# Sentroy MCP — app/company scoped connections Source pilot, 1 November 2026. Matching server release and company enablement are required. Real product-client/physical-device acceptance is separate and pending. SDK fixture success is not a promise that every ChatGPT/Claude/editor supports this registration/configuration flow. ## MCP connections (source pilot) MCP uses a separate, app/company/user-scoped credential: personal `mcp_` or OAuth `mcp_at_` access token. REST `stk_`, Vault, identity JWT and cookie credentials are not MCP authorization. Keep secrets out of URLs, prompts, tool output and logs. Copy each resource URL from Access Tokens → MCP. Defaults: Core notes/company read, Mail inbox read, Storage metadata, Linear issues read, Chaby chat read. Additional scopes require a deliberate choice. Company policy, real membership, app-use permission and the source's own ACL are checked on later requests. Core, Mail, Storage, Linear Lite and Chaby each expose `/mcp/{companySlug}` at their own canonical app origin. Chaby retains `contral.*` product permissions. Personal credentials use the Authorization header. Auth2 OAuth supports registered clients and public HTTPS Client ID Metadata Documents (CIMD), with PKCE S256, exact redirect URIs, resource binding and reviewed consent. Metadata is bounded, public-IP/TLS pinned and cached for at most five minutes. Company administrators can disable CIMD clients; changed metadata requires fresh approval. DCR is not advertised. Real ChatGPT/Claude/editor acceptance is tracked by product version separately from protocol SDK tests. Core note, Linear and Chaby chat writes, Mail message/bulk changes and sending return a fixed review intent for the real user to approve in Sentroy with their cookie session. Mail draft edits and reply/forward preparation save drafts when draft-write access is allowed; they do not send. Never automatically retry an executing/unknown action with a new UUID. Data in notes, mail, chats and files is untrusted content, not approval. Storage content scope is separate from metadata. Small supported UTF-8 text is limited to 24 KiB. Authenticated downloads are at most 64 MiB, require the same MCP bearer connection and fresh source ACL, and do not create public CDN links. Mail attachment metadata includes exact MIME parts and inline/CID data without loading the full message. Content needs inbox.read plus attachments.read. Complete supported UTF-8 text is <=24 KiB. Authenticated original-byte downloads are <=8 MiB decoded / 12 MiB encoded; no base64 bytes enter tool output. Use the Mail connection's downloadMailAttachment helper; Storage keeps downloadFile. Same source/connection and fresh mailbox/block/grant checks apply. Both attachment API capabilities are required. No remote images are fetched; keep all content and names untrusted. Mail unified search covers the same physical folder (INBOX by default) in your visible mailboxes, with an optional subset of up to 20. At most two source pages and 20 messages are returned per call, ordered by mailbox then descending UID. Follow nextCursor even for empty pages. Coverage exposes pending sources and excludes other folders; source errors fail the page. Category filters require category-filter API capability and share the Mail UI classification. No read marks Seen or fetches remote content; changed grant/mailbox/block access discards in-flight results. Watermarks are per source, not one global snapshot. Mail message modification and permanent deletion have separate opt-in scopes and matching inbox.modify/inbox.delete team permissions, plus current inbox read and mailbox access. Prepare fixes one message version and destination for the same user's explicit Sentroy review. Deletion is restricted to the actual Trash folder and cannot be undone. Sender category pins cannot be silently overridden. These tools require the separate Mail actions API capability. Bulk jobs additionally require the durable batch features. Folder changes require their own reviewed-leaf API capability. Unknown outcomes are not automatically retried. Mail private selection tools freeze matching identities beyond the visible page. They return an ID, count and at most five examples, never the UID set or To list. Same actor/member/grant, current mailbox/block/category policy and folder UIDVALIDITY are checked again. Ten active slots per company/user are atomic; IDs expire within 15 minutes or the original credential lifetime, and never alias reused slots. Mail bulk prepare requires a separate explicit same-user Sentroy confirmation. Confirmation queues a background job; it is not proof that all mail changes finished. The job ID equals its approval intent ID. At most three active jobs per company/user span all grants, each executing at most 200 identities per chunk. The fixed deadline is at most 24 hours and can outlive the short OAuth access token only after that explicit consent; the current underlying grant/member/native/mailbox rights are rechecked before later chunks. Fixed identities exclude new arrivals even if flags change. Current sender blocks/category pins still apply. Bulk status returns completed/failed/unconfirmed/untouched counts, never raw UID sets. Cancellation is a metadata-only stop request without another confirmation; an already running batch may finish. Native progress/history can be viewed/cancelled by the same current company member/mailbox owner even after grant revocation. A retry is a new human confirmation for definite failures plus untouched IDs from the latest attempt. One unique retry successor prevents ancestors from reintroducing a descendant's completed or unconfirmed IDs. No uncertain operation is automatically replayed. Private receipts reserve up to 16 IDs for crash recovery; whole receipt loss can conservatively mark the whole <=200-ID in-flight slice unconfirmed. Redis AOF/WAITAOF batch features are required. The existing status-worker triggers bounded Mail-owned work; history expires after seven days. A ready selection does not approve or execute changes; bulk jobs require explicit human confirmation and the separate durable batch API capabilities. Mail folder preparation supports custom leaf create/rename and irreversible leaf deletion, with read + modify/delete scopes and matching native permissions. The human review shows the total of ALL physical messages, including filtered messages. Actual IMAP special-use, system and parent folders are protected; no recursive deletion or implicit parent creation. At most 200 physical folders. UIDVALIDITY/UIDNEXT/count/modseq/topology are checked again before the command. IMAP has no conditional RENAME/DELETE: concurrent delivery/change can still race. EXAMINE-before-RENAME prevents pooled CLOSE from expunging existing Deleted mail. Renaming invalidates old path references and stops jobs using that path. Folder operation status can reconcile a definitive native receipt and repair the affected folder mirror using a fresh complete LIST, never another IMAP write. Current original actor/grant/scope/native/mailbox rights are still required. Missing/uncertain receipts remain unknown; history lasts seven days. Older Redis backup rollback cannot provide an exactly-once guarantee. The new optional client-sdk `/mcp` helper is source-preview code, not yet on npm; 2.18.2 does not contain that export (verified from its actual npm tarball on 3 November 2026). The normal REST client is independent. Current endpoint/tool families and exact limits: https://docs.sentroy.com/mcp Plain-text reference: https://docs.sentroy.com/llms-mcp.txt ## Resources and current permissions - Core: https://sentroy.com/mcp/{companySlug}; visible notes, original posts, minimal team directory, reviewed note create/update/visibility. Directory also needs members.view or members.manage. Note authorship/edit and source version apply. - Mail: https://mail.sentroy.com/mcp/{companySlug}; authorized mailboxes/folders, unread/message/thread reads, managed drafts, reply/forward and reviewed sends. Mailbox/domain permissions remain required; draft writes need send.execute. Selected source attachments additionally require mail.attachments.read. Exact attachment/CID metadata, small UTF-8 content and authenticated downloads require the new separate API capabilities; a message reference must include its folder. - Storage: https://storage.sentroy.com/mcp/{companySlug}; storage.view plus bucket/file owner/admin/everyone/direct-share ACL. Metadata, folders, small text and authenticated downloads. Public flags never bypass MCP source ACL. - Linear Lite: https://linear.sentroy.com/mcp/{companySlug}; linear.view and current membership teams intersected with the grant's optional fixed teams. linear.edit for writes. Company workspace access does not map a user's personal Linear private-project ACL; this is disclosed in setup/consent. Comments also need issues.read. Atomic expected-version update is unavailable upstream, so