisions
+- Recommend policy changes to reduce approval fatigue
+- Tune output guard sensitivity per tool (e.g., `bash` output needs more
+  scrutiny than `read_file`)
+
+Output assessments are queryable via `GET /v1/api/admin/output-assessments`
+(requires `admin.judge` permission). Skills can be re-scanned via
+`POST /v1/api/admin/skills/{id}/rescan` when the scanner is updated.
+
+This data-driven approach means v1 is both useful on its own and a foundation
+for automated policy tuning.

docs/mcp-registry.md

@@ -0,0 +1,193 @@
+# MCP Registry Integration
+
+Turnstone integrates with the [official MCP Registry](https://registry.modelcontextprotocol.io) to let administrators discover and install MCP servers directly from the console admin panel.
+
+## Overview
+
+The MCP Registry is maintained by the [Agentic AI Foundation](https://www.linuxfoundation.org/press/linux-foundation-announces-the-formation-of-the-agentic-ai-foundation) (Linux Foundation) and serves as the canonical discovery layer for MCP servers. Turnstone queries its REST API (v0.1) for server metadata and provides a one-click install flow.
+
+Three sources of MCP servers coexist in Turnstone:
+
+| Source | Badge | Description |
+|--------|-------|-------------|
+| **Config** | `CONFIG` (magenta) | Imported from `config.toml` or JSON file. Read-only in admin UI. |
+| **Manual** | `MANUAL` (cyan) | Added through the admin UI or API. Full CRUD. |
+| **Registry** | `REGISTRY` (green) | Installed from the MCP Registry. Tracked by `registry_name`. |
+
+## Admin UI
+
+The MCP admin tab has two views, toggled by a pill selector:
+
+### Servers View
+
+Lists all installed MCP servers regardless of source. Each server shows:
+
+- **Source badge** — CONFIG, MANUAL, or REGISTRY
+- **Transport badge** — stdio or streamable-http
+- **Tool/resource/prompt counts** — aggregated across cluster nodes
+- **Per-node connection status** — connected (magenta dot), error (red), disabled (gray)
+- **Actions** — Edit / Delete (DB-managed servers only)
+
+Clicking a server name opens the detail modal. For registry-installed servers, the detail modal includes a **Registry** section showing the registry name, installed version, description, and website link.
+
+### Registry View
+
+Search and browse the MCP Registry. Switching to this view auto-loads a listing. Type a query and press Enter or click Search to filter.
+
+Each result card shows:
+
+- **Server name and description**
+- **Source type badges** — remote (streamable-http), npm, pypi
+- **Version number**
+- **Install / Installed / Update button**
+
+#### Install flow
+
+- **One-click**: Remote servers with no required headers or URL variables install immediately — no modal, no form. The server is added to the database, all cluster nodes are notified, and a toast confirms success.
+
+- **Modal**: Servers that require configuration (API keys, headers, URL template variables) or offer multiple install sources (both remote and package) open an install modal with:
+  - Source selector (radio group) — only shown when both remote and package are available
+  - Dynamic form fields for required/optional configuration
+  - Secret fields rendered as password inputs
+
+## Configuration
+
+### Registry URL
+
+By default, Turnstone queries `https://registry.modelcontextprotocol.io`. Override this for enterprise or private registries:
+
+**Via admin Settings tab:**
+
+Set `mcp.registry_url` to your registry's base URL.
+
+**Via config.toml:**
+
+```toml
+[mcp]
+registry_url = "https://registry.internal.example.com"
+```
+
+The resolution order is: database setting > config.toml > default.
+
+## API Endpoints
+
+Both endpoints require `admin.mcp` permission.
+
+### Search
+
+```
+GET /v1/api/admin/mcp-registry/search?search=github&limit=20&cursor=...
+```
+
+Query parameters:
+
+| Parameter | Type | Default | Description |
+|-----------|------|---------|-------------|
+| `search` | string | `""` | Search query. Empty returns a browsable listing. |
+| `limit` | integer | `20` | Results per page (max 100). |
+| `cursor` | string | — | Opaque cursor from `next_cursor` for pagination. |
+
+The response annotates each server with `installed`, `installed_server_id`, `installed_version`, and `update_available` by cross-referencing the `mcp_servers` table.
+
+### Install
+
+```
+POST /v1/api/admin/mcp-registry/install
+```
+
+```json
+{
+  "registry_name": "io.example/mcp-server",
+  "source": "remote",
+  "index": 0,
+  "name": "",
+  "variables": {},
+  "env": {"API_KEY": "sk-..."},
+  "headers": {"Authorization": "Bearer ..."}
+}
+```
+
+| Field | Required | Description |
+|-------|----------|-------------|
+| `registry_name` | Yes | Server name from registry search results. |
+| `source` | Yes | `"remote"` (streamable-http) or `"package"` (npm/pypi). |
+| `index` | No | Which remote or package entry to use (default `0`). |
+| `name` | No | Custom server name. Auto-derived from registry name if empty. |
+| `variables` | No | Values for URL template `{var}` placeholders. |
+| `env` | No | Environment variable values for package servers. |
+| `headers` | No | Header values for remote servers. |
+
+On success, the server is created in the database and all cluster nodes are automatically reloaded. Returns the created `McpServerDetail`.
+
+Errors: `400` (validation), `404` (not found in registry), `409` (already installed or name collision), `502` (registry unreachable).
+
+## SDK
+
+### Python
+
+```python
+from turnstone.sdk.console import TurnstoneConsole
+
+with TurnstoneConsole("http://localhost:8081", token="...") as client:
+    # Search
+    results = client.search_mcp_registry(q="github", limit=10)
+    for srv in results.servers:
+        print(f"{srv.name} v{srv.version} - {srv.description}")
+
+    # Install a remote server
+    detail = client.install_from_registry(
+        "io.example/mcp-server",
+        "remote",
+        headers={"Authorization": "Bearer sk-..."},
+    )
+    print(f"Installed: {detail.name}")
+```
+
+### TypeScript
+
+```typescript
+import { TurnstoneConsole } from "@anthropic/turnstone-sdk";
+
+const client = new TurnstoneConsole({
+  baseUrl: "http://localhost:8081",
+  token: "...",
+});
+
+// Search
+const results = await client.searchMcpRegistry({ q: "github", limit: 10 });
+for (const srv of results.servers) {
+  console.log(`${srv.name} v${srv.version} - ${srv.description}`);
+}
+
+// Install
+const detail = await client.installFromRegistry({
+  registry_name: "io.example/mcp-server",
+  source: "remote",
+  headers: { Authorization: "Bearer sk-..." },
+});
+```
+
+## Storage
+
+Registry-installed servers are stored in the existing `mcp_servers` table with three additional columns (migration 019):
+
+| Column | Type | Description |
+|--------|------|-------------|
+| `registry_name` | TEXT (nullable, unique) | Reverse-DNS name from the registry (e.g. `io.example/mcp-server`). |
+| `registry_version` | TEXT | Version at time of install. |
+| `registry_meta` | TEXT (JSON) | Snapshot of description, title, website, icons for display. |
+
+The partial unique index on `registry_name` prevents duplicate installs while allowing multiple non-registry servers with `NULL` registry_name.
+
+## Package Type Support
+
+| Registry Type | Transport | Command | Status |
+|--------------|-----------|---------|--------|
+| Remote (streamable-http) | `streamable-http` | — (URL-based) | Supported |
+| `npm` | `stdio` | `npx -y @scope/package@version` | Supported |
+| `pypi` | `stdio` | `uvx package==version` | Supported |
+| `oci` | — | — | Not supported (no runtime available) |
+| `nuget` | — | — | Not supported |
+| `mcpb` | — | — | Not supported |
+
+For `npm` and `pypi` packages, the corresponding runtime (`node`/`npx` or `python`/`uvx`) must be available on the cluster nodes. Connection failures due to missing runtimes appear in the per-node MCP status display.

docs/memory.md

@@ -0,0 +1,569 @@
+# Structured Memory
+
+> See also: [Memory Architecture diagram](diagrams/png/23-memory-architecture.png)
+
+The structured memory system gives the AI persistent, typed, scoped memories
+that survive across sessions and workstreams. Memories are automatically
+surfaced in the system message via BM25 relevance scoring, so the model has
+contextual recall without explicit search.
+
+## Overview
+
+Each memory has three dimensions:
+
+- **Type** -- categorizes the memory's purpose
+- **Scope** -- controls visibility boundaries
+- **Name** -- unique identifier within a scope (snake_case, normalized)
+
+### Memory types
+
+| Type        | Purpose                                                    |
+|-------------|------------------------------------------------------------|
+| `user`      | User preferences, conventions, working style               |
+| `project`   | Project-specific knowledge, architecture, patterns         |
+| `feedback`  | Corrections, lessons learned, things to avoid              |
+| `reference` | Reference material, documentation, specifications         |
+
+### Memory scopes
+
+| Scope        | Visibility                                                |
+|--------------|-----------------------------------------------------------|
+| `global`     | Visible to all workstreams and users                      |
+| `workstream` | Visible only within the originating workstream            |
+| `user`       | Follows the authenticated user across workstreams         |
+
+A memory's identity is the tuple `(name, scope, scope_id)`. Saving a memory
+with the same identity upserts -- updating content while preserving the ID.
+
+### BM25 relevance injection
+
+On every conversation turn, the system:
+
+1. Fetches up to `fetch_limit` memories visible in the current scope
+2. Extracts context from the last 3 user messages
+3. Scores memories against that context using a BM25 index
+4. Injects the top `relevance_k` memories into the system message as
+   `<memories>` XML tags
+5. Appends a hint telling the model how many memories are in scope
+
+This means the model always has its most relevant memories available without
+explicit recall -- but can still use `memory(action='search')` for deeper
+lookup.
+
+### Nudges
+
+The metacognition layer can nudge the model to save memories at appropriate
+moments (e.g., after a correction or when resuming a workstream). Nudges are
+rate-limited by `nudge_cooldown` and can be disabled entirely.
+
+---
+
+## Configuration
+
+### config.toml
+
+```toml
+[memory]
+relevance_k = 5          # top-k memories injected per turn
+fetch_limit = 50          # max memories fetched from storage for scoring
+max_content = 32768       # max content length per memory (characters)
+nudge_cooldown = 300      # minimum seconds between memory nudges
+nudges = true             # enable/disable metacognitive nudges
+```
+
+All fields are optional. Defaults are shown above.
+
+---
+
+## Tool Usage
+
+The `memory` tool supports four actions:
+
+### save
+
+Store or update a memory.
+
+```json
+{
+  "action": "save",
+  "name": "project_architecture",
+  "content": "The project uses a hexagonal architecture with...",
+  "description": "Core architecture patterns",
+  "type": "project",
+  "scope": "global"
+}
+```
+
+| Parameter     | Required | Default     | Description                              |
+|---------------|----------|-------------|------------------------------------------|
+| `name`        | yes      | --          | Snake_case identifier (max 256 chars)    |
+| `content`     | yes      | --          | Memory content (max `max_content` chars) |
+| `description` | no       | `""`        | Short description for relevance matching |
+| `type`        | no       | `"project"` | One of: user, project, feedback, reference |
+| `scope`       | no       | `"global"`  | One of: global, workstream, user         |
+
+### search
+
+Find memories by query (BM25 full-text search).
+
+```json
+{
+  "action": "search",
+  "query": "authentication patterns",
+  "type": "project",
+  "limit": 10
+}
+```
+
+| Parameter | Required | Default | Description                          |
+|-----------|----------|---------|--------------------------------------|
+| `query`   | yes      | --      | Search query                         |
+| `type`    | no       | `""`    | Filter by type                       |
+| `scope`   | no       | `""`    | Filter by scope                      |
+| `limit`   | no       | `20`    | Max results (capped at 50)           |
+
+### delete
+
+Remove a memory by name.
+
+```json
+{
+  "action": "delete",
+  "name": "outdated_pattern",
+  "scope": "global"
+}
+```
+
+| Parameter  | Required | Default    | Description              |
+|------------|----------|------------|--------------------------|
+| `name`     | yes      | --         | Memory name to delete    |
+| `scope`    | no       | `"global"` | Scope of the memory      |
+
+### list
+
+List all memories with optional filters.
+
+```json
+{
+  "action": "list",
+  "type": "feedback",
+  "limit": 50
+}
+```
+
+| Parameter | Required | Default | Description                |
+|-----------|----------|---------|----------------------------|
+| `type`    | no       | `""`    | Filter by type             |
+| `scope`   | no       | `""`    | Filter by scope            |
+| `limit`   | no       | `20`    | Max results (capped at 50) |
+
+---
+
+## Server API
+
+Four endpoints on the server for programmatic memory access.
+
+### `GET /v1/api/memories`
+
+List memories with optional filters.
+
+**Query parameters:**
+
+| Parameter  | Type   | Required | Default | Description                  |
+|------------|--------|----------|---------|------------------------------|
+| `type`     | string | no       | `""`    | Filter by memory type        |
+| `scope`    | string | no       | `""`    | Filter by scope              |
+| `scope_id` | string | no       | `""`    | Filter by scope ID           |
+| `limit`    | int    | no       | `100`   | Max results (capped at 200)  |
+
+When `scope=user` and `scope_id` is omitted, the authenticated user's ID is
+used automatically.
+
+**Response:** `200`
+
+```json
+{
+  "memories": [
+    {
+      "memory_id": "a1b2c3d4-e5f6-...",
+      "name": "project_architecture",
+      "description": "Core architecture patterns",
+      "type": "project",
+      "scope": "global",
+      "scope_id": "",
+      "content": "The project uses a hexagonal architecture...",
+      "created": "2026-03-10T10:00:00",
+      "updated": "2026-03-12T14:30:00"
+    }
+  ],
+  "total": 1
+}
+```
+
+---
+
+### `POST /v1/api/memories`
+
+Save or upsert a structured memory.
+
+**Request body:**
+
+```json
+{
+  "name": "deployment_process",
+  "content": "Deploy via GitHub Actions. Staging auto-deploys on push to main.",
+  "description": "CI/CD deployment workflow",
+  "type": "project",
+  "scope": "global",
+  "scope_id": ""
+}
+```
+
+| Field        | Type   | Required | Default     | Description                          |
+|--------------|--------|----------|-------------|--------------------------------------|
+| `name`       | string | yes      | --          | Memory name (max 256 chars)          |
+| `content`    | string | yes      | --          | Memory content (max 65536 chars)     |
+| `description`| string | no       | `""`        | Short description for search ranking |
+| `type`       | string | no       | `"project"` | One of: user, project, feedback, reference |
+| `scope`      | string | no       | `"global"`  | One of: global, workstream, user     |
+| `scope_id`   | string | no       | `""`        | Scope qualifier (auto-resolved for user scope) |
+
+**Response (created):** `201`
+
+```json
+{
+  "memory_id": "a1b2c3d4-e5f6-...",
+  "name": "deployment_process",
+  "description": "CI/CD deployment workflow",
+  "type": "project",
+  "scope": "global",
+  "scope_id": "",
+  "content": "Deploy via GitHub Actions...",
+  "created": "2026-03-14T10:00:00",
+  "updated": "2026-03-14T10:00:00"
+}
+```
+
+**Response (updated):** `200` -- same schema, returned when a memory with the
+same `(name, scope, scope_id)` already existed.
+
+**Errors:**
+
+| Status | Condition                          |
+|--------|------------------------------------|
+| 400    | Missing name, empty content, invalid type/scope, content too long |
+
+---
+
+### `POST /v1/api/memories/search`
+
+Search memories by query. Uses POST for the request body but is non-mutating
+(requires only `read` scope).
+
+**Request body:**
+
+```json
+{
+  "query": "authentication",
+  "type": "project",
+  "scope": "",
+  "scope_id": "",
+  "limit": 20
+}
+```
+
+| Field      | Type   | Required | Default | Description                    |
+|------------|--------|----------|---------|--------------------------------|
+| `query`    | string | yes      | --      | Search query                   |
+| `type`     | string | no       | `""`    | Filter by type                 |
+| `scope`    | string | no       | `""`    | Filter by scope                |
+| `scope_id` | string | no       | `""`    | Filter by scope ID             |
+| `limit`    | int    | no       | `20`    | Max results (capped at 50)     |
+
+**Response:** `200`
+
+```json
+{
+  "memories": [
+    {
+      "memory_id": "a1b2c3d4-e5f6-...",
+      "name": "auth_patterns",
+      "description": "Authentication architecture",
+      "type": "project",
+      "scope": "global",
+      "scope_id": "",
+      "content": "JWT tokens with HS256...",
+      "created": "2026-03-10T10:00:00",
+      "updated": "2026-03-12T14:30:00"
+    }
+  ],
+  "total": 1
+}
+```
+
+---
+
+### `DELETE /v1/api/memories/{name}`
+
+Delete a memory by name and scope.
+
+**Path parameters:**
+
+| Parameter | Type   | Description          |
+|-----------|--------|----------------------|
+| `name`    | string | Memory name          |
+
+**Query parameters:**
+
+| Parameter  | Type   | Required | Default    | Description         |
+|------------|--------|----------|------------|---------------------|
+| `scope`    | string | no       | `"global"` | Scope of the memory |
+| `scope_id` | string | no       | `""`       | Scope qualifier     |
+
+**Response (success):** `200`
+
+```json
+{"status": "ok", "name": "deployment_process"}
+```
+
+**Response (not found):** `404`
+
+```json
+{"error": "Memory 'deployment_process' not found"}
+```
+
+---
+
+## Console Admin API
+
+Four admin endpoints for cross-workstream memory management. All require the
+`admin.memories` permission.
+
+### `GET /v1/api/admin/memories`
+
+List memories across all scopes (no automatic scope resolution).
+
+**Query parameters:**
+
+| Parameter  | Type   | Required | Default | Description                  |
+|------------|--------|----------|---------|------------------------------|
+| `type`     | string | no       | `""`    | Filter by type               |
+| `scope`    | string | no       | `""`    | Filter by scope              |
+| `scope_id` | string | no       | `""`    | Filter by scope ID           |
+| `limit`    | int    | no       | `100`   | Max results (capped at 200)  |
+
+**Response:** `200`
+
+```json
+{
+  "memories": [
+    {
+      "memory_id": "a1b2c3d4-e5f6-...",
+      "name": "project_architecture",
+      "description": "Core architecture patterns",
+      "type": "project",
+      "scope": "global",
+      "scope_id": "",
+      "content": "The project uses...",
+      "created": "2026-03-10T10:00:00",
+      "updated": "2026-03-12T14:30:00"
+    }
+  ],
+  "total": 1
+}
+```
+
+---
+
+### `GET /v1/api/admin/memories/search`
+
+Search memories by query (uses query parameters, not POST body).
+
+**Query parameters:**
+
+| Parameter  | Type   | Required | Default | Description                   |
+|------------|--------|----------|---------|-------------------------------|
+| `q`        | string | yes      | --      | Search query                  |
+| `type`     | string | no       | `""`    | Filter by type                |
+| `scope`    | string | no       | `""`    | Filter by scope               |
+| `scope_id` | string | no       | `""`    | Filter by scope ID            |
+| `limit`    | int    | no       | `20`    | Max results (capped at 50)    |
+
+**Response:** `200` -- same schema as `GET /v1/api/admin/memories`.
+
+---
+
+### `GET /v1/api/admin/memories/{memory_id}`
+
+Get a single memory by ID.
+
+**Path parameters:**
+
+| Parameter   | Type   | Description            |
+|-------------|--------|------------------------|
+| `memory_id` | string | Memory UUID            |
+
+**Response (success):** `200`
+
+```json
+{
+  "memory_id": "a1b2c3d4-e5f6-...",
+  "name": "project_architecture",
+  "description": "Core architecture patterns",
+  "type": "project",
+  "scope": "global",
+  "scope_id": "",
+  "content": "The project uses...",
+  "created": "2026-03-10T10:00:00",
+  "updated": "2026-03-12T14:30:00"
+}
+```
+
+**Response (not found):** `404`
+
+```json
+{"error": "Memory not found"}
+```
+
+---
+
+### `DELETE /v1/api/admin/memories/{memory_id}`
+
+Delete a memory by ID. Records an audit event (`memory.delete`).
+
+**Path parameters:**
+
+| Parameter   | Type   | Description            |
+|-------------|--------|------------------------|
+| `memory_id` | string | Memory UUID            |
+
+**Response (success):** `200`
+
+```json
+{"status": "ok"}
+```
+
+**Response (not found):** `404`
+
+```json
+{"error": "Memory not found"}
+```
+
+---
+
+## SDK
+
+### Python
+
+The server SDK uses `mem_type` (not `type`) to avoid shadowing the Python
+builtin.
+
+```python
+from turnstone.sdk import TurnstoneServer
+
+with TurnstoneServer("http://localhost:8080", token="tok_xxx") as client:
+    # Save a memory
+    mem = client.save_memory(
+        "api_conventions",
+        "All endpoints use /v1/ prefix. JSON responses.",
+        description="API design patterns",
+        mem_type="project",
+        scope="global",
+    )
+    print(mem.memory_id)
+
+    # Search memories
+    results = client.search_memories("authentication", mem_type="project", limit=10)
+    for m in results.memories:
+        print(f"{m['name']}: {m['description']}")
+
+    # List memories
+    all_mems = client.list_memories(mem_type="feedback", limit=50)
+
+    # Delete a memory
+    client.delete_memory("api_conventions", scope="global")
+```
+
+Console admin SDK:
+
+```python
+from turnstone.sdk import TurnstoneConsole
+
+with TurnstoneConsole("http://localhost:9090", token="tok_xxx") as admin:
+    # List all memories (admin view, no scope auto-resolution)
+    result = admin.list_memories(scope="global", limit=100)
+
+    # Search
+    result = admin.search_memories("architecture", mem_type="project")
+
+    # Get by ID
+    mem = admin.get_memory("a1b2c3d4-e5f6-...")
+
+    # Delete by ID
+    admin.delete_memory("a1b2c3d4-e5f6-...")
+```
+
+### TypeScript
+
+```typescript
+import { TurnstoneServer } from "@turnstone/sdk";
+
+const client = new TurnstoneServer({
+  baseUrl: "http://localhost:8080",
+  token: "tok_xxx",
+});
+
+// Save a memory
+const mem = await client.saveMemory({
+  name: "api_conventions",
+  content: "All endpoints use /v1/ prefix. JSON responses.",
+  description: "API design patterns",
+  type: "project",
+  scope: "global",
+});
+
+// Search memories
+const results = await client.searchMemories({
+  query: "authentication",
+  type: "project",
+  limit: 10,
+});
+
+// List memories
+const all = await client.listMemories({ type: "feedback", limit: 50 });
+
+// Delete a memory
+await client.deleteMemory("api_conventions", { scope: "global" });
+```
+
+Console admin SDK:
+
+```typescript
+import { TurnstoneConsole } from "@turnstone/sdk";
+
+const admin = new TurnstoneConsole({
+  baseUrl: "http://localhost:9090",
+  token: "tok_xxx",
+});
+
+// List, search, get, delete by ID
+const mems = await admin.listMemories({ scope: "global" });
+const found = await admin.searchMemories({ q: "auth", limit: 20 });
+const one = await admin.getMemory("a1b2c3d4-e5f6-...");
+await admin.deleteMemory("a1b2c3d4-e5f6-...");
+```
+
+---
+
+## Storage
+
+Memories are stored in the `structured_memories` table (migration 013).
+The unique constraint on `(name, scope, scope_id)` ensures upsert semantics.
+The name is normalized on save: lowercased, hyphens and spaces replaced with
+underscores.
+
+## Architecture
+
+See [Memory Architecture diagram](diagrams/png/23-memory-architecture.png) for
+the full data flow covering the session tool path, API path, admin path, and
+BM25 relevance injection.

docs/oidc.md

@@ -0,0 +1,429 @@
+# OpenID Connect (OIDC) Single Sign-On
+
+Turnstone supports OpenID Connect for federated authentication, allowing
+users to log in with their existing corporate identity provider instead of
+managing a separate password. OIDC is opt-in: when configured, the login
+screen shows a "Continue with SSO" button alongside the existing
+username/password form. When not configured, the login experience is
+unchanged.
+
+Any OIDC-compliant provider works: Google, Okta, Azure AD, Keycloak,
+Auth0, OneLogin, and others that publish a
+`.well-known/openid-configuration` discovery document.
+
+---
+
+## Prerequisites
+
+1. A registered **confidential** OIDC client at your identity provider
+2. The client's redirect URI must include:
+   `https://your-turnstone-host/v1/api/auth/oidc/callback`
+3. A local admin user must exist in Turnstone (complete the initial setup
+   wizard before enabling OIDC)
+
+---
+
+## Configuration
+
+OIDC is configured via environment variables (preferred) or the `[oidc]`
+section of `config.toml`. Environment variables take precedence when both
+are set.
+
+| Variable | Required | Default | Description |
+|----------|----------|---------|-------------|
+| `TURNSTONE_OIDC_ISSUER` | Yes | — | Issuer URL (e.g. `https://accounts.google.com`). Must serve `/.well-known/openid-configuration`. |
+| `TURNSTONE_OIDC_CLIENT_ID` | Yes | — | OAuth 2.0 client ID from your provider |
+| `TURNSTONE_OIDC_CLIENT_SECRET` | Yes | — | OAuth 2.0 client secret (confidential client) |
+| `TURNSTONE_OIDC_SCOPES` | No | `openid email profile` | Space-separated OAuth scopes to request |
+| `TURNSTONE_OIDC_PROVIDER_NAME` | No | `SSO` | Display name for the login button (e.g. "Google", "Okta") |
+| `TURNSTONE_OIDC_ROLE_CLAIM` | No | — | ID token claim containing role/group values (see [Role Mapping](#role-mapping)) |
+| `TURNSTONE_OIDC_ROLE_MAP` | No | — | Mapping from claim values to Turnstone role IDs (see [Role Mapping](#role-mapping)) |
+| `TURNSTONE_OIDC_PASSWORD_ENABLED` | No | `true` | Set to `false` to hide the password form and block all username/password logins (including admin). API tokens and config-file tokens still work. |
+| `TURNSTONE_OIDC_REDIRECT_BASE` | No | — | Externally-reachable origin for the OIDC redirect URI (e.g. `https://app.example.com`). Recommended when running behind a reverse proxy. When unset, derived from the request Host header. |
+
+OIDC is enabled when all three required fields (issuer, client ID, client
+secret) are non-empty. If any is missing, OIDC is silently disabled and
+the login screen shows only the password form.
+
+### Reverse Proxy / Load Balancer
+
+When Turnstone runs behind a reverse proxy, the internal `Host` header may
+not match the externally-reachable URL. Set `TURNSTONE_OIDC_REDIRECT_BASE`
+to the public origin so the redirect URI sent to the identity provider is
+correct:
+
+```bash
+TURNSTONE_OIDC_REDIRECT_BASE=https://app.example.com
+```
+
+The resulting callback URL will be
+`https://app.example.com/v1/api/auth/oidc/callback` — register this as the
+authorized redirect URI in your identity provider.
+
+### config.toml alternative
+
+```toml
+[oidc]
+issuer = "https://accounts.google.com"
+client_id = "your-client-id"
+client_secret = "your-client-secret"
+scopes = "openid email profile"
+provider_name = "Google"
+role_claim = "groups"
+password_enabled = true
+redirect_base = "https://app.example.com"
+
+[oidc.role_map]
+admin = "builtin-admin"
+engineering = "builtin-operator"
+```
+
+---
+
+## Provider-Specific Setup
+
+### Google
+
+1. Go to [Google Cloud Console](https://console.cloud.google.com/) >
+   **APIs & Services** > **Credentials**
+2. Click **Create Credentials** > **OAuth 2.0 Client ID**
+3. Application type: **Web application**
+4. Add authorized redirect URI:
+   `https://your-turnstone-host/v1/api/auth/oidc/callback`
+5. Copy the **Client ID** and **Client secret**
+
+```bash
+TURNSTONE_OIDC_ISSUER=https://accounts.google.com
+TURNSTONE_OIDC_CLIENT_ID=123456789.apps.googleusercontent.com
+TURNSTONE_OIDC_CLIENT_SECRET=GOCSPX-...
+TURNSTONE_OIDC_PROVIDER_NAME=Google
+```
+
+### Okta
+
+1. In the Okta Admin Console, go to **Applications** > **Create App
+   Integration**
+2. Sign-in method: **OIDC - OpenID Connect**
+3. Application type: **Web Application**
+4. Add sign-in redirect URI:
+   `https://your-turnstone-host/v1/api/auth/oidc/callback`
+5. Note the **Issuer** (your Okta domain, e.g.
+   `https://dev-123456.okta.com`)
+
+```bash
+TURNSTONE_OIDC_ISSUER=https://dev-123456.okta.com
+TURNSTONE_OIDC_CLIENT_ID=0oaXXXXXXXXXXXXX
+TURNSTONE_OIDC_CLIENT_SECRET=...
+TURNSTONE_OIDC_PROVIDER_NAME=Okta
+TURNSTONE_OIDC_ROLE_CLAIM=groups
+TURNSTONE_OIDC_ROLE_MAP="admin:builtin-admin,everyone:builtin-operator"
+```
+
+### Azure AD (Entra ID)
+
+1. In the Azure Portal, go to **App registrations** > **New registration**
+2. Redirect URI: **Web** >
+   `https://your-turnstone-host/v1/api/auth/oidc/callback`
+3. Under **Certificates & secrets**, create a new **Client secret** and
+   copy the value immediately
+4. The issuer URL is
+   `https://login.microsoftonline.com/{tenant-id}/v2.0`
+
+```bash
+TURNSTONE_OIDC_ISSUER=https://login.microsoftonline.com/YOUR_TENANT_ID/v2.0
+TURNSTONE_OIDC_CLIENT_ID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
+TURNSTONE_OIDC_CLIENT_SECRET=...
+TURNSTONE_OIDC_PROVIDER_NAME="Azure AD"
+TURNSTONE_OIDC_ROLE_CLAIM=roles
+TURNSTONE_OIDC_ROLE_MAP="Admin:builtin-admin,User:builtin-operator"
+```
+
+### Keycloak
+
+1. In the Keycloak Admin Console, select your **Realm**
+2. Go to **Clients** > **Create client**
+3. Client type: **OpenID Connect**
+4. Set **Client authentication** to **On** (confidential)
+5. Add valid redirect URI:
+   `https://your-turnstone-host/v1/api/auth/oidc/callback`
+6. The issuer URL is
+   `https://keycloak.example.com/realms/your-realm`
+
+```bash
+TURNSTONE_OIDC_ISSUER=https://keycloak.example.com/realms/your-realm
+TURNSTONE_OIDC_CLIENT_ID=turnstone
+TURNSTONE_OIDC_CLIENT_SECRET=...
+TURNSTONE_OIDC_PROVIDER_NAME=Keycloak
+TURNSTONE_OIDC_ROLE_CLAIM=realm_access.roles
+TURNSTONE_OIDC_ROLE_MAP="admin:builtin-admin,operator:builtin-operator"
+```
+
+---
+
+## Role Mapping
+
+OIDC role mapping assigns Turnstone roles to users based on claims in the
+ID token. This is optional — without it, OIDC users are provisioned with
+the `builtin-viewer` role (read-only access) by default.
+
+### Configuration
+
+Set `TURNSTONE_OIDC_ROLE_CLAIM` to the name of the claim in the ID token
+that contains the user's group or role memberships. Then set
+`TURNSTONE_OIDC_ROLE_MAP` to map claim values to Turnstone role IDs.
+
+The role map is a comma-separated list of `claim_value:turnstone_role`
+pairs:
+
+```bash
+TURNSTONE_OIDC_ROLE_CLAIM=groups
+TURNSTONE_OIDC_ROLE_MAP="admin:builtin-admin,engineering:builtin-operator,viewer:builtin-viewer"
+```
+
+### Behavior
+
+- **Synced on every login**: roles are added when new claim values appear,
+  and OIDC-assigned roles are revoked when the corresponding claim value
+  is no longer present. Roles assigned manually (or by other sources) are
+  never touched — only roles with `assigned_by="oidc"` are subject to
+  revocation.
+- **List or string**: the claim value can be a JSON array
+  (`["admin", "engineering"]`) or a single string (`"admin"`). Both are
+  handled correctly.
+- **Unknown values**: claim values not present in the role map are silently
+  ignored.
+- **Missing roles**: if the role map references a Turnstone role ID that
+  does not exist in the database, the assignment is skipped (no error).
+- **Evaluated on every login**: roles are checked and applied each time
+  the user authenticates via OIDC, so new group memberships are picked
+  up on the next login.
+
+### Built-in Roles
+
+| Role ID | Permissions |
+|---------|-------------|
+| `builtin-admin` | All permissions |
+| `builtin-operator` | read, write, workstreams.create, workstreams.close |
+| `builtin-viewer` | read |
+
+---
+
+## User Provisioning
+
+When a user logs in via OIDC for the first time, Turnstone automatically
+creates a local user account:
+
+1. The OIDC identity (`issuer` + `sub` claim) is stored in the
+   `oidc_identities` table and linked to the new user
+2. The **username** is derived from the `preferred_username` claim,
+   falling back to the email local part, with deduplication if needed
+3. The **display name** comes from the `name` claim, falling back to
+   `preferred_username` or email
+4. The user's password hash is set to a sentinel value (`!oidc`) — OIDC
+   users cannot log in with a password
+
+On subsequent logins, the existing user is matched by `(issuer, sub)` and
+the `last_login` timestamp is updated. Role mapping is re-evaluated on
+every login.
+
+---
+
+## OIDC-Only Mode
+
+To enforce OIDC for all logins and hide the password form, set:
+
+```bash
+TURNSTONE_OIDC_PASSWORD_ENABLED=false
+```
+
+In this mode the login screen shows only the "Continue with SSO" button.
+The password form, token toggle, and sign-in button are all hidden.
+All username/password logins are blocked at the API level, including
+admin accounts.
+
+The first admin account must be created via the setup wizard (with a
+password) before OIDC is enabled. The setup wizard always works
+regardless of this setting because it is only available when zero users
+exist in the database.
+
+API token login (`POST /v1/api/auth/login` with a `ts_` token) and
+config-file tokens (`Authorization: Bearer tok_xxx`) continue to work
+regardless of this setting. OIDC-only mode affects password-based
+authentication only.
+
+---
+
+## Login Flow
+
+Both the server and console support OIDC login. The flow is identical:
+
+1. The browser fetches `GET /v1/api/auth/status` at page load
+2. If the response includes `oidc_enabled: true`, the login screen shows
+   a "Continue with {provider_name}" button
+3. Clicking the button navigates to `GET /v1/api/auth/oidc/authorize`
+4. Turnstone generates a state token, nonce, and PKCE verifier, stores
+   them in the database, and redirects the browser to the identity
+   provider's authorization endpoint
+5. The user authenticates at the identity provider
+6. The IdP redirects back to
+   `GET /v1/api/auth/oidc/callback?code=...&state=...`
+7. Turnstone validates the state, exchanges the authorization code for
+   tokens using the PKCE verifier, validates the ID token against the
+   provider's JWKS public keys, provisions or matches the user, and
+   issues a Turnstone JWT
+8. The browser is redirected to `/?oidc_success=1` with the JWT set in
+   an `HttpOnly` session cookie
+9. The browser JavaScript detects the `oidc_success` query parameter,
+   strips it from the URL, hides the login overlay, and calls
+   `onLoginSuccess()` to initialize the application
+
+---
+
+## API Endpoints
+
+| Method | Path | Auth | Description |
+|--------|------|------|-------------|
+| GET | `/v1/api/auth/oidc/authorize` | Public | Redirects to identity provider |
+| GET | `/v1/api/auth/oidc/callback` | Public | Handles IdP callback, issues JWT |
+
+Both endpoints are public (no authentication required) because they are
+part of the login flow itself.
+
+### Auth status response
+
+When OIDC is enabled, `GET /v1/api/auth/status` includes additional
+fields:
+
+```json
+{
+  "auth_enabled": true,
+  "has_users": true,
+  "setup_required": false,
+  "oidc_enabled": true,
+  "oidc_provider_name": "Google",
+  "password_enabled": true
+}
+```
+
+---
+
+## Database Schema
+
+Migration 018 creates two tables:
+
+```sql
+CREATE TABLE oidc_identities (
+    issuer      TEXT NOT NULL,
+    subject     TEXT NOT NULL,
+    user_id     TEXT NOT NULL,
+    email       TEXT NOT NULL DEFAULT '',
+    created     TEXT NOT NULL,
+    last_login  TEXT NOT NULL,
+    PRIMARY KEY (issuer, subject)
+);
+
+CREATE INDEX idx_oidc_identities_user_id ON oidc_identities(user_id);
+
+CREATE TABLE oidc_pending_states (
+    state          TEXT PRIMARY KEY,
+    nonce          TEXT NOT NULL,
+    code_verifier  TEXT NOT NULL,
+    audience       TEXT NOT NULL,
+    created_at     TEXT NOT NULL
+);
+```
+
+The `oidc_identities` table links an OIDC subject (identified by
+`issuer` + `subject`) to a Turnstone `user_id`. A single user can have
+multiple OIDC identities (e.g. from different providers).
+
+The `oidc_pending_states` table stores authorization flow state for
+callback validation. Entries are automatically cleaned up after 5 minutes.
+
+---
+
+## Security Notes
+
+- **Authorization Code Flow with PKCE**: the recommended OAuth 2.0 flow
+  for web applications. PKCE prevents authorization code interception
+  attacks even without a client secret (though the client secret is still
+  used for additional security).
+- **ID token validation**: all tokens are validated using the provider's
+  JWKS public keys (RS256 or ES256). The signature, issuer, audience,
+  and expiry are all checked.
+- **State parameter**: a cryptographically random state token prevents
+  CSRF attacks on the callback endpoint. The state is stored server-side
+  and verified on callback.
+- **Nonce**: a random nonce is included in the authorization request and
+  verified in the ID token to prevent replay attacks.
+- **Client secret**: never leaves the server — it is only used in the
+  server-to-IdP token exchange, not exposed to the browser.
+- **OIDC users cannot use password login**: the sentinel password hash
+  (`!oidc`) ensures `verify_password()` always rejects password attempts
+  for OIDC-provisioned users.
+- **Rate limiting**: the callback endpoint shares the login rate limiter
+  (5 attempts per 5-minute window per IP).
+- **State TTL**: pending authorization states expire after 5 minutes.
+  Expired states are lazily cleaned up on each callback.
+- **Setup guard**: OIDC login requires at least one local admin user to
+  exist. This ensures the initial admin account is always created via the
+  setup wizard with a password, not hijacked by an external identity.
+
+---
+
+## Troubleshooting
+
+### "OIDC not configured"
+
+All three required environment variables must be set:
+`TURNSTONE_OIDC_ISSUER`, `TURNSTONE_OIDC_CLIENT_ID`, and
+`TURNSTONE_OIDC_CLIENT_SECRET`. Check that none are empty or
+whitespace-only.
+
+### "Login session expired"
+
+The authorization flow must complete within 5 minutes. If the user takes
+too long at the identity provider, the pending state expires. Try again.
+
+### "Initial setup required"
+
+OIDC login is blocked until at least one local admin user exists.
+Complete the setup wizard first (navigate to the Turnstone URL and follow
+the prompts to create an admin user with a password).
+
+### Discovery fails at startup
+
+Check that the issuer URL is reachable from the Turnstone server and
+serves a valid `/.well-known/openid-configuration` document. The server
+logs the discovery attempt at startup:
+
+```
+OIDC discovery failed for https://your-issuer.example.com: ...
+```
+
+OIDC is automatically disabled when discovery fails. Restart the server
+after fixing the connectivity issue.
+
+### Redirect URI mismatch
+
+The redirect URI configured at the identity provider must exactly match
+`https://your-host/v1/api/auth/oidc/callback`. Common issues:
+
+- **Scheme mismatch**: the redirect uses `https://` — make sure TLS is
+  configured or a reverse proxy sets the `X-Forwarded-Proto` header
+- **Port mismatch**: if running on a non-standard port, include it in
+  the redirect URI
+- **Path mismatch**: the path must include the `/v1` API version prefix
+
+### User not assigned expected roles
+
+Check that:
+
+1. `TURNSTONE_OIDC_ROLE_CLAIM` matches the exact claim name in the ID
+   token (case-sensitive)
+2. `TURNSTONE_OIDC_ROLE_MAP` maps the correct claim values to valid
+   Turnstone role IDs
+3. The roles referenced in the map exist in the database (check the
+   admin panel > Roles tab)
+4. The identity provider is configured to include the claim in the ID
+   token (some providers require explicit scope or claim configuration)

