Reference · generated

Every operation kovee answers, and every CLI verb it ships.

The registry below is the authority on what exists: 96 operations over 100 (operation, surface) entries in 4 bundles, at registry revision k2-4. If an operation is not on this page, kovee does not have it.

96 operations 6 CLI verbs 197 schemas pre-release

This page is generated by docs-tools/gen_reference.py from spec/registry.json, spec/schemas/, crates/kovee-cli/src/main.rs and crates/koveed/src/handlers.rs. Editing it by hand is pointless — docs-tools/check_docs.py regenerates it and fails on any difference.

How to read this

An entry is one (operation, surface) pair. A few operations are reachable from two surfaces with different authority, so there are more entries than operations. Each card carries the registry's own fields:

Field	What it means
`Surface`	Which socket and channel may carry it: `external_client`, `worker`, or `operator`.
`Actor`	The actor kinds the registry admits for that surface.
`Kind`	Mutation or query. A mutation requires `meta` (`request_id` and `idempotency_key`); a query does not.
`Args`	Argument names taken from the operation's request schema. A trailing `?` marks an optional one.
`Dependencies`	The AuthorizationDependencySet categories re-read at authorization time; a change to any of them invalidates the decision.
`Fence`	The compare-and-swap or epoch the operation is bound to, where it has one.
`Offline`	`no`, `queueable`, or `cached_draft_only`.

CLI

The shipped kovee binary has 6 verbs. This is its own USAGE string, read out of crates/kovee-cli/src/main.rs:

kovee — usage

kovee hello
kovee init
kovee space create --project <id> --title <t> [--visibility project|restricted]
kovee space show --project <id> <space_id>
kovee space contribute --project <id> --space <id> --text <t> [--kind <kind>]
kovee events --project <id> [--after <cursor>] [--limit <n>]

There is no --help flag: any unrecognised verb prints this block on stderr and exits 2. Each verb is a thin client — it writes one JSON command line to the daemon socket and prints the result (or the problem) it reads back. These are the wire operations each verb actually sends, in order:

Verb	Operations sent
`kovee hello`	`hello`
`kovee init`	`hello`, `realm_show`, `project_create`
`kovee space create --project <id> --title <t> [--visibility project\|restricted]`	`space_create`
`kovee space show --project <id> <space_id>`	`space_show`
`kovee space contribute --project <id> --space <id> --text <t> [--kind <kind>]`	`space_show`, `events_read`, `contribution_append`
`kovee events --project <id> [--after <cursor>] [--limit <n>]`	`events_read`

Defaults, taken from the same source:

--visibility defaults to project.
--kind defaults to utterance.
--limit defaults to 100.

Two flags are accepted but not advertised in the usage block: space create and space contribute both take --idempotency-key <key>, which replaces the random key the CLI would otherwise mint — replay the same key and you get the stored result back rather than a second record.

Envelope schemas

Five schemas describe the envelope every operation shares — the command, its result, an event, a problem, and the hello exchange. The per-operation schemas linked from each card below describe only the args and result payloads inside them.

Schema
`kcp-command-result.schema.json`	source
`kcp-command.schema.json`	source
`kcp-event.schema.json`	source
`kcp-hello.schema.json`	source
`kcp-problem.schema.json`	source

Problems

A refused command comes back as {"outcome":"problem","problem":{…}} with a typed type, a title, and usually a detail line naming the rule that was broken. The kinds are closed — there are 21 of them, each with a pinned status:

Type	Status
`urn:kovee:error:invalid`	422
`urn:kovee:error:unauthenticated`	401
`urn:kovee:error:forbidden`	403
`urn:kovee:error:not-found`	404
`urn:kovee:error:unsupported-version`	400
`urn:kovee:error:unknown-op`	400
`urn:kovee:error:forbidden-surface`	403
`urn:kovee:error:stale-revision`	409
`urn:kovee:error:stale-lease`	409
`urn:kovee:error:idempotency-mismatch`	409
`urn:kovee:error:idempotency-result-expired`	410
`urn:kovee:error:authorization-stale`	409
`urn:kovee:error:budget-exceeded`	409
`urn:kovee:error:deadline-exceeded`	409
`urn:kovee:error:cycle`	409
`urn:kovee:error:cursor-expired`	410
`urn:kovee:error:snapshot-expired`	410
`urn:kovee:error:rate-limited`	429
`urn:kovee:error:ambiguous`	409
`urn:kovee:error:unavailable`	503
`urn:kovee:error:internal`	500

MCP tools

kovee-mcp binds 14 operations as MCP tools, all on the participant profile — no worker- or operator-surface operation is ever bound. Each tool's input schema is derived from the operation's request schema minus the fields the channel already fixes. Mutations are gated for your harness to prompt on; reads are marked safe to allow, with one exception whose result carries a live storage credential.

Tool	Operation	Access
`kovee_contribution_append`	`contribution_append`	gated
`kovee_contribution_show`	`contribution_show`	safe to allow
`kovee_contribution_list`	`contribution_list`	safe to allow
`kovee_relation_assert`	`relation_assert`	gated
`kovee_space_show`	`space_show`	safe to allow
`kovee_context_assembly_show`	`context_assembly_show`	safe to allow
`kovee_artifact_upload_begin`	`artifact_upload_begin`	gated
`kovee_artifact_upload_show`	`artifact_upload_show`	safe to allow
`kovee_artifact_upload_credential`	`artifact_upload_credential`	gated
`kovee_artifact_upload_finalize`	`artifact_upload_finalize`	gated
`kovee_artifact_upload_abort`	`artifact_upload_abort`	gated
`kovee_artifact_show`	`artifact_show`	safe to allow
`kovee_events_read`	`events_read`	safe to allow
`kovee_events_wait`	`events_wait`	safe to allow

Bundles

A bundle is atomic: a client may assume every operation in it, or none. That is why an incomplete bundle is not advertised even when its operations dispatch — hello and protocol_info report exactly the bundles named K1_FEATURE_BUNDLES in crates/koveed/src/handlers.rs.

Bundle	Operations	Entries	In `hello`
`core_v1`	3	3	advertised
`shared_space_v1`	62	65	advertised
`developer_assistant_v1`	22	23	advertised
`governed_work_binding_v1`	9	9	not advertised

Limit

governed_work_binding_v1 is the incomplete one. Its operations dispatch over the socket, but a client that discovers capabilities the supported way — by reading hello — will not see it, and should not depend on it.

Operations

`core_v1` — 3 operations

diagnose

core_v1 operator

KCP diagnose result (derived — gap note KG3)

Surface: operator
Actor: principal
Kind: query
Args: checks?
Scope: installation diagnostics/audit action
Assurance: current login
Dependencies: current_authentication_observation, installation_recovery_epoch, membership, principal_status, realm_status_kill_epoch
Constraints: realm and role dependencies bind only where the diagnostic is realm-scoped
Fence: none
Offline: no
Schemas: request · result
Source: DESIGN.md §11.6 (core_v1 row) + §11.6.1 (family: diagnose, audit_export)

hello

core_v1 external_client

KCP hello result (DESIGN.md §11.1)

Surface: external_client
Actor: pre-auth channel
Kind: query
Args: supported_versions implementation implementation_version requested_features
Scope: bounded public installation metadata; protocol negotiation only
Assurance: none
Dependencies: none
Constraints: none
Fence: none
Offline: no
Schemas: request · result
Source: DESIGN.md §11.6 (core_v1 row) + §11.6.1 (family: hello, public protocol_info)

protocol_info

core_v1 external_client

KCP protocol_info result (DESIGN.md §11.1, §11.6.1; derived — gap note KG2)

Surface: external_client
Actor: pre-auth channel
Kind: query
Args: none
Scope: bounded public installation metadata; protocol negotiation only
Assurance: none
Dependencies: none
Constraints: none
Fence: none
Offline: no
Schemas: request · result
Source: DESIGN.md §11.6 (core_v1 row) + §11.6.1 (family: hello, public protocol_info)

`shared_space_v1` — 62 operations

artifact_show

shared_space_v1 external_client

KCP artifact_show result (DESIGN.md §10.10, §11.6.1 read family)

Surface: external_client
Actor: connector service (only for its mapped resources), principal
Kind: query
Args: artifact_id
Scope: exact resource read/resume action; resume cursor where applicable
Assurance: current login or workload identity
Dependencies: classification_retention_policy, contribution_relation_endpoint_visibility, external_visibility_proof, membership, principal_status, project_status_revision, realm_status_kill_epoch, service_identity_capability, space_access_participant_binding, target_resource_revision
Constraints: external visibility proof required only where the target carries external-sourced material
Fence: none
Offline: cached_draft_only
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: *_show, *_list, lens_read, events_read, events_wait, event_payload, snapshot_read, presence_list, realtime_resume, artifact_upload_credential)

artifact_upload_abort

shared_space_v1 external_client

KCP artifact_upload_abort result (DESIGN.md §10.10, §11.6.1 space/content mutation family)

Surface: external_client
Actor: mapped connector (only for contribution/reaction/upload operations granted to it), principal
Kind: mutation — meta required
Args: upload_id reason?
Scope: exact action and space scope
Assurance: current login (principal); workload identity (mapped connector)
Dependencies: branch_status_frontier, classification_retention_policy, contribution_relation_endpoint_visibility, kovee_policy_set, membership, principal_status, service_identity_capability, space_access_participant_binding, target_resource_revision
Constraints: this family excludes project status and every prepared access-widening operation
Fence: none
Offline: no
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: project/Space creation and metadata; Space lifecycle/restrict/policy-narrow; participant proposal/update/removal; contribution/disposition; semantic-relation/disposition; lens, reaction, frontier, and artifact-upload mutations)

artifact_upload_begin

shared_space_v1 external_client

KCP artifact_upload_begin result (DESIGN.md §10.10, §11.6.1 space/content mutation family)

Surface: external_client
Actor: mapped connector (only for contribution/reaction/upload operations granted to it), principal
Kind: mutation — meta required
Args: declared_raw_sha256 declared_size declared_media_type classification_ref?
Scope: exact action and space scope
Assurance: current login (principal); workload identity (mapped connector)
Dependencies: branch_status_frontier, classification_retention_policy, contribution_relation_endpoint_visibility, kovee_policy_set, membership, principal_status, service_identity_capability, space_access_participant_binding, target_resource_revision
Constraints: this family excludes project status and every prepared access-widening operation
Fence: none
Offline: no
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: project/Space creation and metadata; Space lifecycle/restrict/policy-narrow; participant proposal/update/removal; contribution/disposition; semantic-relation/disposition; lens, reaction, frontier, and artifact-upload mutations)

artifact_upload_credential

shared_space_v1 external_client

KCP artifact_upload_credential result (DESIGN.md §10.10, §11.6.1 read family)

Surface: external_client
Actor: connector service (only for its mapped resources), principal
Kind: query
Args: upload_id
Scope: exact resource read/resume action; resume cursor where applicable
Assurance: current login or workload identity
Dependencies: classification_retention_policy, contribution_relation_endpoint_visibility, external_visibility_proof, membership, principal_status, project_status_revision, realm_status_kill_epoch, service_identity_capability, space_access_participant_binding, target_resource_revision
Constraints: external visibility proof required only where the target carries external-sourced material
Fence: none
Offline: cached_draft_only
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: *_show, *_list, lens_read, events_read, events_wait, event_payload, snapshot_read, presence_list, realtime_resume, artifact_upload_credential)

artifact_upload_finalize

shared_space_v1 external_client

KCP artifact_upload_finalize result (DESIGN.md §10.10, §11.6.1 space/content mutation family)