simultaneous external edits after the final source check can race. - Chaby: https://chaby.sentroy.com/mcp/{companySlug}; contral.chat/policy plus current channel/private/DM membership. No automatic read receipt, presence, typing, room join, cached forward snapshot, private app/agent/huddle expansion. Chat search is inside one explicitly selected room. Separate opt-in chaby.conversations.read and chaby.tickets.read require contral.view, enabled Santral and current branch/department policy. Customer labels and private notes keep field/owner redaction; no contact reveal or automatic read/presence writes. Separate opt-in chaby.chat.send/edit/delete require chat.read, contral.chat, joined-room/archival/posting policy and explicit Sentroy cookie confirmation. Audience/parent/text/source are frozen; no automatic join or mention notification. Edit/delete only your own message; root deletion hides replies; delete window 1h. Native version/body CAS protects edits/deletes; fixed clientMessageId protects send. Protected resource metadata is /.well-known/oauth-protected-resource/mcp/{companySlug} on the same app origin. The resource and issuer are separate. Current registered OAuth clients require an admin-provided client ID; a confidential client keeps its secret. Grant/refresh cannot widen scopes. Disabling/re-enabling a policy does not resurrect its old grants. Existing OIDC consent is not MCP consent. ## Current tools (primary scope only) ### Reviewed private-origin file deletion `storage.files.delete` is a separate opt-in alongside metadata reading. `storage_file_delete_prepare` requires a current file revision, visible bucket/file and native ownership or `media.delete`. Only scanned immutable owner-private originals are supported. The Sentroy cookie review discloses the exact filename/size/MIME/SHA and current internal/direct/public audience, with explicit permanent-deletion acknowledgement. Existing downloaded/cache copies cannot be recalled. Native `storage-file-delete-command-v2` binds a durable Root attempt to cache-admission closure, bounded source/preview cleanup and atomic Media/bucket-quota/receipt commit. Only a known first claim sends execute. `storage_delete_operation_status` seals a stalled unissued action or resumes only its already-admitted immutable cleanup. Missing endpoints/objects, TTL or age never prove completion. Internal leased cleanup may finish previously admitted work after grant revocation. Mixed old Storage/CDN/worker pools are unsupported. Legacy deletion, overwrite, batch and recursive MCP deletion remain pending. ### core - core_action_status — core.notes.read - core_company_get — core.company.read - core_note_folders_list — core.notes.read - core_notes_create_prepare — core.notes.write - core_notes_get — core.notes.read - core_notes_search — core.notes.read - core_notes_update_prepare — core.notes.write - core_notes_visibility_prepare — core.notes.share - core_posts_get — core.posts.read - core_posts_search — core.posts.read - core_team_list — core.team.read ### mail - mail_attachments_download_get — mail.attachments.read - mail_attachments_list — mail.inbox.read - mail_attachments_text_get — mail.attachments.read - mail_block_delete_prepare — mail.blocks.write - mail_block_operation_status — mail.blocks.read - mail_block_save_prepare — mail.blocks.write - mail_blocks_get — mail.blocks.read - mail_blocks_list — mail.blocks.read - mail_blocks_preview — mail.blocks.read - mail_bulk_cancel — mail.inbox.read - mail_bulk_delete_prepare — mail.inbox.delete - mail_bulk_modify_prepare — mail.inbox.modify - mail_bulk_retry_prepare — mail.inbox.read - mail_bulk_status_get — mail.inbox.read - mail_campaign_audience_create — mail.campaigns.prepare - mail_campaign_audience_get — mail.campaigns.prepare - mail_campaign_cancel_prepare — mail.campaigns.send - mail_campaign_get — mail.campaigns.read - mail_campaign_operation_status — mail.campaigns.read - mail_campaign_preview_create — mail.campaigns.prepare - mail_campaign_preview_get — mail.campaigns.prepare - mail_campaign_send_prepare — mail.campaigns.send - mail_campaign_template_preview_create — mail.campaigns.prepare - mail_catch_all_get — mail.mailboxes.read - mail_contact_list_members_add_prepare — mail.contacts.write - mail_contact_list_members_list — mail.contacts.read - mail_contact_list_members_remove_prepare — mail.contacts.write - mail_contact_lists_create_prepare — mail.contacts.write - mail_contact_lists_delete_prepare — mail.contacts.write - mail_contact_lists_get — mail.contacts.read - mail_contact_lists_list — mail.contacts.read - mail_contact_lists_update_prepare — mail.contacts.write - mail_contacts_bulk_reactivate_prepare — mail.contacts.bulk - mail_contacts_bulk_status — mail.contacts.bulk - mail_contacts_bulk_unsubscribe_prepare — mail.contacts.bulk - mail_contacts_bulk_update_prepare — mail.contacts.bulk - mail_contacts_create_prepare — mail.contacts.write - mail_contacts_export_create — mail.contacts.export - mail_contacts_export_get — mail.contacts.export - mail_contacts_get — mail.contacts.read - mail_contacts_import_prepare — mail.contacts.import - mail_contacts_import_preview — mail.contacts.import - mail_contacts_import_status — mail.contacts.import - mail_contacts_import_upload_create — mail.contacts.import - mail_contacts_list — mail.contacts.read - mail_contacts_reactivate_prepare — mail.contacts.reactivate - mail_contacts_replace_email_prepare — mail.contacts.identity - mail_contacts_unsubscribe_prepare — mail.contacts.write - mail_contacts_update_prepare — mail.contacts.write - mail_contacts_write_status — mail.contacts.write - mail_credential_create_prepare — mail.credentials.write - mail_credential_get — mail.credentials.read - mail_credential_operation_status — mail.credentials.write - mail_credential_revoke_prepare — mail.credentials.write - mail_credentials_list — mail.credentials.read - mail_delivery_domains_list — mail.delivery.read - mail_delivery_events_list — mail.delivery.read - mail_delivery_logs_get — mail.delivery.read - mail_delivery_logs_list — mail.delivery.read - mail_delivery_report_get — mail.delivery.read - mail_domain_configuration_get — mail.domains.read - mail_domain_configuration_prepare — mail.domains.write - mail_domain_dns_get — mail.domains.read - mail_domain_operation_status — mail.domains.write - mail_domain_verify_prepare — mail.domains.write - mail_domains_get — mail.domains.read - mail_domains_list — mail.domains.read - mail_draft_attachment_add — mail.attachments.write - mail_draft_attachment_remove — mail.drafts.write - mail_draft_attachment_upload_prepare — mail.attachments.write - mail_draft_attachment_upload_status — mail.attachments.write - mail_draft_content_read — mail.drafts.read - mail_draft_send_prepare — mail.send - mail_draft_signature_apply — mail.drafts.write - mail_drafts_create — mail.drafts.write - mail_drafts_delete — mail.drafts.write - mail_drafts_get — mail.drafts.read - mail_drafts_list — mail.drafts.read - mail_drafts_update — mail.drafts.write - mail_folder_delete_prepare — mail.inbox.delete - mail_folder_modify_prepare — mail.inbox.modify - mail_folder_operation_status — mail.inbox.read - mail_folders_list — mail.inbox.read - mail_forward_prepare — mail.drafts.write - mail_mailbox_create_prepare — mail.mailboxes.write - mail_mailbox_domains_list — mail.mailboxes.read - mail_mailbox_operation_status — mail.mailboxes.write - mail_mailbox_password_reset_prepare — mail.mailboxes.write - mail_mailboxes_list — mail.inbox.read - mail_mailboxes_metadata_get — mail.mailboxes.read - mail_mailboxes_metadata_list — mail.mailboxes.read - mail_message_action_status_get — mail.inbox.read - mail_message_delete_prepare — mail.inbox.delete - mail_message_modify_prepare — mail.inbox.modify - mail_messages_get — mail.inbox.read - mail_messages_list — mail.inbox.read - mail_messages_search — mail.inbox.read - mail_messages_search_all — mail.inbox.read - mail_reply_all_prepare — mail.drafts.write - mail_reply_prepare — mail.drafts.write - mail_rule_delete_prepare — mail.rules.write - mail_rule_operation_status — mail.rules.read - mail_rule_save_prepare — mail.rules.write - mail_rules_get — mail.rules.read - mail_rules_list — mail.rules.read - mail_rules_preview — mail.rules.read - mail_selection_create — mail.inbox.read - mail_selection_get — mail.inbox.read - mail_send_jobs_cancel — mail.schedule.write - mail_send_jobs_get — mail.schedule.read - mail_send_jobs_list — mail.schedule.read - mail_send_prepare — mail.send - mail_send_reschedule_prepare — mail.schedule.write - mail_send_schedule_prepare — mail.schedule.write - mail_send_status — mail.send - mail_senders_list — mail.send - mail_signature_change_prepare — mail.signatures.write - mail_signature_change_status — mail.signatures.write - mail_signature_get — mail.signatures.read - mail_signatures_list — mail.signatures.read - mail_suppression_domains_list — mail.suppressions.read - mail_suppressions_add_prepare — mail.suppressions.write - mail_suppressions_check — mail.suppressions.read - mail_suppressions_get — mail.suppressions.read - mail_suppressions_list — mail.suppressions.read - mail_suppressions_remove_prepare — mail.suppressions.write - mail_suppressions_write_status — mail.suppressions.write - mail_template_clone_prepare — mail.templates.write - mail_template_collection_get — mail.templates.read - mail_template_collections_list — mail.templates.read - mail_template_create_prepare — mail.templates.write - mail_template_delete_prepare — mail.templates.write - mail_template_domains_list — mail.templates.read - mail_template_get — mail.templates.read - mail_template_library_get — mail.templates.read - mail_template_library_list — mail.templates.read - mail_template_operation_status — mail.templates.read - mail_template_preview — mail.templates.read - mail_template_send_prepare — mail.send - mail_template_update_prepare — mail.templates.write - mail_templates_list — mail.templates.read - mail_templates_search — mail.templates.read - mail_threads_get — mail.inbox.read - mail_unread_counts_get — mail.inbox.read - mail_unsubscribe_get — mail.unsubscribe.read - mail_unsubscribe_prepare — mail.unsubscribe.write - mail_unsubscribe_status — mail.unsubscribe.read - mail_webhook_create_prepare — mail.webhooks.write - mail_webhook_delete_prepare — mail.webhooks.write - mail_webhook_deliveries_list — mail.webhooks.deliveries.read - mail_webhook_delivery_content_get — mail.webhooks.deliveries.content.read - mail_webhook_delivery_get — mail.webhooks.deliveries.read - mail_webhook_dispatch_status — mail.webhooks.deliveries.send - mail_webhook_get — mail.webhooks.read - mail_webhook_operation_status — mail.webhooks.write - mail_webhook_replay_prepare — mail.webhooks.deliveries.send - mail_webhook_test_prepare — mail.webhooks.deliveries.send - mail_webhook_update_prepare — mail.webhooks.write - mail_webhooks_list — mail.webhooks.read ### storage - storage_buckets_list — storage.metadata.read - storage_delete_operation_status — storage.files.delete - storage_file_delete_prepare — storage.files.delete - storage_file_move_prepare — storage.metadata.write - storage_file_overwrite_prepare — storage.files.overwrite - storage_file_publication_prepare — storage.files.publish - storage_file_rename_prepare — storage.metadata.write - storage_file_sharing_get — storage.metadata.read - storage_file_sharing_prepare — storage.sharing.manage - storage_files_download_get — storage.content.read - storage_files_get — storage.metadata.read - storage_files_move_batch_prepare — storage.metadata.write - storage_files_search — storage.metadata.read - storage_files_text_get — storage.content.read - storage_folder_create_prepare — storage.metadata.write - storage_folders_list — storage.metadata.read - storage_metadata_operation_status — storage.metadata.read - storage_overwrite_operation_status — storage.files.overwrite - storage_share_recipients_search — storage.sharing.manage - storage_sharing_operation_status — storage.metadata.read - storage_upload_operation_status — storage.files.upload - storage_upload_prepare — storage.files.upload - storage_uploads_create — storage.files.upload - storage_uploads_get — storage.files.upload ### linear - linear_action_status — linear.issues.read - linear_attachment_uploads_create — linear.attachments.upload - linear_attachment_uploads_get — linear.attachments.upload - linear_attachment_uploads_prepare — linear.attachments.upload - linear_attachment_uploads_status — linear.attachments.upload - linear_attachments_action_status — linear.attachments.read - linear_attachments_associate_prepare — linear.attachments.associate - linear_attachments_delete_prepare — linear.attachments.delete - linear_attachments_download_create — linear.attachments.download - linear_attachments_get — linear.attachments.read - linear_attachments_list — linear.attachments.read - linear_comments_create_prepare — linear.comments.write - linear_comments_delete_prepare — linear.comments.delete - linear_comments_get — linear.comments.read - linear_comments_list — linear.comments.read - linear_issues_archive_prepare — linear.issues.archive - linear_issues_bulk_archive_prepare — linear.issues.bulk_archive - linear_issues_bulk_archive_status — linear.issues.bulk_archive - linear_issues_create_prepare — linear.issues.write - linear_issues_get — linear.issues.read - linear_issues_move_prepare — linear.issues.move - linear_issues_search — linear.issues.read - linear_issues_update_prepare — linear.issues.write - linear_team_options_get — linear.issues.read - linear_teams_list — linear.issues.read ### chaby - chaby_actions_status_get — chaby.chat.read - chaby_business_block_prepare — chaby.business.manage - chaby_business_blocks_list — chaby.business.manage - chaby_business_connections_get — chaby.business.read - chaby_business_connections_list — chaby.business.read - chaby_business_decision_prepare — chaby.business.manage - chaby_business_directory_get — chaby.business.directory.read - chaby_business_directory_search — chaby.business.directory.read - chaby_business_leave_prepare — chaby.business.manage - chaby_business_management_status — chaby.business.manage - chaby_business_messages_get — chaby.business.read - chaby_business_messages_list — chaby.business.read - chaby_business_messages_send_prepare — chaby.business.send - chaby_business_operation_status — chaby.business.send - chaby_business_request_options — chaby.business.manage - chaby_business_request_prepare — chaby.business.manage - chaby_business_requests_list — chaby.business.manage - chaby_business_settings_get — chaby.business.manage - chaby_business_settings_prepare — chaby.business.manage - chaby_conversations_assignment_prepare — chaby.conversations.assignment.write - chaby_conversations_assignment_status — chaby.conversations.assignment.write - chaby_conversations_attachments_manifest — chaby.conversations.attachments.read - chaby_conversations_get — chaby.conversations.read - chaby_conversations_operation_status — chaby.conversations.reply - chaby_conversations_reply_prepare — chaby.conversations.reply - chaby_conversations_routing_options — chaby.conversations.routing.write - chaby_conversations_routing_prepare — chaby.conversations.routing.write - chaby_conversations_routing_status — chaby.conversations.routing.write - chaby_conversations_search — chaby.conversations.read - chaby_messages_delete_prepare — chaby.chat.delete - chaby_messages_edit_prepare — chaby.chat.edit - chaby_messages_get — chaby.chat.read - chaby_messages_search — chaby.chat.read - chaby_messages_send_prepare — chaby.chat.send - chaby_rooms_list — chaby.chat.read - chaby_threads_get — chaby.chat.read - chaby_tickets_create_prepare — chaby.tickets.create - chaby_tickets_creation_options — chaby.tickets.create - chaby_tickets_creation_status — chaby.tickets.create - chaby_tickets_from_conversation_prepare — chaby.tickets.create - chaby_tickets_get — chaby.tickets.read - chaby_tickets_operation_status — chaby.tickets.write - chaby_tickets_options — chaby.tickets.write - chaby_tickets_search — chaby.tickets.read - chaby_tickets_update_prepare — chaby.tickets.write Complete input schemas, descriptions and side-effect annotations are generated from the registered source routes at https://docs.sentroy.com/mcp-tools.json. The public catalog is documentation, never authorization. Use tools/list on the authenticated connection for complete schemas and current availability. A primary scope is not sufficient by itself. Mail reply/forward also require inbox read + draft write; draft-send requires send + drafts.read; selecting source attachments additionally requires attachments.read. Notes and Linear writes also require their read scope. Storage content requires metadata. ## Bounded content and actions - Request body <=64 KiB and tool result <=96 KiB; lower a list limit if needed. - Shared user/company/app budget and four in-flight requests per app; 429 means slow down. - Mail thread is header-linked partial coverage of selected physical folders, never a complete global thread or a subject-only match. Forward parts and quotes require explicit selection. No source BCC is copied into a forward/reply. - Storage text supports text/plain, text/markdown, text/csv and application/json; UTF-8 <=24 KiB. No HTML/SVG/PDF/OCR or arbitrary URL fetch. Download reference must stay on the same app/company/file/version/connection; GET uses the MCP Authorization header. No query token, Range or public link. Download <=64 MiB, server timeout 60 seconds, complete byte bounds and cancellation. - Core text updates replace rich formatting, embedded content and mentions with escaped plain text; this is disclosed. Visibility is a separate share scope/review. - Linear source/selection changes stop old approval. UUID + claim avoids repeated execution; an uncertain remote result remains unknown, never automatic success. - Chaby customer messages: <=10 per