diff --git a/canonical/.dispatch-state/agents/chittyagent-chatgpt.json b/canonical/.dispatch-state/agents/chittyagent-chatgpt.json
index 39f9d29..983181b 100644
--- a/canonical/.dispatch-state/agents/chittyagent-chatgpt.json
+++ b/canonical/.dispatch-state/agents/chittyagent-chatgpt.json
@@ -1,8 +1,8 @@
 {
-  "canonical_sha": "6004aab619b0171f37619f14a3a3bee899db9498",
+  "canonical_sha": "4414fb06191ec9f9033870f7ce643028f84e7470",
   "targets": {
-    "claude-code": "2c3e8a7005b718f4724dbcb0c123cdebfb120e3d",
-    "codex": "2c3e8a7005b718f4724dbcb0c123cdebfb120e3d",
-    "openclaw": "88989ad699c52b5e91b4a8e4dbeeb61275d0c60c"
+    "claude-code": "75447f59489fc06b19934a30976a387c892afdf8",
+    "codex": "75447f59489fc06b19934a30976a387c892afdf8",
+    "openclaw": "04d4b90d1d79c7a3588157a399410b3788e4a0c7"
   }
 }
\ No newline at end of file
diff --git a/canonical/.dispatch-state/agents/chittyagent-cloudflare.json b/canonical/.dispatch-state/agents/chittyagent-cloudflare.json
index 53c5dce..ff2a1f2 100644
--- a/canonical/.dispatch-state/agents/chittyagent-cloudflare.json
+++ b/canonical/.dispatch-state/agents/chittyagent-cloudflare.json
@@ -1,8 +1,8 @@
 {
-  "canonical_sha": "811827297b9915ab9ff58d32d85c29ae6a6b6d3a",
+  "canonical_sha": "85bdb26397ad7c77a6ec613be76afee49af8571a",
   "targets": {
-    "claude-code": "4049c291e03c0e684946755e69700d2b7c956fb7",
-    "codex": "4049c291e03c0e684946755e69700d2b7c956fb7",
-    "openclaw": "2ecf019414356593b5a8ef300e59f3e5ad7c95b3"
+    "claude-code": "df25b03afcd113996e8be15cbc12fdfcb31ae09b",
+    "codex": "df25b03afcd113996e8be15cbc12fdfcb31ae09b",
+    "openclaw": "c3ed97a078d800f358b7d6db0192aacb517df28b"
   }
 }
\ No newline at end of file
diff --git a/canonical/.dispatch-state/agents/chittyagent-notion.json b/canonical/.dispatch-state/agents/chittyagent-notion.json
index a605ac3..1907fb4 100644
--- a/canonical/.dispatch-state/agents/chittyagent-notion.json
+++ b/canonical/.dispatch-state/agents/chittyagent-notion.json
@@ -1,8 +1,8 @@
 {
-  "canonical_sha": "7e464680620929b934d95b4d653de656a96d6862",
+  "canonical_sha": "7bebfecbb4422721a6ba3b14098dd186204439a7",
   "targets": {
-    "claude-code": "5cab5a901f45eba7b297f7c577c0191672020daa",
-    "codex": "5cab5a901f45eba7b297f7c577c0191672020daa",
-    "openclaw": "ef82b80f871024388a9c3393a8894aa5401c87ad"
+    "claude-code": "e1fa5f7d937ef9632f3dbdc3b00b1c9efef9fd35",
+    "codex": "e1fa5f7d937ef9632f3dbdc3b00b1c9efef9fd35",
+    "openclaw": "cfe2c6ba91a0dee89e7affb6cc25ac9f799105f0"
   }
 }
\ No newline at end of file
diff --git a/canonical/agents/chittyagent-chatgpt.md b/canonical/agents/chittyagent-chatgpt.md
index 6004aab..4414fb0 100644
--- a/canonical/agents/chittyagent-chatgpt.md
+++ b/canonical/agents/chittyagent-chatgpt.md
@@ -11,56 +11,64 @@ runtimes:
 classification:
   - proxy
   - integration
+proxies: chittyagent-chatgpt (chittyentity/workers/chittyagent-chatgpt)
 ---
 
 # ChittyAgent ChatGPT
 
-This agent proxies ChatGPT integration operations to the remote ChittyAgent service.
+This definition proxies ChatGPT integration work to the deployed
+`chittyagent-chatgpt` worker. It is a definition (T); the worker it routes to is
+the actor.
 