Surface: external_client
Actor: mapped connector (only for contribution/reaction/upload operations granted to it), principal
Kind: mutation — meta required
Args: upload_id
Scope: exact action and space scope
Assurance: current login (principal); workload identity (mapped connector)
Dependencies: branch_status_frontier, classification_retention_policy, contribution_relation_endpoint_visibility, kovee_policy_set, membership, principal_status, service_identity_capability, space_access_participant_binding, target_resource_revision
Constraints: this family excludes project status and every prepared access-widening operation
Fence: none
Offline: no
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: project/Space creation and metadata; Space lifecycle/restrict/policy-narrow; participant proposal/update/removal; contribution/disposition; semantic-relation/disposition; lens, reaction, frontier, and artifact-upload mutations)

artifact_upload_show

shared_space_v1 external_client

KCP artifact_upload_show result (DESIGN.md §10.10, §11.6.1 read family)

Surface: external_client
Actor: connector service (only for its mapped resources), principal
Kind: query
Args: upload_id
Scope: exact resource read/resume action; resume cursor where applicable
Assurance: current login or workload identity
Dependencies: classification_retention_policy, contribution_relation_endpoint_visibility, external_visibility_proof, membership, principal_status, project_status_revision, realm_status_kill_epoch, service_identity_capability, space_access_participant_binding, target_resource_revision
Constraints: external visibility proof required only where the target carries external-sourced material
Fence: none
Offline: cached_draft_only
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: *_show, *_list, lens_read, events_read, events_wait, event_payload, snapshot_read, presence_list, realtime_resume, artifact_upload_credential)

context_assembly_create

shared_space_v1 external_client worker dual-surface

KCP context_assembly_create result (DESIGN.md §10.8, §14.1, §11.6.1 prepare/propose + worker families)

Surface: external_client, worker
Actor: fenced worker (exact listed proposal operation in its capability), principal
Kind: mutation — meta required
Args: space_id branch_id audience_ref purpose selection_policy_ref required_refs? trigger_refs? recipe_ref? recipe_revision? attempt_id? fence_epoch?
Scope: assembly; ceilings; current invocation; exact prepare/propose action; fence; output scope; subject digest
Assurance: current login; worker capability
Dependencies: branch_status_frontier, commitment_terms_acceptance, context_item_visibility, service_identity_capability, target_resource_revision
Constraints: none
Fence: current attempt fence; none
Offline: no
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: branch fork/freeze/reopen/archive; merge prepare/reject/withdraw; context assembly request; context-recipe mutation; Need/Offer/Formation/amendment/attention preparation and proposal)

context_assembly_show

shared_space_v1 external_client

KCP context_assembly_show result (DESIGN.md §10.8, §11.6.1 read family)

Surface: external_client
Actor: connector service (only for its mapped resources), principal
Kind: query
Args: assembly_id
Scope: exact resource read/resume action; resume cursor where applicable
Assurance: current login or workload identity
Dependencies: classification_retention_policy, contribution_relation_endpoint_visibility, external_visibility_proof, membership, principal_status, project_status_revision, realm_status_kill_epoch, service_identity_capability, space_access_participant_binding, target_resource_revision
Constraints: external visibility proof required only where the target carries external-sourced material
Fence: none
Offline: cached_draft_only
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: *_show, *_list, lens_read, events_read, events_wait, event_payload, snapshot_read, presence_list, realtime_resume, artifact_upload_credential)

contribution_append

shared_space_v1 external_client worker dual-surface

KCP contribution_append result (DESIGN.md §10.2, §10.3, §11.2, §11.6.1 space/content mutation + worker families)

Surface: external_client, worker
Actor: invocation attempt only, mapped connector (only for contribution/reaction/upload operations granted to it), principal
Kind: mutation — meta required
Args: space_id branch_id expected_head_digest kind body_parts schema_ref? subject_refs? source_refs? epistemic_posture? classification_ref? retention_policy_ref? attempt_id? fence_epoch?
Scope: attempt; budget; exact action and space scope; exact operation and space/object scope listed in the invocation capability; invocation manifest
Assurance: current login (principal); workload identity (mapped connector); workload identity plus invocation capability
Dependencies: branch_status_frontier, classification_retention_policy, context_item_visibility, contribution_relation_endpoint_visibility, kovee_policy_set, membership, principal_status, service_identity_capability, space_access_participant_binding, target_resource_revision
Constraints: the complete current authorization dependency set is required; this family excludes project status and every prepared access-widening operation
Fence: current Kovee fence and byom fence when bound; none
Offline: no, queueable
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: project/Space creation and metadata; Space lifecycle/restrict/policy-narrow; participant proposal/update/removal; contribution/disposition; semantic-relation/disposition; lens, reaction, frontier, and artifact-upload mutations)

contribution_list

shared_space_v1 external_client

KCP contribution_list result (DESIGN.md §10.2, §11.6.1 read family)

Surface: external_client
Actor: connector service (only for its mapped resources), principal
Kind: query
Args: space_id branch_id? kind? after? limit snapshot?
Scope: exact resource read/resume action; resume cursor where applicable
Assurance: current login or workload identity
Dependencies: classification_retention_policy, contribution_relation_endpoint_visibility, external_visibility_proof, membership, principal_status, project_status_revision, realm_status_kill_epoch, service_identity_capability, space_access_participant_binding, target_resource_revision
Constraints: external visibility proof required only where the target carries external-sourced material
Fence: none
Offline: cached_draft_only
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: *_show, *_list, lens_read, events_read, events_wait, event_payload, snapshot_read, presence_list, realtime_resume, artifact_upload_credential)

contribution_redact

shared_space_v1 external_client

KCP contribution_redact result (DESIGN.md §10.2, §11.6.1 space/content mutation family)

Surface: external_client
Actor: principal
Kind: mutation — meta required
Args: contribution_ref reason_class
Scope: exact action and space scope
Assurance: current login; policy may require step-up
Dependencies: branch_status_frontier, classification_retention_policy, contribution_relation_endpoint_visibility, kovee_policy_set, membership, principal_status, space_access_participant_binding, target_resource_revision
Constraints: connector redaction disallowed pending a design amendment (R0 KREG-02 decision); this family excludes project status and every prepared access-widening operation
Fence: none
Offline: no
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: project/Space creation and metadata; Space lifecycle/restrict/policy-narrow; participant proposal/update/removal; contribution/disposition; semantic-relation/disposition; lens, reaction, frontier, and artifact-upload mutations)

contribution_show

shared_space_v1 external_client

KCP contribution_show result (DESIGN.md §10.2, §11.6.1 read family)

Surface: external_client
Actor: connector service (only for its mapped resources), principal
Kind: query
Args: contribution_id
Scope: exact resource read/resume action; resume cursor where applicable
Assurance: current login or workload identity
Dependencies: classification_retention_policy, contribution_relation_endpoint_visibility, external_visibility_proof, membership, principal_status, project_status_revision, realm_status_kill_epoch, service_identity_capability, space_access_participant_binding, target_resource_revision
Constraints: external visibility proof required only where the target carries external-sourced material
Fence: none
Offline: cached_draft_only
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: *_show, *_list, lens_read, events_read, events_wait, event_payload, snapshot_read, presence_list, realtime_resume, artifact_upload_credential)

contribution_supersede

shared_space_v1 external_client

KCP contribution_supersede result (DESIGN.md §10.2, §11.6.1 space/content mutation family)

Surface: external_client
Actor: mapped connector (only for contribution/reaction/upload operations granted to it), principal
Kind: mutation — meta required
Args: contribution_ref replacement_ref reason_class
Scope: exact action and space scope
Assurance: current login (principal); workload identity (mapped connector)
Dependencies: branch_status_frontier, classification_retention_policy, contribution_relation_endpoint_visibility, kovee_policy_set, membership, principal_status, service_identity_capability, space_access_participant_binding, target_resource_revision
Constraints: this family excludes project status and every prepared access-widening operation
Fence: none
Offline: no
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: project/Space creation and metadata; Space lifecycle/restrict/policy-narrow; participant proposal/update/removal; contribution/disposition; semantic-relation/disposition; lens, reaction, frontier, and artifact-upload mutations)

contribution_withdraw

shared_space_v1 external_client

KCP contribution_withdraw result (DESIGN.md §10.2, §11.6.1 space/content mutation family)

Surface: external_client
Actor: mapped connector (only for contribution/reaction/upload operations granted to it), principal
Kind: mutation — meta required
Args: contribution_ref reason_class
Scope: exact action and space scope
Assurance: current login (principal); workload identity (mapped connector)
Dependencies: branch_status_frontier, classification_retention_policy, contribution_relation_endpoint_visibility, kovee_policy_set, membership, principal_status, service_identity_capability, space_access_participant_binding, target_resource_revision
Constraints: this family excludes project status and every prepared access-widening operation
Fence: none
Offline: no
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: project/Space creation and metadata; Space lifecycle/restrict/policy-narrow; participant proposal/update/removal; contribution/disposition; semantic-relation/disposition; lens, reaction, frontier, and artifact-upload mutations)

disclosure_manifest_show

shared_space_v1 external_client

KCP disclosure_manifest_show result (DESIGN.md §16.2, §11.6.1 read family)

Surface: external_client
Actor: connector service (only for its mapped resources), principal
Kind: query
Args: disclosure_id
Scope: exact resource read/resume action; resume cursor where applicable
Assurance: current login or workload identity
Dependencies: classification_retention_policy, contribution_relation_endpoint_visibility, external_visibility_proof, membership, principal_status, project_status_revision, realm_status_kill_epoch, service_identity_capability, space_access_participant_binding, target_resource_revision
Constraints: external visibility proof required only where the target carries external-sourced material
Fence: none
Offline: cached_draft_only
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: *_show, *_list, lens_read, events_read, events_wait, event_payload, snapshot_read, presence_list, realtime_resume, artifact_upload_credential)

event_payload

shared_space_v1 external_client

KCP event_payload result (DESIGN.md §11.3, §11.4, §11.6.1 read family)

Surface: external_client
Actor: connector service (only for its mapped resources), principal
Kind: query
Args: event_id
Scope: exact resource read/resume action; resume cursor where applicable
Assurance: current login or workload identity
Dependencies: classification_retention_policy, contribution_relation_endpoint_visibility, external_visibility_proof, membership, principal_status, project_status_revision, realm_status_kill_epoch, service_identity_capability, space_access_participant_binding, target_resource_revision
Constraints: external visibility proof required only where the target carries external-sourced material
Fence: none
Offline: cached_draft_only
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: *_show, *_list, lens_read, events_read, events_wait, event_payload, snapshot_read, presence_list, realtime_resume, artifact_upload_credential)

events_read

shared_space_v1 external_client

KCP events_read result (DESIGN.md §11.3, §11.4, §11.6.1 read family)

Surface: external_client
Actor: connector service (only for its mapped resources), principal
Kind: query
Args: source after_cursor? project_id? type_prefixes? limit
Scope: exact resource read/resume action; resume cursor where applicable
Assurance: current login or workload identity
Dependencies: classification_retention_policy, contribution_relation_endpoint_visibility, external_visibility_proof, membership, principal_status, project_status_revision, realm_status_kill_epoch, service_identity_capability, space_access_participant_binding, target_resource_revision
Constraints: external visibility proof required only where the target carries external-sourced material
Fence: none
Offline: cached_draft_only
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: *_show, *_list, lens_read, events_read, events_wait, event_payload, snapshot_read, presence_list, realtime_resume, artifact_upload_credential)

events_wait

shared_space_v1 external_client

KCP events_wait result (DESIGN.md §11.3, §11.4, §11.6.1 read family)

Surface: external_client
Actor: connector service (only for its mapped resources), principal
Kind: query
Args: source after_cursor filters? timeout_ms
Scope: exact resource read/resume action; resume cursor where applicable
Assurance: current login or workload identity
Dependencies: classification_retention_policy, contribution_relation_endpoint_visibility, external_visibility_proof, membership, principal_status, project_status_revision, realm_status_kill_epoch, service_identity_capability, space_access_participant_binding, target_resource_revision
Constraints: external visibility proof required only where the target carries external-sourced material
Fence: none
Offline: cached_draft_only
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: *_show, *_list, lens_read, events_read, events_wait, event_payload, snapshot_read, presence_list, realtime_resume, artifact_upload_credential)

frontier_pin

shared_space_v1 external_client

KCP frontier_pin result (DESIGN.md §10.2, §11.6.1 space/content mutation family)