docs/openshell.md

@@ -0,0 +1,288 @@
+# OpenShell Sandbox Integration
+
+Turnstone can run inside an [OpenShell](https://github.com/NVIDIA/OpenShell)
+sandbox for kernel-enforced security boundaries around tool execution. OpenShell
+provides four layers of defense that Turnstone's application-level safety model
+does not cover:
+
+| Layer | Mechanism | What it prevents |
+|-------|-----------|------------------|
+| Filesystem | Landlock | Writes to `/etc`, `~/.ssh`, system paths |
+| Network | Network namespace + seccomp + HTTP CONNECT proxy | Connections to unlisted hosts |
+| Process | `setuid` drop + verification | Privilege escalation to root |
+| Credentials | Proxy-level secret resolution | API keys in sandbox memory |
+
+Turnstone's own safety layers (human approval, intent judge, tool policies,
+output guard) remain active inside the sandbox and handle threats at the semantic
+level -- what the LLM *means* to do with its legitimate access.
+
+> See also: [Security and Authentication](security.md),
+> [Intent Validation](judge.md), [Governance](governance.md)
+
+---
+
+## Quick Start
+
+```bash
+# Run turnstone-server in an OpenShell sandbox
+openshell sandbox run \
+  --policy deploy/openshell/turnstone-policy.yaml \
+  --workdir /path/to/project \
+  -- python3 -m turnstone.server --host 0.0.0.0 --port 8080
+```
+
+With inference routing (API keys never enter the sandbox):
+
+```bash
+openshell sandbox run \
+  --policy deploy/openshell/turnstone-policy.yaml \
+  --inference-routes deploy/openshell/routes.yaml \
+  --workdir /path/to/project \
+  -- python3 -m turnstone.server --host 0.0.0.0 --port 8080 \
+      --base-url https://inference.local
+```
+
+The `inference.local` hostname is intercepted by the OpenShell proxy before
+network policy evaluation -- no network policy entry is needed for it.
+
+---
+
+## Policy Files
+
+### `deploy/openshell/turnstone-policy.yaml`
+
+The main sandbox policy. Covers filesystem, process, and network rules.
+
+### `deploy/openshell/routes.yaml`
+
+Inference routing configuration. Maps `inference.local` to real LLM API
+backends. Uncomment and configure the provider(s) you use.
+
+---
+
+## Filesystem Policy
+
+The policy uses Landlock (Linux 5.13+) for kernel-enforced filesystem access
+control. Paths are locked at sandbox creation and cannot be changed at runtime.
+
+| Path | Access | Purpose |
+|------|--------|---------|
+| `--workdir` | read-write | Project files (auto-added via `include_workdir`) |
+| `/tmp` | read-write | Bash tool temp scripts, eval workdirs |
+| `/dev/null` | read-write | Shell redirections (`2>/dev/null`) |
+| `/var/log` | read-write | Log files |
+| `/usr`, `/lib`, `/lib64` | read-only | Python runtime, installed packages |
+| `/etc` | read-only | System config, SSL certificates |
+| `/proc`, `/dev/urandom` | read-only | Process info, entropy |
+| `~/.config/turnstone` | read-only | Config file (writes go to database) |
+
+Landlock runs in `best_effort` mode by default -- degrades gracefully on kernels
+without Landlock support. Set `compatibility: hard_requirement` for production
+hardened deployments.
+
+---
+
+## Network Policy
+
+Default-deny. Only explicitly listed host:port pairs are reachable. All child
+processes (MCP servers, bash commands, grep) inherit the network namespace and
+cannot bypass the proxy.
+
+### Included endpoints
+
+| Policy | Hosts | Purpose |
+|--------|-------|---------|
+| `openai_api` | `api.openai.com` | OpenAI LLM API |
+| `anthropic_api` | `api.anthropic.com` | Anthropic LLM API |
+| `tavily_api` | `api.tavily.com` | Web search fallback |
+| `skills_registry` | `skills.sh` | Skill discovery |
+| `github_api` | `api.github.com` (read-only L7), `raw.githubusercontent.com` | Skill fetch, GitHub API |
+| `mcp_registry` | `registry.modelcontextprotocol.io` (read-only L7) | MCP server discovery |
+| `redis` | `127.0.0.1:6379` | Message queue |
+| `web_fetch_common` | readthedocs, python docs, GitHub Pages, PyPI, npm, Stack Overflow, Wikipedia | Curated web_fetch domains |
+| `bash_network_tools` | Same as `web_fetch_common` | curl/wget from bash tool |
+| `package_registries` | `pypi.org`, `files.pythonhosted.org` | pip/uv package installs |
+| `git_operations` | `github.com`, `gitlab.com` (L7: clone/fetch only, no push) | Git read-only operations |
+
+### L7 enforcement
+
+Endpoints marked with `protocol: rest` and `tls: terminate` get HTTP-level
+inspection. The proxy TLS-terminates using an ephemeral per-sandbox CA, parses
+each request, and evaluates method + path against the rules.
+
+The `github_api`, `mcp_registry`, and `git_operations` policies use L7
+enforcement:
+
+- **GitHub API / MCP Registry**: `access: read-only` -- only GET, HEAD, OPTIONS
+  allowed
+- **Git operations**: explicit rules allowing only `info/refs` (GET) and
+  `git-upload-pack` (POST) -- clone and fetch work, push is blocked
+
+### Commented-out sections
+
+The policy includes commented blocks for optional integrations. Uncomment and
+configure as needed:
+
+- **OIDC** -- add your identity provider's hostname
+- **Discord** -- `discord.com`, `gateway.discord.gg`, `cdn.discordapp.com`
+- **MCP HTTP servers** -- any MCP servers using streamable-http transport
+
+---
+
+## Customizing the Domain Allowlist
+
+The `web_fetch` tool lets the LLM fetch arbitrary public URLs, but OpenShell
+cannot allow "all HTTPS" -- bare wildcard hosts are rejected by policy
+validation. Instead, the policy ships with a curated set of common reference
+domains.
+
+To add domains your workloads need:
+
+```yaml
+# In turnstone-policy.yaml, under web_fetch_common.endpoints:
+      - host: docs.example.com
+        port: 443
+
+# Also add to bash_network_tools.endpoints if curl/wget should reach it:
+      - host: docs.example.com
+        port: 443
+```
+
+Wildcard patterns are supported:
+
+- `*.example.com` -- matches one subdomain level (e.g. `api.example.com`)
+- `**.example.com` -- matches any depth (e.g. `deep.sub.example.com`)
+
+Unlisted domains return connection errors, which the LLM handles gracefully by
+telling the user it cannot reach that site.
+
+---
+
+## Inference Routing
+
+Inference routing keeps real API keys completely outside the sandbox. The
+sandbox process only sees opaque placeholder tokens in its environment
+(`openshell:resolve:env:ANTHROPIC_API_KEY`). The proxy rewrites these to real
+credentials on the wire before forwarding to the upstream API.
+
+### Setup
+
+1. Edit `deploy/openshell/routes.yaml` -- uncomment your provider:
+
+```yaml
+routes:
+  # OpenAI
+  - name: inference.local
+    endpoint: https://api.openai.com/v1
+    model: gpt-5
+    provider_type: openai
+    protocols:
+      - openai_chat_completions
+      - model_discovery
+    api_key_env: OPENAI_API_KEY
+
+  # Or Anthropic
+  - name: inference.local
+    endpoint: https://api.anthropic.com
+    model: claude-sonnet-4-6
+    provider_type: anthropic
+    protocols:
+      - anthropic_messages
+    api_key_env: ANTHROPIC_API_KEY
+```
+
+2. Start with `--inference-routes` and point turnstone at `inference.local`:
+
+```bash
+openshell sandbox run \
+  --inference-routes deploy/openshell/routes.yaml \
+  --base-url https://inference.local \
+  ...
+```
+
+3. When inference routing is active, the `openai_api` and `anthropic_api`
+   network policies can be removed from the sandbox policy -- the proxy handles
+   LLM traffic on a separate code path that bypasses OPA entirely.
+
+### Local model servers
+
+For local servers (vLLM, llama.cpp) with no authentication, omit both
+`api_key` and `api_key_env` from the route config. No credential resolution
+is needed.
+
+---
+
+## MCP Server Subprocesses
+
+MCP servers using stdio transport are spawned as child processes of turnstone.
+They automatically inherit all sandbox constraints:
+
+- **Network namespace** -- kernel-level, cannot be bypassed
+- **Landlock filesystem** -- kernel-level, cannot be relaxed
+- **Seccomp socket filter** -- kernel-level, inherited on fork
+
+No per-subprocess policy entries are needed for these constraints. However, if
+an MCP server makes outbound network requests (through the proxy), its binary
+must appear in a `binaries[]` entry for the relevant network policy. The proxy
+identifies the requesting process via `/proc/<pid>/exe` (not `argv[0]`, which
+is spoofable).
+
+Example for a Python-based MCP server that calls an external API:
+
+```yaml
+  mcp_external_api:
+    name: mcp-external
+    endpoints:
+      - host: api.example.com
+        port: 443
+    binaries:
+      - path: /usr/bin/python3*
+      - path: /usr/local/bin/python3*
+```
+
+MCP servers using streamable-http transport are remote -- they need a network
+policy entry for their host:port but no binary entry (the Python process making
+the HTTP call is already covered by the standard `python3*` binary entries).
+
+---
+
+## Security Model: Which Layer Enforces What
+
+```
+                      OpenShell (infrastructure)          Turnstone (application)
+                     ─────────────────────────────     ──────────────────────────────
+Filesystem access     Landlock kernel enforcement       (no enforcement)
+Network egress        Netns + seccomp + proxy + OPA     SSRF check on web_fetch
+Credentials           Placeholder injection + proxy     Output guard redaction
+Privilege level       setuid drop + verification        (no enforcement)
+Tool semantics        (no visibility)                   Heuristic + LLM judge
+Tool policies         (no visibility)                   fnmatch admin policies
+Prompt injection      (no visibility)                   Output guard detection
+Human approval        (no visibility)                   Approval gate + "always"
+```
+
+OpenShell constrains what the process can physically reach. Turnstone constrains
+what the LLM does with its legitimate access. Neither layer is sufficient alone:
+
+- Without OpenShell: a bash command can `curl` secrets to any endpoint, write to
+  `/etc/crontab`, or read `~/.ssh/id_rsa` -- all gated only by human approval
+- Without Turnstone: the LLM can `rm -rf` the entire workdir, run destructive
+  commands, or consume prompt injection payloads -- all within the sandbox's
+  allowed scope
+
+---
+
+## Hardening Checklist
+
+For production deployments:
+
+- [ ] Set `landlock.compatibility: hard_requirement`
+- [ ] Enable inference routing (removes API keys from sandbox)
+- [ ] Remove `openai_api`/`anthropic_api` network policies when using inference
+      routing (traffic goes through the router, not direct)
+- [ ] Review and trim `web_fetch_common` domains to your actual needs
+- [ ] Remove `package_registries` policy if pip/uv installs are not needed
+- [ ] Add your OIDC provider endpoint if using SSO
+- [ ] Set Redis `allowed_ips` to your actual Redis host if not localhost
+- [ ] Consider removing `bash_network_tools` entirely if bash should not have
+      network access

docs/pgbouncer.md

@@ -0,0 +1,200 @@
+# PgBouncer Connection Pooling
+
+Turnstone cluster deployments share a single PostgreSQL instance across
+all server nodes, bridge processes, and the console. Each process
+maintains a small connection pool (2 base + 3 overflow = 5 max). At
+scale this adds up — a 100-node cluster opens up to 500 connections,
+and a 1000-node cluster up to 5,000.
+
+PostgreSQL's default `max_connections` is 100, and each real connection
+allocates ~5–10 MB of backend memory. PgBouncer sits between turnstone
+and PostgreSQL, multiplexing thousands of lightweight client connections
+down to a small number of real database connections.
+
+---
+
+## Why PgBouncer works well with turnstone
+
+All turnstone database operations are short-burst queries: acquire a
+connection, execute 1–3 statements, commit, release. No operation holds
+a connection for more than a few milliseconds. This makes **transaction
+pooling mode** ideal — PgBouncer assigns a real connection only for the
+duration of each transaction, then returns it to the pool.
+
+| Cluster size | Client connections (max) | PgBouncer server connections needed |
+|--------------|------------------------|-------------------------------------|
+| 10 nodes     | 50                     | 10–20                               |
+| 100 nodes    | 500                    | 20–40                               |
+| 500 nodes    | 2,500                  | 30–60                               |
+| 1,000 nodes  | 5,000                  | 40–80                               |
+
+The server connection count stays low because most client connections
+are idle at any given moment.
+
+---
+
+## Docker Compose
+
+Add PgBouncer between turnstone services and PostgreSQL:
+
+```yaml
+services:
+  pgbouncer:
+    image: bitnami/pgbouncer:latest
+    environment:
+      POSTGRESQL_HOST: postgres
+      POSTGRESQL_PORT: "5432"
+      POSTGRESQL_DATABASE: turnstone
+      POSTGRESQL_USERNAME: ${POSTGRES_USER:-turnstone}
+      POSTGRESQL_PASSWORD: ${POSTGRES_PASSWORD:?}
+      PGBOUNCER_POOL_MODE: transaction
+      PGBOUNCER_DEFAULT_POOL_SIZE: "40"
+      PGBOUNCER_MAX_CLIENT_CONN: "5000"
+      PGBOUNCER_MAX_DB_CONNECTIONS: "80"
+      PGBOUNCER_SERVER_IDLE_TIMEOUT: "300"
+    ports:
+      - "6432:6432"
+    networks:
+      - turnstone-net
+    depends_on:
+      postgres:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD", "pg_isready", "-h", "127.0.0.1", "-p", "6432"]
+      interval: 5s
+      timeout: 3s
+      retries: 5
+```
+
+Then point turnstone services at PgBouncer instead of PostgreSQL
+directly by changing the `DATABASE_URL` (or `TURNSTONE_DB_URL`):
+
+```bash
+# Before (direct)
+TURNSTONE_DB_URL=postgresql://turnstone:secret@postgres:5432/turnstone
+
+# After (via PgBouncer)
+TURNSTONE_DB_URL=postgresql://turnstone:secret@pgbouncer:6432/turnstone
+```
+
+---
+
+## Helm / Kubernetes
+
+Add a PgBouncer deployment or use a Helm chart like
+[bitnami/pgbouncer](https://github.com/bitnami/charts/tree/main/bitnami/pgbouncer).
+
+In `values.yaml`, point the database at PgBouncer:
+
+```yaml
+database:
+  backend: postgresql
+  external:
+    host: pgbouncer
+    port: 6432
+    database: turnstone
+    username: turnstone
+    existingSecret: turnstone-db-secret
+```
+
+PgBouncer configuration:
+
+```yaml
+pgbouncer:
+  poolMode: transaction
+  defaultPoolSize: 40
+  maxClientConn: 5000
+  maxDbConnections: 80
+```
+
+---
+
+## Configuration reference
+
+| PgBouncer setting | Recommended | Notes |
+|-------------------|-------------|-------|
+| `pool_mode` | `transaction` | Required — turnstone uses short-burst queries with no session state |
+| `default_pool_size` | 40 | Real PostgreSQL connections per database. Start here, increase if you see `no more connections allowed` |
+| `max_client_conn` | 5000 | Upper bound on client connections. Set to `cluster_nodes × 5` |
+| `max_db_connections` | 80 | Hard cap on real connections to PostgreSQL. Keep below PG `max_connections` minus headroom for admin/monitoring |
+| `server_idle_timeout` | 300 | Close idle server connections after 5 minutes |
+| `server_lifetime` | 3600 | Recycle server connections after 1 hour |
+
+On the PostgreSQL side:
+
+| PostgreSQL setting | Recommended | Notes |
+|--------------------|-------------|-------|
+| `max_connections` | 100 | Default is fine — PgBouncer is the only client. Set higher than `max_db_connections` to leave room for admin connections |
+| `shared_buffers` | 25% of RAM | Standard PostgreSQL tuning |
+
+---
+
+## Turnstone pool settings
+
+Each turnstone process maintains its own SQLAlchemy connection pool to
+PgBouncer (which then multiplexes to PostgreSQL):
+
+| Environment variable | Default | Description |
+|---------------------|---------|-------------|
+| `TURNSTONE_DB_POOL_SIZE` | 2 | Base pool size per process |
+| `TURNSTONE_DB_BACKEND` | sqlite | Set to `postgresql` for cluster deployments |
+| `TURNSTONE_DB_URL` | — | Connection URL (point at PgBouncer, not PostgreSQL directly) |
+
+The default pool of 2 + 3 overflow = 5 connections per process is
+intentionally small to support large clusters. You should not need to
+increase this — turnstone's database operations are all short-burst
+context-managed queries that hold connections for milliseconds.
+
+SQLAlchemy `pool_pre_ping` is enabled, so stale connections (e.g. after
+PgBouncer restarts) are automatically detected and replaced.
+
+---
+
+## Monitoring
+
+PgBouncer exposes stats via its admin console (connect to
+PgBouncer port with user `pgbouncer`):
+
+```sql
+-- Active and waiting clients
+SHOW POOLS;
+
+-- Per-database stats
+SHOW STATS;
+
+-- Current client connections
+SHOW CLIENTS;
+```
+
+Key metrics to watch:
+
+- **`cl_active`** — clients with a server connection assigned. Should be
+  well below `max_db_connections`.
+- **`cl_waiting`** — clients waiting for a server connection. Sustained
+  non-zero values mean you need more `default_pool_size`.
+- **`sv_active`** — active server (PostgreSQL) connections. Should stay
+  below PostgreSQL `max_connections`.
+
+---
+
+## Troubleshooting
+
+**"no more connections allowed (max_client_conn)"** — PgBouncer is
+rejecting new client connections. Increase `max_client_conn` to match
+your cluster size × 5.
+
+**"no more connections allowed (max_db_connections)"** — PgBouncer
+cannot open more connections to PostgreSQL. Increase
+`max_db_connections` and ensure PostgreSQL `max_connections` is higher.
+
+**Connections timing out on startup** — If all nodes start
+simultaneously, the burst of initial connections (migrations, health
+checks) can temporarily exceed the pool. PgBouncer queues excess
+clients by default — this resolves itself within seconds.
+
+**Prepared statements not supported** — PgBouncer in `transaction` mode
+does not support prepared statements. Turnstone's SQLAlchemy layer does
+not use server-side prepared statements by default, so this is not an
+issue.
+
+See also: [Docker deployment](docker.md) · [Security](security.md)

docs/sdk.md

@@ -69,12 +69,13 @@ Both `TurnstoneServer` (sync) and `AsyncTurnstoneServer` (async) expose:
 |----------|--------|---------|
 | **Workstreams** | `list_workstreams()` | `ListWorkstreamsResponse` |
 | | `dashboard()` | `DashboardResponse` |
-| | `create_workstream(*, name, model, auto_approve)` | `CreateWorkstreamResponse` |
+| | `create_workstream(*, name, model, auto_approve, skill)` | `CreateWorkstreamResponse` |
 | | `close_workstream(ws_id)` | `StatusResponse` |
 | **Chat** | `send(message, ws_id)` | `SendResponse` |
 | | `approve(*, ws_id, approved, feedback, always)` | `StatusResponse` |
 | | `plan_feedback(*, ws_id, feedback)` | `StatusResponse` |
 | | `command(*, ws_id, command)` | `StatusResponse` |
+| | `cancel(ws_id)` | `StatusResponse` |
 | **Streaming** | `stream_events(ws_id)` | `Iterator[ServerEvent]` |
 | | `stream_global_events()` | `Iterator[ServerEvent]` |
 | **High-level** | `send_and_wait(message, ws_id, *, timeout, on_event)` | `TurnResult` |
@@ -96,13 +97,17 @@ Both `TurnstoneConsole` (sync) and `AsyncTurnstoneConsole` (async) expose:
 | | `workstreams(*, state, node, search, sort, page, per_page)` | `ClusterWorkstreamsResponse` |
 | | `node_detail(node_id)` | `NodeDetailResponse` |
 | | `snapshot()` | `ClusterSnapshotResponse` |
-| | `create_workstream(*, node_id, name, model, initial_message)` | `ConsoleCreateWsResponse` |
+| | `create_workstream(*, node_id, name, model, initial_message, skill)` | `ConsoleCreateWsResponse` |
 | **Schedules** | `list_schedules()` | `ListSchedulesResponse` |
 | | `create_schedule(*, name, schedule_type, initial_message, ...)` | `ScheduleInfo` |
 | | `get_schedule(task_id)` | `ScheduleInfo` |
 | | `update_schedule(task_id, *, name=..., enabled=..., ...)` | `ScheduleInfo` |
 | | `delete_schedule(task_id)` | `StatusResponse` |
 | | `list_schedule_runs(task_id, *, limit=50)` | `ListScheduleRunsResponse` |
+| **MCP Registry** | `search_mcp_registry(q="", *, limit=20, cursor=None)` | `RegistrySearchResponse` |
+| | `install_from_registry(registry_name, source, *, index=0, name="", variables=None, env=None, headers=None)` | `McpServerDetail` |
+| **Skill Discovery** | `discover_skills(q="", *, limit=20)` | `SkillDiscoverResponse` |
+| | `install_skill(source, *, skill_id="", url="")` | `dict` |
 | **Streaming** | `stream_cluster_events()` | `Iterator[ClusterEvent]` |
 | **Auth** | `login(username=..., password=...)` / `login(token="ts_xxx")` | `AuthLoginResponse` |
 | | `logout()` | `StatusResponse` |
@@ -124,11 +129,12 @@ SSE events are deserialized into typed dataclasses. Use `event.type` to discrimi
 | `approve_request` | `ApproveRequestEvent` | `items` |
 | `tool_result` | `ToolResultEvent` | `call_id`, `name`, `output` |
 | `tool_output_chunk` | `ToolOutputChunkEvent` | `call_id`, `chunk` |
-| `status` | `StatusEvent` | `prompt_tokens`, `total_tokens`, `pct`, `effort` |
+| `status` | `StatusEvent` | `prompt_tokens`, `total_tokens`, `pct`, `effort`, `cache_creation_tokens`, `cache_read_tokens` |
 | `plan_review` | `PlanReviewEvent` | `content` |
 | `error` | `ErrorEvent` | `message` |
 | `info` | `InfoEvent` | `message` |
 | `stream_end` | `StreamEndEvent` | — |
+| `cancelled` | `CancelledEvent` | — |
 
 **Global events** (from `stream_global_events()`):
 
@@ -220,6 +226,20 @@ await client.login({ username: "alice", password: "s3cret" });
 const overview = await client.overview();
 console.log(`Nodes: ${overview.nodes}, Workstreams: ${overview.workstreams}`);
 
+// Search and install from the MCP Registry
+const results = await client.searchMcpRegistry({ q: "github", limit: 10 });
+const server = await client.installFromRegistry({
+  registry_name: results.servers[0].name,
+  source: "remote",
+});
+
+// Search and install skills from external registries
+const skills = await client.discoverSkills({ q: "code review" });
+const skill = await client.installSkill({
+  source: "github",
+  url: "https://github.com/owner/skill-repo",
+});
+
 // Stream cluster events
 for await (const event of client.clusterEvents()) {
   console.log(event.type, event);

docs/security.md

@@ -54,7 +54,7 @@ Claims:
 |-------|-------------|
 | `sub` | User ID |
 | `scopes` | Comma-separated scope list (`read,write,approve`) |
-| `src` | Token source (`password`, `api_token`, `config`) |
+| `src` | Token source (`password`, `api_token`, `config`, `oidc`) |
 | `iss` | Issuer — always `turnstone` |
 | `aud` | Audience — `turnstone-server` or `turnstone-console` |
 | `iat` | Issued-at timestamp |
@@ -90,7 +90,36 @@ Scopes are hierarchical — higher scopes imply all lower ones.
 