 ## Endpoint
 
 ```
-https://agent.chitty.cc/api/chatgpt
+https://agent.chitty.cc/chatgpt
 ```
 
-## Usage
+Matches the worker's declared route `agent.chitty.cc/chatgpt/*`
+(`wrangler.jsonc` → `env.production.routes`).
+
+## Routes
+
+Self-declared by the worker at `GET /chatgpt/`:
+
+| Route | Method | Purpose |
+|---|---|---|
+| `/health` | GET | Health check |
+| `/api/v1/status` | GET | ChittyRegister compliance status |
+| `/openapi.json` | GET | OpenAPI 3.1.0 spec for ChatGPT Actions |
+| `/mcp` | POST | MCP server design and implementation guidance |
+| `/actions` | POST | Custom GPT Actions design and implementation |
+| `/plugins` | POST | ChatGPT plugin operations |
+| `/troubleshoot` | POST | Integration debugging |
+
+The worker reports `system_class: chatgpt_integration_agent`,
+`governance_class: III`.
+
+There is **no** single dispatch route taking `{"operation": ...}`. Each concern
+is its own path — post to the route that matches the work.
 
-All ChatGPT integration operations should be forwarded to the remote ChittyAgent:
+## Usage
 
 ```bash
-curl -X POST https://agent.chitty.cc/api/chatgpt \
+curl -X POST https://agent.chitty.cc/chatgpt/actions \
   -H "Content-Type: application/json" \
   -H "Authorization: Bearer $CHITTY_SERVICE_TOKEN" \
-  -d '{
-    "operation": "mcp|actions|plugins|troubleshoot",
-    "payload": { ... }
-  }'
+  -d '{ }'
 ```
 
-## Capabilities
-
-The remote agent handles:
-- MCP Server development and configuration
-- Custom GPT Actions design and implementation
-- ChatGPT extensions and plugins
-- Integration troubleshooting
+`/mcp` on this worker serves design guidance over HTTP POST. It is not the
+streamable-HTTP MCP transport used by the other agent workers — do not send it
+an `Mcp-Session-Id` handshake.
 
 ## Authentication
 
-Authenticate via ChittyAuth service token. The remote agent handles OpenAI API authentication internally.
+ChittyAuth service token. The worker holds the OpenAI credential internally;
+never pass an OpenAI key here.
 
-## Example
+## Known state (verified 2026-09-04)
 
-```bash
-# Design MCP server architecture
-curl -X POST https://agent.chitty.cc/api/chatgpt \
-  -H "Content-Type: application/json" \
-  -H "Authorization: Bearer $CHITTY_SERVICE_TOKEN" \
-  -d '{
-    "operation": "mcp",
-    "action": "design",
-    "payload": {"use_case": "database integration"}
-  }'
-```
+`/health` → `{"status":"ok","checks":{"mcp":"ok"}}`, version 1.0.0. Fully live.
 
-Forward all ChatGPT integration requests to this endpoint. Do not execute OpenAI operations directly.
+Forward ChatGPT integration requests to this endpoint. Do not call the OpenAI API directly.
diff --git a/canonical/agents/chittyagent-cloudflare.md b/canonical/agents/chittyagent-cloudflare.md
index 8118272..85bdb26 100644
--- a/canonical/agents/chittyagent-cloudflare.md
+++ b/canonical/agents/chittyagent-cloudflare.md
@@ -11,62 +11,79 @@ runtimes:
 classification:
   - proxy
   - integration
+proxies: chittyagent-cloudflare (chittyentity/workers/chittyagent-cloudflare)
 ---
 
 # ChittyAgent Cloudflare
 
-This agent proxies Cloudflare operations to the remote ChittyAgent service.
+This definition proxies Cloudflare operations to the deployed
+`chittyagent-cloudflare` worker. It is a definition (T); the worker it routes to
+is the actor.
 