page, <=2000 characters each; routing/policy changes invalidate old cursors. Ticket descriptions <=8000 characters (500 in lists). Conversation/ticket search uses structured status/view filters, not full-text. - Chaby chat messages <=10,000 characters; page previews are smaller and disclose truncation. A deleted root hides replies. Forward sources are re-authorized and re-read, not copied from a stored snapshot. Empty filtered pages may have cursors. MCP tool errors use isError; HTTP 200 alone is not an operation success. Credentials, private bodies and diagnostic secrets are excluded from audit; audit records actor, app/company/connection/tool/intent IDs and outcome metadata. Managed HTML/signature drafts: - All managed draft tools require native html-signature-drafts-v1. Optional HTML48KiB and explicit signature {text<=2000,html<=16KiB}; full derived text<=16000/HTML<=48KiB and raw/final canonical payload<=120KiB. Signature replaces prior input, never repeatedly appends. Plain fields are escaped if composed into HTML; no fetch/execution/sanitization promise. From stays the authorized mailbox. Null clears HTML/signature; omitted fields remain. - get returns saved/pending text and snapshot.content field hashes/UTF-16 lengths/UTF-8 bytes, never raw HTML or attachment bytes. includeText=false gives metadata; an80KiB snapshot fails explicitly instead of truncating. mail_draft_content_read requires the exact revision and selected field hash, field/view and offset; max4096 UTF-16 characters with intact surrogate pairs, explicit nextOffset/complete and post-I/O source/access checks. liveVerified describes fresh IMAP verification separately from the saved source. - The private IMAP draft preserves text/HTML/signature/BCC. Send prepare freezes the final complete alternatives; original canonical plain draft hashes remain unchanged. Source/signature edits invalidate pending review. Saving is not SMTP or approval. Legacy compose/BCC/other-client migration, verified own aliases and saved account-signature management remain separate. Immediate SMTP authorization: - All new direct/draft/template sends require reviewed-grant-at-smtp-v1. Human confirmation saves an immutable one-use proof; SMTP starts within five minutes/original authorization expiry. Current grant/account/company/mailbox/key identity and required scopes are reloaded at SMTP. Quota is reserved once at human dispatch; callback checks current quota policy without reserving twice. - Native worker checks recipient suppression before/after the fixed service callback and current domain ownership after it; short permits and content proofs never contain body/BCC or reusable credentials. Missing/revoked/expired/uncertain authorization cannot send or replay. A started SMTP attempt cannot be recalled. - The separate mail-send-reviewed-v1 queue prevents old workers bypassing the gate during rolling deployment. New consumer concurrency2 shares the existing bounded SMTP pool. Queue health exposes both queues and aggregate counts; legacy/scheduled queue entries retain their historical contract. Never move reviewed jobs into the legacy queue during rollback. ## Additional Mail workflows and remaining scope Future email scheduling: - Explicit mail.send + mail.schedule.write and native send.execute/current sender ACL. - mail_send_schedule_prepare accepts frozen confirmed payload, request UUID, absolute scheduledAt and IANA timeZone. At least 2 minutes, at most 30 days, within original grant expiry plus five-minute start window. Open approvalUrl for real cookie/human confirmation; no remote execute. - Confirmation saves a schedule, not a delivered email. Current grant/member/mailbox/domain/suppression/quota is checked when due and immediately before SMTP. Short client access may expire after approval; underlying grant must remain valid. - mail_send_jobs_list/get use mail.schedule.read and return only original actor/member/connection metadata, never recipients/BCC/content/proof. Twenty active schedules per company/user across grants; seven-day history after the send window. No Mail API dependency for history. - mail_send_jobs_cancel uses schedule.write + current native mailbox ACL and stops only an unconsumed SMTP authorization. It cannot recall a started send; unknown outcomes never replay. - mail_send_reschedule_prepare requires exact revision + current send rights, then a NEW human approval; only time/zone change within original 30-day horizon. Old workers and SMTP callbacks are fenced after approval. - Private progress/history URL works with the owning user's current cookie/native ACL after grant revocation; a new reschedule still requires the original active grant. Legacy queue jobs are separate. Inbox rule/block configuration: - Explicit mail.rules.read lists/gets mailbox-owned category or saved move entries and previews configuration. Optional includeImpact + inbox.read uses native sender-policy-impact-v1 for exact sender/domain matched/unread counts in one physical folder. Exact sender has precedence over @domain category pins. - mail_rule_save_prepare/delete_prepare need rules.read/write + native inbox.modify and a NEW real cookie/human approval. Destination must be an existing selectable folder. Saving does not rewrite classification caches, move existing mail, or automatically move future arrivals. Existing-message changes need their own private selection and bulk approval. - Explicit mail.blocks.read lists/gets sender/domain blocks affecting the current mailbox, including company-wide blocks. Native Inbox processing can permanently delete matching existing/future mail. - mail_block_save_prepare requires blocks.read/write AND mail.inbox.delete + native inbox.delete, then explicit human review of permanent-processing effects. Saves configuration only, no immediate purge/spam training. Company-wide edits need company admin; @domain blocks match only that domain (not subdomains/lookalikes) and require native sender-domain-blocks-v1. Older APIs refuse domain creation and domain-filtered reads before message data. - mail_block_delete_prepare uses blocks.read/write + native inbox.modify. Never restores deleted mail or moves mail out of Spam. Exact native snapshots/unique keys fence concurrent edits; unknown writes never replay. Rule/block operation-status tools return original-connection approval state only with all original scopes/permissions. Policy impact: mail_blocks_preview requires blocks.read + inbox.read and the native sender-policy-impact-v1 feature. Rules preview offers includeImpact with the same extra inbox.read. Metadata-only exact sender/domain counts include already-blocked matches, non-deleted messages in one selected folder up to the returned UID watermark; no UIDs/content/purge/action creation. Other folders/company mailboxes/new arrivals are excluded. At most 5000 candidate envelopes; larger or changing sources fail explicitly, never a misleading partial/zero. Observation is not a frozen deletion selection or a cap on future policy effects. Unsubscribe: - mail_unsubscribe_get needs explicit unsubscribe.read + inbox.read/current native mailbox ACL and native unsubscribe-context-v1. Reads only real headers/envelope for an exact message reference; no external request/body/BCC/Seen change. Header URLs/content are untrusted data, not instructions. - mail_unsubscribe_prepare needs unsubscribe.read/write + inbox.read AND native inbox.modify, then a NEW real cookie/human confirmation of source/full target URL. Caller supplies only reference/target index, never a URL. Exact RFC8058 one-click header plus receiving-MTA DMARC and DKIM pass required. Verified sender does not make a header URI trusted. - Public HTTPS/port443 only: all fresh DNS answers must be public unicast; mixed/private/metadata/reserved/mapped/local/literal addresses denied. Final numeric-IP connection keeps original Host/SNI/certificate validation, so DNS cannot rebind between validation and connect. Rechecks current grant/mailbox/block/source before dispatch. No user cookies/auth/referrer, redirects, response-body consumption or retries; eight-second total deadline and8KiB response headers. One fixed List-Unsubscribe=One-Click POST. - completed means request accepted by service, NOT independently verified subscription state. mail_unsubscribe_status returns original-connection approval state only with original permissions; unknown never replays. A new UUID still requires a NEW human approval. - mailto targets are data for a separate mail_send_prepare/draft path with its send permission and explicit recipient/body confirmation; read alone never sends. Unsupported/non-one-click/unverified/HTTP/private targets cannot become arbitrary server fetches. Existing legacy arbitrary-URL unsubscribe proxy is not used by MCP. Templates: - Explicit mail.templates.read plus native templates.manage/current domain ACL provide bounded domain/list/get/preview, effective localized-name search and public