Surface: external_client
Actor: principal
Kind: mutation — meta required
Args: space_id branch_id
Scope: exact action and space scope
Assurance: current login
Dependencies: branch_status_frontier, classification_retention_policy, contribution_relation_endpoint_visibility, kovee_policy_set, membership, principal_status, space_access_participant_binding, target_resource_revision
Constraints: this family excludes project status and every prepared access-widening operation
Fence: none
Offline: no
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: project/Space creation and metadata; Space lifecycle/restrict/policy-narrow; participant proposal/update/removal; contribution/disposition; semantic-relation/disposition; lens, reaction, frontier, and artifact-upload mutations)

frontier_show

shared_space_v1 external_client

KCP frontier_show result (DESIGN.md §10.2, §11.6.1 read family)

Surface: external_client
Actor: connector service (only for its mapped resources), principal
Kind: query
Args: frontier_id
Scope: exact resource read/resume action; resume cursor where applicable
Assurance: current login or workload identity
Dependencies: classification_retention_policy, contribution_relation_endpoint_visibility, external_visibility_proof, membership, principal_status, project_status_revision, realm_status_kill_epoch, service_identity_capability, space_access_participant_binding, target_resource_revision
Constraints: external visibility proof required only where the target carries external-sourced material
Fence: none
Offline: cached_draft_only
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: *_show, *_list, lens_read, events_read, events_wait, event_payload, snapshot_read, presence_list, realtime_resume, artifact_upload_credential)

lens_create

shared_space_v1 external_client

KCP lens_create result (DESIGN.md §10.2, §11.6.1 space/content mutation family)

Surface: external_client
Actor: principal
Kind: mutation — meta required
Args: space_id kind query_ast sort_spec presentation_options visibility
Scope: exact action and space scope
Assurance: current login
Dependencies: branch_status_frontier, classification_retention_policy, contribution_relation_endpoint_visibility, kovee_policy_set, membership, principal_status, space_access_participant_binding, target_resource_revision
Constraints: this family excludes project status and every prepared access-widening operation
Fence: none
Offline: no
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: project/Space creation and metadata; Space lifecycle/restrict/policy-narrow; participant proposal/update/removal; contribution/disposition; semantic-relation/disposition; lens, reaction, frontier, and artifact-upload mutations)

lens_list

shared_space_v1 external_client

KCP lens_list result (DESIGN.md §10.2, §11.6.1 read family)

Surface: external_client
Actor: connector service (only for its mapped resources), principal
Kind: query
Args: space_id after? limit snapshot?
Scope: exact resource read/resume action; resume cursor where applicable
Assurance: current login or workload identity
Dependencies: classification_retention_policy, contribution_relation_endpoint_visibility, external_visibility_proof, membership, principal_status, project_status_revision, realm_status_kill_epoch, service_identity_capability, space_access_participant_binding, target_resource_revision
Constraints: external visibility proof required only where the target carries external-sourced material
Fence: none
Offline: cached_draft_only
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: *_show, *_list, lens_read, events_read, events_wait, event_payload, snapshot_read, presence_list, realtime_resume, artifact_upload_credential)

lens_read

shared_space_v1 external_client

KCP lens_read result (DESIGN.md §10.2, §11.6.1 read family)

Surface: external_client
Actor: connector service (only for its mapped resources), principal
Kind: query
Args: lens_id after? limit snapshot?
Scope: exact resource read/resume action; resume cursor where applicable
Assurance: current login or workload identity
Dependencies: classification_retention_policy, contribution_relation_endpoint_visibility, external_visibility_proof, membership, principal_status, project_status_revision, realm_status_kill_epoch, service_identity_capability, space_access_participant_binding, target_resource_revision
Constraints: external visibility proof required only where the target carries external-sourced material
Fence: none
Offline: cached_draft_only
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: *_show, *_list, lens_read, events_read, events_wait, event_payload, snapshot_read, presence_list, realtime_resume, artifact_upload_credential)

lens_revoke

shared_space_v1 external_client

KCP lens_revoke result (DESIGN.md §10.2, §11.6.1 space/content mutation family)

Surface: external_client
Actor: principal
Kind: mutation — meta required
Args: lens_id
Scope: exact action and space scope
Assurance: current login
Dependencies: branch_status_frontier, classification_retention_policy, contribution_relation_endpoint_visibility, kovee_policy_set, membership, principal_status, space_access_participant_binding, target_resource_revision
Constraints: this family excludes project status and every prepared access-widening operation
Fence: none
Offline: no
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: project/Space creation and metadata; Space lifecycle/restrict/policy-narrow; participant proposal/update/removal; contribution/disposition; semantic-relation/disposition; lens, reaction, frontier, and artifact-upload mutations)

lens_show

shared_space_v1 external_client

KCP lens_show result (DESIGN.md §10.2, §11.6.1 read family)

Surface: external_client
Actor: connector service (only for its mapped resources), principal
Kind: query
Args: lens_id
Scope: exact resource read/resume action; resume cursor where applicable
Assurance: current login or workload identity
Dependencies: classification_retention_policy, contribution_relation_endpoint_visibility, external_visibility_proof, membership, principal_status, project_status_revision, realm_status_kill_epoch, service_identity_capability, space_access_participant_binding, target_resource_revision
Constraints: external visibility proof required only where the target carries external-sourced material
Fence: none
Offline: cached_draft_only
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: *_show, *_list, lens_read, events_read, events_wait, event_payload, snapshot_read, presence_list, realtime_resume, artifact_upload_credential)

lens_update

shared_space_v1 external_client

KCP lens_update result (DESIGN.md §10.2, §11.6.1 space/content mutation family)

Surface: external_client
Actor: principal
Kind: mutation — meta required
Args: lens_id query_ast? sort_spec? presentation_options? visibility?
Scope: exact action and space scope
Assurance: current login
Dependencies: branch_status_frontier, classification_retention_policy, contribution_relation_endpoint_visibility, kovee_policy_set, membership, principal_status, space_access_participant_binding, target_resource_revision
Constraints: this family excludes project status and every prepared access-widening operation
Fence: none
Offline: no
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: project/Space creation and metadata; Space lifecycle/restrict/policy-narrow; participant proposal/update/removal; contribution/disposition; semantic-relation/disposition; lens, reaction, frontier, and artifact-upload mutations)

project_access_policy_change_cancel

shared_space_v1 external_client

KCP project_access_policy_change_cancel result (DESIGN.md §10.1, §11.6.1 project access-policy change family)

Surface: external_client
Actor: authenticated project owner principal only
Kind: mutation — meta required
Args: change_id
Scope: affected Space frontier/item/audience digests; effective-change class; prior/proposed policy/default classification
Assurance: current login
Dependencies: classification_retention_policy, kovee_policy_set, project_status_revision
Constraints: none
Fence: none
Offline: no
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: project_access_policy_change_prepare, project_access_policy_change_cancel, project_access_policy_change_confirm)

project_access_policy_change_confirm

shared_space_v1 external_client

KCP project_access_policy_change_confirm result (DESIGN.md §10.1, §11.6.1 project access-policy change family)

Surface: external_client
Actor: authenticated project owner principal only
Kind: mutation — meta required
Args: change_id decision_receipt_ref
Scope: affected Space frontier/item/audience digests; authorization decision receipt; effective-change class; prior/proposed policy/default classification
Assurance: risk-required step-up
Dependencies: classification_retention_policy, kovee_policy_set, project_status_revision
Constraints: none
Fence: none
Offline: no
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: project_access_policy_change_prepare, project_access_policy_change_cancel, project_access_policy_change_confirm)

project_access_policy_change_list

shared_space_v1 external_client

KCP project_access_policy_change_list result (DESIGN.md §10.1, §11.6.1 read family)

Surface: external_client
Actor: connector service (only for its mapped resources), principal
Kind: query
Args: after? limit snapshot?
Scope: exact resource read/resume action; resume cursor where applicable
Assurance: current login or workload identity
Dependencies: classification_retention_policy, contribution_relation_endpoint_visibility, external_visibility_proof, membership, principal_status, project_status_revision, realm_status_kill_epoch, service_identity_capability, space_access_participant_binding, target_resource_revision
Constraints: external visibility proof required only where the target carries external-sourced material
Fence: none
Offline: cached_draft_only
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: *_show, *_list, lens_read, events_read, events_wait, event_payload, snapshot_read, presence_list, realtime_resume, artifact_upload_credential)

project_access_policy_change_prepare

shared_space_v1 external_client

KCP project_access_policy_change_prepare result (DESIGN.md §10.1, §11.6.1 project access-policy change family)

Surface: external_client
Actor: authenticated project owner principal only
Kind: mutation — meta required
Args: proposed_policy_set_ref? proposed_default_classification_ref?
Scope: affected Space frontier/item/audience digests; effective-change class; prior/proposed policy/default classification
Assurance: current login
Dependencies: classification_retention_policy, kovee_policy_set, project_status_revision
Constraints: none
Fence: none
Offline: no
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: project_access_policy_change_prepare, project_access_policy_change_cancel, project_access_policy_change_confirm)

project_access_policy_change_show

shared_space_v1 external_client

KCP project_access_policy_change_show result (DESIGN.md §10.1, §11.6.1 read family)

Surface: external_client
Actor: connector service (only for its mapped resources), principal
Kind: query
Args: change_id
Scope: exact resource read/resume action; resume cursor where applicable
Assurance: current login or workload identity
Dependencies: classification_retention_policy, contribution_relation_endpoint_visibility, external_visibility_proof, membership, principal_status, project_status_revision, realm_status_kill_epoch, service_identity_capability, space_access_participant_binding, target_resource_revision
Constraints: external visibility proof required only where the target carries external-sourced material
Fence: none
Offline: cached_draft_only
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: *_show, *_list, lens_read, events_read, events_wait, event_payload, snapshot_read, presence_list, realtime_resume, artifact_upload_credential)

project_create

shared_space_v1 external_client

KCP project_create result (DESIGN.md §10.1, §11.6.1 space/content mutation family)

Surface: external_client
Actor: principal
Kind: mutation — meta required
Args: name default_classification_ref? policy_set_ref?
Scope: exact action and space scope
Assurance: current login
Dependencies: branch_status_frontier, classification_retention_policy, contribution_relation_endpoint_visibility, kovee_policy_set, membership, principal_status, space_access_participant_binding, target_resource_revision
Constraints: this family excludes project status and every prepared access-widening operation
Fence: none
Offline: no
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: project/Space creation and metadata; Space lifecycle/restrict/policy-narrow; participant proposal/update/removal; contribution/disposition; semantic-relation/disposition; lens, reaction, frontier, and artifact-upload mutations)

project_list

shared_space_v1 external_client

KCP project_list result (DESIGN.md §10.1, §11.6.1 read family)

Surface: external_client
Actor: connector service (only for its mapped resources), principal
Kind: query
Args: after? limit snapshot?
Scope: exact resource read/resume action; resume cursor where applicable
Assurance: current login or workload identity
Dependencies: classification_retention_policy, contribution_relation_endpoint_visibility, external_visibility_proof, membership, principal_status, project_status_revision, realm_status_kill_epoch, service_identity_capability, space_access_participant_binding, target_resource_revision
Constraints: external visibility proof required only where the target carries external-sourced material
Fence: none
Offline: cached_draft_only
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: *_show, *_list, lens_read, events_read, events_wait, event_payload, snapshot_read, presence_list, realtime_resume, artifact_upload_credential)

project_show

shared_space_v1 external_client

KCP project_show result (DESIGN.md §10.1, §11.6.1 read family)