 ## Endpoint
 
 ```
-https://agent.chitty.cc/api/cloudflare
+https://agent.chitty.cc/cloudflare
 ```
 
-## Usage
+Matches the worker's declared route `agent.chitty.cc/cloudflare/*`
+(`wrangler.jsonc` → `env.production.routes`).
 
-All Cloudflare operations should be forwarded to the remote ChittyAgent:
+## Routes
 
-```bash
-curl -X POST https://agent.chitty.cc/api/cloudflare \
-  -H "Content-Type: application/json" \
-  -H "Authorization: Bearer $CHITTY_SERVICE_TOKEN" \
-  -d '{
-    "operation": "workers|pages|r2|d1|kv|dns|...",
-    "action": "deploy|configure|query|...",
-    "payload": { ... }
-  }'
-```
+| Route | Purpose |
+|---|---|
+| `/health` | Health + per-account reachability |
+| `/api/v1/status` | ChittyRegister compliance status |
+| `/workers/list` | List Workers |
+| `/kv/list` | List KV namespaces |
+| `/r2/list`, `/r2/inventory`, `/r2/inventory/all`, `/r2/create` | R2 buckets |
+| `/dns/zones` | DNS zones |
+| `/domains/list`, `/sync/domains` | Domains |
+| `/cf-api` | Generic Cloudflare API passthrough |
+| `/mcp` | MCP transport |
 
 ## Capabilities
 
-The remote agent handles:
-- Workers deployment and management
-- Pages deployment and configuration
-- R2 object storage operations
-- D1 database operations
-- KV namespace management
-- DNS and zone configuration
-- WAF and security settings
-- Durable Objects
-- Queues and Workers AI
+The worker reports exactly: **`workers`, `kv`, `r2`, `dns`, `domains`**.
 
-## Authentication
+Pages, D1, WAF, Durable Objects, Queues, and Workers AI are **not** served by
+this agent. A previous revision of this document listed them; that was not
+backed by the deployment. Route those elsewhere.
 
-Authenticate via ChittyAuth service token. The remote agent handles Cloudflare API authentication internally.
+## Accounts
 
-## Example
+Multi-account. `/health` reports per-account reachability for `chittycorp`,
+`digitaldossier`, and `furnishedcondos`.
+
+## Usage
 
 ```bash
-# Deploy a worker
-curl -X POST https://agent.chitty.cc/api/cloudflare \
-  -H "Content-Type: application/json" \
-  -H "Authorization: Bearer $CHITTY_SERVICE_TOKEN" \
-  -d '{
-    "operation": "workers",
-    "action": "deploy",
-    "payload": {"name": "my-worker", "code": "..."}
-  }'
+curl -s https://agent.chitty.cc/cloudflare/workers/list \
+  -H "Authorization: Bearer $CHITTY_SERVICE_TOKEN"
 ```
 
-Forward all Cloudflare requests to this endpoint. Do not execute Cloudflare API calls directly.
+Each concern is its own path. There is no single dispatch route taking
+`{"operation": ..., "action": ...}`.
+
+## Authentication
+
+ChittyAuth service token. The worker holds Cloudflare API credentials
+internally; never pass a Cloudflare key or `X-Auth-Key` here.
+
+## Known state (verified 2026-09-04)
+
+- `/health` → `status: degraded`.
+- `GET /cloudflare/` → **403 `"Missing CHITTY_AUTH_SERVICE_TOKEN in env"`** — the
+  worker's own outbound service credential is absent from its environment.
+- Account reachability: `chittycorp` reachable; `digitaldossier` and
+  `furnishedcondos` both fail with `"Unknown X-Auth-Key or X-Auth-Email"`.
+
+Two of three accounts and the service token are credential faults, not routing
+faults. Repair routes through ChittyConnect (`/chico`), not through this
+definition.
+
+Note: `cloudflare.chitty.cc` returns **522**. It is a stale hostname with no
+worker behind it — not this service. Use the path form above.
+
+Forward Cloudflare requests to this endpoint. Do not call the Cloudflare API directly.
diff --git a/canonical/agents/chittyagent-notion.md b/canonical/agents/chittyagent-notion.md
index 7e46468..7bebfec 100644
--- a/canonical/agents/chittyagent-notion.md
+++ b/canonical/agents/chittyagent-notion.md
@@ -1,7 +1,7 @@
 ---
 name: chittyagent-notion
 canon_uri: chittycanon://core/services/chittymarket#agents/chittyagent-notion
-description: Proxy to remote ChittyAgent Notion service for database operations
+description: Proxy to remote ChittyAgent Notion service for registry database operations
 kind: agent
 plugin: chittyos-proxy-agents
 runtimes:
@@ -11,73 +11,85 @@ runtimes:
 classification:
   - proxy
   - integration
+proxies: chittyagent-notion (chittyentity/workers/chittyagent-notion)
 ---
 