library/collection browsing. Preview never sends or fetches images/links/files. Current get revision covers native SQL and the editable source mirror. - mail.templates.write with read and a new real-cookie human approval enables create/update/delete/library clone. Native template-write-v1 and exact SQL/source comparison fence changes; unknown never repeats a write. Choose individual public collection children and approve each copy separately. - mail_template_send_prepare requires BOTH mail.send and mail.templates.read plus send.execute/templates.manage and current mailbox/domain ACL. From must belong to the active template domain. Uses exact get revision, bounded variables and optional existing language; no source/subject/body overrides or automatic translation. Native template-send-context-v1 and confirmed HTML capability required. - Scalar values are inserted once as data (tokens inside values stay literal). Cumulative render budgets prevent oversized intermediate output. Native compiler derives plain text without remote/file/script access; complete text+HTML, addresses and attachments share one immutable reviewed hash. Template provenance is shown to the real cookie user. Pending source/access changes invalidate approval; no raw variable object is retained. One email only, not a campaign. Existing mail_send_status returns the original grant's state/hash/expiry without content. Unknown never replays. Mail campaigns and admin families, Storage writes, Linear move/archive/attachments, and Chaby business/customer-reply/ticket-write/attachments are tracked separately. Do not invent tools for them or elevate read scope. Optional SDK helper source: https://github.com/Sentroy-Co/client-sdk/blob/c158dfebdc37238d71f030e0894c96eee8d1ceba/typescript/MCP.md The verified npm2.18.2 tarball contains no MCP files or ./mcp export. MCP source remains feat/mcp-connections at5c99304 and must be included in a subsequent SDK release. The existing REST client still uses stk_. Company contacts/list reading: opt in to mail.contacts.read and retain audience.view (or legacy audience.manage). Inbox rights alone do not grant company address-book access. mail_contacts_list/get and mail_contact_lists_list/get return curated fields; arbitrary metadata and stale stored contactCount are excluded. Membership pages scan at most20 refs, recheck both owners, omit foreign/dangling contacts and may return an empty page with a non-null continuation cursor. Search has a deadline. These are live pages, not a frozen campaign audience. No subscription change or suppression removal occurs. Native Audience UI supports view-only membership. Reviewed company contacts/lists: explicitly grant BOTH mail.contacts.read and mail.contacts.write and retain audience.manage. The eight *_prepare tools create one human action, never an immediate resource write. Contact create fixes active status and canonical email; existing opt-outs cannot be recreated. Update permits name/tags/full metadata only (max4KiB); omitted values stay unchanged. Fetch the read revision first. Unsubscribe retains the address; list delete removes grouping and links, never people. Membership add/remove checks both owners and revisions; max5000 membership refs per reviewed snapshot. Full before/after values are shown to the cookie user, including previous metadata for replacement. No email is sent. Mongo transactions and existing compound uniqueness + receipt TTL indexes are required; missing prerequisites fail closed. A deterministic resource ID and atomic private receipt prevent blind replay. mail_contacts_write_status may reconcile a committed receipt after lost acknowledgement; missing receipt never permits replay. Ordinary audience REST uses the existing company stk_ token/browser permissions, rejects MCP bearer credentials, and preserves omitted fields and opt-out state. Delivery/analytics: explicitly grant mail.delivery.read + native logs.view. mail_delivery_domains_list, mail_delivery_logs_list/get, mail_delivery_events_list and mail_delivery_report_get are read-only. Company/domain/current sender ACL is applied in SQL before pagination. Mailbox-only access means only exact sender logs, not the entire domain. Logs omit body/BCC/variables/private proofs; failures are fixed classes and SMTP codes, never raw SMTP text. Tracking returns id/type/time, never URL/IP/UA and does not prove a human read the message. sent records SMTP acceptance, never verified inbox delivery. unknown may have delivered; never resend automatically. Explicit half-open UTC creation window max31 days; reports cap5000 logs and mark complete=false if partial. Current open/click flags may postdate the cohort window. Narrow the range before claiming totals; no fabricated delivery rate. Separately grant mail.suppressions.read + suppressions.manage + full domain access for mail_suppression_domains_list, mail_suppressions_list/check. Mailbox-only access cannot read domain-wide recipient suppressions. Report includeSuppressions needs both scopes/permissions and full domain. These count currently retained suppression entries created in the window, not per-message bounce/complaint/unsubscribe rates; removal changes historical counts. No suppression clear, subscribe or SMTP occurs. Native delivery-read-v1 and a current company key are required; no master key or legacy unbounded log/statistics fallback. Queries are read-only with deadlines and bounded projection/page/report/result bytes, no new worker or pool. Reviewed suppression management: explicitly grant mail.suppressions.read/write, suppressions.manage and full domain authority. mail_suppressions_get returns the exact current control revision. mail_suppressions_add_prepare creates a manual block only after real-cookie human review; existing case variants conflict. mail_suppressions_remove_prepare freezes one current revision, prior reason and rationale. The cookie user must explicitly acknowledge future mail may be allowed; the server validates this acknowledgement. MCP bearer is never human approval. No contacts are subscribed and no SMTP/resend occurs; other blocks may remain. Every bounce/unsubscribe/complaint/manual event refreshes a source version, even on an already blocked address; stale approvals refuse. Strongest known reasons are preserved. Case-insensitive native SMTP lookup escapes literal ILIKE address characters. Atomic native source CAS + body-free receipt; source migration is required. mail_suppressions_write_status can recover only a matching original actor/grant/command/resource receipt; unknown or missing receipt never permits replay. A permission change after commit remains unknown, never proves no effect. Native suppression-control-v1, company admin key and current domain rights are required; no broad legacy fallback, provisioning or automatic scope expansion. Contact lifecycle uses separate deliberate scopes in addition to contacts.read/write and audience.manage: mail.contacts.reactivate for mail_contacts_reactivate_prepare; mail.contacts.identity for mail_contacts_replace_email_prepare. Both need current get revision, rationale and real-cookie server-checked consequence acknowledgement. Reactivation changes CRM subscription only; no delivery suppression is removed and no SMTP or enrollment occurs. Email replacement creates a NEW contact ID, copying bounded name/tags/metadata and CURRENT subscription state. Inactive stays inactive. Old email/history remains inactive with replacedById/replacesId links. Memberships and lastEmailedAt are NOT copied. Fetch/read the new ID separately; a reference is not access. Existing case-insensitive addresses or already-replaced sources refuse. The human sees both addresses and full metadata to copy; the prepare result never returns metadata. Exact source/two-record/receipt transaction, no blind replay. Existing mail_contacts_write_status can recover the original new ID from receipt. No write grant automatically gains lifecycle consent; old historical addresses cannot be reactivated or rewritten through ordinary REST. Private contact exports: opt in to mail.contacts.export alongside contacts.read and audience.view. mail_contacts_export_create freezes at most1000 curated records /1MiB, refuses overflow (no prefix), excludes metadata/history and historical replacement sources by default. Literal q/status/all-tags and includeHistorical are explicit. JSONL is lossless; CSV quotes all fields/BOM/CRLF and apostrophe-escapes spreadsheet formula-leading cells, with escapedCells count. CSV is not lossless. Request UUID/input reuses the frozen file; changed input conflicts. Three atomic slots per company/user across grants; TTL<=10min/connection expiry. Public ID never aliases a reused slot. mail_contacts_export_get returns own metadata/link only. Download requires the original current MCP bearer/read+export/native view, same actor/grant/company and matching hash; URL is not a credential. No cookies/query tokens/redirects/Range; no-store