Surface: external_client
Actor: connector service (only for its mapped resources), principal
Kind: query
Args: none
Scope: exact resource read/resume action; resume cursor where applicable
Assurance: current login or workload identity
Dependencies: classification_retention_policy, contribution_relation_endpoint_visibility, external_visibility_proof, membership, principal_status, project_status_revision, realm_status_kill_epoch, service_identity_capability, space_access_participant_binding, target_resource_revision
Constraints: external visibility proof required only where the target carries external-sourced material
Fence: none
Offline: cached_draft_only
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: *_show, *_list, lens_read, events_read, events_wait, event_payload, snapshot_read, presence_list, realtime_resume, artifact_upload_credential)

project_update_metadata

shared_space_v1 external_client

KCP project_update_metadata result (DESIGN.md §10.1, §11.6.1 space/content mutation family)

Surface: external_client
Actor: principal
Kind: mutation — meta required
Args: name
Scope: exact action and space scope
Assurance: current login
Dependencies: branch_status_frontier, classification_retention_policy, contribution_relation_endpoint_visibility, kovee_policy_set, membership, principal_status, space_access_participant_binding, target_resource_revision
Constraints: this family excludes project status and every prepared access-widening operation
Fence: none
Offline: no
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: project/Space creation and metadata; Space lifecycle/restrict/policy-narrow; participant proposal/update/removal; contribution/disposition; semantic-relation/disposition; lens, reaction, frontier, and artifact-upload mutations)

reaction_set

shared_space_v1 external_client

KCP reaction_set result (DESIGN.md §10.2, §11.6.1 space/content mutation family)

Surface: external_client
Actor: mapped connector (only for contribution/reaction/upload operations granted to it), principal
Kind: mutation — meta required
Args: space_id target_ref target_revision target_digest key state
Scope: exact action and space scope
Assurance: current login (principal); workload identity (mapped connector)
Dependencies: branch_status_frontier, classification_retention_policy, contribution_relation_endpoint_visibility, kovee_policy_set, membership, principal_status, service_identity_capability, space_access_participant_binding, target_resource_revision
Constraints: this family excludes project status and every prepared access-widening operation
Fence: none
Offline: queueable
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: project/Space creation and metadata; Space lifecycle/restrict/policy-narrow; participant proposal/update/removal; contribution/disposition; semantic-relation/disposition; lens, reaction, frontier, and artifact-upload mutations)

realm_show

shared_space_v1 external_client

KCP realm_show result (DESIGN.md §10.1, §11.6.1 read family)

Surface: external_client
Actor: connector service (only for its mapped resources), principal
Kind: query
Args: none
Scope: exact resource read/resume action; resume cursor where applicable
Assurance: current login or workload identity
Dependencies: classification_retention_policy, contribution_relation_endpoint_visibility, external_visibility_proof, membership, principal_status, project_status_revision, realm_status_kill_epoch, service_identity_capability, space_access_participant_binding, target_resource_revision
Constraints: external visibility proof required only where the target carries external-sourced material
Fence: none
Offline: cached_draft_only
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: *_show, *_list, lens_read, events_read, events_wait, event_payload, snapshot_read, presence_list, realtime_resume, artifact_upload_credential)

relation_assert

shared_space_v1 external_client worker dual-surface

KCP relation_assert result (DESIGN.md §10.2, §10.3, §11.6.1 space/content mutation + worker families)

Surface: external_client, worker
Actor: invocation attempt only, principal
Kind: mutation — meta required
Args: space_id branch_id expected_head_digest kind from_ref to_ref rationale_ref? schema_ref? attempt_id? fence_epoch?
Scope: attempt; budget; exact action and space scope; exact operation and space/object scope listed in the invocation capability; invocation manifest
Assurance: current login; workload identity plus invocation capability
Dependencies: branch_status_frontier, classification_retention_policy, context_item_visibility, contribution_relation_endpoint_visibility, kovee_policy_set, membership, principal_status, service_identity_capability, space_access_participant_binding, target_resource_revision
Constraints: the complete current authorization dependency set is required; this family excludes project status and every prepared access-widening operation
Fence: current Kovee fence and byom fence when bound; none
Offline: no
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: project/Space creation and metadata; Space lifecycle/restrict/policy-narrow; participant proposal/update/removal; contribution/disposition; semantic-relation/disposition; lens, reaction, frontier, and artifact-upload mutations)

relation_retract

shared_space_v1 external_client

KCP relation_retract result (DESIGN.md §10.2, §11.6.1 space/content mutation family)

Surface: external_client
Actor: principal
Kind: mutation — meta required
Args: relation_ref reason_class
Scope: exact action and space scope
Assurance: current login
Dependencies: branch_status_frontier, classification_retention_policy, contribution_relation_endpoint_visibility, kovee_policy_set, membership, principal_status, space_access_participant_binding, target_resource_revision
Constraints: this family excludes project status and every prepared access-widening operation
Fence: none
Offline: no
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: project/Space creation and metadata; Space lifecycle/restrict/policy-narrow; participant proposal/update/removal; contribution/disposition; semantic-relation/disposition; lens, reaction, frontier, and artifact-upload mutations)

snapshot_read

shared_space_v1 external_client

KCP snapshot_read result (DESIGN.md §11.5, §11.6.1 read family)

Surface: external_client
Actor: connector service (only for its mapped resources), principal
Kind: query
Args: source after? limit snapshot?
Scope: exact resource read/resume action; resume cursor where applicable
Assurance: current login or workload identity
Dependencies: classification_retention_policy, contribution_relation_endpoint_visibility, external_visibility_proof, membership, principal_status, project_status_revision, realm_status_kill_epoch, service_identity_capability, space_access_participant_binding, target_resource_revision
Constraints: external visibility proof required only where the target carries external-sourced material
Fence: none
Offline: cached_draft_only
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: *_show, *_list, lens_read, events_read, events_wait, event_payload, snapshot_read, presence_list, realtime_resume, artifact_upload_credential)

space_access_grant_create

shared_space_v1 operator

KCP space_access_grant_create result (DESIGN.md §10.2, §11.6.1 operator administration family)

Surface: operator
Actor: principal only
Kind: mutation — meta required
Args: space_id subject_ref allowed_actions classification_ceiling_ref? expires_at?
Scope: exact administrative/governance action; prepared subject digest
Assurance: current step-up observation at risk-required level
Dependencies: classification_retention_policy, current_authentication_observation, kovee_policy_set, membership, principal_status, project_status_revision, realm_authority_binding, realm_status_kill_epoch, remaining_use_grant, space_access_participant_binding, target_resource_revision
Constraints: this family excludes access-widening confirms and handoff-transfer reconciliation
Fence: none; cannot impersonate a worker
Offline: no
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: force-cancel, realm/binding, project-status, identity/membership, invitation/join, space-access-grant administration, classification mapping, artifact grant, handoff offer/admission decisions, effect authorization/reconciliation)

space_access_grant_list

shared_space_v1 external_client

KCP space_access_grant_list result (DESIGN.md §10.2, §11.6.1 read family)

Surface: external_client
Actor: connector service (only for its mapped resources), principal
Kind: query
Args: space_id after? limit snapshot?
Scope: exact resource read/resume action; resume cursor where applicable
Assurance: current login or workload identity
Dependencies: classification_retention_policy, contribution_relation_endpoint_visibility, external_visibility_proof, membership, principal_status, project_status_revision, realm_status_kill_epoch, service_identity_capability, space_access_participant_binding, target_resource_revision
Constraints: external visibility proof required only where the target carries external-sourced material
Fence: none
Offline: cached_draft_only
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: *_show, *_list, lens_read, events_read, events_wait, event_payload, snapshot_read, presence_list, realtime_resume, artifact_upload_credential)

space_access_grant_revoke

shared_space_v1 operator

KCP space_access_grant_revoke result (DESIGN.md §10.2, §11.6.1 operator administration family)

Surface: operator
Actor: principal only
Kind: mutation — meta required
Args: space_access_id
Scope: exact administrative/governance action; prepared subject digest
Assurance: current step-up observation at risk-required level
Dependencies: classification_retention_policy, current_authentication_observation, kovee_policy_set, membership, principal_status, project_status_revision, realm_authority_binding, realm_status_kill_epoch, remaining_use_grant, space_access_participant_binding, target_resource_revision
Constraints: this family excludes access-widening confirms and handoff-transfer reconciliation
Fence: none; cannot impersonate a worker
Offline: no
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: force-cancel, realm/binding, project-status, identity/membership, invitation/join, space-access-grant administration, classification mapping, artifact grant, handoff offer/admission decisions, effect authorization/reconciliation)

space_access_widen_cancel

shared_space_v1 external_client

KCP space_access_widen_cancel result (DESIGN.md §10.2, §11.6.1 access-widening prepare family)

Surface: external_client
Actor: authenticated steward/owner principal
Kind: mutation — meta required
Args: widening_id
Scope: affected frontier/item/audience digests; prior/proposed visibility/policy/classification
Assurance: current login
Dependencies: classification_retention_policy, context_item_visibility, contribution_relation_endpoint_visibility, kovee_policy_set, membership, space_access_participant_binding, target_resource_revision
Constraints: none
Fence: none
Offline: no
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: space_access_widen_prepare, space_access_widen_cancel)

space_access_widen_confirm

shared_space_v1 external_client

KCP space_access_widen_confirm result (DESIGN.md §10.2, §11.6.1 access-widening confirm family)

Surface: external_client
Actor: authenticated steward/owner principal only
Kind: mutation — meta required
Args: widening_id decision_receipt_ref
Scope: authorization decision receipt; exact prepared widening subject
Assurance: risk-required current step-up
Dependencies: target_resource_revision
Constraints: item-level policies remain intersected
Fence: none
Offline: no
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: space_access_widen_confirm)

space_access_widen_list

shared_space_v1 external_client

KCP space_access_widen_list result (DESIGN.md §10.2, §11.6.1 read family)

Surface: external_client
Actor: connector service (only for its mapped resources), principal
Kind: query
Args: space_id? after? limit snapshot?
Scope: exact resource read/resume action; resume cursor where applicable
Assurance: current login or workload identity
Dependencies: classification_retention_policy, contribution_relation_endpoint_visibility, external_visibility_proof, membership, principal_status, project_status_revision, realm_status_kill_epoch, service_identity_capability, space_access_participant_binding, target_resource_revision
Constraints: external visibility proof required only where the target carries external-sourced material
Fence: none
Offline: cached_draft_only
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: *_show, *_list, lens_read, events_read, events_wait, event_payload, snapshot_read, presence_list, realtime_resume, artifact_upload_credential)

space_access_widen_prepare

shared_space_v1 external_client

KCP space_access_widen_prepare result (DESIGN.md §10.2, §11.6.1 access-widening prepare family)

Surface: external_client
Actor: authenticated steward/owner principal
Kind: mutation — meta required
Args: space_id proposed_visibility? proposed_policy_set_ref? proposed_default_classification_ref?
Scope: affected frontier/item/audience digests; prior/proposed visibility/policy/classification
Assurance: current login; policy may require step-up
Dependencies: classification_retention_policy, context_item_visibility, contribution_relation_endpoint_visibility, kovee_policy_set, membership, space_access_participant_binding, target_resource_revision
Constraints: none
Fence: none
Offline: no
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: space_access_widen_prepare, space_access_widen_cancel)

space_access_widen_show

shared_space_v1 external_client

KCP space_access_widen_show result (DESIGN.md §10.2, §11.6.1 read family)