 # ChittyAgent Notion
 
-This agent proxies Notion operations to the remote ChittyAgent service.
+This definition proxies Notion registry operations to the deployed
+`chittyagent-notion` worker. It is a definition (T); the worker it routes to is
+the actor.
 
 ## Endpoint
 
 ```
-https://agent.chitty.cc/api/notion
+https://agent.chitty.cc/notion
 ```
 
-## Usage
+Matches the worker's declared route `agent.chitty.cc/notion/*`
+(`wrangler.jsonc` → `env.production.routes`). MCP is at `/notion/mcp`
+(streamable HTTP; requires an `Mcp-Session-Id` header).
 
-All Notion database operations should be forwarded to the remote ChittyAgent:
+## Routes
+
+| Route | Method | Purpose |
+|---|---|---|
+| `/health` | GET | Health + per-registry token reachability |
+| `/api/v1/status` | GET | ChittyRegister compliance status |
+| `/query` | POST | Query a registry |
+| `/execute` | POST | Create / update / archive |
+| `/registries` | GET | List registries with `database_id` |
+| `/blocks`, `/update-page-content`, `/page/{id}/blocks` | POST | Page content |
+| `/bulk`, `/run-now`, `/sync-domains`, `/sync/status`, `/sync/health` | — | Sync |
+| `/discover`, `/audit`, `/manifest`, `/governance` | — | Introspection |
+| `/webhook` | POST | Webhook receiver |
+| `/refresh-cache` | POST | Clear `data_source_id` cache |
+
+## Query
+
+`registry` **or** `database_id` is required.
 
 ```bash
-curl -X POST https://agent.chitty.cc/api/notion \
+curl -X POST https://agent.chitty.cc/notion/query \
   -H "Content-Type: application/json" \
   -H "Authorization: Bearer $CHITTY_SERVICE_TOKEN" \
-  -d '{
-    "operation": "query|create|update|archive",
-    "registry": "service|domain|systems|...",
-    "payload": { ... }
-  }'
+  -d '{"registry": "service", "filter": {...}, "page_size": 100}'
 ```
 
-## Available Registries
-
-The remote agent has access to all canonical registries:
-- Domain Registry
-- Service Registry
-- Systems Registry
-- GitHub Repository Registry
-- Legal Entities Registry
-- Authority Registry
-- Context Registry
-- Asset Registry
-- Document Registry
-- Property Resources Registry
-- Central Registry of Registries
-
-## Operations
-
-| Operation | Description |
-|-----------|-------------|
-| `query` | Query database entries with filters |
-| `create` | Create new database entry |
-| `update` | Update existing entry by page ID |
-| `archive` | Soft delete entry by page ID |
+Optional: `filter`, `sorts`, `page_size` (default 100). Returns `registry`,
+`database_id`, `data_source_id`, `count`, `results`, `has_more`.
 
-## Authentication
+## Execute
 
-Authenticate via ChittyAuth service token. The remote agent handles Notion API authentication internally.
-
-## Example
+`action` is required, plus `registry` **or** `database_id`.
 
 ```bash
-# Query all active services
-curl -X POST https://agent.chitty.cc/api/notion \
+curl -X POST https://agent.chitty.cc/notion/execute \
   -H "Content-Type: application/json" \
   -H "Authorization: Bearer $CHITTY_SERVICE_TOKEN" \
-  -d '{
-    "operation": "query",
-    "registry": "service",
-    "filter": {"status": "Active"}
-  }'
+  -d '{"action": "create", "registry": "service", "properties": { }}'
 ```
 
