Four tools. Read, search, propose. Nothing writes directly.

list_projects()
→ { projects: [ { id, name, data_class, updated_at } ] }

Only allowed projects are returned. Restricted projects are not listed.

get_context({ project_id, task })
→ {
    context_id,           // request id, used for dedupe and audit
    freshness: { compiled_at, replica_at },
    identity: { actor, trust_zone, role },
    policies: [ ... ],    // protected, always included where relevant
    facts: [ { state, kind, text, provenance: { source, date, actor } } ],
    open_threads: [ ... ],
    methods: [ ... ],     // instruction-only skills relevant to the task
    pointers: [ { ref, why } ]   // deeper retrieval, not the vault
  }

The bundle is bounded. The whole workspace is never returned.

search_memory({ project_id, query, cursor? })
→ { results: [ { ref, excerpt, provenance, data_class } ], cursor? }

Results are limited to the selected project and the token's data classes.
A cursor from one project is invalid in another.

propose_memory({
  project_id,
  request_id,           // client-supplied; replays are acknowledged, not duplicated
  change: { op: "add_fact" | "update_fact" | "open_thread" | "close_thread" | "reject",
            target?, text, supersedes? },
  evidence: [ { ref | text, trust } ]
})
→ { proposal_id, status: "queued" | "quarantined", taint }

Proposals are append-only and attested. They are delivered to the
consolidator exactly once. Nothing is published until it is reviewed.