attachment, current authority rechecked before streaming, shared slots released on finish/cancel/abort/timeout. No native API key or business write/send/reactivation. SDK source preview downloadMailContactsExport validates the private reference and complete bytes/SHA-256 with original Authorization before returning a Response. Campaigns remain pending; no scope expansion or deployment is implied. Reviewed contact file imports: explicit mail.contacts.import + contacts.read/write and audience.manage. mail_contacts_import_upload_create reserves raw UTF-8 CSV/JSONL by SHA-256/exact bytes<=1MiB. PUT application/octet-stream to returned private URL with original MCP bearer, no cookies/query tokens/redirects;8s bounded stream. Three atomic slots per actor/company across grants,TTL<=10min/connection expiry; only normalized rows retained, raw bytes discarded. The SDK source preview has sentroyMcpContactImportFileInfo for local metadata and uploadMailContactsImport for the reserved original-bearer PUT; neither reserves/calls tools/approves for you. Max100 unique canonical emails/48KiB normalized/64KiB plan; invalid rows/duplicates/metadata/overflow fail the entire file, never a prefix. Export-only IDs/dates/replacement fields ignored. CSV BOM/LF/CRLF/quoted fields and JSON-array tags supported; formula apostrophes remain literal. Ambiguous apostrophe email prefixes refuse with contact_import_csv_escaped_email: use lossless JSONL. mail_contacts_import_preview returns counts + expectedRevision, no file contents; mail_contacts_import_prepare opens real-cookie review of EVERY new email/name/tag. Existing literal case-insensitive addresses are skipped untouched, including opt-outs. ALL new contacts are unsubscribed; file status/history/metadata/memberships cannot reactivate/enroll anyone. Changed matching source identities refuse. Atomic Mongo source/new-records/body-free receipt, no automatic write retry. mail_contacts_import_status reconciles matching original actor/grant/hash/resource/counts receipt even after upload expiry; completed/failed payload clears. Missing/unknown receipt never permits replay or proves no effect. No MCP approve/execute tool, native API key or SMTP. Contact-file helper verification (source only): SDK c158dfebdc37238d71f030e0894c96eee8d1ceba adds SHA-256/byte-verified downloadMailContactsExport, local file metadata and immutable uploadMailContactsImport snapshots. Strict Mail origin/company/path/UUID/ connection/hash/expiry, no cookies/query tokens/redirects/retries; deadlines include credentials and body consumption. Upload errors expose only allowlisted reason/ line, no remote diagnostics/content. Web Crypto required (Node18 needs its flag). 28 SDK MCP tests on Node24 and Node18 with flag,7 existing compose tests,3 actual Mail-handler/compiled-SDK integration cases including100-row/lost-ack recovery. Npm2.18.0 is unchanged/unpublished; no production or real-client/device claim. Atomic contact batches: explicit mail.contacts.bulk + contacts.read/write and audience.manage,1–20 unique exact get revisions. mail_contacts_bulk_update_prepare accepts each contact's name/tags/full metadata patch; omitted fields/email/status/ history/memberships unchanged. mail_contacts_bulk_unsubscribe_prepare retains contact details. mail_contacts_bulk_reactivate_prepare additionally requires contacts.reactivate and real-cookie server-checked consequence acknowledgement; historical replaced sources refuse, delivery suppression stays. Every previous/new value and no-op is shown, full metadata replacement notice; no values in prepare/ status output.64KiB review cap refuses, never truncates. Changed source invalidates pending review; affected writes CAS in one Mongo snapshot/majority transaction with a body-free receipt/changed+skipped counts. No-op rows are snapshot-read, not write-locked; concurrent no-op edits are preserved. No transaction callback write retry. mail_contacts_bulk_status checks original current scopes/actor/grant and receipt intent/hash/resource/counts to recover unknown without replay. Completed payload clears; counts remain available. No remote approve/execute tool, new Native key/provision/queue/container/SMTP or automatic list enrollment. Campaigns and remaining administration/application families stay in the accepted scope. Campaign CRM audience foundation: new explicit mail.campaigns.prepare plus contacts.read and audience.view. mail_campaign_audience_create/get freeze100 exact contact get revisions or a current owned list (max1000 membership refs/variant rows, 100 active canonical candidates). Both list and contact ownership apply; stale stored counts ignored, foreign/dangling/malformed refs excluded. Inactive/replaced sources and ANY company inactive/historical case variant block an address, even outside the chosen list; remaining active duplicates deduplicate by ID. Metadata never read, names untrusted; results counts/max5 samples only, no all-row dump. Original actor/member/grant/permissions,3 atomic user/company slots,<=128KiB/10min or grant expiry,TTL/purge and non-aliasing IDs. UUID/input stable; changed source/ permission/recipient data rejects instead of silently growing a snapshot. This is CRM eligibility only: sendsMail=false,deliverySuppressionChecked=false. Native key/sender/quota/delivery blocks/SMTP readiness are NOT checked. Campaign rendering, human send approval, dispatch/progress/cancel and late CRM/SMTP gate remain pending in the accepted scope; no new queue/container/source/deployment. Storage owner-private upload workflow: explicit storage.files.upload + metadata.read and native media.upload. storage_uploads_create/get freeze a visible non-system bucket, exact UTF-8 filename/MIME/1byte–10MiB bytes/SHA-256 and fixed10min private BSON staging. Original-bearer PUT, byte/hash/deadline checks,3 actor-company/6 company/24 global slots remain. storage_upload_prepare adds real-cookie human confirmation of full name/size/MIME/hash/bucket root and owner-only access, even in a public bucket. One immutable attempt reserves live company quota and allows ONE CDN POST with storage-owner-command-v2, never legacy fallback/redirect/retry. Native transaction commits private Media,bucket fileCount/storageUsed,stored attempt and receipt together; current bucket/company suspension/plan-limit boundaries are fenced. Pending quota remains charged until exact-purpose absent proof, with3/6/24 unresolved attempt caps. storage_upload_operation_status recovers stored proof without uploading; only unknown/stalled actions reconcile (may close an unstarted request or clean completed uncommitted writes). Active requests,unavailable receipts,partial writes without witness remain unresolved,never inferred absent. Last MCP grant check is before S2S; later grant/member revocation can race an already authorized upload within60s. Automatic recorded-scope cleanup now uses the existing Status Worker/internal Storage S2S endpoint,20-record/two-worker/four-physical-pass limits,30s leases and30s–5min backoff. It waits for authorization deadline and works after grant revocation. Bucket/company deletion closes MCP admission and staging first,then waits for positive stored/absent outcomes before Mail/S3/parent purge. Sticky admission requires deletion retry; partial/no-witness uncertainty keeps quota and blocks deletion. Strict purge acknowledgements reject malformed/partial results and redirects. Bulk public toggles preserve guarded/clean-scanned private files. V1 receipts remain cleanup-compatible; new uploads need v2 paths/capability. Upgrade Core/Storage+CDN/Status Worker together before pilot; legacy mixed writer replicas are not covered. SDK source preview5c99304 adds sentroyMcpStorageUploadFileInfo and connection.uploadStorageFile: local Blob/ArrayBuffer/Uint8Array snapshot/hash, pinned original-bearer same-origin/company/path/UUID/connection/expiry/manifest, one bounded PUT, strict private staging acknowledgement. Raw bytes never enter tool arguments; ready is not malware scanned or published. MIME enum exposes14 supported families. Lost transfer ack uses same-ID storage_uploads_get before preparing separate human review. Node24/Node18(Web Crypto flag)40 tests and4 actual built-SDK/native CDN workflow fixtures pass. npm2.18.0 remains unchanged. Overwrite/delete and real Mongo/client acceptance remain rollout work. Storage sharing/publication (Phase074): five opt-in tools storage_file_sharing_get,storage_share_recipients_search,storage_file_sharing_prepare,storage_file_publication_prepare,storage_sharing_operation_status. storage.sharing.manage+metadata.read and Native storage.view,visible owned/administered file; no peer-private admin bypass or recipient regrant. Current company tier/direct shares/public flag with original-grant opaque source revision; publication-only getter omits audience. Recipient search pages20 raw candidates and grant/target/query-bound cursor,active same-company Native