-Forward all Notion requests to this endpoint. Do not execute Notion API calls directly.
+`action: create` passes a **triage gate**. An unclassified create returns
+`{"deferred": true, "triage": {...}}` instead of writing — it is not an error.
+Use a registered registry name, or `triage_override: true` to bypass.
+
+## Registries
+
+`domain`, `service`, `systems`, `github`, `legal`, `authority`, `asset`,
+`context`, `document`, `central` — confirmed live via `GET /registries`.
+
+## Authentication
+
+ChittyAuth service token. The worker holds the Notion credential internally;
+never pass a Notion token here.
+
+## Known state (verified 2026-09-04)
+
+`/health` reports `status: degraded`, `mode: EXECUTION_ONLY`. The worker's own
+Notion token returns **401 — "API token is invalid"**, so every registry read
+currently fails upstream. The route and contract are live; the credential is
+not. Credential repair routes through ChittyConnect (`/chico`), not through
+this definition.
+
+Forward Notion registry requests to this endpoint. Do not call the Notion API directly.
diff --git a/plugins/chittyos-proxy-agents/agents/chittyagent-chatgpt.md b/plugins/chittyos-proxy-agents/agents/chittyagent-chatgpt.md
index 2c3e8a7..75447f5 100644
--- a/plugins/chittyos-proxy-agents/agents/chittyagent-chatgpt.md
+++ b/plugins/chittyos-proxy-agents/agents/chittyagent-chatgpt.md
@@ -2,56 +2,64 @@
 name: chittyagent-chatgpt
 description: Proxy to remote ChittyAgent ChatGPT integration service
 canon_uri: chittycanon://core/services/chittymarket#agents/chittyagent-chatgpt
+proxies: chittyagent-chatgpt (chittyentity/workers/chittyagent-chatgpt)
 ---
 
 # ChittyAgent ChatGPT
 
-This agent proxies ChatGPT integration operations to the remote ChittyAgent service.
+This definition proxies ChatGPT integration work to the deployed
+`chittyagent-chatgpt` worker. It is a definition (T); the worker it routes to is
+the actor.
 
 ## Endpoint
 
 ```
-https://agent.chitty.cc/api/chatgpt
+https://agent.chitty.cc/chatgpt
 ```
 
-## Usage
+Matches the worker's declared route `agent.chitty.cc/chatgpt/*`
+(`wrangler.jsonc` → `env.production.routes`).
+
+## Routes
+
+Self-declared by the worker at `GET /chatgpt/`:
+
+| Route | Method | Purpose |
+|---|---|---|
+| `/health` | GET | Health check |
+| `/api/v1/status` | GET | ChittyRegister compliance status |
+| `/openapi.json` | GET | OpenAPI 3.1.0 spec for ChatGPT Actions |
+| `/mcp` | POST | MCP server design and implementation guidance |
+| `/actions` | POST | Custom GPT Actions design and implementation |
+| `/plugins` | POST | ChatGPT plugin operations |
+| `/troubleshoot` | POST | Integration debugging |
+
+The worker reports `system_class: chatgpt_integration_agent`,
+`governance_class: III`.
+
+There is **no** single dispatch route taking `{"operation": ...}`. Each concern
+is its own path — post to the route that matches the work.
 
-All ChatGPT integration operations should be forwarded to the remote ChittyAgent:
+## Usage
 
 ```bash
-curl -X POST https://agent.chitty.cc/api/chatgpt \
+curl -X POST https://agent.chitty.cc/chatgpt/actions \
   -H "Content-Type: application/json" \
   -H "Authorization: Bearer $CHITTY_SERVICE_TOKEN" \
-  -d '{
-    "operation": "mcp|actions|plugins|troubleshoot",
-    "payload": { ... }
-  }'
+  -d '{ }'
 ```
 
-## Capabilities
-
-The remote agent handles:
-- MCP Server development and configuration
-- Custom GPT Actions design and implementation
-- ChatGPT extensions and plugins
-- Integration troubleshooting
+`/mcp` on this worker serves design guidance over HTTP POST. It is not the
+streamable-HTTP MCP transport used by the other agent workers — do not send it
+an `Mcp-Session-Id` handshake.
 
 ## Authentication
 
-Authenticate via ChittyAuth service token. The remote agent handles OpenAI API authentication internally.
+ChittyAuth service token. The worker holds the OpenAI credential internally;
+never pass an OpenAI key here.
 