Surface: external_client
Actor: connector service (only for its mapped resources), principal
Kind: query
Args: widening_id
Scope: exact resource read/resume action; resume cursor where applicable
Assurance: current login or workload identity
Dependencies: classification_retention_policy, contribution_relation_endpoint_visibility, external_visibility_proof, membership, principal_status, project_status_revision, realm_status_kill_epoch, service_identity_capability, space_access_participant_binding, target_resource_revision
Constraints: external visibility proof required only where the target carries external-sourced material
Fence: none
Offline: cached_draft_only
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: *_show, *_list, lens_read, events_read, events_wait, event_payload, snapshot_read, presence_list, realtime_resume, artifact_upload_credential)

space_archive

shared_space_v1 external_client

KCP space_archive result (DESIGN.md §10.2, §11.6.1 space/content mutation family)

Surface: external_client
Actor: principal
Kind: mutation — meta required
Args: space_id
Scope: exact action and space scope
Assurance: current login
Dependencies: branch_status_frontier, classification_retention_policy, contribution_relation_endpoint_visibility, kovee_policy_set, membership, principal_status, space_access_participant_binding, target_resource_revision
Constraints: this family excludes project status and every prepared access-widening operation
Fence: none
Offline: no
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: project/Space creation and metadata; Space lifecycle/restrict/policy-narrow; participant proposal/update/removal; contribution/disposition; semantic-relation/disposition; lens, reaction, frontier, and artifact-upload mutations)

space_create

shared_space_v1 external_client

KCP space_create result (DESIGN.md §10.2, §11.6.1 space/content mutation family)

Surface: external_client
Actor: principal
Kind: mutation — meta required
Args: title visibility purpose_contribution_ref? default_classification_ref? policy_set_ref?
Scope: exact action and space scope
Assurance: current login
Dependencies: branch_status_frontier, classification_retention_policy, contribution_relation_endpoint_visibility, kovee_policy_set, membership, principal_status, space_access_participant_binding, target_resource_revision
Constraints: this family excludes project status and every prepared access-widening operation
Fence: none
Offline: no
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: project/Space creation and metadata; Space lifecycle/restrict/policy-narrow; participant proposal/update/removal; contribution/disposition; semantic-relation/disposition; lens, reaction, frontier, and artifact-upload mutations)

space_freeze

shared_space_v1 external_client

KCP space_freeze result (DESIGN.md §10.2, §11.6.1 space/content mutation family)

Surface: external_client
Actor: principal
Kind: mutation — meta required
Args: space_id
Scope: exact action and space scope
Assurance: current login
Dependencies: branch_status_frontier, classification_retention_policy, contribution_relation_endpoint_visibility, kovee_policy_set, membership, principal_status, space_access_participant_binding, target_resource_revision
Constraints: this family excludes project status and every prepared access-widening operation
Fence: none
Offline: no
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: project/Space creation and metadata; Space lifecycle/restrict/policy-narrow; participant proposal/update/removal; contribution/disposition; semantic-relation/disposition; lens, reaction, frontier, and artifact-upload mutations)

space_list

shared_space_v1 external_client

KCP space_list result (DESIGN.md §10.2, §11.6.1 read family)

Surface: external_client
Actor: connector service (only for its mapped resources), principal
Kind: query
Args: after? limit snapshot?
Scope: exact resource read/resume action; resume cursor where applicable
Assurance: current login or workload identity
Dependencies: classification_retention_policy, contribution_relation_endpoint_visibility, external_visibility_proof, membership, principal_status, project_status_revision, realm_status_kill_epoch, service_identity_capability, space_access_participant_binding, target_resource_revision
Constraints: external visibility proof required only where the target carries external-sourced material
Fence: none
Offline: cached_draft_only
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: *_show, *_list, lens_read, events_read, events_wait, event_payload, snapshot_read, presence_list, realtime_resume, artifact_upload_credential)

space_participant_activate

shared_space_v1 operator

KCP space_participant_activate result (DESIGN.md §10.2, §11.6.1 activation family)

Surface: operator
Actor: authenticated principal, narrow policy service consuming an exact active standing-policy/contract receipt
Kind: mutation — meta required
Args: participant_id subject_digest
Scope: budget/disclosure union; exact prepared subject digest
Assurance: current assurance required by policy
Dependencies: attention_revision_acceptance, branch_status_frontier, commitment_terms_acceptance, remaining_use_grant, target_resource_revision
Constraints: the complete current dependency set is required
Fence: none; never model prose or a worker self-decision
Offline: no
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: attention accept/decline/resume/widen/candidate-activate/replay-start; merge acceptance; Commitment/Need review; participant activation)

space_participant_add

shared_space_v1 external_client

KCP space_participant_add result (DESIGN.md §10.2, §11.6.1 space/content mutation family)

Surface: external_client
Actor: principal
Kind: mutation — meta required
Args: space_id subject_ref kind role subject_revision?
Scope: exact action and space scope
Assurance: current login
Dependencies: branch_status_frontier, classification_retention_policy, contribution_relation_endpoint_visibility, kovee_policy_set, membership, principal_status, space_access_participant_binding, target_resource_revision
Constraints: this family excludes project status and every prepared access-widening operation
Fence: none
Offline: no
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: project/Space creation and metadata; Space lifecycle/restrict/policy-narrow; participant proposal/update/removal; contribution/disposition; semantic-relation/disposition; lens, reaction, frontier, and artifact-upload mutations)

space_participant_list

shared_space_v1 external_client

KCP space_participant_list result (DESIGN.md §10.2, §11.6.1 read family)

Surface: external_client
Actor: connector service (only for its mapped resources), principal
Kind: query
Args: space_id after? limit snapshot?
Scope: exact resource read/resume action; resume cursor where applicable
Assurance: current login or workload identity
Dependencies: classification_retention_policy, contribution_relation_endpoint_visibility, external_visibility_proof, membership, principal_status, project_status_revision, realm_status_kill_epoch, service_identity_capability, space_access_participant_binding, target_resource_revision
Constraints: external visibility proof required only where the target carries external-sourced material
Fence: none
Offline: cached_draft_only
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: *_show, *_list, lens_read, events_read, events_wait, event_payload, snapshot_read, presence_list, realtime_resume, artifact_upload_credential)

space_participant_remove

shared_space_v1 external_client

KCP space_participant_remove result (DESIGN.md §10.2, §11.6.1 space/content mutation family)

Surface: external_client
Actor: principal
Kind: mutation — meta required
Args: participant_id
Scope: exact action and space scope
Assurance: current login
Dependencies: branch_status_frontier, classification_retention_policy, contribution_relation_endpoint_visibility, kovee_policy_set, membership, principal_status, space_access_participant_binding, target_resource_revision
Constraints: this family excludes project status and every prepared access-widening operation
Fence: none
Offline: no
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: project/Space creation and metadata; Space lifecycle/restrict/policy-narrow; participant proposal/update/removal; contribution/disposition; semantic-relation/disposition; lens, reaction, frontier, and artifact-upload mutations)

space_participant_update

shared_space_v1 external_client

KCP space_participant_update result (DESIGN.md §10.2, §11.6.1 space/content mutation family)

Surface: external_client
Actor: principal
Kind: mutation — meta required
Args: participant_id role? status?
Scope: exact action and space scope
Assurance: current login
Dependencies: branch_status_frontier, classification_retention_policy, contribution_relation_endpoint_visibility, kovee_policy_set, membership, principal_status, space_access_participant_binding, target_resource_revision
Constraints: this family excludes project status and every prepared access-widening operation
Fence: none
Offline: no
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: project/Space creation and metadata; Space lifecycle/restrict/policy-narrow; participant proposal/update/removal; contribution/disposition; semantic-relation/disposition; lens, reaction, frontier, and artifact-upload mutations)

space_policy_narrow

shared_space_v1 external_client

KCP space_policy_narrow result (DESIGN.md §10.2, §11.6.1 space/content mutation family)

Surface: external_client
Actor: principal
Kind: mutation — meta required
Args: space_id policy_set_ref? default_classification_ref?
Scope: exact action and space scope
Assurance: current login
Dependencies: branch_status_frontier, classification_retention_policy, contribution_relation_endpoint_visibility, kovee_policy_set, membership, principal_status, space_access_participant_binding, target_resource_revision
Constraints: this family excludes project status and every prepared access-widening operation
Fence: none
Offline: no
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: project/Space creation and metadata; Space lifecycle/restrict/policy-narrow; participant proposal/update/removal; contribution/disposition; semantic-relation/disposition; lens, reaction, frontier, and artifact-upload mutations)

space_reopen

shared_space_v1 external_client

KCP space_reopen result (DESIGN.md §10.2, §11.6.1 space/content mutation family)

Surface: external_client
Actor: principal
Kind: mutation — meta required
Args: space_id
Scope: exact action and space scope
Assurance: current login
Dependencies: branch_status_frontier, classification_retention_policy, contribution_relation_endpoint_visibility, kovee_policy_set, membership, principal_status, space_access_participant_binding, target_resource_revision
Constraints: this family excludes project status and every prepared access-widening operation
Fence: none
Offline: no
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: project/Space creation and metadata; Space lifecycle/restrict/policy-narrow; participant proposal/update/removal; contribution/disposition; semantic-relation/disposition; lens, reaction, frontier, and artifact-upload mutations)

space_restrict

shared_space_v1 external_client

KCP space_restrict result (DESIGN.md §10.2, §11.6.1 space/content mutation family)

Surface: external_client
Actor: principal
Kind: mutation — meta required
Args: space_id
Scope: exact action and space scope
Assurance: current login
Dependencies: branch_status_frontier, classification_retention_policy, contribution_relation_endpoint_visibility, kovee_policy_set, membership, principal_status, space_access_participant_binding, target_resource_revision
Constraints: this family excludes project status and every prepared access-widening operation
Fence: none
Offline: no
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: project/Space creation and metadata; Space lifecycle/restrict/policy-narrow; participant proposal/update/removal; contribution/disposition; semantic-relation/disposition; lens, reaction, frontier, and artifact-upload mutations)

space_show

shared_space_v1 external_client

KCP space_show result (DESIGN.md §10.2, §11.6.1 read family)

Surface: external_client
Actor: connector service (only for its mapped resources), principal
Kind: query
Args: space_id
Scope: exact resource read/resume action; resume cursor where applicable
Assurance: current login or workload identity
Dependencies: classification_retention_policy, contribution_relation_endpoint_visibility, external_visibility_proof, membership, principal_status, project_status_revision, realm_status_kill_epoch, service_identity_capability, space_access_participant_binding, target_resource_revision
Constraints: external visibility proof required only where the target carries external-sourced material
Fence: none
Offline: cached_draft_only
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: *_show, *_list, lens_read, events_read, events_wait, event_payload, snapshot_read, presence_list, realtime_resume, artifact_upload_credential)

space_update_metadata

shared_space_v1 external_client

KCP space_update_metadata result (DESIGN.md §10.2, §11.6.1 space/content mutation family)

Surface: external_client
Actor: principal
Kind: mutation — meta required
Args: space_id title? purpose_contribution_ref?
Scope: exact action and space scope
Assurance: current login
Dependencies: branch_status_frontier, classification_retention_policy, contribution_relation_endpoint_visibility, kovee_policy_set, membership, principal_status, space_access_participant_binding, target_resource_revision
Constraints: this family excludes project status and every prepared access-widening operation
Fence: none
Offline: no
Schemas: request · result
Source: DESIGN.md §11.6 (shared_space_v1 row) + §11.6.1 (family: project/Space creation and metadata; Space lifecycle/restrict/policy-narrow; participant proposal/update/removal; contribution/disposition; semantic-relation/disposition; lens, reaction, frontier, and artifact-upload mutations)

`developer_assistant_v1` — 22 operations

application_event_emit

developer_assistant_v1 worker

KCP application_event_emit result (DESIGN.md §11.3; derived — gap note KG15)