 Public paths bypass authentication entirely: `/`, `/health`, `/metrics`,
 `/static/*`, `/shared/*`, `/docs`, `/openapi.json`, `/api/auth/login`,
-`/api/auth/logout`, `/api/auth/status`, `/api/auth/setup`.
+`/api/auth/logout`, `/api/auth/status`, `/api/auth/setup`,
+`/api/auth/oidc/authorize`, `/api/auth/oidc/callback`.
+
+### RBAC (Granular Permissions)
+
+> See also: [Governance documentation](governance.md)
+
+Scopes provide coarse endpoint-level access control. For finer-grained
+enforcement, the governance layer adds 15 named permissions checked
+per-endpoint by `require_permission()`. Permissions are bundled into
+roles; users are assigned roles via the `user_roles` join table.
+
+At login, `_load_user_permissions()` aggregates all permissions from
+the user's assigned roles. `_permissions_to_scopes()` derives legacy
+scopes for backward compatibility (e.g., any `admin.*` permission
+implies the `approve` scope). The JWT carries both `scopes` and
+`permissions` claims.
+
+Three built-in roles are seeded by migration 008:
+
+| Role | Permissions |
+|------|-------------|
+| admin | All 15 permissions |
+| operator | read, write, workstreams.create, workstreams.close |
+| viewer | read |
+
+Custom roles can be created with any subset of the valid permissions.
+Role creation and update validate permissions against a static allowlist.
+Self-assignment is blocked, and assigning a role requires the caller to
+hold a superset of the target role's permissions.
 
 ---
 
@@ -171,6 +200,94 @@ Response:
 The response also sets an `HttpOnly` session cookie containing the JWT,
 so the browser is immediately authenticated after setup completes.
 
+### OIDC SSO (Single Sign-On)
+
+Turnstone supports OIDC Authorization Code Flow with PKCE for
+single sign-on with external identity providers (Okta, Azure AD,
+Google, etc.). SSO is opt-in — enabled when the three required
+environment variables are set. Users are auto-provisioned on first
+login.
+
+#### Configuration
+
+| Variable | Required | Description |
+|----------|----------|-------------|
+| `TURNSTONE_OIDC_ISSUER` | Yes | OIDC issuer URL (e.g., `https://accounts.google.com`) |
+| `TURNSTONE_OIDC_CLIENT_ID` | Yes | Client ID from the identity provider |
+| `TURNSTONE_OIDC_CLIENT_SECRET` | Yes | Client secret (confidential client) |
+| `TURNSTONE_OIDC_SCOPES` | No | OIDC scopes (default: `openid email profile`) |
+| `TURNSTONE_OIDC_PROVIDER_NAME` | No | Display name for the SSO button (default: `SSO`) |
+| `TURNSTONE_OIDC_ROLE_CLAIM` | No | Claim name in the ID token for role mapping (e.g., `groups`) |
+| `TURNSTONE_OIDC_ROLE_MAP` | No | Comma-separated `claim_value:role_id` pairs (e.g., `admin:builtin-admin,eng:builtin-operator`) |
+| `TURNSTONE_OIDC_PASSWORD_ENABLED` | No | Set to `false` to hide password login and force SSO-only |
+
+OIDC is enabled when all three required variables (`ISSUER`,
+`CLIENT_ID`, `CLIENT_SECRET`) are set.
+
+#### Login flow
+
+1. User clicks "Continue with [Provider]" on the login page
+2. `GET /v1/api/auth/oidc/authorize` generates state, nonce, and PKCE
+   challenge, stores them in the database, and redirects to the IdP
+3. User authenticates at the identity provider
+4. IdP redirects to `/v1/api/auth/oidc/callback` with `code` + `state`
+5. Server validates state, exchanges the authorization code (with PKCE
+   verifier), and validates the ID token (JWKS signature, issuer,
+   audience, nonce)
+6. Provisions or matches the user by `(issuer, sub)` — never by
+   username or email
+7. Issues a JWT (`src: oidc`), sets a session cookie, and redirects to
+   the application
+
+#### Security measures
+
+- **PKCE (S256)** — prevents authorization code interception
+- **State parameter** — one-time use, 5-minute TTL, database-backed
+  (multi-node safe)
+- **Nonce** — prevents ID token replay
+- **JWKS validation** — asymmetric algorithm allowlist (RS/ES/PS
+  256-512), HMAC excluded
+- **Algorithm allowlist enforced** — the signing key is resolved from
+  the JWKS by ``kid``; PyJWK infers the key's algorithm from the JWKS
+  ``alg``/``kty`` fields; the token header's ``alg`` must be in the
+  allowlist AND match the key type, preventing algorithm confusion
+- **Identity matching by (issuer, sub) only** — prevents account
+  takeover via email or username reuse
+- **`password_enabled=false` enforced server-side** — not just a UI
+  toggle
+- **Rate limiting** on both authorize and callback endpoints
+- **OIDC-provisioned users cannot password-login** — the password hash
+  is set to the `!oidc` sentinel, which never matches bcrypt verify
+
+#### Role mapping
+
+When `TURNSTONE_OIDC_ROLE_CLAIM` is set (e.g., `groups`), the server
+reads that claim from the ID token and maps values to Turnstone roles
+via `TURNSTONE_OIDC_ROLE_MAP`. Roles are synced on every login:
+matching claim values are added, and stale OIDC-assigned roles are
+revoked. Roles assigned manually (not by OIDC) are never touched.
+
+If no role mapping is configured, OIDC users are provisioned with the
+`builtin-viewer` role by default.
+
+#### OIDC-only mode
+
+Setting `TURNSTONE_OIDC_PASSWORD_ENABLED=false` hides the password
+form on the login page and blocks password-based login at the API
+level. The setup wizard always works regardless of this setting — the
+first admin user is created with a password before OIDC is relevant.
+API tokens and config-file tokens are unaffected by this setting.
+
+#### Known limitations
+
+- **No session revocation** — deprovisioned IdP users retain their JWT
+  until the 24-hour expiry
+- **Single IdP** — configuration supports one issuer (the database
+  schema supports multiple for future expansion)
+- **Redirect URI** — defaults to request Host header; deployments behind
+  reverse proxies should set `TURNSTONE_OIDC_REDIRECT_BASE` to the
+  externally-reachable origin to pin the redirect URI
+
 ---
 
 ## Token Detection Order
@@ -455,3 +572,13 @@ and browsers enforce same-origin policy.
   refresh, eliminating long-lived static tokens for inter-service auth.
 - **Secret strength validation** — warning logged when JWT secret is
   shorter than 32 characters.
+- **OIDC PKCE enforcement** — S256 code challenge on every
+  authorization request prevents code interception in transit.
+- **OIDC state/nonce in database** — one-time-use, TTL-bounded tokens
+  stored in the database, safe for multi-node deployments.
+- **OIDC JWKS-only validation** — ID tokens are verified using the
+  provider's published JWKS keys with asymmetric algorithms only;
+  HMAC-based algorithms are rejected to prevent algorithm confusion.
+- **OIDC identity binding by (issuer, sub)** — user matching uses the
+  immutable subject identifier, not email or username, preventing
+  account takeover via IdP attribute changes.

docs/settings.md

@@ -0,0 +1,355 @@
+# System Settings
+
+> See also: [Settings Architecture diagram](diagrams/png/24-settings-architecture.png)
+
+The system settings feature provides database-backed configuration for server
+nodes. Settings are stored in the `system_settings` table and managed through
+the admin API or console Settings tab. This replaces `config.toml` for
+non-bootstrap settings on server entry points, while the CLI continues to read
+`config.toml` directly.
+
+## Overview
+
+Settings follow a typed registry pattern: every storable setting has a
+`SettingDef` entry in `settings_registry.py` with type, default, description,
+validation constraints, and a `restart_required` flag. Unknown keys are rejected
+at the API boundary.
+
+At runtime, `ConfigStore` loads all settings from storage into an in-memory
+cache. Reads are lock-free dict lookups on an immutable snapshot. Writes acquire
+a lock, persist to storage, and swap the cache atomically.
+
+---
+
+## Precedence
+
+Settings resolution differs between entry points:
+
+| Entry point | Chain |
+|-------------|-------|
+| **Server** (`turnstone-server`, `turnstone-bridge`) | CLI flag > ConfigStore > registry default |
+| **CLI** (`turnstone`) | CLI flag > config.toml > argparse default |
+
+The server's `apply_config()` ignores config.toml sections that overlap with
+ConfigStore. A startup warning is logged for each overlapping key, directing
+users to the admin Settings API.
+
+---
+
+## Bootstrap vs ConfigStore
+
+**Bootstrap settings** are required before storage is available (database
+connection, Redis, auth secrets, server bind address). These stay in
+`config.toml` and environment variables.
+
+| Category | Section | Where |
+|----------|---------|-------|
+| API credentials | `[api]` | config.toml / env |
+| Database | `[database]` | config.toml / env |
+| Redis | `[redis]` | config.toml / env |
+| Auth | `[auth]` | config.toml / env |
+| Bridge identity | `[bridge]` | config.toml / env |
+| Console bind | `[console]` | config.toml / env |
+
+**ConfigStore settings** (48 settings) are loaded from the database after
+storage initialization:
+
+| Section | Settings |
+|---------|----------|
+| `model` | name, temperature, max_tokens, reasoning_effort, context_window |
+| `session` | instructions, retention_days, compact_max_tokens, auto_compact_pct |
+| `tools` | timeout, truncation, agent_max_turns, skip_permissions, search, search_threshold, search_max_results |
+| `server` | workstream_idle_timeout, max_workstreams |
+| `cluster` | node_fan_out_limit, mcp_max_servers |
+| `mcp` | config_path, refresh_interval, registry_url |
+| `ratelimit` | enabled, requests_per_second, burst, trusted_proxies |
+| `health` | backend_probe_interval, backend_probe_timeout, circuit_breaker_threshold, circuit_breaker_cooldown |
+| `judge` | enabled, model, provider, base_url, api_key, confidence_threshold, max_context_ratio, timeout, read_only_tools, output_guard, redact_secrets |
+| `skills` | discovery_url |
+| `memory` | relevance_k, fetch_limit, max_content, nudge_cooldown, nudges |
+
+Settings are addressed by dotted key (e.g. `memory.relevance_k`). Each has a
+declared type (`int`, `float`, `str`, `bool`), optional `min_value`/`max_value`
+range, optional `choices` list, and an `is_secret` flag.
+
+---
+
+## Storage
+
+The `system_settings` table (migration 015) stores settings as JSON-encoded
+values with a composite primary key of `(key, node_id)`:
+
+| Column | Type | Description |
+|--------|------|-------------|
+| `key` | text | Dotted setting key (e.g. `model.temperature`) |
+| `value` | text | JSON-encoded value |
+| `node_id` | text | Node ID for per-node overrides (empty string = global) |
+| `is_secret` | int | 1 if the setting contains secrets |
+| `changed_by` | text | Username of last editor |
+| `created` | text | ISO timestamp |
+| `updated` | text | ISO timestamp |
+
+Per-node overrides layer on top of global settings. When `ConfigStore` loads,
+it fetches global settings first, then overlays per-node values.
+
+---
+
+## Admin API
+
+Four endpoints on the **console** server, all requiring the `admin.settings`
+permission.
+
+### `GET /v1/api/admin/settings`
+
+List all settings with their effective values, defaults, and metadata.
+
+**Response:** `200`
+
+```json
+{
+  "settings": [
+    {
+      "key": "model.temperature",
+      "value": 0.7,
+      "source": "storage",
+      "type": "float",
+      "description": "Sampling temperature",
+      "section": "model",
+      "is_secret": false,
+      "node_id": "",
+      "changed_by": "admin",
+      "updated": "2026-03-14T10:00:00",
+      "restart_required": false
+    }
+  ]
+}
+```
+
+---
+
+### `GET /v1/api/admin/settings/schema`
+
+Return the full registry catalog (all defined settings with metadata). Useful
+for building dynamic admin UIs.
+
+**Response:** `200`
+
+```json
+{
+  "schema": [
+    {
+      "key": "model.temperature",
+      "type": "float",
+      "default": 0.5,
+      "description": "Sampling temperature",
+      "section": "model",
+      "is_secret": false,
+      "min_value": 0.0,
+      "max_value": 2.0,
+      "choices": null,
+      "restart_required": false
+    }
+  ]
+}
+```
+
+---
+
+### `PUT /v1/api/admin/settings/{key}`
+
+Update a setting. The value is validated against the registry (type coercion,
+range, choices). Secret settings (`is_secret=true`) cannot be written via the
+API -- they must be configured via config.toml or environment variables.
+
+**Path parameters:**
+
+| Parameter | Type   | Description |
+|-----------|--------|-------------|
+| `key`     | string | Dotted setting key (e.g. `model.temperature`) |
+
+**Request body:**
+
+```json
+{
+  "value": 0.7,
+  "node_id": ""
+}
+```
+
+| Field     | Type   | Required | Default | Description |
+|-----------|--------|----------|---------|-------------|
+| `value`   | any    | yes      | --      | New value (type-coerced against registry) |
+| `node_id` | string | no       | `""`    | Node ID for per-node override |
+
+**Response (success):** `200`
+
+```json
+{
+  "key": "model.temperature",
+  "value": 0.7,
+  "source": "storage",
+  "type": "float",
+  "description": "Sampling temperature",
+  "section": "model",
+  "is_secret": false,
+  "node_id": "",
+  "changed_by": "admin",
+  "updated": "",
+  "restart_required": false
+}
+```
+
+**Errors:**
+
+| Status | Condition |
+|--------|-----------|
+| 400    | Unknown key, invalid value, type mismatch, out of range |
+| 403    | Secret setting (must use config.toml or env) |
+
+---
+
+### `DELETE /v1/api/admin/settings/{key}`
+
+Reset a setting to its registry default by removing it from storage.
+
+**Path parameters:**
+
+| Parameter | Type   | Description |
+|-----------|--------|-------------|
+| `key`     | string | Dotted setting key |
+
+**Query parameters:**
+
+| Parameter | Type   | Required | Default | Description |
+|-----------|--------|----------|---------|-------------|
+| `node_id` | string | no       | `""`    | Node ID (empty = global) |
+
+**Response (success):** `200`
+
+```json
+{"status": "ok", "key": "model.temperature", "default": 0.5}
+```
+
+**Response (not found):** `404`
+
+```json
+{"error": "Setting 'model.temperature' has no stored value"}
+```
+
+---
+
+## Secret Settings
+
+Settings with `is_secret=True` (currently only `judge.api_key`) are blocked
+from the write API with a `403` response. This prevents accidental exposure
+through the admin UI or audit logs. Secret settings must be configured via
+`config.toml` or environment variables.
+
+The list endpoint masks secret values: stored secrets appear as `"***"`
+rather than their actual value.
+
+---
+
+## Hot Reload
+
+`ConfigStore` caches all settings in memory for fast, lock-free reads. To
+refresh the cache after external changes (e.g. direct database edits or
+cluster-wide propagation):
+
+```
+POST /v1/api/_internal/config-reload
+```
+
+This triggers `ConfigStore.reload()`, which re-reads all settings from storage
+and atomically swaps the cache. The `version` counter increments on every
+reload.
+
+**Behavior after reload:**
+
+- New workstreams pick up updated values immediately (via `session_factory`)
+- Existing sessions keep their frozen configuration (settings are captured at
+  workstream creation time, not read on every turn)
+- Settings marked `restart_required=True` need a server restart to take effect
+
+---
+
+## Migration from config.toml
+
+On startup, `warn_migrated_settings()` scans `config.toml` for keys that are
+now managed by ConfigStore. Each overlap produces a warning:
+
+```
+WARNING config.toml [model] temperature is now managed via Settings API —
+this value will be ignored. Use the admin Settings tab or
+PUT /v1/api/admin/settings/model.temperature to configure.
+```
+
+To migrate:
+
+1. Note the values from `config.toml` for sections that overlap with ConfigStore
+2. Use `PUT /v1/api/admin/settings/{key}` or the console Settings tab to set
+   each value
+3. Remove the migrated sections from `config.toml`
+4. Restart the server to verify no warnings
+
+---
+
+## SDK
+
+### Python
+
+```python
+from turnstone.sdk import TurnstoneConsole
+
+with TurnstoneConsole("http://localhost:9090", token="tok_xxx") as admin:
+    # List all settings with effective values
+    result = admin.list_settings()
+    for s in result["settings"]:
+        print(f"{s['key']} = {s['value']} (source: {s['source']})")
+
+    # Get the schema catalog
+    schema = admin.get_settings_schema()
+
+    # Update a setting
+    admin.update_setting("model.temperature", value=0.7)
+
+    # Update with per-node override
+    admin.update_setting("model.temperature", value=0.3, node_id="node-2")
+
+    # Reset to default
+    admin.delete_setting("model.temperature")
+```
+
+### TypeScript
+
+```typescript
+import { TurnstoneConsole } from "@turnstone/sdk";
+
+const admin = new TurnstoneConsole({
+  baseUrl: "http://localhost:9090",
+  token: "tok_xxx",
+});
+
+// List all settings
+const result = await admin.listSettings();
+for (const s of result.settings) {
+  console.log(`${s.key} = ${s.value} (source: ${s.source})`);
+}
+
+// Get schema catalog
+const schema = await admin.getSettingsSchema();
+
+// Update a setting
+await admin.updateSetting("model.temperature", { value: 0.7 });
+
+// Reset to default
+await admin.deleteSetting("model.temperature");
+```
+
+---
+
+## Architecture
+
+See [Settings Architecture diagram](diagrams/png/24-settings-architecture.png)
+for the full data flow covering server startup, admin API writes, hot reload,
+and settings precedence.

docs/tools.md

@@ -1,6 +1,6 @@
 # Tools Reference
 
-turnstone exposes 16 built-in tools plus any number of external MCP tools to the
+turnstone exposes 18 built-in tools plus any number of external MCP tools to the
 LLM via the OpenAI function-calling interface. Built-in tools are defined as JSON
 files under `turnstone/tools/` and loaded at startup by `turnstone/core/tools.py`.
 MCP tools are discovered from configured MCP servers at startup by
@@ -46,12 +46,12 @@ schema plus turnstone-specific metadata keys:
 
 | Name                | Description |
 |---------------------|-------------|
-| `TOOLS`             | All 16 tool definitions (sent to the model). |
+| `TOOLS`             | All 17 tool definitions (sent to the model). |
 | `AGENT_TOOLS`       | Tools with `agent: true` -- available to plan sub-agents. Read-only tools. |
 | `TASK_AGENT_TOOLS`  | Tools with `task_agent: true` -- available to task sub-agents. Includes write operations. |
 | `AGENT_AUTO_TOOLS`  | Set of tool names with `auto_approve: true` -- no user confirmation needed. |
 | `TASK_AUTO_TOOLS`   | Same as `AGENT_AUTO_TOOLS` (identical filter). |
-| `BUILTIN_TOOL_NAMES`| Frozenset of all 16 built-in tool names. Used by tool search to distinguish always-on tools from deferrable MCP tools. |
+| `BUILTIN_TOOL_NAMES`| Frozenset of all 17 built-in tool names. Used by tool search to distinguish always-on tools from deferrable MCP tools. |
 | `PRIMARY_KEY_MAP`   | Dict mapping tool name to its `primary_key` parameter name. |
 
 ---
@@ -69,7 +69,7 @@ Tool execution follows a three-phase pipeline inside `ChatSession._execute_tools
 - Parses the JSON arguments (with fallback for malformed JSON).
 - If JSON parsing fails entirely, uses `PRIMARY_KEY_MAP` to map a bare string
   to the correct parameter.
-- Dispatches to the matching `_prepare_{func_name}()` handler. There are 15
+- Dispatches to the matching `_prepare_{func_name}()` handler. There are 17
   built-in tools plus `tool_search` (synthetic, client-side BM25 fallback) and
   the generic `_prepare_mcp_tool()` handler for MCP tools.
 - Validates arguments and builds a preview dict containing:
@@ -87,8 +87,11 @@ All prepared items are sent to the UI via `ui.approve_tools(items)`.
   but do not block execution.
 - Items where `needs_approval` is `True` require the user to accept or deny.
 - The user can provide feedback alongside their approval (e.g. "y, use full path").
-- If `auto_approve` is `True` on the session (headless mode), all tools are
-  approved automatically.
+- Choosing "always" (key `a`) adds the pending tool names to `auto_approve_tools`,
+  so that specific tool type is auto-approved going forward (other tool types still
+  prompt). This is per-tool, not blanket.
+- If `auto_approve` is `True` on the session (via `--skip-permissions` or workstream
+  template), all tools are approved automatically.
 
 ### Phase 3: Execute
 
@@ -114,9 +117,8 @@ Each item's `execute` callable is invoked:
 - `read_file` -- reads files, no side effects
 - `search` -- grep-style search, no side effects
 - `man` -- reads man pages, no side effects
-- `remember` -- writes to persistent memory database (lightweight, always auto-approved)
-- `recall` -- reads from persistent memory database
-- `forget` -- deletes from persistent memory database (lightweight, always auto-approved)
+- `memory` -- structured persistent memory (save/search/delete/list)
+- `recall` -- searches conversation history
 - `notify` -- sends notifications to linked channels (time-sensitive, auto-approved for urgency)
 
 **Requires user confirmation** (write operations, network access, side effects):
@@ -164,10 +166,11 @@ Every tool defines a `primary_key`. The mapping is:
 | `web_search` | `query`     |
 | `task`       | `prompt`    |
 | `plan`       | `prompt`    |
-| `remember`   | `key`       |
+| `memory`     | `name`      |
 | `recall`     | `query`     |
-| `forget`     | `key`       |
 | `notify`     | `message`   |
+| `read_resource` | `uri`    |
+| `use_prompt` | `name`     |
 
 ---
 
@@ -351,16 +354,22 @@ Plan before implementing -- an autonomous agent explores the codebase and writes
 
 ## Memory
 
-### remember
+### memory
 
-Save a persistent memory that persists across sessions.
+Structured persistent memory across sessions with typed, scoped entries.
 
-| Parameter | Type   | Required | Description |
-|-----------|--------|----------|-------------|
-| `key`     | string | yes      | Short identifier (e.g. `user_name`). |
-| `value`   | string | yes      | Content to remember. |
+| Parameter     | Type    | Required | Description |
+|---------------|---------|----------|-------------|
+| `action`      | string  | yes      | `save`, `search`, `delete`, or `list`. |
+| `name`        | string  | save/delete | Short snake_case identifier for the memory. |
+| `content`     | string  | save     | Memory content to store. |
+| `description` | string  | no       | Short description for relevance matching (recommended for `save`). |
+| `type`        | string  | no       | Memory type: `user`, `project`, `feedback`, or `reference`. Default: `project`. |
+| `scope`       | string  | no       | Memory scope: `global`, `workstream`, or `user`. Default: `global`. |
+| `query`       | string  | search   | Search query for finding memories. |
+| `limit`       | integer | no       | Max results for `search` or `list`. Default: 20. |
 
-- **What it does**: Stores a key-value pair in the SQLite memory database. Memories persist across sessions and are included in the system prompt on startup.
+- **What it does**: Manages structured persistent memories in the database. Memories persist across sessions, have a type classification (user preferences, project knowledge, feedback, reference material) and a scope (global across all workstreams, private to a workstream, or following a user). Relevant memories are included in the system prompt on startup.
 - **Auto-approve**: Yes.
 - **Agent availability**: Not available to sub-agents (top-level only).
 
@@ -368,28 +377,14 @@ Save a persistent memory that persists across sessions.
 
 ### recall
 
-Search memories and past conversations.
+Search conversation history for past messages and tool results.
 
 | Parameter | Type    | Required | Description |
 |-----------|---------|----------|-------------|
-| `query`   | string  | no       | Search term or phrase. Omit to list all memories. |
-| `limit`   | integer | no       | Max conversation results to return (default 20). |
+| `query`   | string  | yes      | Search term or phrase to find in conversation history. |
+| `limit`   | integer | no       | Max results to return (default 20). |
 
-- **What it does**: With no query, lists all saved memories. With a query, searches both the memory store and conversation history using FTS5 full-text search.
-- **Auto-approve**: Yes.
-- **Agent availability**: Not available to sub-agents (top-level only).
-
----
-
-### forget
-
-Remove a persistent memory by key.
-
-| Parameter | Type   | Required | Description |
-|-----------|--------|----------|-------------|
-| `key`     | string | yes      | The memory key to remove (e.g. `user_name`). |
-
-- **What it does**: Deletes the memory entry with the given key from the SQLite database.
+- **What it does**: Searches conversation history across sessions using FTS5 full-text search. Returns matching messages, tool calls, and tool results with timestamps and workstream context.
 - **Auto-approve**: Yes.
 - **Agent availability**: Not available to sub-agents (top-level only).
 
@@ -497,6 +492,36 @@ data.get("mergedAt") is not None
 
 ---
 
+### skill
+
+Discover and activate skills at runtime during a conversation. The model can
+search for available skills and load one by name, replacing the current active
+skill. This enables model-driven skill selection without requiring the user to
+pre-configure skills at workstream creation.
+
+| Parameter | Type   | Required | Description |
+|-----------|--------|----------|-------------|
+| `action`  | string | yes      | `load` or `search`. |
+| `name`    | string | load     | Skill name to activate. |
+| `query`   | string | no       | Search query for finding skills (for `search` action). |
+
+**Actions:**
+
+- `load` — Activate a skill by name. Calls `set_skill()` which handles content
+  rendering with `{{model}}`/`{{ws_id}}`/`{{node_id}}` variables, system message
+  reinitialization, and config persistence. Returns the skill name, description,
+  and security scan tier. Warns on high/critical scan status.
+- `search` — Find available skills by query. Uses BM25 relevance ranking over
+  name, description, tags, and category (same `BM25Index` used by memory
+  relevance and tool search). Returns up to 10 results with name, description,
+  category, scan status, and activation type.
+
+- **Auto-approve**: `load` requires approval (changes session behavior); `search`
+  is auto-approved (read-only).
+- **Agent availability**: Main session only — not available to plan/task sub-agents.
+
+---
+
 ## Summary Table
 
 | Tool         | Category   | Auto-approve | agent | task_agent | primary_key |
@@ -512,11 +537,13 @@ data.get("mergedAt") is not None
 | `web_search` | Info       | No           | Yes   | Yes        | `query`     |
 | `task`       | Agent      | No           | No    | No         | `prompt`    |
 | `plan`       | Agent      | No           | No    | No         | `prompt`    |
-| `remember`   | Memory     | Yes          | No    | No         | `key`       |
+| `memory`     | Memory     | Yes          | No    | No         | `name`      |
 | `recall`     | Memory     | Yes          | No    | No         | `query`     |
-| `forget`     | Memory     | Yes          | No    | No         | `key`       |
 | `notify`     | Notify     | Yes          | Yes   | Yes        | `message`   |
 | `watch`      | Monitor    | No (create)  | No    | No         | `command`   |
+| `read_resource`| MCP      | No           | Yes   | Yes        | `uri`       |
+| `use_prompt` | MCP        | No           | Yes   | Yes        | `name`      |
+| `skill`      | Skills     | No (load)    | No    | No         | `name`      |
 | `tool_search`| Search     | Yes          | No    | No         | `query`     |
 
 ---
@@ -564,12 +591,12 @@ CLI flags override the config file:
 
 ### How it works
 
-1. **Threshold check**: At session startup, `ToolSearchManager.should_activate()`
-   counts total tools (built-in + MCP). If the count is below the threshold, tool
-   search stays off and all tools are sent to the model directly.
+1. **Threshold check**: At session startup, if the total tool count (built-in + MCP)
+   is below the threshold, tool search stays off and all tools are sent to the model
+   directly.
 
 2. **Partitioning**: When active, tools are split into two sets:
-   - **Always-on** -- the 15 built-in tools (members of `BUILTIN_TOOL_NAMES`).
+   - **Always-on** -- the 17 built-in tools (members of `BUILTIN_TOOL_NAMES`).
      These are always visible to the model.
    - **Deferred** -- all MCP tools. These are not sent in the tool list unless
      the model searches for them.
@@ -593,6 +620,8 @@ where the model can interactively search for tools it needs.
 
 ## MCP Tools (External)
 
+> See also: [MCP Architecture diagram](diagrams/png/20-mcp-architecture.png)
+
 Turnstone supports the [Model Context Protocol](https://modelcontextprotocol.io/)
 (MCP) for connecting external tool servers — GitHub, databases, filesystems, or any
 MCP-compatible service.
@@ -610,7 +639,7 @@ MCP-compatible service.
 3. **Schema conversion**: Each MCP tool's `inputSchema` is converted to OpenAI
    function-calling format. The tool name is prefixed: `mcp__{server}__{tool}`.
 
-4. **Merging**: MCP tools are appended after the 15 built-in tools via
+4. **Merging**: MCP tools are appended after the 17 built-in tools via
    `merge_mcp_tools()`. Built-in tools appear first, giving them natural LLM priority.
    When dynamic tool search is active, MCP tools are deferred rather than directly
    visible -- the model discovers them via search as needed (see
@@ -625,8 +654,11 @@ MCP-compatible service.
 MCP tools **require user approval by default** (`needs_approval: True`). turnstone
 does not auto-approve MCP tools based on their schema, since it cannot guarantee
 that external tools are read-only. However, global overrides such as
-`--skip-permissions` or the UI's "always allow" setting will auto-approve all
-tools, including MCP tools.
+`--skip-permissions` will auto-approve all tools, including MCP tools. The
+interactive "Always" button adds specific tool types to the per-tool auto-approve
+set. The web UI and server use `approval_label` for MCP tools, giving
+per-prompt/per-resource granularity. The CLI and bridge use `func_name`, which
+gives per-tool-type granularity (e.g., all `use_prompt` calls).
 