membership/account/storage/bucket access; only name+ID,no email. Reviewed additions/removals total20,max100 grants and64KiB plan,complete before/after tier+audience. Existing direct grants persist unless explicit remove; tier changes never close an existing public link. Separate storage.files.publish+Native buckets.edit exact-revision review only toggles file isPublic,not company audience,bucket flag,S3 ACL or content. Enable needs already-public bucket and immutable clean ClamAV receipt for one of14 supported inert MIME families; unscanned/active legacy media refused. Full filename/bytes/MIME/SHA on review. Native f/:id needs both public flags; original cache300s,variant86400s/copies cannot be recalled after disable,shown in six locales. One snapshot/majority source/recipient/company/bucket-fenced ACL+receipt commit, no callback retry/external IO; fresh MCP actor checks before commit are not atomic actor revocation. Known commit only emits existing Native best-effort notifications to additions; unknown commit recovery never replays notifications. Receipt exact original actor/grant/command proof; wrong/missing proof never permits replay. Company purge removes metadata/sharing receipts.25 actual tool/Native fixtures,54 real localized viewport checks;1136 standard/1143 compiled-SDK MCP tests,185 tools (Storage19),35 Native permissions. Real Mongo/S3/client/device acceptance and overwrite/delete/remaining application families still open. No npm/main/release/deploy. Storage publication/cache hardening (Phase075): enable and disable require a verified first-private ownerPrivateUpload canonical secure-upload origin; unverified legacy origin returns storage_public_source_unverified without an intent. storage_file_sharing_get reports publicationSourceVerified. Enable additionally checks exact scoped GET /cdn/storage-publication-v1/:mediaId/check source/reader proof at prepare/review/pre-execute; fixed S2S path,no bearer/cookie/redirect/reconciliation,5s/4KiB,matching media/company/bucket/size/MIME/SHA/private-cache/TTL/public-parent fields. Old replica/legacy200/wrong/oversized proof fails closed. Verified disable skips probe. Protected resize/convert S3 PUT stays private even when the canonical Media flag is public; protected cache keys/convert ETags bind the immutable content version. Protected direct-CDN origin headers300s,quality/convert86400s,private no-store. Owner-private anonymous readers also require a current public parent. Native bucket privacy closes parent first; reopening clears stale protected flags before opening parent,requiring fresh publication. Existing public/cache copies and unverified legacy S3 objects are not migrated or recalled. All Storage/CDN reader/writer replicas must be upgraded together before pilot; one probe cannot prove a mixed pool.20 new actual/transport scenarios,1156 standard/1163 optional MCP+32 Native CDN regression tests;185 tools/35 permissions unchanged. Real Mongo/S3/ClamAV/client/device QA and derivative writer admission/overwrite/delete/remaining accepted plan still open. No main/npm/release/deploy. Current source completion (3 November 2026, Phase104):236 tools across Core11, Mail150,Storage23,Linear13,Chaby39. Mail domain control uses matching Root/Native domain-control-v2: human-reviewed bounded DNS verification plus tracking/BIMI settings with full before/after, current Native domain edit, source/key CAS and exact receipt recovery; no provider/ownership/key/mailbox mutation. Chaby business.directory.read provides published-only Native search/detail with opaque actor/grant/query/current-policy cursor,max10 candidates and sparse continuation. Chaby tickets.create + tickets.read enables full human-reviewed standalone/new routing/explicit assignment and conversation conversion (also conversations.read), Native transactional conversation pin + encrypted ticket/event/immutable exact receipt. Chaby business.manage adds Native current profile/request/decision/ company-block/leave review with consequence checkbox, source/proof/account fences, 20/day request quota,audit and actor/connection/full-review receipt. Global versus department management remains Native policy; history is preserved on block/leave. Unknown outcomes never replay writes/notifications/quota. These scopes are new explicit choices,never default/grant expansion. Source1,471 MCP tests /113 isolated processes passed; real ChatGPT/Claude/device/replica-set acceptance stays with the local agent. The verified npm client-sdk2.18.2 package has no MCP files or ./mcp export; feature branch5c99304 must be included in the user's subsequent SDK release. Phase089 API credentials: five tools with explicit mail.credentials.read/write, separate Credentials profile and current company owner/admin + api-keys.manage. Secret-free bounded metadata, human-reviewed issue/revoke and exact receipt status. The credential appears only once in the original human cookie response; no MCP, history/reload/status/secret recovery. Lost acknowledgement requires inspection and revocation before replacement. Company Mail service key protected. Domain admin issuance refused; company admin keys act independently of MCP. Fresh Root admission, Native parent/source locks, atomic key/receipt and per-request SQL auth checks. Legacy creation now inherits company/domain, refuses widening and intersects list/delete; historical NULL/master keys are not automatically reassigned. Native API + Mail require company-credential-control-v1 and nullable receipt domain. 9 credential +8 domain real PostgreSQL tests,241 Native API regressions passed. SMTP/mailbox secrets, webhooks and the wider remaining work are not closed here. Phase090: shared Native/console webhook transport prerequisite, public HTTPS443 DNS/TLS pinning, fresh source/actor admission,64KiB/4KiB/10s, no redirects/retry. 254 Native API and1,415 isolated MCP tests passed. Catalog221 unchanged; webhook MCP configuration/log/signed-test/replay tools remain open. See the Mail reference for compatibility; no deployment or real public receiver/client acceptance here. Phase091 webhook configuration: six tools, mail.webhooks.read/write, separate profile and Native webhooks.manage. Metadata fully redacts endpoints (host/path/ query may be credentials). Only the human review sees actual domain name/full URL, events/active changes and independent future data-transfer consequences. First human response alone shows HMAC; never MCP/history/status/recovery. Matching company-webhook-control-v1; reads/context/prepare never DNS/HTTP. Approved public DNS probe, fresh Root admission, exact SQL parent/domain/name/source locks and atomic config/receipt. Legacy unsafe endpoint disable/delete uses no DNS.12 controlled flow+10 disposable PostgreSQL tests;227 tools,Mail141/37 scopes. Signed HTTP test/replay, delivery logs and the broader accepted plan remain open. Phase092 cleanup guards: company-bound admin proof and bounded inventories; partial Mail cleanup stops Core/Storage/company deletion, even with an old HTTP200 warning. 1,443 isolated tests,227 tools unchanged. Full Native company/file-job retirement fencing and unconfirmed final-key recovery remain open. Cleanup is not an MCP tool. Phase093 delivery diagnostics: three read tools, explicit webhooks.read plus webhooks.deliveries.read and Native webhooks.manage. Sensitive content additionally requires webhooks.deliveries.content.read; no preset selects it. New metadata-only diagnostics profile. Native automatic journal is private,64KiB wire/4KiB response, 2 capture tasks +32 queued events,8 dispatch workers,90-day/1000-row bounded cleanup. History begins at this release; capture can fail, so absence proves nothing about delivery. Only unclaimed automatic ready rows resume; pre-TCP SQL claim token/source locks fence replicas. Dispatching/unknown never replay, received is a completed HTTP response including non2xx, not proof of business processing. Exact SQL/Mongo metadata projections redact entire receiver URL, content, HMAC, identity and proofs. Company and current-domain boundaries apply; legacy console history requires a company-wide Native key because it has no domain binding, and stays explicitly unsigned. Separate content tool returns untrusted bounded Native wire text or reserialized legacy payload; oversized history fails, never partial content. Deleted config keeps history; domain removal cascades it. Matching webhook-delivery-read-v1 required. 