Surface: worker
Actor: invocation attempt only
Kind: mutation — meta required
Args: attempt_id fence_epoch type payload
Scope: attempt; budget; exact operation and space/object scope listed in the invocation capability; invocation manifest
Assurance: workload identity plus invocation capability
Dependencies: branch_status_frontier, context_item_visibility, kovee_policy_set, service_identity_capability, target_resource_revision
Constraints: the complete current authorization dependency set is required
Fence: current Kovee fence and byom fence when bound
Offline: no
Schemas: request · result
Source: DESIGN.md §11.6 (developer_assistant_v1 row) + §11.6.1 (family: checkpoint/contribution/semantic-relation/model/tool/application_event_emit worker operations)

assistant_alias_bind

developer_assistant_v1 operator

KCP assistant_alias_bind result (DESIGN.md §10.5, §11.6.1 assistant author/deploy family)

Surface: operator
Actor: principal
Kind: mutation — meta required
Args: display_alias assistant_deployment_id deployment_revision
Scope: exact author/deploy action
Assurance: current login
Dependencies: kovee_policy_set, membership, principal_status, project_status_revision, realm_status_kill_epoch, target_resource_revision
Constraints: none
Fence: none
Offline: no
Schemas: request · result
Source: DESIGN.md §11.6 (developer_assistant_v1 row) + §11.6.1 (family: assistant definition/revision/deployment/alias mutations)

assistant_alias_list

developer_assistant_v1 external_client

KCP assistant_alias_list result (DESIGN.md §10.5, §11.6.1 assistant author/deploy family)

Surface: external_client
Actor: connector service (only for its mapped resources), principal
Kind: query
Args: after? limit snapshot? assistant_deployment_id?
Scope: exact resource read/resume action; resume cursor where applicable
Assurance: current login or workload identity
Dependencies: classification_retention_policy, contribution_relation_endpoint_visibility, external_visibility_proof, membership, principal_status, project_status_revision, realm_status_kill_epoch, service_identity_capability, space_access_participant_binding, target_resource_revision
Constraints: external visibility proof required only where the target carries external-sourced material
Fence: none
Offline: cached_draft_only
Schemas: request · result
Source: DESIGN.md §11.6 (developer_assistant_v1 row) + §11.6.1 (family: *_show, *_list, lens_read, events_read, events_wait, event_payload, snapshot_read, presence_list, realtime_resume, artifact_upload_credential)

assistant_alias_revoke

developer_assistant_v1 operator

KCP assistant_alias_revoke result (DESIGN.md §10.5, §11.6.1 assistant author/deploy family)

Surface: operator
Actor: principal
Kind: mutation — meta required
Args: alias_binding_id
Scope: exact author/deploy action
Assurance: current login
Dependencies: kovee_policy_set, membership, principal_status, project_status_revision, realm_status_kill_epoch, target_resource_revision
Constraints: none
Fence: none
Offline: no
Schemas: request · result
Source: DESIGN.md §11.6 (developer_assistant_v1 row) + §11.6.1 (family: assistant definition/revision/deployment/alias mutations)

assistant_alias_show

developer_assistant_v1 external_client

KCP assistant_alias_show result (DESIGN.md §10.5, §11.6.1 assistant author/deploy family)

Surface: external_client
Actor: connector service (only for its mapped resources), principal
Kind: query
Args: alias_binding_id
Scope: exact resource read/resume action; resume cursor where applicable
Assurance: current login or workload identity
Dependencies: classification_retention_policy, contribution_relation_endpoint_visibility, external_visibility_proof, membership, principal_status, project_status_revision, realm_status_kill_epoch, service_identity_capability, space_access_participant_binding, target_resource_revision
Constraints: external visibility proof required only where the target carries external-sourced material
Fence: none
Offline: cached_draft_only
Schemas: request · result
Source: DESIGN.md §11.6 (developer_assistant_v1 row) + §11.6.1 (family: *_show, *_list, lens_read, events_read, events_wait, event_payload, snapshot_read, presence_list, realtime_resume, artifact_upload_credential)

assistant_alias_update

developer_assistant_v1 operator

KCP assistant_alias_update result (DESIGN.md §10.5, §11.6.1 assistant author/deploy family)

Surface: operator
Actor: principal
Kind: mutation — meta required
Args: alias_binding_id assistant_deployment_id deployment_revision
Scope: exact author/deploy action
Assurance: current login
Dependencies: kovee_policy_set, membership, principal_status, project_status_revision, realm_status_kill_epoch, target_resource_revision
Constraints: none
Fence: none
Offline: no
Schemas: request · result
Source: DESIGN.md §11.6 (developer_assistant_v1 row) + §11.6.1 (family: assistant definition/revision/deployment/alias mutations)

assistant_create

developer_assistant_v1 operator

KCP assistant_create result (DESIGN.md §10.5, §11.6.1 assistant author/deploy family)

Surface: operator
Actor: principal
Kind: mutation — meta required
Args: name description
Scope: exact author/deploy action
Assurance: current login
Dependencies: kovee_policy_set, membership, principal_status, project_status_revision, realm_status_kill_epoch, target_resource_revision
Constraints: none
Fence: none
Offline: no
Schemas: request · result
Source: DESIGN.md §11.6 (developer_assistant_v1 row) + §11.6.1 (family: assistant definition/revision/deployment/alias mutations)

assistant_list

developer_assistant_v1 external_client

KCP assistant_list result (DESIGN.md §10.5, §11.6.1 assistant author/deploy family)

Surface: external_client
Actor: connector service (only for its mapped resources), principal
Kind: query
Args: after? limit snapshot?
Scope: exact resource read/resume action; resume cursor where applicable
Assurance: current login or workload identity
Dependencies: classification_retention_policy, contribution_relation_endpoint_visibility, external_visibility_proof, membership, principal_status, project_status_revision, realm_status_kill_epoch, service_identity_capability, space_access_participant_binding, target_resource_revision
Constraints: external visibility proof required only where the target carries external-sourced material
Fence: none
Offline: cached_draft_only
Schemas: request · result
Source: DESIGN.md §11.6 (developer_assistant_v1 row) + §11.6.1 (family: *_show, *_list, lens_read, events_read, events_wait, event_payload, snapshot_read, presence_list, realtime_resume, artifact_upload_credential)

assistant_revision_list

developer_assistant_v1 external_client

KCP assistant_revision_list result (DESIGN.md §10.5, §11.6.1 assistant author/deploy family)

Surface: external_client
Actor: connector service (only for its mapped resources), principal
Kind: query
Args: after? limit snapshot? definition_id?
Scope: exact resource read/resume action; resume cursor where applicable
Assurance: current login or workload identity
Dependencies: classification_retention_policy, contribution_relation_endpoint_visibility, external_visibility_proof, membership, principal_status, project_status_revision, realm_status_kill_epoch, service_identity_capability, space_access_participant_binding, target_resource_revision
Constraints: external visibility proof required only where the target carries external-sourced material
Fence: none
Offline: cached_draft_only
Schemas: request · result
Source: DESIGN.md §11.6 (developer_assistant_v1 row) + §11.6.1 (family: *_show, *_list, lens_read, events_read, events_wait, event_payload, snapshot_read, presence_list, realtime_resume, artifact_upload_credential)

assistant_revision_register

developer_assistant_v1 operator

KCP assistant_revision_register result (DESIGN.md §10.5, §11.6.1 assistant author/deploy family)

Surface: operator
Actor: principal
Kind: mutation — meta required
Args: definition_id version manifest package_artifact_ref package_digest config_schema_digest sdk_protocol_range signature_refs?
Scope: exact author/deploy action
Assurance: current login
Dependencies: kovee_policy_set, membership, principal_status, project_status_revision, realm_status_kill_epoch, target_resource_revision
Constraints: none
Fence: none
Offline: no
Schemas: request · result
Source: DESIGN.md §11.6 (developer_assistant_v1 row) + §11.6.1 (family: assistant definition/revision/deployment/alias mutations)

assistant_revision_show

developer_assistant_v1 external_client

KCP assistant_revision_show result (DESIGN.md §10.5, §11.6.1 assistant author/deploy family)

Surface: external_client
Actor: connector service (only for its mapped resources), principal
Kind: query
Args: assistant_revision_id
Scope: exact resource read/resume action; resume cursor where applicable
Assurance: current login or workload identity
Dependencies: classification_retention_policy, contribution_relation_endpoint_visibility, external_visibility_proof, membership, principal_status, project_status_revision, realm_status_kill_epoch, service_identity_capability, space_access_participant_binding, target_resource_revision
Constraints: external visibility proof required only where the target carries external-sourced material
Fence: none
Offline: cached_draft_only
Schemas: request · result
Source: DESIGN.md §11.6 (developer_assistant_v1 row) + §11.6.1 (family: *_show, *_list, lens_read, events_read, events_wait, event_payload, snapshot_read, presence_list, realtime_resume, artifact_upload_credential)

assistant_show

developer_assistant_v1 external_client

KCP assistant_show result (DESIGN.md §10.5, §11.6.1 assistant author/deploy family)

Surface: external_client
Actor: connector service (only for its mapped resources), principal
Kind: query
Args: definition_id
Scope: exact resource read/resume action; resume cursor where applicable
Assurance: current login or workload identity
Dependencies: classification_retention_policy, contribution_relation_endpoint_visibility, external_visibility_proof, membership, principal_status, project_status_revision, realm_status_kill_epoch, service_identity_capability, space_access_participant_binding, target_resource_revision
Constraints: external visibility proof required only where the target carries external-sourced material
Fence: none
Offline: cached_draft_only
Schemas: request · result
Source: DESIGN.md §11.6 (developer_assistant_v1 row) + §11.6.1 (family: *_show, *_list, lens_read, events_read, events_wait, event_payload, snapshot_read, presence_list, realtime_resume, artifact_upload_credential)

deployment_activate

developer_assistant_v1 operator

KCP deployment_activate result (DESIGN.md §10.5, §11.6.1 assistant author/deploy family)

Surface: operator
Actor: principal
Kind: mutation — meta required
Args: assistant_deployment_id
Scope: exact author/deploy action
Assurance: current login; step-up for production activation
Dependencies: kovee_policy_set, membership, principal_status, project_status_revision, realm_status_kill_epoch, target_resource_revision
Constraints: none
Fence: none
Offline: no
Schemas: request · result
Source: DESIGN.md §11.6 (developer_assistant_v1 row) + §11.6.1 (family: assistant definition/revision/deployment/alias mutations)

deployment_create

developer_assistant_v1 operator

KCP deployment_create result (DESIGN.md §10.5, §11.6.1 assistant author/deploy family)

Surface: operator
Actor: principal
Kind: mutation — meta required
Args: assistant_revision_id config_ref config_digest secret_binding_set_ref secret_binding_set_digest policy_ref pool_ref security_profile concurrency_policy rollout_policy
Scope: exact author/deploy action
Assurance: current login
Dependencies: kovee_policy_set, membership, principal_status, project_status_revision, realm_status_kill_epoch, target_resource_revision
Constraints: none
Fence: none
Offline: no
Schemas: request · result
Source: DESIGN.md §11.6 (developer_assistant_v1 row) + §11.6.1 (family: assistant definition/revision/deployment/alias mutations)

deployment_drain

developer_assistant_v1 operator

KCP deployment_drain result (DESIGN.md §10.5, §11.6.1 assistant author/deploy family)

Surface: operator
Actor: principal
Kind: mutation — meta required
Args: assistant_deployment_id
Scope: exact author/deploy action
Assurance: current login
Dependencies: kovee_policy_set, membership, principal_status, project_status_revision, realm_status_kill_epoch, target_resource_revision
Constraints: none
Fence: none
Offline: no
Schemas: request · result
Source: DESIGN.md §11.6 (developer_assistant_v1 row) + §11.6.1 (family: assistant definition/revision/deployment/alias mutations)

deployment_list

developer_assistant_v1 external_client

KCP deployment_list result (DESIGN.md §10.5, §11.6.1 assistant author/deploy family)