 ### Sub-agent availability
 
@@ -729,3 +761,140 @@ MCP refresh complete:
 MCP refresh complete:
   github: no changes
 ```
+
+---
+
+## MCP Resources
+
+MCP servers can expose **resources** -- named data items (files, database rows,
+API responses) addressable by URI. turnstone discovers resources at startup and
+makes them available to the model via the `read_resource` built-in tool.
+
+### Discovery
+
+During the MCP `initialize` handshake, `MCPClientManager` checks each server's
+capabilities for the `resources` capability. For servers that declare it:
+
+1. `list_resources` fetches static resources (fixed URIs).
+2. `list_resource_templates` fetches URI templates (parameterized patterns like
+   `db://tables/{table}/rows/{id}`).
+
+Both are stored as `{uri, name, description, mimeType, server}` dicts and
+merged into a unified catalog.
+
+### Resource catalog in system message
+
+The first 50 resources are injected into the system message as an XML-delimited
+block so the model knows what URIs are available:
+
+```xml
+<mcp-resources>
+  file:///project/README.md  Project readme
+  db://users/schema  User table schema
+</mcp-resources>
+Use read_resource(uri='...') to access the resources listed above.
+```
+
+### read_resource tool
+
+| Parameter | Type   | Required | Description |
+|-----------|--------|----------|-------------|
+| `uri`     | string | yes      | The resource URI to read. |
+
+- **What it does**: Reads the resource from its MCP server via `MCPClientManager.read_resource_sync()`. Returns text content for text resources or base64-encoded data for binary resources. Output is truncated by the standard tool output limiter.
+- **Auto-approve**: No -- requires user confirmation (reads external data).
+- **Agent availability**: `agent` and `task_agent`.
+
+### Capability guards
+
+The `read_resource` tool schema is always loaded (it is a built-in JSON schema),
+but resource discovery only runs for servers that declare the `resources`
+capability. Servers without the capability contribute zero resources to the
+catalog.
+
+### Refresh
+
+Resource lists stay current through the same three-tier mechanism as tool lists:
+
+1. **Push** -- Servers declaring `resources.listChanged: true` send
+   `notifications/resources/list_changed`, triggering an immediate refresh.
+2. **Periodic** -- Servers without push are polled on the configured refresh
+   interval (default 4 hours, same timer as tools).
+3. **Manual** -- `/mcp refresh` re-fetches resources alongside tools.
+
+---
+
+## MCP Prompts
+
+MCP servers can also expose **prompts** -- reusable message templates with
+optional arguments. turnstone discovers prompts at startup for servers that
+declare the `prompts` capability.
+
+### Discovery
+
+Prompt discovery mirrors resource discovery: `list_prompts` is called during
+the `initialize` handshake. Each prompt is stored with its prefixed name
+(`mcp__{server}__{prompt}`), description, and argument schema.
+
+### use_prompt tool
+
+| Parameter   | Type   | Required | Description |
+|-------------|--------|----------|-------------|
+| `name`      | string | yes      | The prompt name (e.g. `mcp__server__prompt_name`). |
+| `arguments` | object | no       | Key-value argument pairs for the prompt. Values must be strings. |
+
+- **What it does**: Invokes an MCP prompt by name via `MCPClientManager.get_prompt_sync()`, expanding it into messages. Returns the expanded prompt content formatted as `[role]: content` blocks joined with blank lines. The prompt catalog is listed in the system message so the model knows which prompts are available. Output is truncated by the standard tool output limiter.
+- **Auto-approve**: No -- requires user confirmation (invokes external prompt servers).
+- **Agent availability**: `agent` and `task_agent`.
+
+### Invocation
+
+`MCPClientManager.get_prompt_sync()` calls the server's `get_prompt` method
+with the provided arguments and returns the expanded messages. The `use_prompt`
+built-in tool exposes this to the model as a function call.
+
+### Governance Sync
+
+Discovered MCP prompts are automatically synced into the `prompt_templates`
+table (which stores skills) as first-class governed skills:
+
+- **Origin tracking**: MCP-sourced skills have `origin="mcp"` and
+  `mcp_server` set to the server name. Manual skills have
+  `origin="manual"`.
+- **Read-only**: MCP-sourced skills are `readonly=True`. The admin API
+  returns 403 on update/delete attempts. The admin UI disables edit/delete
+  buttons and shows an origin badge.
+- **Precedence**: If a manual skill and MCP prompt share the same name,
+  the manual skill wins and the MCP prompt is skipped (with a log
+  warning).
+- **Lifecycle**: Skills are created on connect, updated on prompt list
+  refresh, and removed when the MCP server no longer exposes the prompt.
+  The sync runs automatically on connect, on `PromptListChangedNotification`,
+  and on manual `/mcp refresh`.
+- **Schema**: Migration 009 adds `origin`, `mcp_server`, and `readonly`
+  columns to the `prompt_templates` table.
+
+The `use_prompt` tool allows the model to invoke any discovered MCP prompt at
+runtime. A catalog of up to 30 prompts is injected into the system message
+inside `<mcp-prompts>` XML tags so the model can discover available prompts.
+
+---
+
+## MCP UI Visibility
+
+MCP server, resource, and prompt counts are surfaced across the UI:
+
+- **Server `/health` endpoint**: Returns `mcp.servers`, `mcp.resources`,
+  `mcp.prompts` when MCP is configured
+- **Server UI**: Magenta status badge in the header showing server count,
+  with resource/prompt counts in tooltip
+- **Console cluster status bar**: MCP metrics (servers/resources/prompts)
+  with magenta LED dot indicator, shown after a divider from workstream
+  metrics
+- **Console node detail**: Per-node MCP summary showing server, resource,
+  and prompt counts
+- **Console collector**: Aggregates MCP counts across all nodes in the
+  cluster overview
+
+MCP indicators use the `--magenta` design token for consistent theming
+across light and dark modes.

examples/mcp-cluster-ops/README.md

@@ -0,0 +1,123 @@
+# MCP Cluster Ops
+
+An MCP server that exposes tools for executing commands across a [Turnstone](https://github.com/turnstonelabs/turnstone) cluster. Serves as a reference implementation for both MCP server patterns and Turnstone MQ client SDK usage.
+
+## How it works
+
+This server uses Turnstone's MQ client (`TurnstoneClient`) to dispatch shell commands to specific nodes via Redis. Remote agents execute the command and the raw bash output is captured directly from the `ToolResultEvent` stream — bypassing the costly "agent reads output → re-generates output as completion tokens" round-trip.
+
+Multi-node dispatches run in parallel via `asyncio.gather`, so total wall time is bounded by the slowest node rather than the sum.
+
+## Tools
+
+| Tool | Description |
+|------|-------------|
+| `list_nodes` | Discover active nodes in the cluster |
+| `run_on_node` | Execute a command on a specific node |
+| `run_on_nodes` | Execute a command on selected nodes in parallel |
+| `run_on_all_nodes` | Execute a command on ALL active nodes in parallel |
+
+## Prerequisites
+
+- A running Turnstone cluster (at least one `turnstone-server` + `turnstone-bridge`)
+- Redis accessible from wherever this MCP server runs
+- Python 3.11+
+
+## Installation
+
+```bash
+# From the turnstone repo root:
+pip install -e ./examples/mcp-cluster-ops
+
+# Or install turnstone with MQ support first, then the example:
+pip install -e ".[mq]"
+pip install -e ./examples/mcp-cluster-ops
+```
+
+## Configuration
+
+### Environment Variables
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `REDIS_HOST` | `localhost` | Redis host |
+| `REDIS_PORT` | `6379` | Redis port |
+| `REDIS_PASSWORD` | _(none)_ | Redis password (use env vars, not config files) |
+| `MCP_CLUSTER_OPS_TIMEOUT` | `120` | Default command timeout (seconds, clamped 5-3600) |
+| `MCP_CLUSTER_OPS_MAX_OUTPUT` | `8192` | Max output bytes per node (0 = unlimited) |
+| `MCP_CLUSTER_OPS_MAX_NODES` | `32` | Max concurrent node dispatches |
+| `MCP_CLUSTER_OPS_MAX_COMMAND` | `65536` | Max command string length |
+
+### Register with Turnstone
+
+**TOML** (`~/.config/turnstone/config.toml`):
+
+```toml
+[mcp.servers.cluster-ops]
+command = "mcp-cluster-ops"
+
+[mcp.servers.cluster-ops.env]
+REDIS_HOST = "redis.example.com"
+```
+
+**JSON** (via `--mcp-config`):
+
+```json
+{
+  "mcpServers": {
+    "cluster-ops": {
+      "command": "mcp-cluster-ops",
+      "env": {
+        "REDIS_HOST": "redis.example.com"
+      }
+    }
+  }
+}
+```
+
+## Usage Examples
+
+Once registered, the tools appear in any Turnstone session. The model can:
+
+```
+> Check disk usage across the cluster
+
+[calls list_nodes → discovers node-1, node-2, node-3]
+[calls run_on_all_nodes with "df -h /"]
+
+node-1: /dev/sda1  500G  320G  180G  64%  /
+node-2: /dev/sda1  500G  410G   90G  82%  /
+node-3: /dev/sda1  1.0T  200G  800G  20%  /
+```
+
+## Why MQ client instead of HTTP SDK?
+
+The HTTP SDK (`TurnstoneServer`) talks to a single server instance. The MQ client (`TurnstoneClient`) routes through Redis with `target_node` support, which is the entire point of cross-node cluster operations.
+
+## Security Considerations
+
+**This MCP server grants the calling agent shell access to cluster nodes.**
+
+- Commands are executed with `auto_approve=True` and the privileges of the
+  Turnstone server process on the target node.
+- Command output (which may contain secrets, credentials, or sensitive data)
+  is returned through the MCP tool result and becomes part of the LLM context.
+- The security boundary is at the MCP host layer -- use Turnstone's tool
+  policy system to restrict which agents can invoke these tools.
+- Set `REDIS_PASSWORD` via your environment or a secrets manager -- avoid
+  hardcoding passwords in config files.
+
+## Development
+
+```bash
+cd examples/mcp-cluster-ops
+
+# Run tests
+pip install -e ".[test]"
+pytest
+
+# Lint
+pip install -e ".[dev]"
+ruff check mcp_cluster_ops/
+mypy --strict mcp_cluster_ops/
+```

examples/mcp-cluster-ops/mcp_cluster_ops/__init__.py

@@ -0,0 +1,3 @@
+"""MCP server for Turnstone cluster operations."""
+
+__version__ = "0.1.0"

examples/mcp-cluster-ops/mcp_cluster_ops/__main__.py

@@ -0,0 +1,4 @@
+from mcp_cluster_ops.server import main
+
+if __name__ == "__main__":
+    main()

examples/mcp-cluster-ops/mcp_cluster_ops/server.py

@@ -0,0 +1,404 @@
+"""MCP server for Turnstone cluster operations.
+
+Exposes tools to execute commands on specific nodes in a Turnstone cluster.
+Uses the MQ client (``TurnstoneClient``) for direct node targeting via Redis.
+
+Usage::
+
+    mcp-cluster-ops              # via entry point
+    python -m mcp_cluster_ops    # via module
+
+Configure in ``~/.config/turnstone/config.toml``::
+
+    [mcp.servers.cluster-ops]
+    command = "mcp-cluster-ops"
+
+    [mcp.servers.cluster-ops.env]
+    REDIS_HOST = "redis.example.com"
+
+Environment variables
+---------------------
+REDIS_HOST              Redis host (default: localhost)
+REDIS_PORT              Redis port (default: 6379)
+REDIS_PASSWORD          Redis password (default: none)
+MCP_CLUSTER_OPS_TIMEOUT     Default command timeout in seconds (default: 120)
+MCP_CLUSTER_OPS_MAX_OUTPUT  Max output bytes per node (default: 8192, 0=unlimited)
+
+Performance notes
+-----------------
+Remote agents are told to reply with only "ok" or "failed" — the raw bash
+output is captured directly from the ToolResultEvent that already flows
+through Redis, bypassing the costly "agent reads output then re-generates
+output as completion tokens" round-trip.
+
+All multi-node dispatches run in parallel via ``asyncio.gather`` so total
+wall time is bounded by the slowest node, not the sum of all nodes.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import json
+import logging
+import os
+from contextlib import asynccontextmanager
+from typing import TYPE_CHECKING, Any
+
+from mcp.server.fastmcp import Context, FastMCP
+from turnstone.mq.client import TurnResult, TurnstoneClient
+
+if TYPE_CHECKING:
+    from collections.abc import AsyncIterator
+
+log = logging.getLogger(__name__)
+
+# ---------------------------------------------------------------------------
+# Configuration
+# ---------------------------------------------------------------------------
+
+_DEFAULT_TIMEOUT = int(os.environ.get("MCP_CLUSTER_OPS_TIMEOUT", "120"))
+_DEFAULT_MAX_OUTPUT = int(os.environ.get("MCP_CLUSTER_OPS_MAX_OUTPUT", "8192"))
+_MAX_CONCURRENT_NODES = int(os.environ.get("MCP_CLUSTER_OPS_MAX_NODES", "32"))
+_MAX_COMMAND_LEN = int(os.environ.get("MCP_CLUSTER_OPS_MAX_COMMAND", "65536"))
+_MIN_TIMEOUT = 5
+_MAX_TIMEOUT = 3600
+
+# ---------------------------------------------------------------------------
+# Helpers (pure functions, easily testable)
+# ---------------------------------------------------------------------------
+
+
+def _redis_kwargs() -> dict[str, Any]:
+    """Build Redis connection kwargs from environment variables.
+
+    Follows the same env var convention as ``turnstone.mq.broker.add_redis_args``:
+    ``REDIS_HOST``, ``REDIS_PORT``, ``REDIS_PASSWORD``.
+    """
+    kwargs: dict[str, Any] = {"host": os.environ.get("REDIS_HOST", "localhost")}
+    port = os.environ.get("REDIS_PORT")
+    if port is not None:
+        kwargs["port"] = int(port)
+    password = os.environ.get("REDIS_PASSWORD")
+    if password:
+        kwargs["password"] = password
+    return kwargs
+
+
+def _exec_prompt(command: str) -> str:
+    """Build the prompt sent to the remote agent.
+
+    Instructs it to run the command and reply minimally so that the raw
+    bash output (captured via ToolResultEvent) is the primary result,
+    avoiding token waste from re-transcription.
+    """
+    return (
+        "Execute this shell command using the bash tool:\n"
+        f"  {command}\n\n"
+        "After the tool completes, reply with only 'ok' or 'failed'.\n"
+        "Do NOT repeat, quote, or summarise the command output in your reply."
+    )
+
+
+def _extract_output(result: TurnResult) -> str:
+    """Extract useful output from a TurnResult.
+
+    Prefers raw bash ToolResultEvent output (zero LLM re-transcription cost)
+    over agent content.  Falls back through tool results and content.
+    """
+    bash_outputs = [out for name, out in result.tool_results if name == "bash"]
+    if bash_outputs:
+        return "\n".join(bash_outputs)
+    content: str = result.content
+    if content:
+        return content
+    if result.tool_results:
+        return str(result.tool_results[0][1])
+    return ""
+
+
+def _truncate(text: str, max_bytes: int) -> str:
+    """Truncate *text* to at most *max_bytes* UTF-8 bytes.
+
+    Appends a marker when truncation occurs.  Handles multi-byte characters
+    safely by decoding with ``errors='ignore'``.
+
+    Pass ``max_bytes=0`` to disable truncation.
+    """
+    if max_bytes <= 0:
+        return text
+    encoded = text.encode("utf-8")
+    if len(encoded) <= max_bytes:
+        return text
+    truncated = encoded[:max_bytes].decode("utf-8", errors="ignore")
+    omitted = len(encoded) - len(truncated.encode("utf-8"))
+    return truncated + f"\n... [truncated: {omitted} bytes omitted]"
+
+
+def _clamp_timeout(timeout: int) -> float:
+    """Clamp timeout to a safe range."""
+    return float(max(_MIN_TIMEOUT, min(timeout, _MAX_TIMEOUT)))
+
+
+def _validate_command(command: str) -> str | None:
+    """Validate a command string.  Returns an error message or None."""
+    if not command.strip():
+        return "command must be a non-empty string"
+    if len(command) > _MAX_COMMAND_LEN:
+        return f"command too long ({len(command)} chars, max {_MAX_COMMAND_LEN})"
+    return None
+
+
+def _format_node_result(
+    node_id: str,
+    result: TurnResult,
+    max_output: int,
+) -> dict[str, Any]:
+    """Format a single node's TurnResult for JSON output."""
+    raw = _extract_output(result)
+    output = _truncate(raw, max_output)
+    entry: dict[str, Any] = {
+        "node": node_id,
+        "ok": result.ok,
+    }
+    if result.timed_out:
+        entry["timed_out"] = True
+    if result.ok:
+        entry["output"] = output
+    else:
+        entry["output"] = output or None
+        if result.errors:
+            entry["error"] = "; ".join(result.errors)
+    return entry
+
+
+# ---------------------------------------------------------------------------
+# Core dispatch functions (testable with mocked TurnstoneClient)
+# ---------------------------------------------------------------------------
+
+
+def _exec_on_node_sync(
+    redis_kw: dict[str, Any],
+    node_id: str,
+    command: str,
+    timeout: float,
+) -> tuple[str, TurnResult]:
+    """Dispatch *command* to *node_id* and block until complete.
+
+    Runs inside ``asyncio.to_thread`` so it does not block the event loop.
+    Each call creates its own ``TurnstoneClient`` to avoid Redis pub/sub
+    subscription conflicts between concurrent dispatches.
+    """
+    prompt = _exec_prompt(command)
+    with TurnstoneClient(**redis_kw) as client:
+        result = client.send_and_wait(
+            message=prompt,
+            target_node=node_id,
+            auto_approve=True,
+            timeout=timeout,
+        )
+    return node_id, result
+
+
+async def _dispatch_parallel(
+    redis_kw: dict[str, Any],
+    node_ids: list[str],
+    command: str,
+    timeout: float,
+    max_output: int,
+) -> list[dict[str, Any]]:
+    """Dispatch *command* to all *node_ids* concurrently.
+
+    Total wall time is bounded by the slowest node.
+    """
+    tasks = [
+        asyncio.to_thread(_exec_on_node_sync, redis_kw, nid, command, timeout) for nid in node_ids
+    ]
+    outcomes = await asyncio.gather(*tasks, return_exceptions=True)
+
+    results: list[dict[str, Any]] = []
+    for nid, outcome in zip(node_ids, outcomes, strict=True):
+        if isinstance(outcome, BaseException):
+            if not isinstance(outcome, Exception):
+                raise outcome  # propagate KeyboardInterrupt, SystemExit, etc.
+            results.append({"node": nid, "ok": False, "error": str(outcome)})
+        else:
+            _, turn_result = outcome
+            results.append(_format_node_result(nid, turn_result, max_output))
+    return results
+
+
+def _list_nodes_sync(redis_kw: dict[str, Any]) -> list[dict[str, Any]]:
+    """List active cluster nodes (blocking)."""
+    with TurnstoneClient(**redis_kw) as client:
+        nodes: list[dict[str, Any]] = client.list_nodes()
+        return nodes
+
+
+async def _list_nodes_impl(redis_kw: dict[str, Any]) -> list[dict[str, Any]]:
+    """List active cluster nodes."""
+    return await asyncio.to_thread(_list_nodes_sync, redis_kw)
+
+
+# ---------------------------------------------------------------------------
+# MCP server
+# ---------------------------------------------------------------------------
+
+
+@asynccontextmanager
+async def _lifespan(server: FastMCP[dict[str, Any]]) -> AsyncIterator[dict[str, Any]]:
+    """Lifespan context — stores Redis kwargs for tool handlers."""
+    kw = _redis_kwargs()
+    yield {"redis_kwargs": kw}
+
+
+mcp = FastMCP(
+    "turnstone-cluster-ops",
+    instructions=(
+        "Tools for executing commands across a Turnstone AI cluster. "
+        "Use list_nodes first to discover available nodes, then run_on_node "
+        "to execute commands on specific nodes or run_on_all_nodes for "
+        "cluster-wide operations."
+    ),
+    lifespan=_lifespan,
+)
+
+
+@mcp.tool()
+async def list_nodes(ctx: Context[Any, Any, Any]) -> str:
+    """List all active nodes in the Turnstone cluster.
+
+    Call this before dispatching work to discover available node IDs.
+    Returns a JSON array of node metadata objects.
+    """
+    redis_kw: dict[str, Any] = ctx.request_context.lifespan_context["redis_kwargs"]
+    nodes = await _list_nodes_impl(redis_kw)
+    return json.dumps(nodes, indent=2)
+
+
+@mcp.tool()
+async def run_on_node(
+    node_id: str,
+    command: str,
+    ctx: Context[Any, Any, Any],
+    timeout: int = _DEFAULT_TIMEOUT,
+) -> str:
+    """Execute a shell command on a specific node and return the raw output.
+
+    Use list_nodes first to discover available node IDs.
+
+    Args:
+        node_id: Target node ID (e.g. 'worker-1.example.com').
+        command: Shell command to execute on the target node.
+        timeout: Timeout in seconds (default: 120).
+    """
+    node_id = node_id.strip()
+    if not node_id:
+        return json.dumps({"error": "node_id must be a non-empty string"})
+    cmd_err = _validate_command(command)
+    if cmd_err:
+        return json.dumps({"error": cmd_err})
+
+    redis_kw: dict[str, Any] = ctx.request_context.lifespan_context["redis_kwargs"]
+    max_output = _DEFAULT_MAX_OUTPUT
+
+    log.info("run_on_node node=%s cmd=%r", node_id, command)
+    _, result = await asyncio.to_thread(
+        _exec_on_node_sync, redis_kw, node_id, command, _clamp_timeout(timeout)
+    )
+    formatted = _format_node_result(node_id, result, max_output)
+    return json.dumps(formatted, indent=2)
+
+
+@mcp.tool()
+async def run_on_nodes(
+    node_ids: list[str],
+    command: str,
+    ctx: Context[Any, Any, Any],
+    timeout: int = _DEFAULT_TIMEOUT,
+) -> str:
+    """Execute a shell command on specific nodes in parallel.
+
+    Results are collected from each node.  Total wall time is bounded by
+    the slowest node rather than the sum.
+
+    Args:
+        node_ids: List of node IDs to target.
+        command: Shell command to execute.
+        timeout: Timeout per node in seconds (default: 120).
+    """
+    cmd_err = _validate_command(command)
+    if cmd_err:
+        return json.dumps({"error": cmd_err})
+
+    redis_kw: dict[str, Any] = ctx.request_context.lifespan_context["redis_kwargs"]
+    max_output = _DEFAULT_MAX_OUTPUT
+
+    clean_ids = list(dict.fromkeys(nid.strip() for nid in node_ids if nid.strip()))
+    if not clean_ids:
+        return json.dumps({"error": "node_ids must be a non-empty list"})
+    if len(clean_ids) > _MAX_CONCURRENT_NODES:
+        return json.dumps(
+            {"error": f"Too many nodes ({len(clean_ids)}), max is {_MAX_CONCURRENT_NODES}"}
+        )
+
+    log.info("run_on_nodes nodes=%s cmd=%r", clean_ids, command)
+    results = await _dispatch_parallel(
+        redis_kw, clean_ids, command, _clamp_timeout(timeout), max_output
+    )
+    return json.dumps(results, indent=2)
+
+
+@mcp.tool()
+async def run_on_all_nodes(
+    command: str,
+    ctx: Context[Any, Any, Any],
+    timeout: int = _DEFAULT_TIMEOUT,
+) -> str:
+    """Execute a shell command on ALL active nodes in parallel.
+
+    Discovers nodes automatically, then dispatches in parallel.  Useful for
+    cluster-wide operations like checking disk usage, GPU status, or
+    running processes.
+
+    Args:
+        command: Shell command to execute on every node.
+        timeout: Timeout per node in seconds (default: 120).
+    """
+    cmd_err = _validate_command(command)
+    if cmd_err:
+        return json.dumps({"error": cmd_err})
+
+    redis_kw: dict[str, Any] = ctx.request_context.lifespan_context["redis_kwargs"]
+    max_output = _DEFAULT_MAX_OUTPUT
+
+    nodes = await _list_nodes_impl(redis_kw)
+    if not nodes:
+        return json.dumps({"error": "No active nodes found in cluster"})
+
+    node_ids = list(
+        dict.fromkeys(
+            nid.strip() for n in nodes if (nid := n.get("node_id") or n.get("id")) and nid.strip()
+        )
+    )
+    if not node_ids:
+        return json.dumps({"error": "No nodes with identifiable IDs found"})
+    if len(node_ids) > _MAX_CONCURRENT_NODES:
+        return json.dumps(
+            {"error": f"Too many nodes ({len(node_ids)}), max is {_MAX_CONCURRENT_NODES}"}
+        )
+    log.info("run_on_all_nodes nodes=%s cmd=%r", node_ids, command)
+    results = await _dispatch_parallel(
+        redis_kw, node_ids, command, _clamp_timeout(timeout), max_output
+    )
+    return json.dumps(results, indent=2)
+
+
+# ---------------------------------------------------------------------------
+# Entry point
+# ---------------------------------------------------------------------------
+
+
+def main() -> None:
+    """Run the MCP cluster-ops server via stdio transport."""
+    logging.basicConfig(level=logging.INFO)
+    mcp.run(transport="stdio")

examples/mcp-cluster-ops/pyproject.toml

@@ -0,0 +1,57 @@
+[build-system]
+requires = ["hatchling>=1.29"]
+build-backend = "hatchling.build"
+
+[project]
+name = "mcp-cluster-ops"
+version = "0.1.0"
+description = "MCP server for Turnstone cluster operations — reference implementation."
+requires-python = ">=3.11"
+license = "BUSL-1.1"
+dependencies = [
+    "turnstone[mq]",
+    "mcp>=1.6",
+]
+
+[project.scripts]
+mcp-cluster-ops = "mcp_cluster_ops.server:main"
+
+[project.optional-dependencies]
+test = ["pytest>=9.0"]
+dev = ["ruff>=0.9", "mypy>=1.14", "types-redis>=4.6"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+
+[tool.ruff]
+target-version = "py311"
+line-length = 100
+
+[tool.ruff.lint]
+select = ["E", "F", "W", "I", "N", "UP", "B", "A", "SIM", "TCH"]
+ignore = ["E501"]
+
+[tool.ruff.format]
+quote-style = "double"
+
+[tool.mypy]
+python_version = "3.11"
+strict = true
+warn_return_any = true
+warn_unused_configs = true
+disallow_untyped_defs = true
+disallow_incomplete_defs = true
+check_untyped_defs = true
+no_implicit_optional = true
+
+[[tool.mypy.overrides]]
+module = ["mcp", "mcp.*"]
+ignore_missing_imports = true
+
+[[tool.mypy.overrides]]
+module = ["turnstone", "turnstone.*"]
+ignore_missing_imports = true
+
+[[tool.mypy.overrides]]
+module = "tests.*"
+disallow_untyped_defs = false

examples/mcp-cluster-ops/tests/test_helpers.py

@@ -0,0 +1,192 @@
+"""Tests for pure helper functions in mcp_cluster_ops.server."""
+
+from __future__ import annotations
+
+from turnstone.mq.client import TurnResult
+
+from mcp_cluster_ops.server import (
+    _clamp_timeout,
+    _exec_prompt,
+    _extract_output,
+    _format_node_result,
+    _truncate,
+    _validate_command,
+)
+
+# ---------------------------------------------------------------------------
+# _truncate
+# ---------------------------------------------------------------------------
+
+
+class TestTruncate:
+    def test_empty_string(self):
+        assert _truncate("", 100) == ""
+
+    def test_under_limit(self):
+        assert _truncate("hello", 100) == "hello"
+
+    def test_at_limit(self):
+        text = "x" * 50
+        assert _truncate(text, 50) == text
+
+    def test_over_limit(self):
+        text = "x" * 200
+        result = _truncate(text, 50)
+        assert result.startswith("x" * 50)
+        assert "truncated" in result
+        assert "150 bytes omitted" in result
+
+    def test_unicode_boundary(self):
+        # U+00E9 (é) is 2 bytes in UTF-8 (0xC3 0xA9), so 5 chars = 10 bytes
+        text = "\u00e9\u00e9\u00e9\u00e9\u00e9"
+        result = _truncate(text, 5)
+        # Should not crash, should truncate cleanly
+        assert "truncated" in result
+
+    def test_zero_disables(self):
+        text = "x" * 10000
+        assert _truncate(text, 0) == text
+
+    def test_custom_max(self):
+        text = "abcdefghij"  # 10 bytes
+        result = _truncate(text, 5)
+        assert result.startswith("abcde")
+        assert "truncated" in result
+
+
+# ---------------------------------------------------------------------------
+# _extract_output
+# ---------------------------------------------------------------------------
+
+
+class TestExtractOutput:
+    def test_bash_result_preferred(self):
+        r = TurnResult(
+            content_parts=["agent said something"],
+            tool_results=[("bash", "raw output")],
+        )
+        assert _extract_output(r) == "raw output"
+
+    def test_multiple_bash_results_joined(self):
+        r = TurnResult(
+            tool_results=[("bash", "line1"), ("bash", "line2")],
+        )
+        assert _extract_output(r) == "line1\nline2"
+
+    def test_content_fallback(self):
+        r = TurnResult(
+            content_parts=["agent response"],
+            tool_results=[("read_file", "file contents")],
+        )
+        assert _extract_output(r) == "agent response"
+
+    def test_any_tool_fallback(self):
+        r = TurnResult(
+            tool_results=[("read_file", "file contents")],
+        )
+        assert _extract_output(r) == "file contents"
+
+    def test_empty_result(self):
+        r = TurnResult()
+        assert _extract_output(r) == ""
+
+    def test_bash_preferred_over_content(self):
+        r = TurnResult(
+            content_parts=["I ran the command"],
+            tool_results=[("read_file", "data"), ("bash", "output")],
+        )
+        assert _extract_output(r) == "output"
+
+
+# ---------------------------------------------------------------------------
+# _exec_prompt
+# ---------------------------------------------------------------------------
+
+
+class TestExecPrompt:
+    def test_contains_command(self):
+        result = _exec_prompt("ls -la /tmp")
+        assert "ls -la /tmp" in result
+
+    def test_suppression_instruction(self):
+        result = _exec_prompt("echo hello")
+        assert "Do NOT repeat" in result
+        assert "ok" in result.lower() or "failed" in result.lower()
+
+
+# ---------------------------------------------------------------------------
+# _format_node_result
+# ---------------------------------------------------------------------------
+
+
+class TestFormatNodeResult:
+    def test_success(self):
+        r = TurnResult(tool_results=[("bash", "output data")])
+        fmt = _format_node_result("node-1", r, 8192)
+        assert fmt["node"] == "node-1"
+        assert fmt["ok"] is True
+        assert fmt["output"] == "output data"
+        assert "timed_out" not in fmt
+
+    def test_timeout(self):
+        r = TurnResult(timed_out=True)
+        fmt = _format_node_result("node-1", r, 8192)
+        assert fmt["ok"] is False
+        assert fmt["timed_out"] is True
+
+    def test_error(self):
+        r = TurnResult(errors=["connection refused"])
+        fmt = _format_node_result("node-1", r, 8192)
+        assert fmt["ok"] is False
+        assert fmt["error"] == "connection refused"
+
+    def test_truncation_applied(self):
+        r = TurnResult(tool_results=[("bash", "x" * 200)])
+        fmt = _format_node_result("node-1", r, 50)
+        assert "truncated" in fmt["output"]
+
+    def test_unlimited_output(self):
+        big = "x" * 100000
+        r = TurnResult(tool_results=[("bash", big)])
+        fmt = _format_node_result("node-1", r, 0)
+        assert fmt["output"] == big
+
+
+# ---------------------------------------------------------------------------
+# _validate_command
+# ---------------------------------------------------------------------------
+
+
+class TestValidateCommand:
+    def test_valid(self):
+        assert _validate_command("ls -la") is None
+
+    def test_empty(self):
+        assert _validate_command("") is not None
+
+    def test_whitespace_only(self):
+        assert _validate_command("   ") is not None
+
+    def test_too_long(self):
+        err = _validate_command("x" * 100000)
+        assert err is not None
+        assert "too long" in err
+
+
+# ---------------------------------------------------------------------------
+# _clamp_timeout
+# ---------------------------------------------------------------------------
+
+
+class TestClampTimeout:
+    def test_normal(self):
+        assert _clamp_timeout(60) == 60.0
+
+    def test_too_low(self):
+        assert _clamp_timeout(1) == 5.0
+
+    def test_too_high(self):
+        assert _clamp_timeout(99999) == 3600.0
+
+    def test_negative(self):
+        assert _clamp_timeout(-1) == 5.0

examples/mcp-cluster-ops/tests/test_tools.py

@@ -0,0 +1,149 @@
+"""Tests for MCP tool handlers with mocked TurnstoneClient."""
+
+from __future__ import annotations
+
+import asyncio
+from typing import Any
+from unittest.mock import MagicMock, patch
+
+from turnstone.mq.client import TurnResult
+
+from mcp_cluster_ops.server import (
+    _dispatch_parallel,
+    _exec_on_node_sync,
+    _list_nodes_impl,
+)
+
+# ---------------------------------------------------------------------------
+# _list_nodes_impl
+# ---------------------------------------------------------------------------
+
+
+class TestListNodesImpl:
+    def test_returns_nodes(self):
+        nodes = [{"node_id": "a", "model": "gpt-5"}, {"node_id": "b", "model": "gpt-5"}]
+        with patch("mcp_cluster_ops.server.TurnstoneClient") as mock_cls:
+            mock_client = MagicMock()
+            mock_client.list_nodes.return_value = nodes
+            mock_cls.return_value.__enter__ = MagicMock(return_value=mock_client)
+            mock_cls.return_value.__exit__ = MagicMock(return_value=False)
+
+            result = asyncio.run(_list_nodes_impl({"host": "localhost"}))
+            assert result == nodes
+
+    def test_empty_cluster(self):
+        with patch("mcp_cluster_ops.server.TurnstoneClient") as mock_cls:
+            mock_client = MagicMock()
+            mock_client.list_nodes.return_value = []
+            mock_cls.return_value.__enter__ = MagicMock(return_value=mock_client)
+            mock_cls.return_value.__exit__ = MagicMock(return_value=False)
+
+            result = asyncio.run(_list_nodes_impl({"host": "localhost"}))
+            assert result == []
+
+
+# ---------------------------------------------------------------------------