-## Example
+## Known state (verified 2026-09-04)
 
-```bash
-# Design MCP server architecture
-curl -X POST https://agent.chitty.cc/api/chatgpt \
-  -H "Content-Type: application/json" \
-  -H "Authorization: Bearer $CHITTY_SERVICE_TOKEN" \
-  -d '{
-    "operation": "mcp",
-    "action": "design",
-    "payload": {"use_case": "database integration"}
-  }'
-```
+`/health` → `{"status":"ok","checks":{"mcp":"ok"}}`, version 1.0.0. Fully live.
 
-Forward all ChatGPT integration requests to this endpoint. Do not execute OpenAI operations directly.
+Forward ChatGPT integration requests to this endpoint. Do not call the OpenAI API directly.
diff --git a/plugins/chittyos-proxy-agents/agents/chittyagent-cloudflare.md b/plugins/chittyos-proxy-agents/agents/chittyagent-cloudflare.md
index 4049c29..df25b03 100644
--- a/plugins/chittyos-proxy-agents/agents/chittyagent-cloudflare.md
+++ b/plugins/chittyos-proxy-agents/agents/chittyagent-cloudflare.md
@@ -2,62 +2,79 @@
 name: chittyagent-cloudflare
 description: Proxy to remote ChittyAgent Cloudflare service for infrastructure operations
 canon_uri: chittycanon://core/services/chittymarket#agents/chittyagent-cloudflare
+proxies: chittyagent-cloudflare (chittyentity/workers/chittyagent-cloudflare)
 ---
 
 # ChittyAgent Cloudflare
 
-This agent proxies Cloudflare operations to the remote ChittyAgent service.
+This definition proxies Cloudflare operations to the deployed
+`chittyagent-cloudflare` worker. It is a definition (T); the worker it routes to
+is the actor.
 
 ## Endpoint
 
 ```
-https://agent.chitty.cc/api/cloudflare
+https://agent.chitty.cc/cloudflare
 ```
 
-## Usage
+Matches the worker's declared route `agent.chitty.cc/cloudflare/*`
+(`wrangler.jsonc` → `env.production.routes`).
 
-All Cloudflare operations should be forwarded to the remote ChittyAgent:
+## Routes
 
-```bash
-curl -X POST https://agent.chitty.cc/api/cloudflare \
-  -H "Content-Type: application/json" \
-  -H "Authorization: Bearer $CHITTY_SERVICE_TOKEN" \
-  -d '{
-    "operation": "workers|pages|r2|d1|kv|dns|...",
-    "action": "deploy|configure|query|...",
-    "payload": { ... }
-  }'
-```
+| Route | Purpose |
+|---|---|
+| `/health` | Health + per-account reachability |
+| `/api/v1/status` | ChittyRegister compliance status |
+| `/workers/list` | List Workers |
+| `/kv/list` | List KV namespaces |
+| `/r2/list`, `/r2/inventory`, `/r2/inventory/all`, `/r2/create` | R2 buckets |
+| `/dns/zones` | DNS zones |
+| `/domains/list`, `/sync/domains` | Domains |
+| `/cf-api` | Generic Cloudflare API passthrough |
+| `/mcp` | MCP transport |
 
 ## Capabilities
 
-The remote agent handles:
-- Workers deployment and management
-- Pages deployment and configuration
-- R2 object storage operations
-- D1 database operations
-- KV namespace management
-- DNS and zone configuration
-- WAF and security settings
-- Durable Objects
-- Queues and Workers AI
+The worker reports exactly: **`workers`, `kv`, `r2`, `dns`, `domains`**.
 
-## Authentication
+Pages, D1, WAF, Durable Objects, Queues, and Workers AI are **not** served by
+this agent. A previous revision of this document listed them; that was not
+backed by the deployment. Route those elsewhere.
 