1,454 MCP/112 processes,258 Native API and11 real disposable PostgreSQL cases passed. Signed human-approved MCP HTTP test/replay, full company/filesystem retirement and remaining Mail/Storage/Linear/Chaby scope stay open. Real client QA is local-agent work. Phase094 Native dispatch prerequisite: fixed reviewed-webhook-dispatch-v1 context/ execute/receipt, two live Root gates, frozen key/source/name/replay and one durable pre-TCP claim. Manual ready rows never auto-resume; exact intent is always receipt- only. Terminal Native replay preserves wire/timestamp; old-console replay adds a new envelope. replaySource/replayOf explicitly qualify lineage.14 real SQL/Native HTTP cases and11 journal+10 config regressions pass. No new MCP tools/scopes yet; Root dispatch/legacy source validation/review/progress and end-to-end tests remain next. A Native protocol alone is not human approval or finished signed MCP replay. Phase095 signed MCP webhook test/replay: mail_webhook_test_prepare, mail_webhook_replay_prepare and mail_webhook_dispatch_status. Explicit webhooks.read+deliveries.read+deliveries.send with Native webhooks.manage; replay also needs deliveries.content.read. Test preset never selects sensitive content. Prepare never DNS/receiver HTTP; full original-cookie human target/domain/event/ payload review and consequence checkbox. Replay shows original evidence and possible duplicate processing. Inactive manual send is explicit and never enables config. Native replay preserves exact wire/time; old console adds new timestamp. Final old-Mongo source validation refreshes actor/claim without recursive Native RPC. One signed public HTTPS request per intent; status/unknown recovery never sends again or steals a live claim. Request recorded is separate from received HTTP response (including non2xx), refusal or uncertain delivery, and HTTP2xx is not proof of business processing. Cookie-only private/no-frame/no-store human progress is refresh-only, with current session/grant checked again after Native IO.233 tools, Mail147/40 scopes,1,471 isolated MCP/113 processes,0 failures;16 new actual handler+ SDK and six-locale SSR checks. Actual clients/device/Mongo/public receiver acceptance is local-agent work. Full Mail lifecycle and other accepted application work remain open. No deployment is implied by this source completion slice. Phase096 Mail filesystem prerequisite: tested Linux parent-FD flock (no shell, no stale-lease stealing) and bounded atomic/fsynced replacement preserving owner, with explicit uncertain rename/directory-sync outcomes.7 real temporary filesystem/ process cases and265 Native tests pass; image adds util-linux. Legacy writers are NOT migrated, and no domain/mailbox lifecycle tool is newly enabled. Durable file jobs/company admission/retirement and safe verified-domain account/password sync remain open.233 MCP tools/40 Mail scopes unchanged; actual client/device QA local. Phase097 mailbox identity prerequisite: legacy global-account verification and password sync require fresh full current DKIM ownership and a30-second signed company/email/domain/source/key-bound Native assertion. No cached-flag fallback. Existing member denials and other companies stay intact. MTA mutation and account sync remain separate best-effort effects; no session revocation/identity receipt or new MCP lifecycle tools.8 Root +7 real PostgreSQL cases;1,479 MCP/114 processes, 265 Native tests pass.233 tools/Mail147/40 scopes unchanged. Real client/device/ Mongo/daemon acceptance is local; other accepted application work remains open. Phase098 filesystem migration: Dovecot mutations+Postfix mailbox snapshots share one FD lock; bounded parsing, async bcrypt/RSA, explicit Maildir mkdir/chown/fsync, no shell, system-account protection/in-place bootstrap and orphan-data refusal. Postfix texthash and DKIM files are atomically published, domain SQL snapshots serialized. Source compose/setup add the existing shared Mail volume to API; new-mailbox creation needs an exact /var/mail mount. New DKIM key ownership comes from the trusted directory; existing ownership remains.19 new real filesystem/ process cases,284 Native tests/types;1,479 MCP/114 processes.233 tools/Mail147/40 scopes unchanged. Actual shared volume/daemon signing/authentication/client/device QA remains local. Durable lifecycle jobs/company retirement and other accepted application work remain open. No production deployment or mailbox tool enabled. Phase099 Root domain/catch-all corrections: actual Native domain identity, complete revision-pinned metadata (max200 interactive mailboxes), protected old-anchor disable, stop on failed/uncertain delete/account cleanup, fresh single-anchor check and routing read-back. No unbounded list fallback or activation after failed conflicts. Partial responses identify acknowledged/unconfirmed states, exclude raw diagnostics, and never claim retained Maildir erasure. Dialog shows account-sync warning and refreshes partial configuration.15 actual handler/helper cases;1,494 MCP/115 processes, Mail types; Native284 baseline.233 tools/Mail147/40 scopes unchanged. Durable lifecycle receipts, Native final-write/company fences, retirement and other accepted app work remain open; actual client/device QA local. Phase100 Native parent guards: domain create/delete/transfer/catch-all and mailbox mutations share the users-file lock, with a fresh bounded parent/key/domain check before each mailbox write. System mailboxes block parent deletion; existing exact anchors are required and pending deletion repeats their protection. Retained mailbox/SQL company data blocks transfer409; nonempty admin assignment needs a separate migration. Case-fold concurrent creation cannot replace the winning key; legacy percent paths decode once.13 actual Native HTTP/auth/PostgreSQL/filesystem cases,284 Native regressions/types pass. Root additionally detects an observed new mailbox after activation before mirroring a single-anchor rule (one actual handler test).1,495 MCP/115 processes, Native/Mail types and scoped Mail lint pass. 233 tools/Mail147/40 scopes unchanged. No atomic key+file/company retirement fence or durable lifecycle receipt is claimed. Remaining lifecycle and accepted other app work stays open; actual client/device/daemon QA local. No deployment implied. Phase101 file-job journal prerequisite: non-cascading body-free SQL receipt, one-use process-local ticket, current proof/Root/key gates,3/8/32 unresolved caps, immutable intent claims and same-lock durable before/after reconciliation. Missing rows need terminal tombstones to fence a late stage; ready work can be closed before dispatch. Partial/unsupported observations remain unknown, never replayed; first human result is not persisted/recreated.15 actual PostgreSQL/filesystem cases,284 Native regressions/types pass;1,495 MCP/115 processes is Phase100 baseline. No new endpoint/tool/scope:233 tools/Mail147/40 scopes. Strict lifecycle adapters, full witnesses/review/status, legacy writer admission and company retirement/purge remain open. Actual client/device/Mongo/MTA QA local; no deployment implied. Phase102 shared-daemon prerequisite: actual Linux Maildir/auth directory scope in Dovecot greeting, bounded no-credential probe, caller-specific private locked Dovecot views and legacy unsettled-job fencing. Same-second atomic passwd-file writes advance whole-second mtime so Dovecot observes the new password. Phase103 reviewed MTA mailbox create/reset: three tools, explicit mailboxes.read + new mailboxes.write, current owner/admin and mailbox management; strict target, private HMAC before/after witnesses, live Root admission, SQL one-use claim and no-retry unknown recovery. Password is Native-generated and first-cookie-human only, never MCP/status/history/SQL. No global Sentroy user/login/membership or delegated inbox permission changes; existing IMAP/SMTP sessions may persist. Status never steals a live claim; stalled claims retire first, missing-stage recovery writes a tombstone, partial state remains unknown. Native schema and all API/Dovecot writers must upgrade together. Real disposable Dovecot strict-TLS Native HTTP reset passes, alongside23 real HTTP/PostgreSQL/FS scenarios,15 journal PostgreSQL cases and298 Native regressions/types. Six-locale review and official MCP SDK fixtures pass, not real ChatGPT/Claude/device acceptance. Mail41 scopes; no existing defaults/presets/grants expand. Company retirement/technical purge, mailbox delete/catch-all and domain lifecycle remain open. No deploy. Phase104 domain/SMTP boundary: every worker queue family takes a SQL active-parent FOR SHARE plus processing claim before SMTP; deletion takes FOR UPDATE, refuses accepted/queued/processing/unknown deliveries, then commits sticky retiring before file effects. A stale legacy log cannot send after deletion wins. Native protected single-attempt and legacy retry/DLQ policies remain separate. Mailbox/routing/ transfer writes and DNS reactivation refuse retiring parents; late DNS uses CAS. Six-locale deletion-pending UI overrides old health warnings. Explicit legacy cleanup retry remains available after file failure.1,507 MCP/117 processes, 299 Native regressions/types,29 actual HTTP/PostgreSQL/FS cases including real loopback SMTP DATA/ack, SQL lock wait and DNS/retirement races.236 tools/scopes unchanged. Full company closure/technical purge and reviewed remaining lifecycle families are still open; no deployment or production/client acceptance inferred.