+# _exec_on_node_sync
+# ---------------------------------------------------------------------------
+
+
+class TestExecOnNodeSync:
+    def test_success(self):
+        turn_result = TurnResult(
+            tool_results=[("bash", "hello world")],
+        )
+        with patch("mcp_cluster_ops.server.TurnstoneClient") as mock_cls:
+            mock_client = MagicMock()
+            mock_client.send_and_wait.return_value = turn_result
+            mock_cls.return_value.__enter__ = MagicMock(return_value=mock_client)
+            mock_cls.return_value.__exit__ = MagicMock(return_value=False)
+
+            node_id, result = _exec_on_node_sync(
+                {"host": "localhost"}, "node-1", "echo hello", 60.0
+            )
+            assert node_id == "node-1"
+            assert result.ok
+            mock_client.send_and_wait.assert_called_once()
+            call_kwargs = mock_client.send_and_wait.call_args
+            assert call_kwargs.kwargs["target_node"] == "node-1"
+            assert call_kwargs.kwargs["auto_approve"] is True
+
+    def test_timeout(self):
+        turn_result = TurnResult(timed_out=True)
+        with patch("mcp_cluster_ops.server.TurnstoneClient") as mock_cls:
+            mock_client = MagicMock()
+            mock_client.send_and_wait.return_value = turn_result
+            mock_cls.return_value.__enter__ = MagicMock(return_value=mock_client)
+            mock_cls.return_value.__exit__ = MagicMock(return_value=False)
+
+            _, result = _exec_on_node_sync({"host": "localhost"}, "node-1", "sleep 9999", 1.0)
+            assert result.timed_out
+            assert not result.ok
+
+
+# ---------------------------------------------------------------------------
+# _dispatch_parallel
+# ---------------------------------------------------------------------------
+
+
+class TestDispatchParallel:
+    def test_parallel_success(self):
+        def fake_exec(redis_kw: Any, node_id: str, command: str, timeout: float) -> Any:
+            return (node_id, TurnResult(tool_results=[("bash", f"output-{node_id}")]))
+
+        with patch("mcp_cluster_ops.server._exec_on_node_sync", side_effect=fake_exec):
+            results = asyncio.run(
+                _dispatch_parallel(
+                    {"host": "localhost"},
+                    ["a", "b", "c"],
+                    "echo hi",
+                    60.0,
+                    8192,
+                )
+            )
+            assert len(results) == 3
+            assert all(r["ok"] for r in results)
+            outputs = {r["node"]: r["output"] for r in results}
+            assert outputs["a"] == "output-a"
+            assert outputs["b"] == "output-b"
+
+    def test_partial_failure(self):
+        def fake_exec(redis_kw: Any, node_id: str, command: str, timeout: float) -> Any:
+            if node_id == "bad":
+                raise ConnectionError("Redis down")
+            return (node_id, TurnResult(tool_results=[("bash", "ok")]))
+
+        with patch("mcp_cluster_ops.server._exec_on_node_sync", side_effect=fake_exec):
+            results = asyncio.run(
+                _dispatch_parallel(
+                    {"host": "localhost"},
+                    ["good", "bad"],
+                    "echo hi",
+                    60.0,
+                    8192,
+                )
+            )
+            assert len(results) == 2
+            good = next(r for r in results if r["node"] == "good")
+            bad = next(r for r in results if r["node"] == "bad")
+            assert good["ok"] is True
+            assert bad["ok"] is False
+            assert "Redis down" in bad["error"]
+
+    def test_all_fail(self):
+        def fake_exec(redis_kw: Any, node_id: str, command: str, timeout: float) -> Any:
+            raise RuntimeError(f"fail-{node_id}")
+
+        with patch("mcp_cluster_ops.server._exec_on_node_sync", side_effect=fake_exec):
+            results = asyncio.run(
+                _dispatch_parallel(
+                    {"host": "localhost"},
+                    ["a", "b"],
+                    "echo hi",
+                    60.0,
+                    8192,
+                )
+            )
+            assert all(not r["ok"] for r in results)
+            assert "fail-a" in results[0]["error"]
+            assert "fail-b" in results[1]["error"]

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "turnstone"
-version = "0.5.3"
+version = "0.8.6"
 description = "Multi-node AI orchestration platform with tool use, agent routing, and cluster simulation."
 readme = "README.md"
 license = "BUSL-1.1"
@@ -35,6 +35,7 @@ dependencies = [
     "structlog>=24.1",
     "PyJWT>=2.8",
     "bcrypt>=4.0",
+    "python-frontmatter>=1.0",
 ]
 
 [project.urls]
@@ -50,8 +51,9 @@ console = ["redis>=7.2", "croniter>=3.0"]
 sim = ["redis>=7.2"]
 anthropic = ["anthropic>=0.39"]
 postgres = ["psycopg[binary]>=3.2"]
+ddg = ["ddgs>=9.0"]
 discord = ["discord.py>=2.4", "redis>=7.2"]
-
+all = ["turnstone[mq,console,sim,anthropic,postgres,discord,ddg]"]
 
 [project.scripts]
 turnstone = "turnstone.cli:main"
@@ -62,6 +64,7 @@ turnstone-console = "turnstone.console.server:main"
 turnstone-sim = "turnstone.sim.cli:main"
 turnstone-admin = "turnstone.admin:main"
 turnstone-channel = "turnstone.channels.cli:main"
+turnstone-bootstrap = "turnstone.bootstrap:main"
 
 [tool.hatch.build.targets.wheel]
 include = [
@@ -75,6 +78,9 @@ include = [
   "turnstone/console/static/*.js",
   "turnstone/shared_static/*.css",
   "turnstone/shared_static/*.js",
+  "turnstone/shared_static/katex-0.16.40/**/*",
+  "turnstone/shared_static/hljs-11.11.1/**/*",
+  "turnstone/shared_static/mermaid-11.13.0/**/*",
   "turnstone/sdk/py.typed",
 ]
 
@@ -89,6 +95,7 @@ line-length = 100
 [tool.ruff.lint]
 select = ["E", "F", "W", "I", "N", "UP", "B", "A", "SIM", "TCH"]
 ignore = ["E501"]
+per-file-ignores = { "turnstone/core/sandbox.py" = ["N802"] }
 
 [tool.ruff.format]
 quote-style = "double"
@@ -154,6 +161,10 @@ ignore_missing_imports = true
 module = ["croniter", "croniter.*"]
 ignore_missing_imports = true
 
+[[tool.mypy.overrides]]
+module = ["frontmatter", "frontmatter.*"]
+ignore_missing_imports = true
+
 [[tool.mypy.overrides]]
 module = ["turnstone.channels.discord.*"]
 disallow_subclassing_any = false

scripts/update-vendored-js.sh

@@ -0,0 +1,159 @@
+#!/usr/bin/env bash
+# Update a vendored JavaScript library in turnstone/shared_static/.
+#
+# Usage:
+#   scripts/update-vendored-js.sh katex 0.16.39
+#   scripts/update-vendored-js.sh hljs 11.12.0
+#   scripts/update-vendored-js.sh mermaid 11.14.0
+#
+# This script:
+#   1. Downloads the new version from CDN
+#   2. Creates the new versioned directory
+#   3. Updates all version references in source files
+#   4. Removes the old versioned directory
+
+set -euo pipefail
+
+STATIC_DIR="turnstone/shared_static"
+CDN="https://cdn.jsdelivr.net/npm"
+
+usage() {
+    echo "Usage: $0 <katex|hljs|mermaid> <version>"
+    echo "Example: $0 katex 0.16.39"
+    exit 1
+}
+
+[[ $# -eq 2 ]] || usage
+
+LIB="$1"
+VERSION="$2"
+
+# Detect current version from the filesystem (not pyproject.toml, which
+# Renovate may have already updated).  Falls back to pyproject.toml if
+# no directory is found.
+detect_old_version() {
+    local pattern="$1"
+    # Look for existing directory: e.g. turnstone/shared_static/katex-0.16.38
+    local dir
+    dir=$(find "${STATIC_DIR}" -maxdepth 1 -type d -name "${pattern}-*" | head -1)
+    if [[ -n "$dir" ]]; then
+        basename "$dir" | sed "s/${pattern}-//"
+        return
+    fi
+    # Fallback to pyproject.toml
+    grep -oE "${pattern}-[0-9.]+" pyproject.toml | head -1 | sed "s/${pattern}-//"
+}
+
+# Update version references across all source files
+update_refs() {
+    local old_pattern="$1"  # e.g. katex-0.16.38
+    local new_pattern="$2"  # e.g. katex-0.16.39
+
+    # Find all files with version references (excludes vendored JS and worktrees)
+    local files
+    files=$(grep -rl --include='*.toml' --include='*.html' --include='*.js' --include='*.md' \
+        -F "$old_pattern" . \
+        --exclude-dir='.claude' --exclude-dir='node_modules' --exclude-dir='shared_static' \
+        2>/dev/null || true)
+    for f in $files; do
+        sed -i "s|${old_pattern}|${new_pattern}|g" "$f"
+        echo "  Updated $f"
+    done
+}
+
+check_same_version() {
+    if [[ "$1" == "$2" ]]; then
+        echo "ERROR: Old version ($1) == new version ($2). Nothing to update."
+        echo "If the old directory was already removed, re-download with:"
+        echo "  rm -rf ${STATIC_DIR}/${3}-${1} && $0 $3 $2"
+        exit 1
+    fi
+}
+
+case "$LIB" in
+    katex)
+        OLD_VERSION=$(detect_old_version "katex")
+        check_same_version "$OLD_VERSION" "$VERSION" "katex"
+        OLD_DIR="${STATIC_DIR}/katex-${OLD_VERSION}"
+        NEW_DIR="${STATIC_DIR}/katex-${VERSION}"
+
+        echo "Updating KaTeX ${OLD_VERSION} -> ${VERSION}"
+        mkdir -p "${NEW_DIR}/fonts"
+
+        echo "  Downloading katex.min.js..."
+        curl -sSfL "${CDN}/katex@${VERSION}/dist/katex.min.js" -o "${NEW_DIR}/katex.min.js"
+        echo "  Downloading katex.min.css..."
+        curl -sSfL "${CDN}/katex@${VERSION}/dist/katex.min.css" -o "${NEW_DIR}/katex.min.css"
+
+        echo "  Downloading fonts..."
+        # Extract font filenames from the CSS
+        font_files=$(curl -sSfL "${CDN}/katex@${VERSION}/dist/katex.min.css" \
+            | grep -oE 'fonts/[^")]+' | sort -u)
+        for font in $font_files; do
+            if ! curl -sSfL "${CDN}/katex@${VERSION}/dist/${font}" -o "${NEW_DIR}/${font}" 2>/dev/null; then
+                echo "  WARNING: Failed to download font: ${font}"
+            fi
+        done
+
+        # Copy LICENSE from old dir if present
+        if [[ -f "${OLD_DIR}/LICENSE" ]]; then
+            cp "${OLD_DIR}/LICENSE" "${NEW_DIR}/LICENSE"
+        fi
+
+        update_refs "katex-${OLD_VERSION}" "katex-${VERSION}"
+        rm -rf "${OLD_DIR}"
+        echo "Done. Old directory removed: ${OLD_DIR}"
+        ;;
+
+    hljs)
+        OLD_VERSION=$(detect_old_version "hljs")
+        check_same_version "$OLD_VERSION" "$VERSION" "hljs"
+        OLD_DIR="${STATIC_DIR}/hljs-${OLD_VERSION}"
+        NEW_DIR="${STATIC_DIR}/hljs-${VERSION}"
+
+        echo "Updating Highlight.js ${OLD_VERSION} -> ${VERSION}"
+        mkdir -p "${NEW_DIR}"
+
+        echo "  Downloading highlight.min.js..."
+        curl -sSfL "${CDN}/@highlightjs/cdn-assets@${VERSION}/highlight.min.js" -o "${NEW_DIR}/highlight.min.js"
+
+        if [[ -f "${OLD_DIR}/LICENSE" ]]; then
+            cp "${OLD_DIR}/LICENSE" "${NEW_DIR}/LICENSE"
+        fi
+
+        update_refs "hljs-${OLD_VERSION}" "hljs-${VERSION}"
+        rm -rf "${OLD_DIR}"
+        echo "Done. Old directory removed: ${OLD_DIR}"
+        ;;
+
+    mermaid)
+        OLD_VERSION=$(detect_old_version "mermaid")
+        check_same_version "$OLD_VERSION" "$VERSION" "mermaid"
+        OLD_DIR="${STATIC_DIR}/mermaid-${OLD_VERSION}"
+        NEW_DIR="${STATIC_DIR}/mermaid-${VERSION}"
+
+        echo "Updating Mermaid ${OLD_VERSION} -> ${VERSION}"
+        mkdir -p "${NEW_DIR}"
+
+        echo "  Downloading mermaid.min.js..."
+        curl -sSfL "${CDN}/mermaid@${VERSION}/dist/mermaid.min.js" -o "${NEW_DIR}/mermaid.min.js"
+
+        if [[ -f "${OLD_DIR}/LICENSE" ]]; then
+            cp "${OLD_DIR}/LICENSE" "${NEW_DIR}/LICENSE"
+        fi
+
+        update_refs "mermaid-${OLD_VERSION}" "mermaid-${VERSION}"
+        rm -rf "${OLD_DIR}"
+        echo "Done. Old directory removed: ${OLD_DIR}"
+        ;;
+
+    *)
+        echo "Unknown library: ${LIB}"
+        usage
+        ;;
+esac
+
+echo ""
+echo "Verify the update:"
+echo "  git diff --stat"
+echo "  python -m turnstone.server  # test locally"

sdk/typescript/openapi-server.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.0",
   "info": {
     "title": "turnstone Server API",
-    "version": "0.4.2",
+    "version": "0.8.4",
     "description": "Single-node workstream management, chat interaction, and real-time streaming."
   },
   "paths": {
@@ -314,6 +314,57 @@
         }
       }
     },
+    "/v1/api/cancel": {
+      "post": {
+        "summary": "Cancel the active generation in a workstream",
+        "operationId": "v1_api_cancel_post",
+        "tags": [
+          "Chat"
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/CancelRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Success",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/StatusResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Error 400",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "Error 404",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
     "/v1/api/events": {
       "get": {
         "summary": "Per-workstream SSE event stream",
@@ -386,6 +437,27 @@
         }
       }
     },
+    "/v1/api/skills": {
+      "get": {
+        "summary": "List available skills (summary)",
+        "operationId": "v1_api_skills_get",
+        "tags": [
+          "Skills"
+        ],
+        "responses": {
+          "200": {
+            "description": "Success",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ListSkillSummaryResponse"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
     "/v1/api/auth/login": {
       "post": {
         "summary": "Authenticate with a token",
@@ -530,6 +602,274 @@
         }
       }
     },
+    "/v1/api/auth/oidc/authorize": {
+      "get": {
+        "summary": "Redirect to OIDC provider for SSO login",
+        "operationId": "v1_api_auth_oidc_authorize_get",
+        "tags": [
+          "Auth"
+        ],
+        "responses": {
+          "302": {
+            "description": "Success"
+          },
+          "404": {
+            "description": "Error 404",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
+          },
+          "503": {
+            "description": "Error 503",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/v1/api/auth/oidc/callback": {
+      "get": {
+        "summary": "OIDC callback \u2014 validates code, provisions user, sets JWT cookie, redirects to app",
+        "operationId": "v1_api_auth_oidc_callback_get",
+        "tags": [
+          "Auth"
+        ],
+        "responses": {
+          "302": {
+            "description": "Success"
+          }
+        }
+      }
+    },
+    "/v1/api/auth/whoami": {
+      "get": {
+        "summary": "Return authenticated user info and permissions",
+        "operationId": "v1_api_auth_whoami_get",
+        "tags": [
+          "Auth"
+        ],
+        "responses": {
+          "200": {
+            "description": "Success",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/AuthWhoamiResponse"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Error 401",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/v1/api/memories": {
+      "get": {
+        "summary": "List structured memories",
+        "operationId": "v1_api_memories_get",
+        "tags": [
+          "Memories"
+        ],
+        "parameters": [
+          {
+            "name": "type",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Filter by memory type"
+          },
+          {
+            "name": "scope",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Filter by scope"
+          },
+          {
+            "name": "scope_id",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Filter by scope identifier"
+          },
+          {
+            "name": "limit",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "integer",
+              "default": 100
+            },
+            "description": "Max results (default 100, max 200)"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ListMemoriesResponse"
+                }
+              }
+            }
+          }
+        }
+      },
+      "post": {
+        "summary": "Save (upsert) a structured memory",
+        "operationId": "v1_api_memories_post",
+        "tags": [
+          "Memories"
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/SaveMemoryRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Success",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/MemoryInfo"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Error 400",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/v1/api/memories/search": {
+      "post": {
+        "summary": "Search structured memories by query",
+        "operationId": "v1_api_memories_search_post",
+        "tags": [
+          "Memories"
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/SearchMemoriesRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Success",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ListMemoriesResponse"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/v1/api/memories/{name}": {
+      "delete": {
+        "summary": "Delete a structured memory by name and scope",
+        "operationId": "v1_api_memories_{name}_delete",
+        "tags": [
+          "Memories"
+        ],
+        "parameters": [
+          {
+            "name": "name",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "scope",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Scope (default: global)"
+          },
+          {
+            "name": "scope_id",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Scope identifier"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/StatusResponse"
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "Error 404",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
     "/health": {
       "get": {
         "summary": "Server health check",
@@ -735,6 +1075,21 @@
           "setup_required": {
             "title": "Setup Required",
             "type": "boolean"
+          },
+          "oidc_enabled": {
+            "default": false,
+            "title": "Oidc Enabled",
+            "type": "boolean"
+          },
+          "oidc_provider_name": {
+            "default": "",
+            "title": "Oidc Provider Name",
+            "type": "string"
+          },
+          "password_enabled": {
+            "default": true,
+            "title": "Password Enabled",
+            "type": "boolean"
           }
         },
         "required": [
@@ -805,7 +1160,7 @@
           },
           "always": {
             "default": false,
-            "description": "Enable auto-approve for this tool",
+            "description": "Auto-approve the tools in this batch going forward",
             "title": "Always",
             "type": "boolean"
           },
@@ -862,6 +1217,20 @@
         "title": "CommandRequest",
         "type": "object"
       },
+      "CancelRequest": {
+        "properties": {
+          "ws_id": {
+            "description": "Target workstream ID",
+            "title": "Ws Id",
+            "type": "string"
+          }
+        },
+        "required": [
+          "ws_id"
+        ],
+        "title": "CancelRequest",
+        "type": "object"
+      },
       "CreateWorkstreamRequest": {
         "properties": {
           "name": {
@@ -887,6 +1256,12 @@
             "description": "Workstream ID to resume atomically during creation (empty = fresh start)",
             "title": "Resume Ws",
             "type": "string"
+          },
+          "skill": {
+            "default": "",
+            "description": "Skill name (replaces default skills)",
+            "title": "Skill",
+            "type": "string"
           }
         },
         "title": "CreateWorkstreamRequest",
@@ -1184,6 +1559,11 @@
             "title": "Version",
             "type": "string"
           },
+          "node_id": {
+            "default": "",
+            "title": "Node Id",
+            "type": "string"
+          },
           "uptime_seconds": {
             "default": 0.0,
             "title": "Uptime Seconds",
@@ -1194,6 +1574,12 @@
             "title": "Model",
             "type": "string"
           },
+          "max_ws": {
+            "default": 10,
+            "description": "Maximum concurrent workstreams",
+            "title": "Max Ws",
+            "type": "integer"
+          },
           "workstreams": {
             "$ref": "#/components/schemas/WorkstreamCounts",
             "default": {
@@ -1215,6 +1601,17 @@
               }
             ],
             "default": null
+          },
+          "mcp": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/McpStatus"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "default": null
           }
         },
         "required": [
@@ -1250,6 +1647,27 @@
         "title": "BackendStatus",
         "type": "object"
       },
+      "McpStatus": {
+        "properties": {
+          "servers": {
+            "default": 0,
+            "title": "Servers",
+            "type": "integer"
+          },
+          "resources": {
+            "default": 0,
+            "title": "Resources",
+            "type": "integer"
+          },
+          "prompts": {
+            "default": 0,
+            "title": "Prompts",
+            "type": "integer"
+          }
+        },
+        "title": "McpStatus",
+        "type": "object"
+      },
       "WorkstreamCounts": {
         "properties": {
           "total": {
@@ -1285,6 +1703,280 @@
         },
         "title": "WorkstreamCounts",
         "type": "object"
+      },
+      "SaveMemoryRequest": {
+        "properties": {
+          "name": {
+            "description": "Memory identifier (normalized to snake_case)",
+            "title": "Name",
+            "type": "string"
+          },
+          "content": {
+            "description": "Memory content",
+            "maxLength": 65536,
+            "title": "Content",
+            "type": "string"
+          },
+          "description": {
+            "default": "",
+            "description": "Short description for relevance matching",
+            "title": "Description",
+            "type": "string"
+          },
+          "type": {
+            "default": "project",
+            "description": "Memory type",
+            "enum": [
+              "user",
+              "project",
+              "feedback",
+              "reference"
+            ],
+            "title": "Type",
+            "type": "string"
+          },
+          "scope": {
+            "default": "global",
+            "description": "Memory scope",
+            "enum": [
+              "global",
+              "workstream",
+              "user"
+            ],
+            "title": "Scope",
+            "type": "string"
+          },
+          "scope_id": {
+            "default": "",
+            "description": "Scope identifier (ws_id for workstream, user_id for user scope)",
+            "title": "Scope Id",
+            "type": "string"
+          }
+        },
+        "required": [
+          "name",
+          "content"
+        ],
+        "title": "SaveMemoryRequest",
+        "type": "object"
+      },
+      "MemoryInfo": {
+        "properties": {
+          "memory_id": {
+            "title": "Memory Id",
+            "type": "string"
+          },
+          "name": {
+            "title": "Name",
+            "type": "string"
+          },
+          "description": {
+            "default": "",
+            "title": "Description",
+            "type": "string"
+          },
+          "type": {
+            "enum": [
+              "user",
+              "project",
+              "feedback",
+              "reference"
+            ],
+            "title": "Type",
+            "type": "string"
+          },
+          "scope": {
+            "enum": [
+              "global",
+              "workstream",
+              "user"
+            ],
+            "title": "Scope",
+            "type": "string"
+          },
+          "scope_id": {
+            "default": "",
+            "title": "Scope Id",
+            "type": "string"
+          },
+          "content": {
+            "title": "Content",
+            "type": "string"
+          },
+          "created": {
+            "title": "Created",
+            "type": "string"
+          },
+          "updated": {
+            "title": "Updated",
+            "type": "string"
+          }
+        },
+        "required": [
+          "memory_id",
+          "name",
+          "type",
+          "scope",
+          "content",
+          "created",
+          "updated"
+        ],
+        "title": "MemoryInfo",
+        "type": "object"
+      },
+      "ListMemoriesResponse": {
+        "properties": {
+          "memories": {
+            "items": {
+              "$ref": "#/components/schemas/MemoryInfo"
+            },
+            "title": "Memories",
+            "type": "array"
+          },
+          "total": {
+            "default": 0,
+            "title": "Total",
+            "type": "integer"
+          }
+        },
+        "required": [
+          "memories"
+        ],
+        "title": "ListMemoriesResponse",
+        "type": "object"
+      },
+      "SearchMemoriesRequest": {
+        "properties": {
+          "query": {
+            "description": "Search query text",
+            "title": "Query",
+            "type": "string"
+          },
+          "type": {
+            "default": "",
+            "description": "Filter by memory type",
+            "enum": [
+              "",
+              "user",
+              "project",
+              "feedback",
+              "reference"
+            ],
+            "title": "Type",
+            "type": "string"
+          },
+          "scope": {
+            "default": "",
+            "description": "Filter by scope",
+            "enum": [
+              "",
+              "global",
+              "workstream",
+              "user"
+            ],
+            "title": "Scope",
+            "type": "string"
+          },
+          "scope_id": {
+            "default": "",
+            "description": "Filter by scope_id",
+            "title": "Scope Id",
+            "type": "string"
+          },
+          "limit": {
+            "default": 20,
+            "description": "Max results (1-50)",
+            "maximum": 50,
+            "minimum": 1,
+            "title": "Limit",
+            "type": "integer"
+          }
+        },
+        "required": [
+          "query"
+        ],
+        "title": "SearchMemoriesRequest",
+        "type": "object"
+      },
+      "SkillSummary": {
+        "properties": {
+          "name": {
+            "description": "Skill name",
+            "title": "Name",
+            "type": "string"
+          },
+          "category": {
+            "default": "",
+            "description": "Skill category",
+            "title": "Category",
+            "type": "string"
+          },
+          "description": {
+            "default": "",
+            "description": "Skill description for discovery",
+            "title": "Description",
+            "type": "string"
+          },
+          "tags": {
+            "description": "Semantic tags",
+            "items": {
+              "type": "string"
+            },
+            "title": "Tags",
+            "type": "array"
+          },
+          "is_default": {
+            "default": false,
+            "description": "Whether auto-applied to all sessions",
+            "title": "Is Default",
+            "type": "boolean"
+          },
+          "activation": {
+            "default": "named",
+            "description": "Activation mode: default, named, search",
+            "title": "Activation",
+            "type": "string"
+          },
+          "origin": {
+            "default": "manual",
+            "description": "Source: manual, mcp, skills.sh, github",
+            "title": "Origin",
+            "type": "string"
+          },
+          "author": {
+            "default": "",
+            "description": "Skill author",
+            "title": "Author",
+            "type": "string"
+          },
+          "version": {
+            "default": "1.0.0",
+            "description": "Skill version",
+            "title": "Version",
+            "type": "string"
+          }
+        },
+        "required": [
+          "name"
+        ],
+        "title": "SkillSummary",
+        "type": "object"
+      },
+      "ListSkillSummaryResponse": {
+        "properties": {
+          "skills": {
+            "items": {
+              "$ref": "#/components/schemas/SkillSummary"
+            },
+            "title": "Skills",
+            "type": "array"
+          }
+        },
+        "required": [
+          "skills"
+        ],
+        "title": "ListSkillSummaryResponse",
+        "type": "object"
       }
     }
   }

sdk/typescript/package.json

@@ -32,7 +32,7 @@
   ],
   "license": "BUSL-1.1",
   "devDependencies": {
-    "typescript": "^5.4",
-    "vitest": "^2.0"
+    "typescript": "^6.0.0",
+    "vitest": "^4.1"
   }
 }

sdk/typescript/src/console.ts

@@ -1,6 +1,11 @@
 import { BaseClient, type ClientOptions } from "./base.js";
 import type { ClusterEvent } from "./events.js";
 import type {
+  AdminListMemoriesOptions,
+  AdminMemoryInfo,
+  AdminSearchMemoriesOptions,
+  AuditQueryOptions,
+  AuditResponse,
   AuthLoginResponse,
   AuthSetupResponse,
   AuthStatusResponse,
@@ -11,14 +16,47 @@ import type {
   ConsoleCreateWsRequest,
   ConsoleCreateWsResponse,
   ConsoleHealthResponse,
+  CreateMcpServerRequest,
+  CreatePolicyOptions,
+  CreateRoleOptions,
   CreateScheduleRequest,
+  CreateSkillRequest,
+  CreateSkillResourceRequest,
+  ImportMcpConfigResponse,
+  ListAdminMemoriesResponse,
+  ListMcpServersResponse,
   ListScheduleRunsResponse,
   ListSchedulesResponse,
+  ListSettingSchemaResponse,
+  ListSettingsResponse,
+  ListSkillResourcesResponse,
+  ListSkillsResponse,
+  McpServerDetail,
+  RegistryInstallRequest,
+  RegistrySearchResponse,
+  SkillDiscoverResponse,
+  SkillInfo,
+  SkillInstallRequest,
+  SkillInstallResponse,
+  SkillResourceInfo,
   NodeDetailResponse,
   NodesOptions,
+  OrgInfo,
+  RoleInfo,
   ScheduleInfo,
+  SettingInfo,
   StatusResponse,
+  ToolPolicyInfo,
+  UpdateMcpServerRequest,
+  UpdateOrgOptions,
+  UpdatePolicyOptions,
+  UpdateRoleOptions,
   UpdateScheduleRequest,
+  UpdateSettingOptions,
+  UpdateSkillRequest,
+  UsageQueryOptions,
+  UsageResponse,
+  UserRoleInfo,
   WorkstreamsOptions,
 } from "./types.js";
 
@@ -157,4 +195,299 @@ export class TurnstoneConsole extends BaseClient {
       params: { limit: opts?.limit ?? 50 },
     });
   }
+
+  // -- Governance: Roles ------------------------------------------------------
+
+  async listRoles(): Promise<{ roles: RoleInfo[] }> {
+    return this.request("GET", "/v1/api/admin/roles");
+  }
+
+  async createRole(opts: CreateRoleOptions): Promise<RoleInfo> {
+    return this.request("POST", "/v1/api/admin/roles", { json: opts });
+  }
+
+  async updateRole(roleId: string, opts: UpdateRoleOptions): Promise<RoleInfo> {
+    return this.request("PUT", `/v1/api/admin/roles/${roleId}`, {
+      json: opts,
+    });
+  }
+
+  async deleteRole(roleId: string): Promise<StatusResponse> {
+    return this.request("DELETE", `/v1/api/admin/roles/${roleId}`);
+  }
+
+  async listUserRoles(userId: string): Promise<{ roles: UserRoleInfo[] }> {
+    return this.request("GET", `/v1/api/admin/users/${userId}/roles`);
+  }
+
+  async assignRole(userId: string, roleId: string): Promise<StatusResponse> {
+    return this.request("POST", `/v1/api/admin/users/${userId}/roles`, {
+      json: { role_id: roleId },
+    });
+  }
+
+  async unassignRole(userId: string, roleId: string): Promise<StatusResponse> {
+    return this.request(
+      "DELETE",
+      `/v1/api/admin/users/${userId}/roles/${roleId}`,
+    );
+  }
+
+  // -- Governance: Organizations ----------------------------------------------
+
+  async listOrgs(): Promise<{ orgs: OrgInfo[] }> {
+    return this.request("GET", "/v1/api/admin/orgs");
+  }
+
+  async getOrg(orgId: string): Promise<OrgInfo> {
+    return this.request("GET", `/v1/api/admin/orgs/${orgId}`);
+  }
+
+  async updateOrg(orgId: string, opts: UpdateOrgOptions): Promise<OrgInfo> {
+    return this.request("PUT", `/v1/api/admin/orgs/${orgId}`, { json: opts });
+  }
+
+  // -- Governance: Tool Policies ----------------------------------------------
+
+  async listPolicies(): Promise<{ policies: ToolPolicyInfo[] }> {
+    return this.request("GET", "/v1/api/admin/policies");
+  }
+
+  async createPolicy(opts: CreatePolicyOptions): Promise<ToolPolicyInfo> {
+    return this.request("POST", "/v1/api/admin/policies", { json: opts });
+  }
+
+  async updatePolicy(
+    policyId: string,
+    opts: UpdatePolicyOptions,
+  ): Promise<ToolPolicyInfo> {
+    return this.request("PUT", `/v1/api/admin/policies/${policyId}`, {
+      json: opts,
+    });
+  }
+
+  async deletePolicy(policyId: string): Promise<StatusResponse> {
+    return this.request("DELETE", `/v1/api/admin/policies/${policyId}`);
+  }
+
+  // -- Governance: Skills -------------------------------------------------------
+
+  async listSkills(): Promise<SkillInfo[]> {
+    const resp = await this.request<ListSkillsResponse>(
+      "GET",
+      "/v1/api/admin/skills",
+    );
+    return resp.skills;
+  }
+
+  async createSkill(body: CreateSkillRequest): Promise<SkillInfo> {
+    return this.request("POST", "/v1/api/admin/skills", { json: body });
+  }
+
+  async updateSkill(
+    skillId: string,
+    body: UpdateSkillRequest,
+  ): Promise<SkillInfo> {
+    return this.request("PUT", `/v1/api/admin/skills/${skillId}`, {
+      json: body,
+    });
+  }
+
+  async deleteSkill(skillId: string): Promise<void> {