-Authenticate via ChittyAuth service token. The remote agent handles Cloudflare API authentication internally.
+## Accounts
 
-## Example
+Multi-account. `/health` reports per-account reachability for `chittycorp`,
+`digitaldossier`, and `furnishedcondos`.
+
+## Usage
 
 ```bash
-# Deploy a worker
-curl -X POST https://agent.chitty.cc/api/cloudflare \
-  -H "Content-Type: application/json" \
-  -H "Authorization: Bearer $CHITTY_SERVICE_TOKEN" \
-  -d '{
-    "operation": "workers",
-    "action": "deploy",
-    "payload": {"name": "my-worker", "code": "..."}
-  }'
+curl -s https://agent.chitty.cc/cloudflare/workers/list \
+  -H "Authorization: Bearer $CHITTY_SERVICE_TOKEN"
 ```
 
-Forward all Cloudflare requests to this endpoint. Do not execute Cloudflare API calls directly.
+Each concern is its own path. There is no single dispatch route taking
+`{"operation": ..., "action": ...}`.
+
+## Authentication
+
+ChittyAuth service token. The worker holds Cloudflare API credentials
+internally; never pass a Cloudflare key or `X-Auth-Key` here.
+
+## Known state (verified 2026-09-04)
+
+- `/health` → `status: degraded`.
+- `GET /cloudflare/` → **403 `"Missing CHITTY_AUTH_SERVICE_TOKEN in env"`** — the
+  worker's own outbound service credential is absent from its environment.
+- Account reachability: `chittycorp` reachable; `digitaldossier` and
+  `furnishedcondos` both fail with `"Unknown X-Auth-Key or X-Auth-Email"`.
+
+Two of three accounts and the service token are credential faults, not routing
+faults. Repair routes through ChittyConnect (`/chico`), not through this
+definition.
+
+Note: `cloudflare.chitty.cc` returns **522**. It is a stale hostname with no
+worker behind it — not this service. Use the path form above.
+
+Forward Cloudflare requests to this endpoint. Do not call the Cloudflare API directly.
diff --git a/plugins/chittyos-proxy-agents/agents/chittyagent-notion.md b/plugins/chittyos-proxy-agents/agents/chittyagent-notion.md
index 5cab5a9..e1fa5f7 100644
--- a/plugins/chittyos-proxy-agents/agents/chittyagent-notion.md
+++ b/plugins/chittyos-proxy-agents/agents/chittyagent-notion.md
@@ -1,74 +1,86 @@
 ---
 name: chittyagent-notion
-description: Proxy to remote ChittyAgent Notion service for database operations
+description: Proxy to remote ChittyAgent Notion service for registry database operations
 canon_uri: chittycanon://core/services/chittymarket#agents/chittyagent-notion
+proxies: chittyagent-notion (chittyentity/workers/chittyagent-notion)
 ---
 
 # ChittyAgent Notion
 
-This agent proxies Notion operations to the remote ChittyAgent service.
+This definition proxies Notion registry operations to the deployed
+`chittyagent-notion` worker. It is a definition (T); the worker it routes to is
+the actor.
 
 ## Endpoint
 
 ```
-https://agent.chitty.cc/api/notion
+https://agent.chitty.cc/notion
 ```
 
-## Usage
+Matches the worker's declared route `agent.chitty.cc/notion/*`
+(`wrangler.jsonc` → `env.production.routes`). MCP is at `/notion/mcp`
+(streamable HTTP; requires an `Mcp-Session-Id` header).
 
-All Notion database operations should be forwarded to the remote ChittyAgent:
+## Routes
+
+| Route | Method | Purpose |
+|---|---|---|
+| `/health` | GET | Health + per-registry token reachability |
+| `/api/v1/status` | GET | ChittyRegister compliance status |
+| `/query` | POST | Query a registry |
+| `/execute` | POST | Create / update / archive |
+| `/registries` | GET | List registries with `database_id` |
+| `/blocks`, `/update-page-content`, `/page/{id}/blocks` | POST | Page content |
+| `/bulk`, `/run-now`, `/sync-domains`, `/sync/status`, `/sync/health` | — | Sync |
+| `/discover`, `/audit`, `/manifest`, `/governance` | — | Introspection |
+| `/webhook` | POST | Webhook receiver |
+| `/refresh-cache` | POST | Clear `data_source_id` cache |
+
+## Query
+
+`registry` **or** `database_id` is required.
 
 ```bash
-curl -X POST https://agent.chitty.cc/api/notion \
+curl -X POST https://agent.chitty.cc/notion/query \
   -H "Content-Type: application/json" \
   -H "Authorization: Bearer $CHITTY_SERVICE_TOKEN" \
-  -d '{
-    "operation": "query|create|update|archive",
-    "registry": "service|domain|systems|...",
-    "payload": { ... }
-  }'
+  -d '{"registry": "service", "filter": {...}, "page_size": 100}'
 ```
 
