The registry monolith (agents/protocol/src/tool-registry.ts, ~1,400 lines, 25 tools) is replaced by five verb
definitions plus internal address dispatch. No aliases: the old tool names stop existing; stored transcripts keep their
historical events (rendered generically) and replay fine — provider messages carry names verbatim and never re-dispatch
old calls.

read {address, …opts} — one dispatcher keyed by address shape:

~/memory/** → agent-memory read/list (dir address ⇒ listing with summary lines)

~/tools/** → tool contract (M1: from the builtin table; M2: from documents)

hm://… → existing hypermedia read path; ipfs://… → ipfs read

https://… → web read; activity: (or ~/activity) → activity feed with existing filters

~/threads/<id> → transcript; run:<id> → run journal

write {address, content, …opts} — memory writes/deletes, plan documents, hm:// document operations (absorbing

the 22-command write envelope into address+content+intent), ipfs://, attachment moves (an attachment is just a
readable source address).

call {tool, input} — dispatch by tools/… path over one seam (registerBuiltin), which M1 introduces

internally: search, web_search, navigate, execute land here as bound builtins. Calling an unexpanded tool returns its
contract as the result (touch-expands); the retry runs.

delegate {brief, script?, output?, await?, title?, step?} — merges sub_session (default), run_workflow

(script present ⇒ script child), start_session (await: false ⇒ detached but still in the run tree).
Verbatim-markdown briefs, typed output with bounded retries, plan-step attachment — all preserved from v1.

plan {steps | update} — absorbs update_plan; set_session_title is deleted (titling is already automatic and

agent-authored).

Files: protocol/src/tool-registry.ts (rewrite), protocol/src/index.ts (event/type updates), api-service.ts
(createAgentServicePiTools region, the three name-filter chains, delegation paths), shared UI tool renderers
(@shm/ui/agents), desktop run-card step labels, affected tests across agents/src/*.test.ts and desktop.

Success is measurable: default-agent system prompt shrinks by roughly the difference between 25 schemas and 5; model
tool-choice in the simulated gate has no wrong-tool retries.

Tool documents in the Space: frontmatter-style metadata (name, summary, tags, grants required), Onyx input/output

contracts, model-facing description, and source (lambda) or builtin binding id. Storage rides the agent-memory tree
(~/tools/**) so read/write/versioning come free; each save produces a CID (content-address the canonical CBOR
encoding).

Boot upsert: builtins materialize/refresh their documents at service start; a forked builtin doc keeps the binding id

but its contract diff is visible.

The index: generated summary of the Space (one line per tool/group, memory dirs with counts, live plans, active

triggers), injected into every run's system prompt; a CI test asserts the byte budget (~1.5 KB default agent).

Touch-expand + pins: read on a tool document (or contract-returning call) appends a durable

expanded {path, cid} log event and activates the tool via Pi setActiveToolsByName; replay/compaction/park-resume
reconstruct the active set from pins. Unpin is explicit.

The five verbs' own docs deepen on first use (full help returned beside the first result).

actor: 'user' | 'agent' | 'system' | 'trigger' on session events (schema migration; existing rows backfill by event

type).

Protocol: user-invoked read/write/call against a thread — appended to the log as actor: user

tool_call/tool_result pairs and executed as runs on the interactive queue; the agent sees them in transcript replay on
its next turn, no side channel.

Desktop: composer / palette over the Space (tools, saved plans, triggers); Onyx-schema-generated forms for tool

input; results render with the existing card grammar; user edits to plan steps and per-child cancels emit log events
the agent can read.

Web parity via the shared @shm/ui/agents package where the platform adapters allow.

execute {runtime: 'ts' | 'python', code, files?} — the whole compute surface; option sprawl (image/cpu/memory per

call) collapses to service config.

Bun-based TS runner image beside the Python image; one file-framed runner protocol for both; runner-protocol suite

runs against the injected fake sandbox, real-microVM smoke stays gated.

Lambda tool documents become callable: call tools/<lambda> = validate input (Onyx, outside VM) → execute stored

source → validate output. Author→test→save flows through write + call.

runs.wait gains event and budget-pause beside children/timer.

ctx.sleep(until) persists wake-at; the dispatch loop's timer sweep wakes due runs (days-scale, restart-proof —

kill/restart tests across sleeps).

ctx.waitForEvent(match, {timeout}) registers an ephemeral trigger scoped to the run; firing appends the payload

to the journal and requeues the run; timeout is a timer wait racing it.

ctx.continueAsNew(state) finalizes the run and enqueues a successor carrying declared state only — journal growth

over week-scale loops stays bounded.

Card/thread copy for every parked state: "sleeping until 08:00", "waiting for approval", "paused: daily budget", with

user wake/cancel affordances.

Trigger documents in ~/triggers/** replace the trigger CRUD protocol surface; monitors read documents.

status: draft | active; activation is the consented step (minimal consent card — the card grammar's question state).

Sources: the shipped four (schedule, document-comment, user-mention, site-update) plus document-change (watch any

hm:// path or Space dir) and run-completed (chain automations). Webhook stays out of scope unless trivial.

Continuations: newThread {brief} (today's behavior), appendTo {thread}, wake {run, signal} (delivers to a

waiting ctx.waitForEvent), runPlan {plan} (saved plan → fresh run).

Per-trigger budgets with auto-pause; firing history browsable as run records beside the document.