Surface: external_client
Actor: connector service (only for its mapped resources), principal
Kind: query
Args: after? limit snapshot? assistant_revision_id?
Scope: exact resource read/resume action; resume cursor where applicable
Assurance: current login or workload identity
Dependencies: classification_retention_policy, contribution_relation_endpoint_visibility, external_visibility_proof, membership, principal_status, project_status_revision, realm_status_kill_epoch, service_identity_capability, space_access_participant_binding, target_resource_revision
Constraints: external visibility proof required only where the target carries external-sourced material
Fence: none
Offline: cached_draft_only
Schemas: request · result
Source: DESIGN.md §11.6 (developer_assistant_v1 row) + §11.6.1 (family: *_show, *_list, lens_read, events_read, events_wait, event_payload, snapshot_read, presence_list, realtime_resume, artifact_upload_credential)

deployment_show

developer_assistant_v1 external_client

KCP deployment_show result (DESIGN.md §10.5, §11.6.1 assistant author/deploy family)

Surface: external_client
Actor: connector service (only for its mapped resources), principal
Kind: query
Args: assistant_deployment_id
Scope: exact resource read/resume action; resume cursor where applicable
Assurance: current login or workload identity
Dependencies: classification_retention_policy, contribution_relation_endpoint_visibility, external_visibility_proof, membership, principal_status, project_status_revision, realm_status_kill_epoch, service_identity_capability, space_access_participant_binding, target_resource_revision
Constraints: external visibility proof required only where the target carries external-sourced material
Fence: none
Offline: cached_draft_only
Schemas: request · result
Source: DESIGN.md §11.6 (developer_assistant_v1 row) + §11.6.1 (family: *_show, *_list, lens_read, events_read, events_wait, event_payload, snapshot_read, presence_list, realtime_resume, artifact_upload_credential)

invocation_cancel

developer_assistant_v1 external_client worker dual-surface

KCP invocation_cancel result (DESIGN.md §10.6)

Surface: external_client, worker
Actor: authenticated creator or authorized principal, current attempt (own exact child invocation under an explicit parent capability)
Kind: mutation — meta required
Args: invocation_id cancellation_scope? reason? attempt_id? fence_epoch?
Scope: ancestry; cancellation scope; inherited ceilings; parent attempt binding
Assurance: current login; worker capability
Dependencies: commitment_terms_acceptance, service_identity_capability, target_resource_revision
Constraints: none
Fence: current attempt fence, plus byom fence when bound; none
Offline: no
Schemas: request · result
Source: DESIGN.md §11.6 (developer_assistant_v1 row) + §11.6.1 (family: Invocation, Commitment, and WorkRealization cancel)

invocation_create

developer_assistant_v1 external_client

KCP invocation_create result (DESIGN.md §10.6)

Surface: external_client
Actor: authenticated operator, authenticated principal
Kind: mutation — meta required
Args: assistant_deployment_id assistant_deployment_revision space_id? branch_id? context_assembly_ref? context_assembly_digest? budget_reservation_set_ref? disclosure_rules_digest? priority? not_before? max_attempts? deadline
Scope: ContextAssembly/input manifest; budget; disclosure; exact manual/deployment-test create action
Assurance: current login; production test may require step-up
Dependencies: context_item_visibility, kovee_policy_set, target_resource_revision
Constraints: cannot name a worker as requester or create a Commitment; the complete current authorization dependency set is required
Fence: none
Offline: no
Schemas: request · result
Source: DESIGN.md §11.6 (developer_assistant_v1 row) + §11.6.1 (family: direct invocation)

invocation_list

developer_assistant_v1 external_client

KCP invocation_list result (DESIGN.md §10.6)

Surface: external_client
Actor: connector service (only for its mapped resources), principal
Kind: query
Args: after? limit snapshot? assistant_deployment_id? space_id? state?
Scope: exact resource read/resume action; resume cursor where applicable
Assurance: current login or workload identity
Dependencies: classification_retention_policy, contribution_relation_endpoint_visibility, external_visibility_proof, membership, principal_status, project_status_revision, realm_status_kill_epoch, service_identity_capability, space_access_participant_binding, target_resource_revision
Constraints: external visibility proof required only where the target carries external-sourced material
Fence: none
Offline: cached_draft_only
Schemas: request · result
Source: DESIGN.md §11.6 (developer_assistant_v1 row) + §11.6.1 (family: *_show, *_list, lens_read, events_read, events_wait, event_payload, snapshot_read, presence_list, realtime_resume, artifact_upload_credential)

invocation_show

developer_assistant_v1 external_client

KCP invocation_show result (DESIGN.md §10.6)

Surface: external_client
Actor: connector service (only for its mapped resources), principal
Kind: query
Args: invocation_id
Scope: exact resource read/resume action; resume cursor where applicable
Assurance: current login or workload identity
Dependencies: classification_retention_policy, contribution_relation_endpoint_visibility, external_visibility_proof, membership, principal_status, project_status_revision, realm_status_kill_epoch, service_identity_capability, space_access_participant_binding, target_resource_revision
Constraints: external visibility proof required only where the target carries external-sourced material
Fence: none
Offline: cached_draft_only
Schemas: request · result
Source: DESIGN.md §11.6 (developer_assistant_v1 row) + §11.6.1 (family: *_show, *_list, lens_read, events_read, events_wait, event_payload, snapshot_read, presence_list, realtime_resume, artifact_upload_credential)

model_complete

developer_assistant_v1 worker

KCP model_complete result (DESIGN.md §16.1-§16.3; derived)

Surface: worker
Actor: invocation attempt only
Kind: mutation — meta required
Args: attempt_id fence_epoch model_profile_ref purpose_ref classification_ref prompt system? max_output_tokens stable_binding_key? act_intent_ref act_intent_digest act_revision subject_digest context_manifest_ref context_manifest_digest stable_execution_key budget_reservation_set_ref
Scope: budget; exact model call through ONE logical ModelProfile named by the invocation capability; invocation manifest, attempt, and the exact DisclosureManifest the ProviderContextManifest chain seals; the byom model_egress ActIntent whose one-shot ExecutionConsumptionReceipt the broker must hold before egress; the destination is that profile's ModelProviderBinding endpoint; a worker cannot name a provider, host, URL, header, or credential
Assurance: workload identity plus invocation capability
Dependencies: classification_retention_policy, context_item_visibility, kovee_policy_set, realm_authority_binding, remaining_use_grant, service_identity_capability, target_resource_revision
Constraints: credentials never enter workers, events, or portable manifests: credential_secret_ref lives only on the ModelProviderBinding and resolves inside the broker; no egress without a valid byom ExecutionConsumptionReceipt (max_uses 1) for this effect's exact stable_execution_key: the act chain is byom's and Kovee only consumes the permit; the act refs a worker presents are CLAIMS, never authority: byomd re-derives intent/subject/disclosure digests, both fences, and the driver audience inside execution_permit_consume, and the permit-channel token is byomd's own file keyed to that act; the complete current authorization dependency set is required; the prepared Effect and the dispatching EffectAttempt are each committed before the next step; an attempt left dispatching resolves to ambiguous and is never auto-retried
Fence: current Kovee invocation fence and the byom Episode fence when bound; both are re-presented to byomd (family contract L21)
Offline: no
Schemas: request · result
Source: DESIGN.md §11.6 (developer_assistant_v1 row) + §11.6.1 (family: checkpoint/contribution/semantic-relation/model/tool/application_event_emit worker operations) + §16.1-§16.3 (effect lifecycle, disclosure manifest, model broker) + byom/DESIGN.md §13.1-§13.3 (the model-egress act chain and execution_permit_consume) + byom/spec/governed-work/provider-context-manifest-byom-fields.schema.json

`governed_work_binding_v1` — 9 operations

byom_episode_binding_show

governed_work_binding_v1 operator

KCP byom_episode_binding_show result

Surface: operator
Actor: human realm-owner principal only
Kind: query
Args: stable_binding_key? episode_ref?
Scope: both fence epochs (byom_fence_epoch and kovee_invocation_fence) per row; exact hosted-Episode binding read over the realm's ByomEpisodeBinding rows; retained fenced rows for audit and orphan-result diagnostics
Assurance: current login
Dependencies: current_authentication_observation, external_visibility_proof, principal_status, realm_authority_binding, realm_status_kill_epoch, target_resource_revision
Constraints: a human realm-owner principal only — never a service identity, session, assistant, or connector; personal-mode bootstrap is owner-only over the UID-checked local socket; a read: it never binds, fences, releases, or advances an Episode; the Episode/EpisodeLease lifecycle is byom-owned and referenced, never re-owned; recovery-only service authority: a service may query saga state (external_command_result_query pattern), never submit, terminalize, modify, or impersonate the original human (R42)
Fence: none
Offline: no
Schemas: request · result
Source: DESIGN.md §11.6 (governed_work_binding_v1 row) + design/2026-07-25-amendment-governance-owner.md §A5 (wire-name resolution) + byom/DESIGN.md §16.6 item 3 + byom/spec/descriptors/byom-episode-binding.json

endeavor_promotion_cancel

governed_work_binding_v1 operator

KCP endeavor_promotion_cancel result (the released pair)

Surface: operator
Actor: human realm-owner principal only
Kind: mutation — meta required
Args: formation_id reason
Scope: exact pre-send cancel over one prepared intent with a still-held slot; the recorded cancel reason
Assurance: explicit confirmation in personal mode; fresh step-up/challenge in team mode
Dependencies: authentication_binding_security_epoch, current_authentication_observation, external_visibility_proof, installation_recovery_epoch, principal_status, realm_authority_binding, realm_status_kill_epoch, target_resource_revision
Constraints: a human realm-owner principal only — never a service identity, session, assistant, or connector; personal-mode bootstrap is owner-only over the UID-checked local socket; after bytes may have left Kovee, cancel is not a row of this machine and the slot has no timeout-based release; recovery-only service authority: a service may query saga state (external_command_result_query pattern), never submit, terminalize, modify, or impersonate the original human (R42); the ONE pre-send release: the local cancel must durably precede the first send (byom §16.3 table row 1)
Fence: paired intent/slot CAS under the slot generation; slot released with released_at set
Offline: no
Schemas: request · result
Source: DESIGN.md §11.6 (governed_work_binding_v1 row) + design/2026-07-25-amendment-governance-owner.md §A5 (wire-name resolution) + byom/DESIGN.md §16.3 (the frozen EndeavorFormationIntent/Slot/Attempt machine and the five-fact ExternalCommandResultQuery union) + byom/spec/descriptors/endeavor-formation.json

endeavor_promotion_prepare

governed_work_binding_v1 operator

KCP endeavor_promotion_prepare result (the durable intent/slot pair)

