fix(brains): sync the generated capability catalog and bump to 2.9.1 [BRNS-MCP-052][BRNS-CORE-061]

plugins/brains/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "brains",
   "description": "Your memory layer: Gmail, Calendar, Drive, and prior Claude conversations as queryable pages, with reflexive recall, hook-driven turn-by-turn capture and inbox delivery, and boards/automations/workflows on top.",
-  "version": "2.9.0",
+  "version": "2.9.1",
   "author": {
     "name": "brains (ssvlabs)"
   },

plugins/brains/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "brains",
-  "version": "2.9.0",
+  "version": "2.9.1",
   "description": "Your personal memory layer for Codex: query Gmail, Calendar, Drive, and prior conversations, then build boards, automations, and workflows.",
   "author": {
     "name": "brains (ssvlabs)",

plugins/brains/generated/capability-catalog.json

@@ -7,15 +7,15 @@
   "artifacts": [
     {
       "capability_id": "integration-actions",
-      "catalog_sha256": "29f58ddc5dab294814934fe7af0d808f4b7dc441e3c3d29bb0e67fa705d7add4",
+      "catalog_sha256": "f93159bc3af5e891ae4b31c82178535242783c5419a07cd76b5aa3598ff299a7",
       "artifact_path": "plugins/brains/skills/brains-write/SKILL.md",
-      "artifact_sha256": "21f7cd40bedb7602efbbd43f718c1e5e78e41a19de3d96f3dd599b95fb17732d"
+      "artifact_sha256": "c289803f96c35dcfd5347e46177c009850dfdc4b42579a770ea6516d0c60e2af"
     },
     {
       "capability_id": "brains-features",
-      "catalog_sha256": "a1677c30594d44e516a3aaa8e6524829360e44d90f8304d2ab8291b7e5ed6a3a",
+      "catalog_sha256": "9976952657698137f1ab4cb0d9eb547555e0c966659632cc4d14e5797d66830b",
       "artifact_path": "plugins/brains/skills/brains-build/SKILL.md",
-      "artifact_sha256": "f9196254dd49af3cd8bb1d4d93b1ba36ff10d8efc0bb039fb464901e143e143f"
+      "artifact_sha256": "95261ee804b3b3cae4f42231264aafa64c96753dce71ab851fad6f97eed37c48"
     },
     {
       "capability_id": "procedure:board",
@@ -27,7 +27,7 @@
       "capability_id": "procedure:automation",
       "catalog_sha256": "ea1e883788e138e39b80627e5a14d6ac35dc7f658b4628e7e32084bb6620fe8b",
       "artifact_path": "plugins/brains/skills/brains-automation/SKILL.md",
-      "artifact_sha256": "78c63d6a09ffdf55f80f3b686b1cd0d1000585bc1d5d148323ea03ebda018bc2"
+      "artifact_sha256": "c91cc266c317a5d2ae479594ecad0e5048970d7431139777ea61f401bb4e9cc6"
     },
     {
       "capability_id": "procedure:workflow",
@@ -36,5 +36,5 @@
       "artifact_sha256": "b22814fd630ed78964d54440ec327e3aebcde8c812aaa9985fff9c4d345d3f09"
     }
   ],
-  "source_commit": "e332512644b2f06a6b7068dcc9196eab2d31c05a"
+  "source_commit": "6fb7b2356592b4e5313176cc55d6d06cb3130e31"
 }

plugins/brains/skills/brains-automation/SKILL.md

@@ -176,7 +176,7 @@ After one hour a draft moves to the `/inbox` Expired tab but remains
 approvable. There is no edit-at-confirm step: call
 `discard_action` before re-drafting corrected input.
 
-Automation tokens cannot self-confirm. A confirmation-required action therefore waits for the human at `/inbox`, but a `requires_confirmation:false` action still executes inline for any caller granted `act_on_integration`. Get explicit agreement before saving an automation that performs an unattended external write. New automations default to `write_policy:'always_draft'`; only `update_automation` can switch to `auto_confirm_safe`, and that policy does not override an action whose recipe already auto-executes.
+Automation tokens cannot self-confirm: `confirm_action` is refused for them under either policy, so a confirmation-required action is released by the `write_policy` rule above, not by the sandbox. Get explicit agreement before saving an automation that performs an unattended external write. New automations default to `write_policy:'always_draft'`; switching to `auto_confirm_safe` is an explicit configuration change, and that policy does not override an action whose recipe already auto-executes.
 
 **For "notify me" / "ping me" / "DM me" asks**, default to `telegram_push` when the user has Telegram connected — it's the user's primary notification surface. Reach for `act_on_integration` only when the notification belongs in a specific channel (email thread, calendar invite, Drive doc). `telegram_push` bypasses the draft/confirm step and sends immediately, so the user must have opted in by connecting the bot.
 
