Project and agent contracts
Project-domain integrations expose authenticated HTTP operations and grouped MCP actions for Projects, Trackers, Review packages, Project Review Sessions, source snapshots, and evidence. Exact deployed operations and request shapes are in the generated HTTP operation reference and MCP tool reference.
Before writing, read current state and its ETag/version. Supply the exact typed input, conditional version, and idempotency key required by that operation. Keep the same key only for an identical retry. On conflict, preserve the proposed change, reload current data, reconcile, and submit a new intent.
Agent workspace grants, Resource authorization, provider permissions, and user membership are separate. A Resource reference is not an access grant. Agents cannot create human Decisions, alter reviewer eligibility, or assert trusted verification. Provider writes require independent provider write authority.
Use Project and Tracker automation, Project evidence definitions, and exact human acceptance before automating a consequential workflow.