Tool visibility by rights, apps, PHI, risk ceiling, taint, capability and charter

Shipped

September 27, 2026 at 7:16 AM UTC

Author

Kamo

Commit

2567023

The capability gate caches the router's answer per member (SP04 filter 10 narrows candidates by the member's access policies), keeps a failure to get one for 30 s rather than 5 min, and never lets an unexpected error escape; a failed org-facts lookup is UNKNOWN for 5 s rather than a minute (SP05-T9).