+    await this.request("DELETE", `/v1/api/admin/skills/${skillId}`);
+  }
+
+  async listSkillResources(skillId: string): Promise<SkillResourceInfo[]> {
+    const resp = await this.request<ListSkillResourcesResponse>(
+      "GET",
+      `/v1/api/admin/skills/${skillId}/resources`,
+    );
+    return resp.resources;
+  }
+
+  async createSkillResource(
+    skillId: string,
+    body: CreateSkillResourceRequest,
+  ): Promise<SkillResourceInfo> {
+    return this.request("POST", `/v1/api/admin/skills/${skillId}/resources`, {
+      json: body,
+    });
+  }
+
+  async deleteSkillResource(skillId: string, path: string): Promise<void> {
+    await this.request(
+      "DELETE",
+      `/v1/api/admin/skills/${skillId}/resources/${path.split("/").map(encodeURIComponent).join("/")}`,
+    );
+  }
+
+  // -- Governance: Usage & Audit ----------------------------------------------
+
+  async getUsage(opts: UsageQueryOptions): Promise<UsageResponse> {
+    const params: Record<string, string> = { since: opts.since };
+    if (opts.until) params.until = opts.until;
+    if (opts.user_id) params.user_id = opts.user_id;
+    if (opts.model) params.model = opts.model;
+    if (opts.group_by) params.group_by = opts.group_by;
+    return this.request("GET", "/v1/api/admin/usage", { params });
+  }
+
+  async getAudit(opts?: AuditQueryOptions): Promise<AuditResponse> {
+    const params: Record<string, string> = {};
+    if (opts?.action) params.action = opts.action;
+    if (opts?.user_id) params.user_id = opts.user_id;
+    if (opts?.since) params.since = opts.since;
+    if (opts?.until) params.until = opts.until;
+    if (opts?.limit !== undefined) params.limit = String(opts.limit);
+    if (opts?.offset !== undefined) params.offset = String(opts.offset);
+    return this.request("GET", "/v1/api/admin/audit", { params });
+  }
+
+  // -- Admin: Memories ------------------------------------------------------
+
+  async listMemories(
+    opts?: AdminListMemoriesOptions,
+  ): Promise<ListAdminMemoriesResponse> {
+    const params: Record<string, string | number> = {};
+    if (opts?.type) params.type = opts.type;
+    if (opts?.scope) params.scope = opts.scope;
+    if (opts?.scope_id) params.scope_id = opts.scope_id;
+    if (opts?.limit !== undefined) params.limit = opts.limit;
+    return this.request("GET", "/v1/api/admin/memories", { params });
+  }
+
+  async searchMemories(
+    opts: AdminSearchMemoriesOptions,
+  ): Promise<ListAdminMemoriesResponse> {
+    const params: Record<string, string | number> = { q: opts.q };
+    if (opts.type) params.type = opts.type;
+    if (opts.scope) params.scope = opts.scope;
+    if (opts.scope_id) params.scope_id = opts.scope_id;
+    if (opts.limit !== undefined) params.limit = opts.limit;
+    return this.request("GET", "/v1/api/admin/memories/search", { params });
+  }
+
+  async getMemory(memoryId: string): Promise<AdminMemoryInfo> {
+    return this.request("GET", `/v1/api/admin/memories/${memoryId}`);
+  }
+
+  async deleteMemory(memoryId: string): Promise<StatusResponse> {
+    return this.request("DELETE", `/v1/api/admin/memories/${memoryId}`);
+  }
+
+  // -- System: Settings -------------------------------------------------------
+
+  async listSettings(): Promise<ListSettingsResponse> {
+    return this.request("GET", "/v1/api/admin/settings");
+  }
+
+  async getSettingsSchema(): Promise<ListSettingSchemaResponse> {
+    return this.request("GET", "/v1/api/admin/settings/schema");
+  }
+
+  async updateSetting(
+    key: string,
+    opts: UpdateSettingOptions,
+  ): Promise<SettingInfo> {
+    return this.request("PUT", `/v1/api/admin/settings/${key}`, {
+      json: opts,
+    });
+  }
+
+  async deleteSetting(key: string, nodeId?: string): Promise<StatusResponse> {
+    const params: Record<string, string> = {};
+    if (nodeId) params.node_id = nodeId;
+    return this.request("DELETE", `/v1/api/admin/settings/${key}`, {
+      params,
+    });
+  }
+
+  // -- MCP servers ----------------------------------------------------------
+
+  async listMcpServers(opts?: {
+    reveal?: boolean;
+  }): Promise<ListMcpServersResponse> {
+    const params: Record<string, string> = {};
+    if (opts?.reveal) params.reveal = "true";
+    return this.request("GET", "/v1/api/admin/mcp-servers", { params });
+  }
+
+  async createMcpServer(
+    body: CreateMcpServerRequest,
+  ): Promise<McpServerDetail> {
+    return this.request("POST", "/v1/api/admin/mcp-servers", { json: body });
+  }
+
+  async getMcpServer(serverId: string): Promise<McpServerDetail> {
+    return this.request("GET", `/v1/api/admin/mcp-servers/${serverId}`);
+  }
+
+  async updateMcpServer(
+    serverId: string,
+    body: UpdateMcpServerRequest,
+  ): Promise<McpServerDetail> {
+    return this.request("PUT", `/v1/api/admin/mcp-servers/${serverId}`, {
+      json: body,
+    });
+  }
+
+  async deleteMcpServer(serverId: string): Promise<StatusResponse> {
+    return this.request("DELETE", `/v1/api/admin/mcp-servers/${serverId}`);
+  }
+
+  async reloadMcpServers(): Promise<StatusResponse> {
+    return this.request("POST", "/v1/api/admin/mcp-servers/reload");
+  }
+
+  async importMcpConfig(
+    config: Record<string, unknown>,
+  ): Promise<ImportMcpConfigResponse> {
+    return this.request("POST", "/v1/api/admin/mcp-servers/import", {
+      json: { config },
+    });
+  }
+
+  // -- MCP Registry ---------------------------------------------------------
+
+  async searchMcpRegistry(opts?: {
+    q?: string;
+    limit?: number;
+    cursor?: string;
+  }): Promise<RegistrySearchResponse> {
+    const params: Record<string, string> = {};
+    if (opts?.q) params.search = opts.q;
+    if (opts?.limit) params.limit = String(opts.limit);
+    if (opts?.cursor) params.cursor = opts.cursor;
+    return this.request("GET", "/v1/api/admin/mcp-registry/search", {
+      params,
+    });
+  }
+
+  async installFromRegistry(
+    body: RegistryInstallRequest,
+  ): Promise<McpServerDetail> {
+    return this.request("POST", "/v1/api/admin/mcp-registry/install", {
+      json: body,
+    });
+  }
+
+  // -- Skill Discovery ------------------------------------------------------
+
+  async discoverSkills(opts?: {
+    q?: string;
+    limit?: number;
+  }): Promise<SkillDiscoverResponse> {
+    const params: Record<string, string> = {};
+    if (opts?.q) params.q = opts.q;
+    if (opts?.limit) params.limit = String(opts.limit);
+    return this.request("GET", "/v1/api/admin/skills/discover", {
+      params,
+    });
+  }
+
+  async installSkill(body: SkillInstallRequest): Promise<SkillInstallResponse> {
+    return this.request("POST", "/v1/api/admin/skills/install", {
+      json: body,
+    });
+  }
 }

sdk/typescript/src/events.ts

@@ -48,6 +48,12 @@ export interface ApproveRequestEvent {
   items: Array<Record<string, unknown>>;
 }
 
+export interface ApprovalResolvedEvent {
+  type: "approval_resolved";
+  approved: boolean;
+  feedback: string;
+}
+
 export interface ToolResultEvent {
   type: "tool_result";
   call_id: string;
@@ -69,6 +75,8 @@ export interface StatusEvent {
   context_window: number;
   pct: number;
   effort: string;
+  cache_creation_tokens?: number;
+  cache_read_tokens?: number;
 }
 
 export interface PlanReviewEvent {
@@ -95,6 +103,10 @@ export interface ClearUiEvent {
   type: "clear_ui";
 }
 
+export interface CancelledEvent {
+  type: "cancelled";
+}
+
 // Global events
 
 export interface WsStateEvent {
@@ -105,6 +117,8 @@ export interface WsStateEvent {
   context_ratio: number;
   activity: string;
   activity_state: string;
+  /** Full assistant response text — populated on idle transitions only. */
+  content?: string;
 }
 
 export interface WsActivityEvent {
@@ -137,6 +151,7 @@ export type ServerEvent =
   | StreamEndEvent
   | ToolInfoEvent
   | ApproveRequestEvent
+  | ApprovalResolvedEvent
   | ToolResultEvent
   | ToolOutputChunkEvent
   | StatusEvent
@@ -145,6 +160,7 @@ export type ServerEvent =
   | ErrorEvent
   | BusyErrorEvent
   | ClearUiEvent
+  | CancelledEvent
   | WsStateEvent
   | WsActivityEvent
   | WsRenameEvent
@@ -244,6 +260,16 @@ export function isApproveRequestEvent(
   return e.type === "approve_request";
 }
 
+export function isApprovalResolvedEvent(
+  e: ServerEvent,
+): e is ApprovalResolvedEvent {
+  return e.type === "approval_resolved";
+}
+
 export function isPlanReviewEvent(e: ServerEvent): e is PlanReviewEvent {
   return e.type === "plan_review";
 }
+
+export function isCancelledEvent(e: ServerEvent): e is CancelledEvent {
+  return e.type === "cancelled";
+}

sdk/typescript/src/index.ts

@@ -37,6 +37,7 @@ export type {
   StreamEndEvent,
   ToolInfoEvent,
   ApproveRequestEvent,
+  ApprovalResolvedEvent,
   ToolResultEvent,
   ToolOutputChunkEvent,
   StatusEvent,
@@ -45,6 +46,7 @@ export type {
   ErrorEvent,
   BusyErrorEvent,
   ClearUiEvent,
+  CancelledEvent,
   WsStateEvent,
   WsActivityEvent,
   WsRenameEvent,
@@ -66,7 +68,9 @@ export {
   isToolResultEvent,
   isWsStateEvent,
   isApproveRequestEvent,
+  isApprovalResolvedEvent,
   isPlanReviewEvent,
+  isCancelledEvent,
 } from "./events.js";
 
 // Request/response types
@@ -87,6 +91,7 @@ export type {
   SavedWorkstreamInfo,
   ListSavedWorkstreamsResponse,
   BackendStatus,
+  McpStatus,
   WorkstreamCounts,
   HealthResponse,
   AuthLoginRequest,
@@ -112,10 +117,69 @@ export type {
   ScheduleRunInfo,
   ListSchedulesResponse,
   ListScheduleRunsResponse,
+  RoleInfo,
+  CreateRoleOptions,
+  UpdateRoleOptions,
+  UserRoleInfo,
+  OrgInfo,
+  UpdateOrgOptions,
+  ToolPolicyInfo,
+  CreatePolicyOptions,
+  UpdatePolicyOptions,
+  SkillSummary,
+  SkillInfo,
+  CreateSkillRequest,
+  UpdateSkillRequest,
+  ListSkillsResponse,
+  SkillResourceInfo,
+  ListSkillResourcesResponse,
+  CreateSkillResourceRequest,
+  UsageBreakdownItem,
+  UsageResponse,
+  UsageQueryOptions,
+  AuditEventInfo,
+  AuditQueryOptions,
+  AuditResponse,
   TurnResult,
   SendAndWaitOptions,
   NodesOptions,
   WorkstreamsOptions,
+  // Memory types
+  SaveMemoryRequest,
+  MemoryInfo,
+  ListMemoriesResponse,
+  SearchMemoriesRequest,
+  ListMemoriesOptions,
+  DeleteMemoryOptions,
+  AdminMemoryInfo,
+  ListAdminMemoriesResponse,
+  AdminListMemoriesOptions,
+  AdminSearchMemoriesOptions,
+  // Settings types
+  SettingInfo,
+  ListSettingsResponse,
+  SettingSchemaInfo,
+  ListSettingSchemaResponse,
+  UpdateSettingOptions,
+  // MCP server types
+  McpServerStatus,
+  McpServerDetail,
+  ListMcpServersResponse,
+  CreateMcpServerRequest,
+  UpdateMcpServerRequest,
+  ImportMcpConfigResponse,
+  // MCP registry types
+  RegistryRemoteInfo,
+  RegistryPackageInfo,
+  RegistryServerInfo,
+  RegistrySearchResponse,
+  RegistryInstallRequest,
+  // Skill discovery types
+  SkillDiscoverListing,
+  SkillDiscoverResponse,
+  SkillInstallRequest,
+  SkillInstallResponse,
+  SkillInstallSkipped,
 } from "./types.js";
 
 // SSE parser (for advanced usage)

sdk/typescript/src/server.ts

@@ -7,9 +7,16 @@ import type {
   CreateWorkstreamRequest,
   CreateWorkstreamResponse,
   DashboardResponse,
+  DeleteMemoryOptions,
   HealthResponse,
+  ListMemoriesOptions,
+  ListMemoriesResponse,
   ListSavedWorkstreamsResponse,
+  SkillSummary,
   ListWorkstreamsResponse,
+  MemoryInfo,
+  SaveMemoryRequest,
+  SearchMemoriesRequest,
   SendAndWaitOptions,
   SendResponse,
   StatusResponse,
@@ -86,6 +93,12 @@ export class TurnstoneServer extends BaseClient {
     });
   }
 
+  async cancel(wsId: string): Promise<StatusResponse> {
+    return this.request("POST", "/v1/api/cancel", {
+      json: { ws_id: wsId },
+    });
+  }
+
   // -- Streaming ------------------------------------------------------------
 
   async *streamEvents(wsId: string): AsyncIterableIterator<ServerEvent> {
@@ -184,6 +197,49 @@ export class TurnstoneServer extends BaseClient {
     return this.request("GET", "/v1/api/workstreams/saved");
   }
 
+  // -- Skills -----------------------------------------------------------------
+
+  async listSkills(): Promise<SkillSummary[]> {
+    const resp = await this.request<{ skills: SkillSummary[] }>(
+      "GET",
+      "/v1/api/skills",
+    );
+    return resp.skills;
+  }
+
+  // -- Memories -------------------------------------------------------------
+
+  async listMemories(
+    opts?: ListMemoriesOptions,
+  ): Promise<ListMemoriesResponse> {
+    const params: Record<string, string | number> = {};
+    if (opts?.type) params.type = opts.type;
+    if (opts?.scope) params.scope = opts.scope;
+    if (opts?.scope_id) params.scope_id = opts.scope_id;
+    if (opts?.limit !== undefined) params.limit = opts.limit;
+    return this.request("GET", "/v1/api/memories", { params });
+  }
+
+  async saveMemory(opts: SaveMemoryRequest): Promise<MemoryInfo> {
+    return this.request("POST", "/v1/api/memories", { json: opts });
+  }
+
+  async searchMemories(
+    opts: SearchMemoriesRequest,
+  ): Promise<ListMemoriesResponse> {
+    return this.request("POST", "/v1/api/memories/search", { json: opts });
+  }
+
+  async deleteMemory(
+    name: string,
+    opts?: DeleteMemoryOptions,
+  ): Promise<StatusResponse> {
+    const params: Record<string, string> = {};
+    if (opts?.scope) params.scope = opts.scope;
+    if (opts?.scope_id) params.scope_id = opts.scope_id;
+    return this.request("DELETE", `/v1/api/memories/${name}`, { params });
+  }
+
   // -- Auth -----------------------------------------------------------------
 
   async login(opts: {

sdk/typescript/src/types.ts

@@ -72,6 +72,7 @@ export interface CreateWorkstreamRequest {
   model?: string;
   auto_approve?: boolean;
   resume_ws?: string;
+  skill?: string;
 }
 
 export interface CreateWorkstreamResponse {
@@ -141,6 +142,136 @@ export interface ListSavedWorkstreamsResponse {
   workstreams: SavedWorkstreamInfo[];
 }
 
+// ---------------------------------------------------------------------------
+// Server API — Skills
+// ---------------------------------------------------------------------------
+
+export interface SkillSummary {
+  name: string;
+  category: string;
+  description: string;
+  tags: string[];
+  is_default: boolean;
+  activation: string;
+  origin: string;
+  author: string;
+  version: string;
+}
+
+export interface SkillInfo {
+  template_id: string;
+  name: string;
+  category: string;
+  content: string;
+  description: string;
+  tags: string[];
+  variables: string;
+  is_default: boolean;
+  activation: string;
+  org_id: string;
+  created_by: string;
+  origin: string;
+  mcp_server: string;
+  readonly: boolean;
+  source_url: string;
+  version: string;
+  author: string;
+  token_estimate: number;
+  model: string;
+  auto_approve: boolean;
+  temperature: number | null;
+  reasoning_effort: string;
+  max_tokens: number | null;
+  token_budget: number;
+  agent_max_turns: number | null;
+  notify_on_complete: string;
+  enabled: boolean;
+  priority: number;
+  allowed_tools: string;
+  license: string;
+  compatibility: string;
+  resource_count: number;
+  created: string;
+  updated: string;
+}
+
+export interface CreateSkillRequest {
+  name: string;
+  content: string;
+  category?: string;
+  description?: string;
+  tags?: string;
+  variables?: string;
+  is_default?: boolean;
+  activation?: string;
+  org_id?: string;
+  author?: string;
+  version?: string;
+  model?: string;
+  auto_approve?: boolean;
+  temperature?: number | null;
+  reasoning_effort?: string;
+  max_tokens?: number | null;
+  token_budget?: number;
+  agent_max_turns?: number | null;
+  notify_on_complete?: string;
+  enabled?: boolean;
+  priority?: number;
+  allowed_tools?: string;
+  license?: string;
+  compatibility?: string;
+}
+
+export interface UpdateSkillRequest {
+  name?: string;
+  content?: string;
+  category?: string;
+  description?: string;
+  tags?: string;
+  variables?: string;
+  is_default?: boolean;
+  activation?: string;
+  author?: string;
+  version?: string;
+  model?: string;
+  auto_approve?: boolean;
+  temperature?: number | null;
+  reasoning_effort?: string;
+  max_tokens?: number | null;
+  token_budget?: number;
+  agent_max_turns?: number | null;
+  notify_on_complete?: string;
+  enabled?: boolean;
+  priority?: number;
+  allowed_tools?: string;
+  license?: string;
+  compatibility?: string;
+}
+
+export interface ListSkillsResponse {
+  skills: SkillInfo[];
+}
+
+export interface SkillResourceInfo {
+  resource_id: string;
+  skill_id: string;
+  path: string;
+  content?: string;
+  content_type: string;
+  size: number;
+  created: string;
+}
+
+export interface ListSkillResourcesResponse {
+  resources: SkillResourceInfo[];
+}
+
+export interface CreateSkillResourceRequest {
+  path: string;
+  content: string;
+  content_type?: string;
+}
+
 // ---------------------------------------------------------------------------
 // Server API — Health
 // ---------------------------------------------------------------------------
@@ -159,6 +290,12 @@ export interface WorkstreamCounts {
   error?: number;
 }
 
+export interface McpStatus {
+  servers: number;
+  resources: number;
+  prompts: number;
+}
+
 export interface HealthResponse {
   status: string;
   version?: string;
@@ -166,6 +303,7 @@ export interface HealthResponse {
   model?: string;
   workstreams?: WorkstreamCounts;
   backend?: BackendStatus | null;
+  mcp?: McpStatus | null;
 }
 
 // ---------------------------------------------------------------------------
@@ -266,6 +404,8 @@ export interface ConsoleCreateWsRequest {
   name?: string;
   model?: string;
   initial_message?: string;
+  skill?: string;
+  resume_ws?: string;
 }
 
 export interface ConsoleCreateWsResponse {
@@ -354,6 +494,139 @@ export interface ListScheduleRunsResponse {
   runs: ScheduleRunInfo[];
 }
 
+// ---------------------------------------------------------------------------
+// Console API — Governance: Roles
+// ---------------------------------------------------------------------------
+
+export interface RoleInfo {
+  role_id: string;
+  name: string;
+  display_name: string;
+  permissions: string;
+  builtin: boolean;
+  org_id: string;
+  created: string;
+  updated: string;
+}
+
+export interface CreateRoleOptions {
+  name: string;
+  display_name?: string;
+  permissions?: string;
+}
+
+export interface UpdateRoleOptions {
+  display_name?: string;
+  permissions?: string;
+}
+
+export interface UserRoleInfo extends RoleInfo {
+  assigned_by: string;
+  assignment_created: string;
+}
+
+// ---------------------------------------------------------------------------
+// Console API — Governance: Orgs
+// ---------------------------------------------------------------------------
+
+export interface OrgInfo {
+  org_id: string;
+  name: string;
+  display_name: string;
+  settings: string;
+  created: string;
+  updated: string;
+}
+
+export interface UpdateOrgOptions {
+  display_name?: string;
+  settings?: string;
+}
+
+// ---------------------------------------------------------------------------
+// Console API — Governance: Tool Policies
+// ---------------------------------------------------------------------------
+
+export interface ToolPolicyInfo {
+  policy_id: string;
+  name: string;
+  tool_pattern: string;
+  action: string;
+  priority: number;
+  org_id: string;
+  enabled: boolean;
+  created_by: string;
+  created: string;
+  updated: string;
+}
+
+export interface CreatePolicyOptions {
+  name: string;
+  tool_pattern: string;
+  action: string;
+  priority?: number;
+  org_id?: string;
+  enabled?: boolean;
+}
+
+export interface UpdatePolicyOptions {
+  name?: string;
+  tool_pattern?: string;
+  action?: string;
+  priority?: number;
+  enabled?: boolean;
+}
+
+// ---------------------------------------------------------------------------
+// Console API — Governance: Usage & Audit
+// ---------------------------------------------------------------------------
+
+export interface UsageBreakdownItem {
+  key?: string;
+  prompt_tokens: number;
+  completion_tokens: number;
+  tool_calls_count: number;
+}
+
+export interface UsageResponse {
+  summary: UsageBreakdownItem[];
+  breakdown: UsageBreakdownItem[];
+}
+
+export interface UsageQueryOptions {
+  since: string;
+  until?: string;
+  user_id?: string;
+  model?: string;
+  group_by?: string;
+}
+
+export interface AuditEventInfo {
+  event_id: string;
+  timestamp: string;
+  user_id: string;
+  action: string;
+  resource_type: string;
+  resource_id: string;
+  detail: string;
+  ip_address: string;
+  created: string;
+}
+
+export interface AuditQueryOptions {
+  action?: string;
+  user_id?: string;
+  since?: string;
+  until?: string;
+  limit?: number;
+  offset?: number;
+}
+
+export interface AuditResponse {
+  events: AuditEventInfo[];
+  total: number;
+}
+
 // ---------------------------------------------------------------------------
 // SDK-specific types
 // ---------------------------------------------------------------------------
@@ -391,5 +664,282 @@ export interface WorkstreamsOptions {
   per_page?: number;
 }
 
+// -- Server API: Memories ---------------------------------------------------
+
+export interface SaveMemoryRequest {
+  name: string;
+  content: string;
+  description?: string;
+  type?: "user" | "project" | "feedback" | "reference";
+  scope?: "global" | "workstream" | "user";
+  scope_id?: string;
+}
+
+export interface MemoryInfo {
+  memory_id: string;
+  name: string;
+  description: string;
+  type: string;
+  scope: string;
+  scope_id: string;
+  content: string;
+  created: string;
+  updated: string;
+}
+
+export interface ListMemoriesResponse {
+  memories: MemoryInfo[];
+  total: number;
+}
+
+export interface SearchMemoriesRequest {
+  query: string;
+  type?: string;
+  scope?: string;
+  scope_id?: string;
+  limit?: number;
+}
+
+export interface ListMemoriesOptions {
+  type?: string;
+  scope?: string;
+  scope_id?: string;
+  limit?: number;
+}
+
+export interface DeleteMemoryOptions {
+  scope?: string;
+  scope_id?: string;
+}
+
+// -- Console API: Admin Memories --------------------------------------------
+
+export interface AdminMemoryInfo {
+  memory_id: string;
+  name: string;
+  description: string;
+  type: string;
+  scope: string;
+  scope_id: string;
+  content: string;
+  created: string;
+  updated: string;
+  last_accessed: string;
+  access_count: number;
+}
+
+export interface ListAdminMemoriesResponse {
+  memories: AdminMemoryInfo[];
+  total: number;
+}
+
+export interface AdminListMemoriesOptions {
+  type?: string;
+  scope?: string;
+  scope_id?: string;
+  limit?: number;
+}
+
+export interface AdminSearchMemoriesOptions {
+  q: string;
+  type?: string;
+  scope?: string;
+  scope_id?: string;
+  limit?: number;
+}
+
+// -- Console API: MCP Servers -----------------------------------------------
+
+export interface McpServerStatus {
+  connected: boolean;
+  tools: number;
+  resources: number;
+  prompts: number;
+  error: string;
+}
+
+export interface McpServerDetail {
+  server_id: string;
+  name: string;
+  transport: string;
+  command: string;
+  args: string;
+  url: string;
+  headers: string;
+  env: string;
+  auto_approve: boolean;
+  enabled: boolean;
+  created_by: string;
+  registry_name: string | null;
+  registry_version: string;
+  registry_meta: string;
+  created: string;
+  updated: string;
+  status: Record<string, McpServerStatus>;
+}
+
+export interface ListMcpServersResponse {
+  servers: McpServerDetail[];
+}
+
+export interface CreateMcpServerRequest {
+  name: string;
+  transport: string;
+  command?: string;
+  args?: string[];
+  url?: string;
+  headers?: Record<string, string>;
+  env?: Record<string, string>;
+  auto_approve?: boolean;
+  enabled?: boolean;
+}
+
+export interface UpdateMcpServerRequest {
+  name?: string;
+  transport?: string;
+  command?: string;
+  args?: string[];
+  url?: string;
+  headers?: Record<string, string>;
+  env?: Record<string, string>;
+  auto_approve?: boolean;
+  enabled?: boolean;
+}
+
+export interface ImportMcpConfigResponse {
+  imported: string[];
+  skipped: string[];
+  errors: string[];
+}
+
+// -- Console API: MCP Registry ----------------------------------------------
+
+export interface RegistryRemoteInfo {
+  type: string;
+  url: string;
+  headers: Record<string, unknown>[];
+  variables: Record<string, Record<string, unknown>>;
+}
+
+export interface RegistryPackageInfo {
+  registry_type: string;
+  identifier: string;
+  version: string;
+  transport_type: string;
+  environment_variables: Record<string, unknown>[];
+}
+
+export interface RegistryServerInfo {
+  name: string;
+  description: string;
+  title: string;
+  version: string;
+  website_url: string;
+  repository: Record<string, string>;
+  icons: Record<string, string>[];
+  remotes: RegistryRemoteInfo[];
+  packages: RegistryPackageInfo[];
+  meta: Record<string, unknown>;
+  installed: boolean;
+  installed_server_id: string;
+  installed_version: string;
+  update_available: boolean;
+}
+
+export interface RegistrySearchResponse {
+  servers: RegistryServerInfo[];
+  total: number;
+  next_cursor: string | null;
+}
+
+export interface RegistryInstallRequest {
+  registry_name: string;
+  source: string;
+  index?: number;
+  name?: string;
+  variables?: Record<string, string>;
+  env?: Record<string, string>;
+  headers?: Record<string, string>;
+}
+
+// -- Console API: Skill Discovery -------------------------------------------
+
+export interface SkillDiscoverListing {
+  id: string;
+  name: string;
+  description: string;
+  author: string;
+  source: string;
+  source_url: string;
+  install_count: number;
+  tags: string[];
+  installed: boolean;
+  scan_status?: string;
+  template_id?: string;
+}
+
+export interface SkillDiscoverResponse {
+  skills: SkillDiscoverListing[];
+}
+
+export interface SkillInstallRequest {
+  source: string;
+  skill_id?: string;
+  url?: string;
+}
+
+export interface SkillInstallSkipped {
+  name: string;
+  reason: string;
+}
+
+export interface SkillInstallResponse {
+  installed: SkillInfo[];
+  skipped: SkillInstallSkipped[];
+  total: number;
+}
+
+// -- Console API: System Settings -------------------------------------------
+
+export interface SettingInfo {
+  key: string;
+  value: unknown;
+  source: string;
+  type: string;
+  description: string;
+  section: string;
+  is_secret: boolean;
+  node_id: string;
+  changed_by: string;
+  updated: string;
+  restart_required: boolean;
+}
+
+export interface ListSettingsResponse {
+  settings: SettingInfo[];
+}
+
+export interface SettingSchemaInfo {
+  key: string;
+  type: string;
+  default: unknown;
+  description: string;
+  section: string;
+  is_secret: boolean;
+  min_value: number | null;
+  max_value: number | null;
+  choices: string[] | null;
+  restart_required: boolean;
+}
+
+export interface ListSettingSchemaResponse {
+  schema: SettingSchemaInfo[];
+}
+
+export interface UpdateSettingOptions {
+  value: unknown;
+  node_id?: string;
+}
+
 // Re-export event types for convenience
 export type { ServerEvent, ClusterEvent } from "./events.js";

sdk/typescript/tests/events.test.ts

@@ -6,6 +6,7 @@ import {
   isToolResultEvent,
   isWsStateEvent,
   isApproveRequestEvent,
+  isApprovalResolvedEvent,
   isPlanReviewEvent,
   isReasoningEvent,
 } from "../src/events.js";
@@ -62,6 +63,15 @@ describe("event type guards", () => {
     expect(isApproveRequestEvent(e)).toBe(true);
   });
 
+  it("isApprovalResolvedEvent", () => {
+    const e: ServerEvent = {
+      type: "approval_resolved",
+      approved: false,
+      feedback: "Approval timed out",
+    };
+    expect(isApprovalResolvedEvent(e)).toBe(true);
+  });
+
   it("isPlanReviewEvent", () => {
     const e: ServerEvent = { type: "plan_review", content: "## Plan" };
     expect(isPlanReviewEvent(e)).toBe(true);

tests/conftest.py

@@ -1,11 +1,23 @@
+from __future__ import annotations
+
+import os
 from unittest.mock import MagicMock
 
 import pytest
 
 
+def pytest_addoption(parser: pytest.Parser) -> None:
+    parser.addoption(
+        "--storage-backend",
+        default="sqlite",
+        choices=["sqlite", "postgresql"],
+        help="Storage backend for integration tests (default: sqlite)",
+    )
+
+
 @pytest.fixture
 def tmp_db(tmp_path):
-    """Provide a temporary SQLite storage backend."""
+    """Provide a temporary SQLite storage backend (singleton registry)."""
     from turnstone.core.storage import init_storage, reset_storage
 
     db_path = str(tmp_path / "test.db")
@@ -15,6 +27,68 @@ def tmp_db(tmp_path):
     reset_storage()
 
 
+@pytest.fixture
+def storage_backend(request, tmp_path):
+    """Shared storage backend fixture — respects --storage-backend flag.
+
+    Returns a StorageBackend instance (SQLite or PostgreSQL).
+    Tests that use this fixture run against whichever backend CI selects.
+    """
+    from turnstone.core.storage import init_storage, reset_storage
+
+    backend_type = request.config.getoption("--storage-backend")
+    reset_storage()
+
+    if backend_type == "postgresql":
+        pg_url = os.environ.get(
+            "TURNSTONE_TEST_PG_URL",
+            "postgresql+psycopg://postgres:postgres@localhost:5432/turnstone_test",
+        )
+        backend = init_storage("postgresql", url=pg_url, run_migrations=False)
+        yield backend
+        # Truncate all tables between tests — faster than DELETE and resets
+        # autoincrement sequences.  CASCADE handles any future FK constraints.
+        # NOTE: accesses backend._engine (SQLAlchemy internal) — both SQLite
+        # and PostgreSQL backends expose this.  If a non-SQLAlchemy backend is
+        # ever added, this cleanup will need a protocol-level hook.
+        try:
+            import sqlalchemy as sa
+
+            from turnstone.core.storage._schema import metadata as db_metadata
+
+            with backend._engine.connect() as conn:
+                table_names = ", ".join(t.name for t in reversed(db_metadata.sorted_tables))
+                conn.execute(sa.text(f"TRUNCATE {table_names} RESTART IDENTITY CASCADE"))
+                conn.commit()
+        except Exception:
+            pass  # best-effort cleanup; reset_storage disposes engine
+        finally:
+            reset_storage()
+    else:
+        db_path = str(tmp_path / "test.db")
+        backend = init_storage("sqlite", path=db_path, run_migrations=False)
+        yield backend
+        reset_storage()
+
+
+@pytest.fixture
+def backend(storage_backend):
+    """Alias for storage_backend — used by test_storage_sqlite.py etc."""
+    return storage_backend
+
+
+@pytest.fixture
+def db(storage_backend):
+    """Alias for storage_backend — used by domain-specific storage tests."""
+    return storage_backend
+
+
+@pytest.fixture
+def storage(storage_backend):
+    """Alias for storage_backend — used by services/skill resource tests."""
+    return storage_backend
+
+
 @pytest.fixture
 def mock_openai_client():
     """Return a minimal mock OpenAI client."""

tests/test_api_versioning.py

@@ -19,6 +19,7 @@ class TestServerVersioning:
 
         mock_mgr = MagicMock()
         mock_mgr.list_all.return_value = []
+        mock_mgr.max_workstreams = 10
         app = create_app(
             workstreams=mock_mgr,
             global_queue=queue.Queue(),

tests/test_audit.py

@@ -0,0 +1,58 @@
+"""Tests for turnstone.core.audit."""
+
+import json
+
+import pytest
+
+from turnstone.core.audit import record_audit
+from turnstone.core.storage._sqlite import SQLiteBackend
+
+
+@pytest.fixture
+def storage(tmp_path):
+    path = str(tmp_path / "test.db")
+    backend = SQLiteBackend(path)
+    yield backend
+    backend.close()
+
+
+def test_record_audit_basic(storage):
+    record_audit(
+        storage, "user-1", "user.create", "user", "u123", {"username": "alice"}, "127.0.0.1"
+    )
+    events = storage.list_audit_events()
+    assert len(events) == 1
+    ev = events[0]
+    assert ev["user_id"] == "user-1"
+    assert ev["action"] == "user.create"
+    assert ev["resource_type"] == "user"
+    assert ev["resource_id"] == "u123"
+    assert ev["ip_address"] == "127.0.0.1"
+    detail = json.loads(ev["detail"])
+    assert detail["username"] == "alice"
+
+
+def test_record_audit_no_detail(storage):
+    record_audit(storage, "user-1", "token.revoke", "token", "t456")
+    events = storage.list_audit_events()
+    assert len(events) == 1
+    assert events[0]["detail"] == "{}"
+
+
+def test_record_audit_silent_on_failure():
+    """record_audit should not raise even if storage is broken."""
+
+    class BrokenStorage:
+        def record_audit_event(self, **kw):
+            raise RuntimeError("boom")
+
+    # Should not raise
+    record_audit(BrokenStorage(), "u1", "test.action")
+
+
+def test_record_audit_generates_unique_ids(storage):
+    record_audit(storage, "u1", "a.one")
+    record_audit(storage, "u1", "a.two")
+    events = storage.list_audit_events()
+    assert len(events) == 2
+    assert events[0]["event_id"] != events[1]["event_id"]

tests/test_auth.py

@@ -143,6 +143,61 @@ class TestRequiredScope:
     def test_proxy_v1_read_endpoint_needs_read(self):
         assert required_scope("GET", "/node/node-a/v1/api/workstreams") == "read"
 
+    # Memory endpoints
+    def test_get_memories_needs_read(self):
+        assert required_scope("GET", "/api/memories") == "read"
+
+    def test_post_memories_needs_write(self):
+        assert required_scope("POST", "/api/memories") == "write"
+
+    def test_post_memories_search_needs_read(self):
+        """Search via POST is non-mutating — requires only read scope."""
+        assert required_scope("POST", "/api/memories/search") == "read"