@@ -248,7 +248,7 @@ Derive from Steps 3 + 4. The user doesn't pick this — you do. Mention it inlin
 | Un-retire a row (`brains.boards.restore`) | `restore_board_row` |
 | Pull fresh gmail/calendar/drive data | `fetch_from_integration` |
 | Read a github/monday adapter (`brains.call("adapter_query", …)`) | `adapter_query` |
-| Send | `act_on_integration` (drafts for a confirm-required action; an action declaring `requires_confirmation:false` sends inline) |
+| Send | `act_on_integration` (drafts or sends inline per requires_confirmation and write_policy; see the contract above) |
 | Send a Telegram DM (only when user explicitly asked) | `telegram_push` (bypasses draft/confirm — delivers immediately) |
 | Write a memory page | `create_page` |
 | LLM call from sandbox | `automation_complete` |
@@ -377,8 +377,8 @@ The new agent lands in `active` state — it will start firing on its cron / pag
 Before handing off, prove the source compiles and runs end-to-end against a real trigger payload by firing one manual dry run. Call **`run_automation_once`** with:
 
 - `automation_id` — from Step 8
-- `dry_run: true` — default; lets the user code execute but suppresses outbound writes (same hook the admin Dry-Run button uses)
-- `verify_mode: true` — **REQUIRED for self-verification during this flow.** When true the MCP server suppresses all outbound side-effect tools (telegram_push, email / calendar / drive sends via act_on_integration, fetch_from_integration writes, and non-GET http_fetch) and returns suppressed-shape stubs instead. This lets you confirm the source compiles and the logic path executes end-to-end **without spamming the user's phone / inbox / drive** while you're still iterating. The user code still runs; only the deliveries are muted.
+- `dry_run: true` — default; suppresses act sends and `telegram_push`. Board and page writes run live under `dry_run` AND `verify_mode` — a smoke test mutates real rows
+- `verify_mode: true` — **REQUIRED for self-verification during this flow.** When true the MCP server suppresses all outbound side-effect tools (telegram_push, email / calendar / drive sends via act_on_integration, fetch_from_integration writes, and non-GET http_fetch) and returns suppressed-shape stubs instead. This lets you confirm the source compiles and the logic path executes end-to-end **without spamming the user's phone / inbox / drive** while you're still iterating.
 
 The tool enqueues a `trigger_kind='manual'` run and polls `automation_runs` until it terminates (or `wait_seconds` elapses). Default wait is `max_wall_seconds + 90` to cover the runner's ~30s tick + sandbox spawn.
 

plugins/brains/skills/brains-build/SKILL.md

@@ -23,12 +23,13 @@ Don't restate that artifact here — open it.
 | **Recurring brief / digest** | Install a prebuilt automation that sends a recurring summary instead of scaffolding one. | `list_recipes` → `install_recipe` |
 | **Workflow** | A goal container: charter, KPIs, deadlines, roster, an owned board and template automations. | `create_workflow_flow` if your client exposes it (follow the playbook it returns), otherwise `create_workflow` |
 | **Mini-site** | Static sandboxed HTML on a brain — a deck, a one-pager, a shareable link. | `create_mini_site` |
-| **Sharing** | Give someone access — share_board, share_folder (cascades), share_mini_site, create_share_circle. | `share_board` |
+| **Sharing** | Give someone access — share_board, share_folder (cascades), share_mini_site. | `share_board` |
 | **Board source link** | Bind a board to an external resource through an adapter (http_json, ics, github, monday). | `create_board_link` |
 | **Dataset recipe** | Schedule a board link to materialize into a dataset on a cron — set up on the board's sources page. | the board's Sources page (`/boards/<id>/sources`) — no agent tool for this |
-| **Integrations** | See what's connected and install, upgrade or remove an integration. | the `brains-integrations` skill if your client loads skills, otherwise `list_my_integrations` → `install_integration` |
+| **Integrations** | Connectors: what's connected; install, upgrade, remove. CLI/connector `create_integration_flow` authors one. | the `brains-integrations` skill if your client loads skills, otherwise `list_my_integrations` → `install_integration` |
 | **Recipe publishing** | Publish a board or other supported build to the catalog — publish_recipe names the kinds it accepts. | `publish_recipe` |
-| **Telegram bot** | Reach the brain from a phone, without the laptop. | the Connect Telegram page (`/install/telegram`) — no agent tool for this |
+| **Recipe install** | Catalog recipe: install_recipe, uninstall_recipe removes/deletes; list_installed_versions reads 3 of 5. | `list_recipes` |
+| **Telegram bot** | Reach the brain from Telegram on a phone, without the laptop. | the Connect Telegram page (`/install/telegram`) — no agent tool for this |
 
 Reach for a `*_flow` tool for any create/set-up/scaffold ask: it returns the
 playbook that produces a structure which actually fits. Use the bare

plugins/brains/skills/brains-write/SKILL.md

@@ -23,14 +23,16 @@ execution in their brains settings, in which case a short allowlist of low-risk
 actions also runs inline when called from an eligible client signed in from the
 user's own computer (CLI clients such as Claude Code and Codex) — every execution
 is still recorded in /inbox. The mode is decided server-side per call, so treat
-any call as potentially executing and never assume a `draft_id`. If
+any call as potentially executing and never assume a `draft_id`. Get the user's
+go-ahead for the write before you call; do not call to find out whether it
+drafts. If
 `requires_confirmation` is absent, the page predates the field: treat whether
 it drafts or runs as unknown. `side_effect` says where it writes
 (`external` = the provider, visible outside brains;
 `null` or absent = undeclared, treat as external). Inline external writes
 include `rsvp_event`,
 `create_draft`, and `add_labels`; do not infer safety from read vs write.
-Cap: 30 auto-executions/install/60s.
+Cap: 30 auto-executions/install/60s. Direct execution is additionally capped at 10/user/60s across every install; past either cap a direct execution degrades to a draft.
 Automation `dry_run` suppresses external writes to no-call `[DRY RUN]` drafts.
 
 | `kind` | What happened | What you do |