Surface: operator
Actor: human realm-owner principal only
Kind: mutation — meta required
Args: byom_endpoint_ref society_ref frontier_ref collaboration_context_bundle_ref bound_participant_ref participant_binding_epoch client_formation_key endeavor_proposal_ref endeavor_proposal source_principal_position
Scope: byomd endpoint identity and incarnation, read from the active binding; exact formation-preparation action over one client_formation_key; target society_ref and Society recovery epoch, read from the active mapping; the exact IdempotencyDomain digest and byom command idempotency key; the pinned SpaceFrontier and the ContextAssembly taken at it; the stable KoveeEndeavorFormCommand bytes and their canonical command digest
Assurance: explicit confirmation in personal mode; fresh step-up/challenge in team mode
Dependencies: authentication_binding_security_epoch, branch_status_frontier, context_item_visibility, current_authentication_observation, external_visibility_proof, installation_recovery_epoch, principal_status, realm_authority_binding, realm_status_kill_epoch, target_resource_revision
Constraints: UNIQUE(realm_id, requested_by_principal, client_formation_key) deduplicates one explicit human formation command; it does not imply one Endeavor per Branch, frontier, purpose, or Society (byom §16.3); a human realm-owner principal only — never a service identity, session, assistant, or connector; personal-mode bootstrap is owner-only over the UID-checked local socket; no external contact at all: every byom fact the intent pins is read from the ACTIVE KoveeRealmByomBinding/KoveeSocietyMapping, never asserted by the caller; recovery-only service authority: a service may query saga state (external_command_result_query pattern), never submit, terminalize, modify, or impersonate the original human (R42); the context bundle must be assembled AT the pinned frontier
Fence: paired intent/slot create under slot generation 1; an exact retry of the same client_formation_key returns the identical pair
Offline: no
Schemas: request · result
Source: DESIGN.md §11.6 (governed_work_binding_v1 row) + design/2026-07-25-amendment-governance-owner.md §A5 (wire-name resolution) + byom/DESIGN.md §16.3 (the frozen EndeavorFormationIntent/Slot/Attempt machine and the five-fact ExternalCommandResultQuery union) + byom/spec/descriptors/endeavor-formation.json

endeavor_promotion_reconcile

governed_work_binding_v1 operator

KCP endeavor_promotion_reconcile result (the promotion after the verified fact)

Surface: operator
Actor: human realm-owner principal only
Kind: mutation — meta required
Args: formation_id terminalize? authentication_observation_ref? reason?
Scope: exact recovery action over one non-terminal intent; optionally external_command_terminalize over the exact original domain and command bytes, same source human, freshly authenticated through the current recovery binding (R40); the read-only external_command_result_query against the exact IdempotencyDomain and canonical command digest (R42)
Assurance: always step-up
Dependencies: authentication_binding_security_epoch, current_authentication_observation, external_visibility_proof, installation_recovery_epoch, principal_status, realm_authority_binding, realm_status_kill_epoch, target_resource_revision
Constraints: a human realm-owner principal only — never a service identity, session, assistant, or connector; personal-mode bootstrap is owner-only over the UID-checked local socket; exactly one of five facts drives exactly one row; a verified live `absent` never releases the slot and `unknown` is a conservative hold, never a guess; missing or incomplete RestoreLineage is unknown, never live absent; recovery-only service authority: a service may query saga state (external_command_result_query pattern), never submit, terminalize, modify, or impersonate the original human (R42); terminalization exists exactly where the descriptor's tombstone_verified row does — any state whose outcome is still ambiguous, never one with a verified committed result — and only for the same source human freshly authenticated through the current recovery binding; another principal, service, controller, or successor Participant cannot terminalize; the query is read-only: it cannot submit, terminalize, modify, or impersonate the original human (R42), and it rides the narrow byomd recovery workload, never the delegated-principal credential
Fence: paired intent/slot CAS under the slot generation per verified fact; the slot is released only by a verified non-reexecuting tombstone, a verified historically_fenced_absent, or the committed ExternalLink
Offline: no
Schemas: request · result
Source: DESIGN.md §11.6 (governed_work_binding_v1 row) + design/2026-07-25-amendment-governance-owner.md §A5 (wire-name resolution) + byom/DESIGN.md §16.3 (the frozen EndeavorFormationIntent/Slot/Attempt machine and the five-fact ExternalCommandResultQuery union) + byom/spec/descriptors/endeavor-formation.json

endeavor_promotion_show

governed_work_binding_v1 operator

KCP endeavor_promotion_show result

Surface: operator
Actor: human realm-owner principal only
Kind: query
Args: formation_id?
Scope: exact formation-state read over the realm's intents, slots, attempts, and external links; recorded saga state and slot generation (query-first restore resolution)
Assurance: current login
Dependencies: current_authentication_observation, external_visibility_proof, principal_status, realm_authority_binding, realm_status_kill_epoch, target_resource_revision
Constraints: a human realm-owner principal only — never a service identity, session, assistant, or connector; personal-mode bootstrap is owner-only over the UID-checked local socket; a read: it never prepares, submits, cancels, reconciles, or terminalizes, and makes no byom call at all; recovery-only service authority: a service may query saga state (external_command_result_query pattern), never submit, terminalize, modify, or impersonate the original human (R42)
Fence: none
Offline: no
Schemas: request · result
Source: DESIGN.md §11.6 (governed_work_binding_v1 row) + design/2026-07-25-amendment-governance-owner.md §A5 (wire-name resolution) + byom/DESIGN.md §16.3 (the frozen EndeavorFormationIntent/Slot/Attempt machine and the five-fact ExternalCommandResultQuery union) + byom/spec/descriptors/endeavor-formation.json

endeavor_promotion_start

governed_work_binding_v1 operator

KCP endeavor_promotion_start result (the promotion after the send)

Surface: operator
Actor: human realm-owner principal only
Kind: mutation — meta required
Args: formation_id authentication_observation_ref
Scope: exact formation-submission action over one prepared or awaiting_principal intent; one fresh EndeavorFormationAttempt: nonce, recovery-binding quadruple, authentication observation, and attempt proof; the minted DelegatedPrincipalCredential's (issuer_ref, nonce) consume pair; the unchanged stable command bytes and their canonical command digest
Assurance: always step-up
Dependencies: authentication_binding_security_epoch, current_authentication_observation, external_visibility_proof, installation_recovery_epoch, principal_status, realm_authority_binding, realm_status_kill_epoch, target_resource_revision
Constraints: a fresh human authentication attempt per send: reusing the previous attempt's observation is refused (byom §16.3 table row 2); a human realm-owner principal only — never a service identity, session, assistant, or connector; personal-mode bootstrap is owner-only over the UID-checked local socket; recovery-only service authority: a service may query saga state (external_command_result_query pattern), never submit, terminalize, modify, or impersonate the original human (R42); source-qualified human via the exact Kovee delegated-principal channel, personally filling the sole computed formation seat (R39); it never bootstraps a Society and never manufactures membership; the command endpoint incarnation and Society recovery epoch must still be active; binding rotation fences the send and never releases the slot; the pair moves to submitting and COMMITS before any byte leaves Kovee
Fence: paired intent/slot CAS under the slot generation at the read revision; one immutable attempt per send, UNIQUE(formation_id, attempt_ordinal) and UNIQUE(attempt_nonce); a lost reply becomes remote_unknown and never releases the slot
Offline: no
Schemas: request · result
Source: DESIGN.md §11.6 (governed_work_binding_v1 row) + design/2026-07-25-amendment-governance-owner.md §A5 (wire-name resolution) + byom/DESIGN.md §16.3 (the frozen EndeavorFormationIntent/Slot/Attempt machine and the five-fact ExternalCommandResultQuery union) + byom/spec/descriptors/endeavor-formation.json

governance_disable

governed_work_binding_v1 operator

KCP governance_disable result (greenfield-saga §4)

Surface: operator
Actor: human realm-owner principal only
Kind: mutation — meta required
Args: binding_ref expected_owner_revision confirmed_subject_digest
Scope: canonical subject digest the confirming human sees; exact governance-disable action over one active owner binding; exact scope selector and digest, binding epoch, and expected owner-binding revision
Assurance: always step-up
Dependencies: current_authentication_observation, external_visibility_proof, principal_status, realm_authority_binding, realm_status_kill_epoch, target_resource_revision
Constraints: a human realm-owner principal only — never a service identity, session, assistant, or connector; personal-mode bootstrap is owner-only over the UID-checked local socket and cannot bind an arbitrary endpoint or map another principal; freezes the owner row (status active→frozen) with the owner arm retained for audit and invalidates derived channels and permits; re-enablement is a fresh saga row under a new binding epoch, not a transition of this machine; recovery-only service authority: a service may query saga state (external_command_result_query pattern), never create or activate a binding
Fence: owner-binding CAS at the expected revision under the active binding epoch
Offline: no
Schemas: request · result
Source: DESIGN.md §11.6 (governed_work_binding_v1 row) + design/2026-07-25-amendment-governance-owner.md §A5 (wire-name resolution) + byom/design/2026-07-25-family-contract.md §2.A (the frozen governance_enable authority row, field-complete) + byom/spec/governed-work/greenfield-saga.md (D10)

governance_enable

governed_work_binding_v1 operator

KCP governance_enable result (D10 greenfield enablement saga)

Surface: operator
Actor: human realm-owner principal only
Kind: mutation — meta required
Args: byom_endpoint_ref society_ref exact_scope_selector allowed_project_and_space_selectors classification_binding_ref expected_owner_revision expected_binding_ref? confirmed_subject_digest?
Scope: KoveeSocietyMapping revision; byomd endpoint identity and incarnation; canonical subject digest over the (realm, society_ref, recovery epoch, byom endpoint, mapping revision, owner-binding transition none→byom) tuple — the exact digest the confirming human sees; exact greenfield-enablement action over one exact governed scope; expected absent-or-identical KoveeRealmByomBinding; target society_ref and Society recovery epoch
Assurance: explicit confirmation in personal mode; fresh step-up/challenge in team mode
Dependencies: current_authentication_observation, external_visibility_proof, principal_status, realm_authority_binding, realm_status_kill_epoch, target_resource_revision
Constraints: Kovee is never the genesis governance actor: an already-active Society established by native society_prepare/society_bootstrap is required and is verified by a byomd projection read; Kovee may start/configure/bind byomd and supply inert context only (amendment A2); a human realm-owner principal only — never a service identity, session, assistant, or connector; personal-mode bootstrap is owner-only over the UID-checked local socket and cannot bind an arbitrary endpoint or map another principal; no overlapping scope selector may hold an active owner binding or a pending enablement past step 1 (byom §16.6 item 1); rejection precedes creating anything; recovery-only service authority: a service may query saga state (external_command_result_query pattern), never create or activate a binding
Fence: binding epoch CAS at the expected KoveeGovernanceOwnerBinding revision; overlap rejected; retry returns the identical binding; rollback-before-activation spends the epoch; restore behavior per the D10 saga
Offline: no
Schemas: request · result
Source: DESIGN.md §11.6 (governed_work_binding_v1 row) + design/2026-07-25-amendment-governance-owner.md §A5 (wire-name resolution) + byom/design/2026-07-25-family-contract.md §2.A (the frozen governance_enable authority row, field-complete) + byom/spec/governed-work/greenfield-saga.md (D10)

governance_show

governed_work_binding_v1 operator

KCP governance_show result (D10 greenfield enablement saga state)

Surface: operator
Actor: human realm-owner principal only
Kind: query
Args: binding_ref?
Scope: exact governance-state read over the realm's bindings, mappings, owner rows, and enablement saga slots; recorded saga state and binding epoch (query-first restore resolution)
Assurance: current login
Dependencies: current_authentication_observation, external_visibility_proof, principal_status, realm_authority_binding, realm_status_kill_epoch, target_resource_revision
Constraints: a human realm-owner principal only — never a service identity, session, assistant, or connector; personal-mode bootstrap is owner-only over the UID-checked local socket and cannot bind an arbitrary endpoint or map another principal; a read: it never creates, activates, rolls back, or freezes a binding; recovery-only service authority: a service may query saga state (external_command_result_query pattern), never create or activate a binding
Fence: none
Offline: no
Schemas: request · result
Source: DESIGN.md §11.6 (governed_work_binding_v1 row) + design/2026-07-25-amendment-governance-owner.md §A5 (wire-name resolution) + byom/design/2026-07-25-family-contract.md §2.A (the frozen governance_enable authority row, field-complete) + byom/spec/governed-work/greenfield-saga.md (D10)

How to read this

CLI

Envelope schemas

Problems

MCP tools

Bundles

Operations

core_v1 — 3 operations

shared_space_v1 — 62 operations

developer_assistant_v1 — 22 operations

governed_work_binding_v1 — 9 operations

`core_v1` — 3 operations

`shared_space_v1` — 62 operations

`developer_assistant_v1` — 22 operations

`governed_work_binding_v1` — 9 operations