+
+    def test_delete_memory_needs_write(self):
+        assert required_scope("DELETE", "/api/memories/my_key") == "write"
+
+    def test_v1_post_memories_needs_write(self):
+        assert required_scope("POST", "/v1/api/memories") == "write"
+
+    def test_v1_delete_memory_needs_write(self):
+        assert required_scope("DELETE", "/v1/api/memories/test_key") == "write"
+
+    def test_admin_memories_needs_approve(self):
+        assert required_scope("GET", "/api/admin/memories") == "approve"
+
+    def test_admin_memory_delete_needs_approve(self):
+        assert required_scope("DELETE", "/api/admin/memories/some-id") == "approve"
+
+    # Internal endpoints
+    def test_internal_mcp_reload_needs_approve(self):
+        assert required_scope("POST", "/api/_internal/mcp-reload") == "approve"
+
+    def test_v1_internal_mcp_reload_needs_approve(self):
+        assert required_scope("POST", "/v1/api/_internal/mcp-reload") == "approve"
+
+    def test_internal_config_reload_needs_approve(self):
+        assert required_scope("POST", "/api/_internal/config-reload") == "approve"
+
+    def test_v1_internal_config_reload_needs_approve(self):
+        assert required_scope("POST", "/v1/api/_internal/config-reload") == "approve"
+
+    def test_proxy_internal_config_reload_needs_approve(self):
+        assert required_scope("POST", "/node/n1/v1/api/_internal/config-reload") == "approve"
+
+    def test_proxy_no_v1_internal_config_reload_needs_approve(self):
+        assert required_scope("POST", "/node/n1/api/_internal/config-reload") == "approve"
+
+    def test_proxy_internal_mcp_reload_needs_approve(self):
+        assert required_scope("POST", "/node/n1/v1/api/_internal/mcp-reload") == "approve"
+
+    def test_proxy_no_v1_internal_mcp_reload_needs_approve(self):
+        assert required_scope("POST", "/node/n1/api/_internal/mcp-reload") == "approve"
+
+    def test_get_internal_mcp_reload_needs_read(self):
+        """Only POST is elevated — GET falls through to read."""
+        assert required_scope("GET", "/api/_internal/mcp-reload") == "read"
+
 
 # ---------------------------------------------------------------------------
 # TestAuthConfig
@@ -728,6 +783,7 @@ class TestServerAuth:
         mock_ws.session = mock_session
         mock_mgr = MagicMock()
         mock_mgr.list_all.return_value = [mock_ws]
+        mock_mgr.max_workstreams = 10
 
         app = srv_mod.create_app(
             workstreams=mock_mgr,
@@ -946,6 +1002,7 @@ class TestServerLogin:
         mock_ws.session = mock_session
         mock_mgr = MagicMock()
         mock_mgr.list_all.return_value = [mock_ws]
+        mock_mgr.max_workstreams = 10
 
         app = srv_mod.create_app(
             workstreams=mock_mgr,
@@ -1314,8 +1371,11 @@ class TestCorsConfigurable:
 
         import turnstone.server as srv_mod
 
+        mgr = MagicMock()
+        mgr.list_all.return_value = []
+        mgr.max_workstreams = 10
         app = srv_mod.create_app(
-            workstreams=MagicMock(),
+            workstreams=mgr,
             global_queue=queue.Queue(),
             global_listeners=[],
             global_listeners_lock=threading.Lock(),
@@ -1333,8 +1393,11 @@ class TestCorsConfigurable:
 
         import turnstone.server as srv_mod
 
+        mgr = MagicMock()
+        mgr.list_all.return_value = []
+        mgr.max_workstreams = 10
         app = srv_mod.create_app(
-            workstreams=MagicMock(),
+            workstreams=mgr,
             global_queue=queue.Queue(),
             global_listeners=[],
             global_listeners_lock=threading.Lock(),
@@ -1349,3 +1412,49 @@ class TestCorsConfigurable:
         )
         assert resp.headers.get("Access-Control-Allow-Origin") == "http://example.com"
         client.close()
+
+
+# ---------------------------------------------------------------------------
+# TestVerifyPassword — OIDC sentinel handling
+# ---------------------------------------------------------------------------
+
+
+class TestVerifyPassword:
+    def test_valid_bcrypt_hash(self):
+        from turnstone.core.auth import hash_password, verify_password
+
+        hashed = hash_password("mypassword")
+        assert verify_password("mypassword", hashed) is True
+        assert verify_password("wrongpassword", hashed) is False
+
+    def test_oidc_sentinel_rejected(self):
+        from turnstone.core.auth import verify_password
+
+        # OIDC sentinel must return False, not crash with ValueError
+        assert verify_password("anypassword", "!oidc") is False
+
+    def test_non_bcrypt_hash_rejected(self):
+        from turnstone.core.auth import verify_password
+
+        assert verify_password("password", "not_a_hash") is False
+        assert verify_password("password", "") is False
+
+    def test_empty_password_against_oidc_sentinel(self):
+        from turnstone.core.auth import verify_password
+
+        assert verify_password("", "!oidc") is False
+
+
+# ---------------------------------------------------------------------------
+# TestOIDCPublicPaths — OIDC endpoints are public
+# ---------------------------------------------------------------------------
+
+
+class TestOIDCPublicPaths:
+    def test_oidc_authorize_is_public(self):
+        assert is_public_path("/api/auth/oidc/authorize") is True
+        assert is_public_path("/v1/api/auth/oidc/authorize") is True
+
+    def test_oidc_callback_is_public(self):
+        assert is_public_path("/api/auth/oidc/callback") is True
+        assert is_public_path("/v1/api/auth/oidc/callback") is True

tests/test_auth_identity.py

@@ -130,7 +130,7 @@ class TestParseScopes:
 
 
 class TestJWT:
-    SECRET = "test-secret-key-for-jwt"
+    SECRET = "test-secret-key-for-jwt-min-32b!"
 
     def test_round_trip(self):
         scopes = frozenset({"read", "write"})
@@ -155,7 +155,7 @@ class TestJWT:
 
     def test_invalid_signature(self):
         token = create_jwt("user1", frozenset({"read"}), "db", self.SECRET)
-        assert validate_jwt(token, "wrong-secret") is None
+        assert validate_jwt(token, "wrong-secret-key-for-jwt-min-32b") is None
 
     def test_malformed_token(self):
         assert validate_jwt("not.a.jwt", self.SECRET) is None
@@ -217,7 +217,7 @@ class TestAuthenticateToken:
         assert result.scopes == frozenset({"read", "write", "approve"})
 
     def test_jwt_token(self):
-        secret = "test-secret"
+        secret = "test-secret-key-for-jwt-min-32b!"
         jwt_tok = create_jwt("user1", frozenset({"read", "write"}), "db", secret)
         cfg = AuthConfig(enabled=True)
         result = _authenticate_token(jwt_tok, cfg, jwt_secret=secret)
@@ -304,7 +304,7 @@ class TestCheckRequestScopes:
         assert result.has_scope("approve")
 
     def test_jwt_with_scopes(self):
-        secret = "test"
+        secret = "test-secret-key-for-jwt-min-32b!"
         jwt_tok = create_jwt("u1", frozenset({"read", "write"}), "db", secret)
         cfg = AuthConfig(enabled=True)
         allowed, status, msg, result = check_request(
@@ -319,7 +319,7 @@ class TestCheckRequestScopes:
         assert result.user_id == "u1"
 
     def test_jwt_insufficient_scope(self):
-        secret = "test"
+        secret = "test-secret-key-for-jwt-min-32b!"
         jwt_tok = create_jwt("u1", frozenset({"read"}), "db", secret)
         cfg = AuthConfig(enabled=True)
         allowed, status, msg, _ = check_request(

tests/test_bm25.py

@@ -0,0 +1,71 @@
+"""Tests for turnstone.core.bm25 — tokenizer and BM25 index."""
+
+from turnstone.core.bm25 import BM25Index, _tokenize
+
+
+class TestTokenize:
+    def test_simple_words(self):
+        assert _tokenize("hello world") == ["hello", "world"]
+
+    def test_underscores(self):
+        assert _tokenize("read_file") == ["read", "file"]
+
+    def test_hyphens(self):
+        assert _tokenize("web-search") == ["web", "search"]
+
+    def test_dots(self):
+        assert _tokenize("foo.bar.baz") == ["foo", "bar", "baz"]
+
+    def test_mixed_separators(self):
+        assert _tokenize("mcp__server__read_file") == ["mcp", "server", "read", "file"]
+
+    def test_empty_string(self):
+        assert _tokenize("") == []
+
+    def test_case_folding(self):
+        assert _tokenize("Hello World") == ["hello", "world"]
+
+
+class TestBM25Index:
+    def test_search_returns_relevant(self):
+        docs = ["read a file from disk", "search for file in directory", "execute a bash command"]
+        index = BM25Index(docs)
+        results = index.search("file", k=2)
+        assert 0 in results
+        assert 1 in results
+
+    def test_search_empty_query(self):
+        docs = ["hello world"]
+        index = BM25Index(docs)
+        assert index.search("") == []
+
+    def test_search_no_match(self):
+        docs = ["hello world", "foo bar"]
+        index = BM25Index(docs)
+        assert index.search("zzzznotfound") == []
+
+    def test_search_respects_k(self):
+        docs = [f"document {i} with common word" for i in range(20)]
+        index = BM25Index(docs)
+        results = index.search("common", k=3)
+        assert len(results) <= 3
+
+    def test_empty_corpus(self):
+        index = BM25Index([])
+        assert index.search("anything") == []
+
+    def test_single_document(self):
+        index = BM25Index(["the only document about turnstone"])
+        results = index.search("turnstone")
+        assert results == [0]
+
+    def test_ordering_by_relevance(self):
+        docs = [
+            "unrelated content about cooking recipes",
+            "python programming with file operations",
+            "read file write file file operations disk io",
+        ]
+        index = BM25Index(docs)
+        results = index.search("file operations", k=3)
+        # Doc 2 has more file/operations mentions, should rank higher
+        assert results[0] == 2

tests/test_bootstrap.py

@@ -0,0 +1,630 @@
+"""Tests for the bootstrap wizard module."""
+
+from __future__ import annotations
+
+import os
+import socket
+from pathlib import Path
+from unittest.mock import MagicMock, patch
+
+from turnstone.bootstrap import (
+    SYSTEM_PROMPT,
+    TOOLS,
+    _BootstrapLLM,
+    _FinishError,
+    _mask_secrets,
+    _tool_check_docker,
+    _tool_check_port,
+    _tool_finish,
+    _tool_generate_secret,
+    _tool_read_file,
+    _tool_validate_api_key,
+    _tool_write_file,
+    execute_tool,
+)
+
+# ---------------------------------------------------------------------------
+# Tool function tests
+# ---------------------------------------------------------------------------
+
+
+class TestReadFile:
+    def test_existing_file(self, tmp_path: Path) -> None:
+        f = tmp_path / "test.txt"
+        f.write_text("hello world")
+        result = _tool_read_file(tmp_path, {"path": "test.txt"})
+        assert result == "hello world"
+
+    def test_missing_file(self, tmp_path: Path) -> None:
+        result = _tool_read_file(tmp_path, {"path": "nope.txt"})
+        assert "Error: file not found" in result
+
+    def test_nested_path(self, tmp_path: Path) -> None:
+        sub = tmp_path / "sub"
+        sub.mkdir()
+        f = sub / "nested.txt"
+        f.write_text("nested content")
+        result = _tool_read_file(tmp_path, {"path": "sub/nested.txt"})
+        assert result == "nested content"
+
+    def test_path_traversal_blocked(self, tmp_path: Path) -> None:
+        result = _tool_read_file(tmp_path, {"path": "../../etc/passwd"})
+        assert "escapes project directory" in result
+
+    def test_absolute_path_blocked(self, tmp_path: Path) -> None:
+        result = _tool_read_file(tmp_path, {"path": "/etc/passwd"})
+        assert "escapes project directory" in result
+
+
+class TestWriteFile:
+    def test_write_confirmed(self, tmp_path: Path) -> None:
+        with patch("builtins.input", return_value="y"):
+            result = _tool_write_file(tmp_path, {"path": "out.txt", "content": "data\n"})
+        assert "written successfully" in result
+        assert (tmp_path / "out.txt").read_text() == "data\n"
+
+    def test_write_declined(self, tmp_path: Path) -> None:
+        with patch("builtins.input", return_value="n"):
+            result = _tool_write_file(tmp_path, {"path": "out.txt", "content": "data\n"})
+        assert "declined" in result
+        assert not (tmp_path / "out.txt").exists()
+
+    def test_write_creates_parent_dirs(self, tmp_path: Path) -> None:
+        with patch("builtins.input", return_value="y"):
+            result = _tool_write_file(tmp_path, {"path": "a/b/c.txt", "content": "deep\n"})
+        assert "written successfully" in result
+        assert (tmp_path / "a" / "b" / "c.txt").read_text() == "deep\n"
+
+    def test_sh_files_are_executable(self, tmp_path: Path) -> None:
+        with patch("builtins.input", return_value="y"):
+            _tool_write_file(tmp_path, {"path": "setup.sh", "content": "#!/bin/bash\n"})
+        mode = (tmp_path / "setup.sh").stat().st_mode
+        assert mode & 0o110  # user + group executable, not world
+
+    def test_path_traversal_blocked(self, tmp_path: Path) -> None:
+        result = _tool_write_file(tmp_path, {"path": "../../escape.txt", "content": "bad\n"})
+        assert "escapes project directory" in result
+
+    def test_default_enter_confirms(self, tmp_path: Path) -> None:
+        with patch("builtins.input", return_value=""):
+            result = _tool_write_file(tmp_path, {"path": "ok.txt", "content": "ok\n"})
+        assert "written successfully" in result
+
+    def test_duplicate_write_skipped(self, tmp_path: Path) -> None:
+        (tmp_path / "dup.txt").write_text("same\n")
+        result = _tool_write_file(tmp_path, {"path": "dup.txt", "content": "same\n"})
+        assert "already exists" in result
+
+    def test_different_content_still_prompts(self, tmp_path: Path) -> None:
+        (tmp_path / "changed.txt").write_text("old\n")
+        with patch("builtins.input", return_value="y"):
+            result = _tool_write_file(tmp_path, {"path": "changed.txt", "content": "new\n"})
+        assert "written successfully" in result
+        assert (tmp_path / "changed.txt").read_text() == "new\n"
+
+
+class TestGenerateSecret:
+    def test_default_length(self) -> None:
+        secret = _tool_generate_secret({})
+        assert len(secret) == 64  # 32 bytes -> 64 hex chars
+
+    def test_custom_length(self) -> None:
+        secret = _tool_generate_secret({"length": 16})
+        assert len(secret) == 32
+
+    def test_uniqueness(self) -> None:
+        s1 = _tool_generate_secret({})
+        s2 = _tool_generate_secret({})
+        assert s1 != s2
+
+    def test_invalid_length_fallback(self) -> None:
+        secret = _tool_generate_secret({"length": -1})
+        assert len(secret) == 64  # falls back to 32 bytes
+
+    def test_excessive_length_capped(self) -> None:
+        secret = _tool_generate_secret({"length": 99999})
+        assert len(secret) == 64  # falls back to 32 bytes
+
+
+class TestCheckPort:
+    def test_available_port(self) -> None:
+        # Pick a random high port that's likely free
+        result = _tool_check_port({"port": 59123})
+        assert "AVAILABLE" in result or "IN USE" in result
+
+    def test_in_use_port(self) -> None:
+        with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock:
+            sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+            sock.bind(("127.0.0.1", 0))
+            port = sock.getsockname()[1]
+            sock.listen(1)
+            result = _tool_check_port({"port": port})
+        assert "IN USE" in result
+
+    def test_invalid_port(self) -> None:
+        result = _tool_check_port({"port": -1})
+        assert "Error" in result
+
+    def test_port_zero(self) -> None:
+        result = _tool_check_port({"port": 0})
+        assert "Error" in result
+
+
+class TestCheckDocker:
+    def test_docker_installed(self) -> None:
+        mock_docker = MagicMock()
+        mock_docker.returncode = 0
+        mock_docker.stdout = "24.0.7"
+
+        mock_compose = MagicMock()
+        mock_compose.returncode = 0
+        mock_compose.stdout = "2.24.5"
+
+        with patch("subprocess.run", side_effect=[mock_docker, mock_compose]):
+            result = _tool_check_docker({})
+        assert "Docker: installed" in result
+        assert "Docker Compose: installed" in result
+
+    def test_docker_not_installed(self) -> None:
+        with patch("subprocess.run", side_effect=FileNotFoundError):
+            result = _tool_check_docker({})
+        assert "NOT installed" in result or "NOT available" in result
+
+    def test_docker_daemon_not_running(self) -> None:
+        mock_docker = MagicMock()
+        mock_docker.returncode = 1
+        mock_docker.stderr = "Cannot connect to the Docker daemon"
+
+        mock_compose = MagicMock()
+        mock_compose.returncode = 1
+
+        with patch("subprocess.run", side_effect=[mock_docker, mock_compose]):
+            result = _tool_check_docker({})
+        assert "NOT running" in result
+
+
+class TestValidateApiKey:
+    def test_openai_success(self) -> None:
+        mock_client = MagicMock()
+        mock_client.models.list.return_value = []
+        with patch("openai.OpenAI", return_value=mock_client):
+            result = _tool_validate_api_key({"provider": "openai", "api_key": "sk-test"})
+        assert "Success" in result
+
+    def test_openai_failure(self) -> None:
+        with patch("openai.OpenAI") as mock_cls:
+            mock_cls.return_value.models.list.side_effect = Exception("Invalid key")
+            result = _tool_validate_api_key({"provider": "openai", "api_key": "bad"})
+        assert "Failed" in result
+
+    def test_unknown_provider(self) -> None:
+        result = _tool_validate_api_key({"provider": "unknown", "api_key": "x"})
+        assert "unknown" in result
+
+
+class TestExecuteTool:
+    def test_unknown_tool(self, tmp_path: Path) -> None:
+        result = execute_tool("nonexistent", {}, tmp_path)
+        assert "unknown tool" in result
+
+    def test_dispatches_correctly(self, tmp_path: Path) -> None:
+        f = tmp_path / "hello.txt"
+        f.write_text("hi")
+        result = execute_tool("read_file", {"path": "hello.txt"}, tmp_path)
+        assert result == "hi"
+
+    def test_finish_raises(self, tmp_path: Path) -> None:
+        import pytest
+
+        with pytest.raises(_FinishError, match="All done"):
+            execute_tool("finish", {"summary": "All done"}, tmp_path)
+
+
+class TestFinishTool:
+    def test_raises_with_summary(self) -> None:
+        import pytest
+
+        with pytest.raises(_FinishError) as exc_info:
+            _tool_finish({"summary": "Configured production deployment."})
+        assert exc_info.value.summary == "Configured production deployment."
+
+    def test_default_summary(self) -> None:
+        import pytest
+
+        with pytest.raises(_FinishError) as exc_info:
+            _tool_finish({})
+        assert exc_info.value.summary == "Setup complete."
+
+
+# ---------------------------------------------------------------------------
+# Secret masking tests
+# ---------------------------------------------------------------------------
+
+
+class TestMaskSecrets:
+    def test_masks_api_key(self) -> None:
+        text = "OPENAI_API_KEY=sk-1234567890abcdef"
+        result = _mask_secrets(text)
+        assert "sk-1" in result
+        assert "cdef" in result
+        assert "1234567890abcde" not in result
+
+    def test_preserves_comments(self) -> None:
+        text = "# OPENAI_API_KEY=sk-1234567890abcdef"
+        result = _mask_secrets(text)
+        assert result == text
+
+    def test_preserves_short_values(self) -> None:
+        text = "TOKEN=short"
+        result = _mask_secrets(text)
+        assert result == text
+
+    def test_preserves_non_sensitive(self) -> None:
+        text = "MODEL=gpt-5.4"
+        result = _mask_secrets(text)
+        assert result == text
+
+
+# ---------------------------------------------------------------------------
+# Message conversion tests (Anthropic)
+# ---------------------------------------------------------------------------
+
+
+class TestAnthropicConversion:
+    """Test the Anthropic message/tool conversion inside _BootstrapLLM."""
+
+    def _make_llm(self) -> _BootstrapLLM:
+        return _BootstrapLLM("anthropic", MagicMock(), "test-model")
+
+    def test_tool_format_conversion(self) -> None:
+        """OpenAI tool format should convert to Anthropic format."""
+        llm = self._make_llm()
+        # The conversion happens inside _complete_anthropic; we test indirectly
+        # by checking the tools passed to the mock client
+        mock_response = MagicMock()
+        mock_response.content = [MagicMock(type="text", text="hello")]
+        mock_response.stop_reason = "end_turn"
+        llm.client.messages.create.return_value = mock_response
+
+        llm.complete(
+            [{"role": "system", "content": "sys"}, {"role": "user", "content": "hi"}],
+            TOOLS[:1],  # Just read_file
+        )
+
+        call_kwargs = llm.client.messages.create.call_args[1]
+        api_tools = call_kwargs["tools"]
+        assert len(api_tools) == 1
+        assert api_tools[0]["name"] == "read_file"
+        assert "input_schema" in api_tools[0]
+        assert "description" in api_tools[0]
+
+    def test_system_message_extraction(self) -> None:
+        """System message should be extracted to system parameter."""
+        llm = self._make_llm()
+        mock_response = MagicMock()
+        mock_response.content = [MagicMock(type="text", text="ok")]
+        mock_response.stop_reason = "end_turn"
+        llm.client.messages.create.return_value = mock_response
+
+        llm.complete(
+            [{"role": "system", "content": "test system"}, {"role": "user", "content": "hi"}],
+            [],
+        )
+
+        call_kwargs = llm.client.messages.create.call_args[1]
+        assert call_kwargs["system"] == "test system"
+        # System should NOT appear in messages
+        for msg in call_kwargs["messages"]:
+            assert msg["role"] != "system"
+
+    def test_tool_result_conversion(self) -> None:
+        """OpenAI tool result messages should convert to Anthropic format."""
+        llm = self._make_llm()
+        mock_response = MagicMock()
+        mock_response.content = [MagicMock(type="text", text="got it")]
+        mock_response.stop_reason = "end_turn"
+        llm.client.messages.create.return_value = mock_response
+
+        messages = [
+            {"role": "system", "content": "sys"},
+            {"role": "user", "content": "hi"},
+            {
+                "role": "assistant",
+                "content": "",
+                "tool_calls": [
+                    {
+                        "id": "tc_1",
+                        "type": "function",
+                        "function": {"name": "check_docker", "arguments": "{}"},
+                    }
+                ],
+            },
+            {
+                "role": "tool",
+                "tool_call_id": "tc_1",
+                "content": "Docker: installed",
+            },
+        ]
+        llm.complete(messages, TOOLS)
+
+        call_kwargs = llm.client.messages.create.call_args[1]
+        api_messages = call_kwargs["messages"]
+
+        # Find the tool_result message
+        tool_result_found = False
+        for msg in api_messages:
+            if msg["role"] == "user" and isinstance(msg.get("content"), list):
+                for block in msg["content"]:
+                    if isinstance(block, dict) and block.get("type") == "tool_result":
+                        assert block["tool_use_id"] == "tc_1"
+                        assert block["content"] == "Docker: installed"
+                        tool_result_found = True
+        assert tool_result_found
+
+    def test_tool_use_blocks_in_assistant(self) -> None:
+        """Assistant messages with tool_calls should convert to content blocks."""
+        llm = self._make_llm()
+        mock_response = MagicMock()
+        mock_response.content = [MagicMock(type="text", text="ok")]
+        mock_response.stop_reason = "end_turn"
+        llm.client.messages.create.return_value = mock_response
+
+        messages = [
+            {"role": "system", "content": "sys"},
+            {"role": "user", "content": "hi"},
+            {
+                "role": "assistant",
+                "content": "Let me check",
+                "tool_calls": [
+                    {
+                        "id": "tc_1",
+                        "type": "function",
+                        "function": {"name": "check_docker", "arguments": "{}"},
+                    }
+                ],
+            },
+            {"role": "tool", "tool_call_id": "tc_1", "content": "ok"},
+        ]
+        llm.complete(messages, TOOLS)
+
+        call_kwargs = llm.client.messages.create.call_args[1]
+        api_messages = call_kwargs["messages"]
+
+        # First message should be user "hi"
+        assert api_messages[0]["role"] == "user"
+        # Second should be assistant with content blocks
+        assistant_msg = api_messages[1]
+        assert assistant_msg["role"] == "assistant"
+        assert isinstance(assistant_msg["content"], list)
+        # Should have text block + tool_use block
+        types = [b["type"] for b in assistant_msg["content"]]
+        assert "text" in types
+        assert "tool_use" in types
+
+
+class TestOpenAICompletion:
+    """Test the OpenAI path of _BootstrapLLM."""
+
+    def test_text_response(self) -> None:
+        llm = _BootstrapLLM("openai", MagicMock(), "gpt-5.4")
+        mock_choice = MagicMock()
+        mock_choice.message.content = "Hello!"
+        mock_choice.message.tool_calls = None
+        mock_choice.finish_reason = "stop"
+        llm.client.chat.completions.create.return_value = MagicMock(choices=[mock_choice])
+
+        content, tool_calls, reason = llm.complete([{"role": "user", "content": "hi"}], TOOLS)
+        assert content == "Hello!"
+        assert tool_calls is None
+        assert reason == "stop"
+
+    def test_tool_call_response(self) -> None:
+        llm = _BootstrapLLM("openai", MagicMock(), "gpt-5.4")
+
+        mock_tc = MagicMock()
+        mock_tc.id = "call_123"
+        mock_tc.function.name = "check_docker"
+        mock_tc.function.arguments = "{}"
+
+        mock_choice = MagicMock()
+        mock_choice.message.content = ""
+        mock_choice.message.tool_calls = [mock_tc]
+        mock_choice.finish_reason = "tool_calls"
+        llm.client.chat.completions.create.return_value = MagicMock(choices=[mock_choice])
+
+        content, tool_calls, reason = llm.complete(
+            [{"role": "user", "content": "check docker"}], TOOLS
+        )
+        assert tool_calls is not None
+        assert len(tool_calls) == 1
+        assert tool_calls[0]["function"]["name"] == "check_docker"
+        assert tool_calls[0]["id"] == "call_123"
+
+    def test_no_content(self) -> None:
+        llm = _BootstrapLLM("openai", MagicMock(), "gpt-5.4")
+        mock_choice = MagicMock()
+        mock_choice.message.content = None
+        mock_choice.message.tool_calls = None
+        mock_choice.finish_reason = "stop"
+        llm.client.chat.completions.create.return_value = MagicMock(choices=[mock_choice])
+
+        content, tool_calls, reason = llm.complete([{"role": "user", "content": "hi"}], [])
+        assert content == ""
+        assert tool_calls is None
+
+
+# ---------------------------------------------------------------------------
+# Conversation loop tests
+# ---------------------------------------------------------------------------
+
+
+class TestConversationLoop:
+    def test_quit_exits(self) -> None:
+        """User typing 'quit' should exit the loop."""
+        llm = MagicMock(spec=_BootstrapLLM)
+        llm.complete.return_value = ("What would you like?", None, "stop")
+
+        with patch("builtins.input", return_value="quit"):
+            from turnstone.bootstrap import _run_conversation
+
+            _run_conversation(llm, Path("/tmp"))
+
+    def test_tool_calls_executed(self, tmp_path: Path) -> None:
+        """Tool calls should be executed and results fed back."""
+        llm = MagicMock(spec=_BootstrapLLM)
+        # First call: LLM returns a tool call
+        llm.complete.side_effect = [
+            (
+                "",
+                [
+                    {
+                        "id": "tc_1",
+                        "type": "function",
+                        "function": {"name": "generate_secret", "arguments": "{}"},
+                    }
+                ],
+                "tool_calls",
+            ),
+            # Second call: LLM responds with text after seeing tool result
+            ("Here's your secret!", None, "stop"),
+        ]
+
+        with patch("builtins.input", return_value="quit"):
+            from turnstone.bootstrap import _run_conversation
+
+            _run_conversation(llm, tmp_path)
+
+        # Verify two calls were made
+        assert llm.complete.call_count == 2
+        # Verify tool result was fed back in second call's messages
+        second_call_messages = llm.complete.call_args_list[1][0][0]
+        tool_results = [m for m in second_call_messages if m.get("role") == "tool"]
+        assert len(tool_results) == 1
+        assert tool_results[0]["tool_call_id"] == "tc_1"
+        # Result should be a 64-char hex string
+        assert len(tool_results[0]["content"]) == 64
+
+    def test_empty_input_skipped(self) -> None:
+        """Empty user input should be skipped."""
+        llm = MagicMock(spec=_BootstrapLLM)
+        llm.complete.return_value = ("Ask me something.", None, "stop")
+
+        call_count = 0
+
+        def mock_input(prompt: str = "") -> str:
+            nonlocal call_count
+            call_count += 1
+            if call_count <= 2:
+                return ""  # Empty inputs
+            return "quit"
+
+        with patch("builtins.input", side_effect=mock_input):
+            from turnstone.bootstrap import _run_conversation
+
+            _run_conversation(llm, Path("/tmp"))
+
+    def test_finish_tool_exits_loop(self, tmp_path: Path) -> None:
+        """LLM calling finish tool should exit the conversation cleanly."""
+        llm = MagicMock(spec=_BootstrapLLM)
+        llm.complete.return_value = (
+            "",
+            [
+                {
+                    "id": "tc_fin",
+                    "type": "function",
+                    "function": {
+                        "name": "finish",
+                        "arguments": '{"summary": "All configured."}',
+                    },
+                }
+            ],
+            "tool_calls",
+        )
+
+        from turnstone.bootstrap import _run_conversation
+
+        # Should return without needing user input
+        _run_conversation(llm, tmp_path)
+        assert llm.complete.call_count == 1
+
+
+# ---------------------------------------------------------------------------
+# Interactive startup tests
+# ---------------------------------------------------------------------------
+
+
+class TestProviderDefaults:
+    def test_openai_default_model(self) -> None:
+        from turnstone.bootstrap import _DEFAULT_MODELS
+
+        assert _DEFAULT_MODELS["openai"] == "gpt-5.4"
+
+    def test_anthropic_default_model(self) -> None:
+        from turnstone.bootstrap import _DEFAULT_MODELS
+
+        assert _DEFAULT_MODELS["anthropic"] == "claude-sonnet-4-6"
+
+
+class TestSelectProvider:
+    def test_openai_selection(self) -> None:
+        """Selecting '1' should set up OpenAI."""
+        mock_client = MagicMock()
+        with (
+            patch("builtins.input", side_effect=["1", ""]),
+            patch("getpass.getpass", return_value="sk-test"),
+            patch("openai.OpenAI", return_value=mock_client),
+        ):
+            from turnstone.bootstrap import _select_provider
+
+            provider, client, model = _select_provider()
+        assert provider == "openai"
+        assert model == "gpt-5.4"
+
+    def test_local_selection(self) -> None:
+        """Selecting '3' should set up local/vLLM."""
+        mock_client = MagicMock()
+        # Ensure OPENAI_API_KEY is not in env so we hit the getpass path
+        env = {k: v for k, v in os.environ.items() if k != "OPENAI_API_KEY"}
+        with (
+            patch.dict("os.environ", env, clear=True),
+            patch("builtins.input", side_effect=["3", "http://localhost:8000/v1", "my-model"]),
+            patch("getpass.getpass", return_value="none"),
+            patch("openai.OpenAI", return_value=mock_client),
+        ):
+            from turnstone.bootstrap import _select_provider
+
+            provider, client, model = _select_provider()
+        assert provider == "openai"
+        assert model == "my-model"
+
+
+# ---------------------------------------------------------------------------
+# System prompt and tools sanity checks
+# ---------------------------------------------------------------------------
+
+
+class TestConstants:
+    def test_system_prompt_not_empty(self) -> None:
+        assert len(SYSTEM_PROMPT) > 500
+
+    def test_system_prompt_mentions_turnstone(self) -> None:
+        assert "Turnstone" in SYSTEM_PROMPT
+
+    def test_all_tools_have_required_fields(self) -> None:
+        for tool in TOOLS:
+            assert tool["type"] == "function"
+            func = tool["function"]
+            assert "name" in func
+            assert "description" in func
+            assert "parameters" in func
+            assert func["parameters"]["type"] == "object"
+
+    def test_tool_count(self) -> None:
+        assert len(TOOLS) == 7
+
+    def test_all_tools_have_implementations(self) -> None:
+        from turnstone.bootstrap import TOOL_FUNCTIONS
+
+        for tool in TOOLS:
+            name = tool["function"]["name"]
+            assert name in TOOL_FUNCTIONS, f"Missing implementation for tool: {name}"

tests/test_bridge_events.py

@@ -0,0 +1,120 @@
+"""Tests for bridge event publishing — TurnCompleteEvent on idle transitions."""
+
+from unittest.mock import MagicMock, patch
+
+from turnstone.mq.bridge import Bridge
+from turnstone.mq.protocol import ContentEvent, StateChangeEvent, TurnCompleteEvent
+
+
+def _make_bridge():
+    """Create a Bridge with a mock broker (no Redis or HTTP needed)."""
+    broker = MagicMock()
+    bridge = Bridge(server_url="http://localhost:8080", broker=broker, node_id="test-node")
+    return bridge
+
+
+class TestIdleTurnComplete:
+    """TurnCompleteEvent should be emitted on every idle transition."""
+
+    def test_idle_emits_turn_complete_with_correlation_id(self):
+        """Bridge-initiated turn: TurnCompleteEvent has the correlation_id."""
+        bridge = _make_bridge()
+        bridge._active_sends["ws-1"] = "cid-abc"
+
+        published = []
+        with patch.object(
+            bridge, "_publish_ws", side_effect=lambda ws, ev: published.append((ws, ev))
+        ):
+            bridge._handle_global_event({"type": "ws_state", "ws_id": "ws-1", "state": "idle"})
+
+        turn_completes = [(ws, ev) for ws, ev in published if isinstance(ev, TurnCompleteEvent)]
+        assert len(turn_completes) == 1
+        ws, ev = turn_completes[0]
+        assert ws == "ws-1"
+        assert ev.correlation_id == "cid-abc"
+        # correlation_id should be removed from _active_sends
+        assert "ws-1" not in bridge._active_sends
+
+    def test_idle_emits_turn_complete_without_correlation_id(self):
+        """Server-UI-initiated turn: TurnCompleteEvent has empty correlation_id."""
+        bridge = _make_bridge()
+        # No entry in _active_sends for this workstream
+
+        published = []
+        with patch.object(
+            bridge, "_publish_ws", side_effect=lambda ws, ev: published.append((ws, ev))
+        ):
+            bridge._handle_global_event({"type": "ws_state", "ws_id": "ws-2", "state": "idle"})
+
+        turn_completes = [(ws, ev) for ws, ev in published if isinstance(ev, TurnCompleteEvent)]
+        assert len(turn_completes) == 1
+        ws, ev = turn_completes[0]
+        assert ws == "ws-2"
+        assert ev.correlation_id == ""
+
+    def test_non_idle_state_does_not_emit_turn_complete(self):
+        """Non-idle state transitions should emit StateChangeEvent but not TurnCompleteEvent."""
+        bridge = _make_bridge()
+
+        published = []
+        with patch.object(
+            bridge, "_publish_ws", side_effect=lambda ws, ev: published.append((ws, ev))
+        ):
+            bridge._handle_global_event({"type": "ws_state", "ws_id": "ws-3", "state": "thinking"})
+
+        state_changes = [ev for _, ev in published if isinstance(ev, StateChangeEvent)]
+        turn_completes = [ev for _, ev in published if isinstance(ev, TurnCompleteEvent)]
+        assert len(state_changes) == 1
+        assert state_changes[0].state == "thinking"
+        assert len(turn_completes) == 0
+
+
+class TestContentPassthrough:
+    """Bridge should pass through content from the server's idle SSE event."""
+
+    def test_content_passed_through_in_turn_complete(self):
+        """Content from idle event should be included in TurnCompleteEvent."""
+        bridge = _make_bridge()
+
+        published = []
+        with patch.object(
+            bridge, "_publish_ws", side_effect=lambda ws, ev: published.append((ws, ev))
+        ):
+            bridge._handle_global_event(
+                {"type": "ws_state", "ws_id": "ws-1", "state": "idle", "content": "Hello world"}
+            )
+
+        turn_completes = [(ws, ev) for ws, ev in published if isinstance(ev, TurnCompleteEvent)]
+        assert len(turn_completes) == 1
+        _, ev = turn_completes[0]
+        assert ev.content == "Hello world"
+
+    def test_content_empty_when_not_in_event(self):
+        """TurnCompleteEvent.content should be empty when idle event has no content."""
+        bridge = _make_bridge()
+
+        published = []
+        with patch.object(
+            bridge, "_publish_ws", side_effect=lambda ws, ev: published.append((ws, ev))
+        ):
+            bridge._handle_global_event({"type": "ws_state", "ws_id": "ws-1", "state": "idle"})
+
+        turn_completes = [(ws, ev) for ws, ev in published if isinstance(ev, TurnCompleteEvent)]
+        assert len(turn_completes) == 1
+        _, ev = turn_completes[0]
+        assert ev.content == ""
+
+    def test_content_event_still_published(self):
+        """Content events should still be published to per-ws channel."""
+        bridge = _make_bridge()
+
+        published = []
+        with patch.object(
+            bridge, "_publish_ws", side_effect=lambda ws, ev: published.append((ws, ev))
+        ):
+            bridge._handle_ws_event("ws-1", {"type": "content", "text": "hello"})
+
+        content_events = [(ws, ev) for ws, ev in published if isinstance(ev, ContentEvent)]
+        assert len(content_events) == 1
+        _, ev = content_events[0]
+        assert ev.text == "hello"

tests/test_bridge_stress.py

@@ -0,0 +1,351 @@
+"""Stress tests for bridge.py threading — race conditions in approval,
+plan review, and workstream lifecycle.
+
+Each scenario is run many times (ITERATIONS) with threading.Barrier to
+maximize timing overlap.  Uses mock broker (no Redis) and no HTTP calls.
+
+Races tested:
+1. Duplicate approval on SSE reconnect (TOCTOU in _pending_approvals)
+2. Duplicate plan review on SSE reconnect (TOCTOU in _pending_plan_reviews)
+3. approve_set stale reference escape during concurrent update
+4. _running flag visibility across threads on shutdown
+5. Approval thread exits within bounded time after timeout
+6. Concurrent approval + workstream close leaves no orphaned state
+"""
+
+from __future__ import annotations
+
+import threading
+import time
+from collections import Counter
+from unittest.mock import MagicMock, patch
+
+from turnstone.mq.bridge import Bridge
+
+ITERATIONS = 100
+
+# ---------------------------------------------------------------------------
+# Helpers
+# ---------------------------------------------------------------------------
+
+
+def _make_bridge(**overrides) -> Bridge:
+    """Create a Bridge with a mock broker (no Redis or HTTP)."""
+    broker = MagicMock()
+    defaults = dict(
+        server_url="http://localhost:8080",
+        broker=broker,
+        node_id="test-node",
+        approval_timeout=1,
+    )
+    defaults.update(overrides)
+    return Bridge(**defaults)
+
+
+def _approval_items(tool_name: str = "bash") -> list[dict]:
+    return [{"func_name": tool_name, "needs_approval": True, "approval_label": tool_name}]
+
+
+def _wait_pending_resolved(bridge: Bridge, key: str, attr: str, deadline_s: float = 3.0) -> bool:
+    """Poll until the pending entry is resolved (tombstone) or absent."""
+    deadline = time.monotonic() + deadline_s
+    while time.monotonic() < deadline:
+        with bridge._lock:
+            entries = getattr(bridge, attr)
+            if key not in entries:
+                return True
+            _, resolved_at = entries[key]
+            if resolved_at > 0:
+                return True
+        time.sleep(0.01)
+    return False
+
+
+# ---------------------------------------------------------------------------
+# Race 1: Duplicate approval on SSE reconnect
+# ---------------------------------------------------------------------------
+
+
+class TestDuplicateApproval:
+    """Two threads call _handle_approval for the same ws_id simultaneously.
+    Only one should create a pending entry; the other should be skipped."""
+
+    def test_no_duplicate_approvals(self):
+        sent_count = Counter()
+
+        for _ in range(ITERATIONS):
+            bridge = _make_bridge()
+            bridge._broker.pop_response.return_value = '{"type": "approve", "approved": true}'
+            barrier = threading.Barrier(2, timeout=5)
+
+            def _call_approval(bridge=bridge, barrier=barrier):
+                barrier.wait()
+                bridge._handle_approval("ws-1", {"items": _approval_items()})
+
+            t1 = threading.Thread(target=_call_approval)
+            t2 = threading.Thread(target=_call_approval)
+            with (
+                patch.object(bridge, "_api_approve") as mock_approve,
+                patch.object(bridge, "_publish_ws"),
+            ):
+                t1.start()
+                t2.start()
+                t1.join(timeout=5)
+                t2.join(timeout=5)
+                assert not t1.is_alive(), "Thread 1 hung"
+                assert not t2.is_alive(), "Thread 2 hung"
+
+                # Wait for spawned _wait_approval threads to resolve
+                _wait_pending_resolved(bridge, "ws-1", "_pending_approvals")
+
+                sent_count[mock_approve.call_count] += 1
+
+        # At most 1 approval should be forwarded per iteration
+        assert sent_count.get(2, 0) == 0, (
+            f"Duplicate approvals sent in {sent_count[2]}/{ITERATIONS} iterations"
+        )
+
+
+# ---------------------------------------------------------------------------
+# Race 2: Duplicate plan review on SSE reconnect
+# ---------------------------------------------------------------------------
+
+
+class TestDuplicatePlanReview:
+    """Two threads call _handle_plan_review simultaneously.
+    Only one should create a pending entry."""
+
+    def test_no_duplicate_plan_reviews(self):
+        sent_count = Counter()
+
+        for _ in range(ITERATIONS):
+            bridge = _make_bridge()
+            bridge._broker.pop_response.return_value = (
+                '{"type": "plan_feedback", "feedback": "looks good"}'
+            )
+            barrier = threading.Barrier(2, timeout=5)
+
+            def _call_plan(bridge=bridge, barrier=barrier):
+                barrier.wait()
+                bridge._handle_plan_review("ws-1", {"content": "plan text"})
+
+            t1 = threading.Thread(target=_call_plan)
+            t2 = threading.Thread(target=_call_plan)
+            with patch.object(bridge, "_publish_ws"), patch.object(bridge._http, "post"):
+                t1.start()
+                t2.start()
+                t1.join(timeout=5)
+                t2.join(timeout=5)
+                assert not t1.is_alive(), "Thread 1 hung"
+                assert not t2.is_alive(), "Thread 2 hung"
+
+                # Wait for spawned _wait_plan threads to resolve
+                _wait_pending_resolved(bridge, "ws-1", "_pending_plan_reviews")
+
+                sent_count[bridge._http.post.call_count] += 1
+
+        assert sent_count.get(2, 0) == 0, (
+            f"Duplicate plan reviews sent in {sent_count[2]}/{ITERATIONS} iterations"
+        )
+
+
+# ---------------------------------------------------------------------------
+# Race 3: approve_set stale reference during concurrent update
+# ---------------------------------------------------------------------------
+
+
+class TestApproveSetConsistency:
+    """One thread reads approve_set for auto-approve check while another
+    updates it via _wait_approval 'always' path.  The auto-approve
+    decision should be consistent (either all-approved or not)."""
+
+    def test_approve_set_never_partially_visible(self):
+        for _ in range(ITERATIONS):
+            bridge = _make_bridge()
+            with bridge._lock:
+                bridge._ws_approve_tools["ws-1"] = {"read_file", "search"}
+
+            barrier = threading.Barrier(2, timeout=5)
+            results = []
+
+            def _reader(bridge=bridge, barrier=barrier, results=results):
+                barrier.wait()
+                with bridge._lock:
+                    snap = bridge._ws_approve_tools.get("ws-1", set()).copy()
+                results.append(snap)
+
+            def _writer(bridge=bridge, barrier=barrier):
+                barrier.wait()
+                with bridge._lock:
+                    existing = bridge._ws_approve_tools.get("ws-1", set())
+                    bridge._ws_approve_tools["ws-1"] = existing | {"bash", "write_file"}
+
+            t1 = threading.Thread(target=_reader)
+            t2 = threading.Thread(target=_writer)
+            t1.start()
+            t2.start()
+            t1.join(timeout=5)
+            t2.join(timeout=5)
+            assert not t1.is_alive(), "Reader hung"
+            assert not t2.is_alive(), "Writer hung"
+
+            snap = results[0]
+            assert snap in (
+                {"read_file", "search"},
+                {"read_file", "search", "bash", "write_file"},
+            ), f"Partial set observed: {snap}"
+
+
+# ---------------------------------------------------------------------------
+# Race 4: _running flag visibility across threads
+# ---------------------------------------------------------------------------
+
+
+class TestRunningFlagVisibility:
+    """All threads reading _running should see False within a bounded time
+    after the main thread sets it."""
+
+    def test_all_threads_observe_shutdown(self):
+        bridge = _make_bridge()
+        observed_false = threading.Event()
+        threads_running = []
+
+        def _spin_checker():
+            while bridge._running:
+                time.sleep(0.001)
+            observed_false.set()
+
+        for _ in range(5):
+            t = threading.Thread(target=_spin_checker, daemon=True)
+            threads_running.append(t)
+            t.start()
+
+        time.sleep(0.01)
+        bridge._running = False
+
+        for t in threads_running:
+            t.join(timeout=1)
+            assert not t.is_alive(), "Thread did not observe _running=False"
+
+        assert observed_false.is_set()
+
+
+# ---------------------------------------------------------------------------
+# Race 5: Approval thread exits within bounded time
+# ---------------------------------------------------------------------------
+
+
+class TestApprovalThreadTimeout:
+    """An approval thread blocked on pop_response should exit within the
+    configured approval_timeout, not hang indefinitely."""
+
+    def test_approval_thread_exits_within_timeout(self):
+        for _ in range(10):
+            bridge = _make_bridge(approval_timeout=0.5)
+
+            def _slow_pop(queue_name, timeout=300):
+                time.sleep(min(timeout, 0.5))
+                return None
+
+            bridge._broker.pop_response.side_effect = _slow_pop
+
+            with patch.object(bridge, "_publish_ws"), patch.object(bridge, "_api_approve"):
+                bridge._handle_approval("ws-1", {"items": _approval_items()})
+
+            # The pending entry should be resolved within the timeout
+            resolved = _wait_pending_resolved(bridge, "ws-1", "_pending_approvals", deadline_s=3.0)
+            assert resolved, "Approval thread did not exit within expected timeout"
+
+
+# ---------------------------------------------------------------------------
+# Race 6: Concurrent approval + workstream close
+# ---------------------------------------------------------------------------
+
+
+class TestApprovalDuringClose:
+    """An approval arriving at the exact same time as a ws_closed event
+    should not leave orphaned state."""
+
+    def test_no_orphaned_pending_after_close(self):
+        for _ in range(ITERATIONS):
+            bridge = _make_bridge(approval_timeout=0.1)
+            bridge._broker.pop_response.return_value = None  # timeout
+
+            barrier = threading.Barrier(2, timeout=5)
+
+            def _send_approval(bridge=bridge, barrier=barrier):
+                barrier.wait()
+                with patch.object(bridge, "_publish_ws"), patch.object(bridge, "_api_approve"):
+                    bridge._handle_approval("ws-1", {"items": _approval_items()})
+
+            def _close_ws(bridge=bridge, barrier=barrier):
+                barrier.wait()
+                with (
+                    patch.object(bridge, "_publish_global"),
+                    patch.object(bridge, "_publish_cluster"),
+                ):
+                    bridge._handle_global_event({"type": "ws_closed", "ws_id": "ws-1"})
+
+            t1 = threading.Thread(target=_send_approval)
+            t2 = threading.Thread(target=_close_ws)
+            t1.start()
+            t2.start()
+            t1.join(timeout=5)
+            t2.join(timeout=5)
+            assert not t1.is_alive(), "Approval thread hung"
+            assert not t2.is_alive(), "Close thread hung"
+
+            # Wait for spawned _wait_approval thread to resolve (if close
+            # didn't remove the entry first)
+            resolved = _wait_pending_resolved(bridge, "ws-1", "_pending_approvals")
+            assert resolved, "Orphaned pending approval"
+
+
+# ---------------------------------------------------------------------------
+# Race 7: Plan review refinement loop (tombstone → cleanup → re-entry)
+# ---------------------------------------------------------------------------
+
+
+class TestPlanReviewRefinementLoop:
+    """After a plan review is resolved, a ws_state event should clean up the
+    tombstone so the refinement-loop plan_review event is handled correctly."""
+
+    def test_refinement_loop_allows_reentry(self):
+        for _ in range(ITERATIONS):
+            bridge = _make_bridge()
+            bridge._broker.pop_response.return_value = (
+                '{"type": "plan_feedback", "feedback": "refine this"}'
+            )
+
+            # Step 1: first plan review — creates pending entry, resolves it
+            with patch.object(bridge, "_publish_ws"), patch.object(bridge._http, "post"):
+                bridge._handle_plan_review("ws-1", {"content": "plan v1"})
+
+            _wait_pending_resolved(bridge, "ws-1", "_pending_plan_reviews")
+
+            # Verify tombstone is present (resolved_at > 0)
+            with bridge._lock:
+                assert "ws-1" in bridge._pending_plan_reviews
+                assert bridge._pending_plan_reviews["ws-1"][1] > 0
+
+            # Step 2: ws_state event cleans up the resolved tombstone
+            with (
+                patch.object(bridge, "_publish_ws"),
+                patch.object(bridge, "_publish_global"),
+                patch.object(bridge, "_publish_cluster"),
+            ):
+                bridge._handle_global_event(
+                    {"type": "ws_state", "ws_id": "ws-1", "state": "working"}
+                )
+
+            with bridge._lock:
+                assert "ws-1" not in bridge._pending_plan_reviews
+
+            # Step 3: refinement plan_review arrives — should create new entry
+            with patch.object(bridge, "_publish_ws"), patch.object(bridge._http, "post"):
+                bridge._handle_plan_review("ws-1", {"content": "plan v2"})
+
+            _wait_pending_resolved(bridge, "ws-1", "_pending_plan_reviews")
+
+            with bridge._lock:
+                assert "ws-1" in bridge._pending_plan_reviews

tests/test_cancel.py

@@ -0,0 +1,409 @@
+"""Tests for generation cancellation (cooperative cancel via threading.Event)."""
+
+import threading
+import time
+from dataclasses import dataclass, field
+from unittest.mock import MagicMock, patch
+
+import pytest
+
+from turnstone.core.session import ChatSession, GenerationCancelled
+
+
+class NullUI:
+    """UI adapter that records state changes and discards other output."""
+
+    def __init__(self):
+        self.states = []
+        self.infos = []
+        self.stream_ends = 0
+
+    def on_thinking_start(self):
+        pass
+
+    def on_thinking_stop(self):
+        pass
+
+    def on_reasoning_token(self, text):
+        pass
+
+    def on_content_token(self, text):
+        pass
+
+    def on_stream_end(self):
+        self.stream_ends += 1
+
+    def approve_tools(self, items):
+        return True, None
+
+    def on_tool_result(self, call_id, name, output):
+        pass
+
+    def on_tool_output_chunk(self, call_id, chunk):
+        pass
+
+    def on_status(self, usage, context_window, effort):
+        pass
+
+    def on_plan_review(self, content):
+        return ""
+
+    def on_info(self, message):
+        self.infos.append(message)
+
+    def on_error(self, message):
+        pass
+
+    def on_state_change(self, state):
+        self.states.append(state)
+
+    def on_rename(self, name):
+        pass
+
+    def on_output_warning(self, call_id, assessment):
+        pass
+
+
+def _make_session(ui=None, **kwargs):
+    """Helper to construct a ChatSession with minimal setup."""
+    defaults = dict(
+        client=MagicMock(),
+        model="test-model",
+        ui=ui or NullUI(),
+        instructions=None,
+        temperature=0.5,
+        max_tokens=4096,
+        tool_timeout=30,
+    )
+    defaults.update(kwargs)
+    return ChatSession(**defaults)
+
+
+class TestCancelEvent:
+    """Basic cancel event mechanics."""
+
+    def test_cancel_sets_event(self, tmp_db):
+        session = _make_session()
+        assert not session._cancel_event.is_set()
+        session.cancel()
+        assert session._cancel_event.is_set()
+
+    def test_check_cancelled_raises_when_set(self, tmp_db):
+        session = _make_session()
+        session.cancel()
+        with pytest.raises(GenerationCancelled):
+            session._check_cancelled()
+
+    def test_check_cancelled_noop_when_clear(self, tmp_db):
+        session = _make_session()
+        session._check_cancelled()  # Should not raise
+
+    def test_cancel_is_idempotent(self, tmp_db):
+        session = _make_session()
+        session.cancel()
+        session.cancel()  # Double call is harmless
+        assert session._cancel_event.is_set()
+
+    def test_cancel_event_cleared_on_send_start(self, tmp_db):
+        """send() clears a stale cancel flag before starting."""
+        ui = NullUI()
+        session = _make_session(ui=ui)
+        session.cancel()  # Set stale flag
+
+        @dataclass
+        class FakeChunk:
+            content_delta: str = ""
+            reasoning_delta: str = ""
+            tool_call_deltas: list = field(default_factory=list)
+            usage: None = None
+            finish_reason: str = "stop"
+            info_delta: str = ""
+            provider_blocks: list = field(default_factory=list)
+
+        fake_stream = iter([FakeChunk(content_delta="Hello", finish_reason="stop")])
+
+        with (
+            patch.object(session, "_create_stream_with_retry", return_value=fake_stream),
+            patch.object(session, "_full_messages", return_value=[]),
+        ):
+            session.send("test")
+
+        # Should complete normally — cancel flag was cleared
+        assert "idle" in ui.states
+
+
+class TestCancelDuringStreaming:
+    """Cancel while _stream_response is iterating chunks."""
+
+    def test_preserves_partial_content(self, tmp_db):
+        """Partial content already streamed should be preserved in messages."""
+        ui = NullUI()
+        session = _make_session(ui=ui)
+
+        @dataclass
+        class FakeChunk:
+            content_delta: str = ""
+            reasoning_delta: str = ""
+            tool_call_deltas: list = field(default_factory=list)
+            usage: None = None
+            finish_reason: str = ""
+            info_delta: str = ""
+            provider_blocks: list = field(default_factory=list)
+
+        def cancelling_stream():
+            """Yield a few chunks then cancel."""
+            yield FakeChunk(content_delta="Hello ")
+            yield FakeChunk(content_delta="world")
+            session.cancel()
+            yield FakeChunk(content_delta=" — this should not appear")
+
+        with (
+            patch.object(session, "_create_stream_with_retry", return_value=cancelling_stream()),
+            patch.object(session, "_full_messages", return_value=[]),
+        ):
+            session.send("test")
+
+        # Session should be idle (not error)
+        assert ui.states[-1] == "idle"
+        # Check that "[Generation cancelled]" was emitted
+        assert any("cancelled" in i.lower() for i in ui.infos)
+        # The partial content should be preserved as an assistant message
+        assistant_msgs = [m for m in session.messages if m["role"] == "assistant"]
+        assert len(assistant_msgs) == 1
+        assert assistant_msgs[0]["content"] == "Hello world"
+        # No tool_calls in the partial message
+        assert "tool_calls" not in assistant_msgs[0]
+
+
+class TestCancelDuringToolExecution:
+    """Cancel while tools are being executed."""
+
+    def test_rollback_incomplete_tool_results(self, tmp_db):
+        """When cancelled during tool execution, incomplete results are rolled back."""
+        ui = NullUI()
+        session = _make_session(ui=ui)
+
+        @dataclass
+        class FakeChunk:
+            content_delta: str = ""
+            reasoning_delta: str = ""
+            tool_call_deltas: list = field(default_factory=list)
+            usage: None = None
+            finish_reason: str = ""
+            info_delta: str = ""
+            provider_blocks: list = field(default_factory=list)
+
+        @dataclass
+        class FakeToolDelta:
+            index: int = 0
+            id: str = ""
+            name: str = ""
+            arguments_delta: str = ""
+
+        # First call: return content with a tool call
+        def stream_with_tool():
+            yield FakeChunk(
+                tool_call_deltas=[FakeToolDelta(index=0, id="tc_1", name="bash")],
+                finish_reason="",
+            )
+            yield FakeChunk(
+                tool_call_deltas=[FakeToolDelta(index=0, arguments_delta='{"command":"echo hi"}')],
+                finish_reason="tool_calls",
+            )
+
+        call_count = 0
+
+        def fake_create_stream(msgs):
+            nonlocal call_count
+            call_count += 1
+            if call_count == 1:
+                return stream_with_tool()
+            # Should not be called a second time since cancel happens before phase 3
+            raise AssertionError("Should not stream again after cancel")
+
+        def cancel_before_execute(tool_calls):
+            """Simulate cancel happening before tool execution."""
+            session.cancel()
+            raise GenerationCancelled()
+
+        with (
+            patch.object(session, "_create_stream_with_retry", side_effect=fake_create_stream),
+            patch.object(session, "_full_messages", return_value=[]),
+            patch.object(session, "_execute_tools", side_effect=cancel_before_execute),
+        ):
+            session.send("run something")
+
+        # Session should be idle
+        assert ui.states[-1] == "idle"
+        # No tool result messages should remain (rolled back)
+        roles = [m["role"] for m in session.messages]
+        assert "tool" not in roles
+        # The assistant message with tool_calls should also be rolled back
+        for m in session.messages:
+            if m["role"] == "assistant":
+                assert "tool_calls" not in m or not m["tool_calls"]
+
+
+class TestCancelWhenIdle:
+    """Cancelling when no generation is active is harmless."""
+
+    def test_cancel_when_idle_is_noop(self, tmp_db):
+        session = _make_session()
+        session.cancel()
+        # Next send should work normally (cancel cleared at start)
+
+        @dataclass
+        class FakeChunk:
+            content_delta: str = ""
+            reasoning_delta: str = ""
+            tool_call_deltas: list = field(default_factory=list)
+            usage: None = None
+            finish_reason: str = "stop"
+            info_delta: str = ""
+            provider_blocks: list = field(default_factory=list)
+
+        fake_stream = iter([FakeChunk(content_delta="ok", finish_reason="stop")])
+        with (
+            patch.object(session, "_create_stream_with_retry", return_value=fake_stream),
+            patch.object(session, "_full_messages", return_value=[]),
+        ):
+            session.send("hello")
+
+        # Should complete normally
+        assistant_msgs = [m for m in session.messages if m["role"] == "assistant"]
+        assert len(assistant_msgs) == 1
+        assert assistant_msgs[0]["content"] == "ok"
+
+
+class TestCancelThreadSafety:
+    """Cancel from a different thread while generation is running."""
+
+    def test_cancel_from_another_thread(self, tmp_db):
+        ui = NullUI()
+        session = _make_session(ui=ui)
+
+        @dataclass
+        class FakeChunk:
+            content_delta: str = ""
+            reasoning_delta: str = ""
+            tool_call_deltas: list = field(default_factory=list)
+            usage: None = None
+            finish_reason: str = ""
+            info_delta: str = ""
+            provider_blocks: list = field(default_factory=list)
+
+        barrier = threading.Event()
+
+        def slow_stream():
+            yield FakeChunk(content_delta="Start")
+            barrier.set()  # Signal that streaming has started
+            time.sleep(2)  # Simulate slow streaming
+            yield FakeChunk(content_delta=" end", finish_reason="stop")
+
+        with (
+            patch.object(session, "_create_stream_with_retry", return_value=slow_stream()),
+            patch.object(session, "_full_messages", return_value=[]),
+        ):
+            # Run send() in a thread
+            error = []
+
+            def run():
+                try:
+                    session.send("test")
+                except Exception as e:
+                    error.append(e)
+
+            t = threading.Thread(target=run)
+            t.start()
+            barrier.wait(timeout=5)
+            # Cancel from main thread
+            session.cancel()
+            t.join(timeout=5)
+
+        assert not error
+        assert ui.states[-1] == "idle"
+        assert any("cancelled" in i.lower() for i in ui.infos)
+
+
+class TestGenerationCancelledException:
+    """GenerationCancelled is a BaseException, not Exception."""
+
+    def test_is_base_exception(self):
+        assert issubclass(GenerationCancelled, BaseException)
+
+    def test_not_caught_by_except_exception(self):
+        """Verify GenerationCancelled is NOT caught by except Exception."""
+        with pytest.raises(GenerationCancelled):
+            try:
+                raise GenerationCancelled()
+            except Exception:
+                pytest.fail("GenerationCancelled was caught by except Exception")
+
+
+class TestStreamFlushBeforeToolCalls:
+    """Content pending buffer must be flushed before tool call processing."""
+
+    def test_pending_content_flushed_before_tool_calls(self, tmp_db):
+        """All content tokens arrive via on_content_token before tool calls."""
+        events: list[tuple[str, ...]] = []
+
+        class TrackingUI(NullUI):
+            def on_content_token(self, text):
+                events.append(("content", text))
+
+            def on_stream_end(self):
+                events.append(("stream_end",))
+                super().on_stream_end()
+
+        ui = TrackingUI()
+        session = _make_session(ui=ui)
+
+        @dataclass
+        class FakeChunk:
+            content_delta: str = ""
+            reasoning_delta: str = ""
+            tool_call_deltas: list = field(default_factory=list)
+            usage: None = None
+            finish_reason: str = ""
+            info_delta: str = ""
+            provider_blocks: list = field(default_factory=list)
+
+        @dataclass
+        class FakeToolDelta:
+            index: int = 0
+            id: str = ""
+            name: str = ""
+            arguments_delta: str = ""
+
+        def stream_content_then_tool():
+            # Content long enough to leave chars in pending buffer
+            # (_MAX_TAG_LEN = 13, so _drain_pending retains last 13 chars)
+            yield FakeChunk(content_delta="Hello world, this is a test message")
+            yield FakeChunk(
+                tool_call_deltas=[FakeToolDelta(index=0, id="tc_1", name="bash")],
+            )
+            yield FakeChunk(
+                tool_call_deltas=[FakeToolDelta(index=0, arguments_delta='{"command":"echo hi"}')],
+                finish_reason="tool_calls",
+            )
+
+        with (
+            patch.object(
+                session,
+                "_create_stream_with_retry",
+                return_value=stream_content_then_tool(),
+            ),
+            patch.object(session, "_full_messages", return_value=[]),
+            # Prevent real tool execution (e.g., bash) during this test.
+            patch.object(session, "_execute_tools", return_value=([], None)),
+        ):
+            session.send("test")
+
+        # All content should have been emitted
+        total = "".join(e[1] for e in events if e[0] == "content")
+        assert total == "Hello world, this is a test message"
+
+        # No content events after stream_end
+        stream_end_idx = next(i for i, e in enumerate(events) if e[0] == "stream_end")
+        late_content = [e for e in events[stream_end_idx + 1 :] if e[0] == "content"]
+        assert late_content == [], f"Content after stream_end: {late_content}"