-## Available Registries
-
-The remote agent has access to all canonical registries:
-- Domain Registry
-- Service Registry
-- Systems Registry
-- GitHub Repository Registry
-- Legal Entities Registry
-- Authority Registry
-- Context Registry
-- Asset Registry
-- Document Registry
-- Property Resources Registry
-- Central Registry of Registries
-
-## Operations
-
-| Operation | Description |
-|-----------|-------------|
-| `query` | Query database entries with filters |
-| `create` | Create new database entry |
-| `update` | Update existing entry by page ID |
-| `archive` | Soft delete entry by page ID |
+Optional: `filter`, `sorts`, `page_size` (default 100). Returns `registry`,
+`database_id`, `data_source_id`, `count`, `results`, `has_more`.
 
-## Authentication
+## Execute
 
-Authenticate via ChittyAuth service token. The remote agent handles Notion API authentication internally.
-
-## Example
+`action` is required, plus `registry` **or** `database_id`.
 
 ```bash
-# Query all active services
-curl -X POST https://agent.chitty.cc/api/notion \
+curl -X POST https://agent.chitty.cc/notion/execute \
   -H "Content-Type: application/json" \
   -H "Authorization: Bearer $CHITTY_SERVICE_TOKEN" \
-  -d '{
-    "operation": "query",
-    "registry": "service",
-    "filter": {"status": "Active"}
-  }'
+  -d '{"action": "create", "registry": "service", "properties": { }}'
 ```
 
-Forward all Notion requests to this endpoint. Do not execute Notion API calls directly.
+`action: create` passes a **triage gate**. An unclassified create returns
+`{"deferred": true, "triage": {...}}` instead of writing — it is not an error.
+Use a registered registry name, or `triage_override: true` to bypass.
+
+## Registries
+
+`domain`, `service`, `systems`, `github`, `legal`, `authority`, `asset`,
+`context`, `document`, `central` — confirmed live via `GET /registries`.
+
+## Authentication
+
+ChittyAuth service token. The worker holds the Notion credential internally;
+never pass a Notion token here.
+
+## Known state (verified 2026-09-04)
+
+`/health` reports `status: degraded`, `mode: EXECUTION_ONLY`. The worker's own
+Notion token returns **401 — "API token is invalid"**, so every registry read
+currently fails upstream. The route and contract are live; the credential is
+not. Credential repair routes through ChittyConnect (`/chico`), not through
+this definition.
+
+Forward Notion registry requests to this endpoint. Do not call the Notion API directly.
diff --git a/plugins/chittyos-proxy-agents/codex-skills/chittyagent-chatgpt/SKILL.md b/plugins/chittyos-proxy-agents/codex-skills/chittyagent-chatgpt/SKILL.md
index 2c3e8a7..75447f5 100644
--- a/plugins/chittyos-proxy-agents/codex-skills/chittyagent-chatgpt/SKILL.md
+++ b/plugins/chittyos-proxy-agents/codex-skills/chittyagent-chatgpt/SKILL.md
@@ -2,56 +2,64 @@
 name: chittyagent-chatgpt
 description: Proxy to remote ChittyAgent ChatGPT integration service
 canon_uri: chittycanon://core/services/chittymarket#agents/chittyagent-chatgpt
+proxies: chittyagent-chatgpt (chittyentity/workers/chittyagent-chatgpt)
 ---
 
 # ChittyAgent ChatGPT
 
-This agent proxies ChatGPT integration operations to the remote ChittyAgent service.
+This definition proxies ChatGPT integration work to the deployed
+`chittyagent-chatgpt` worker. It is a definition (T); the worker it routes to is
+the actor.
 
 ## Endpoint
 
 ```
-https://agent.chitty.cc/api/chatgpt
+https://agent.chitty.cc/chatgpt
 ```
 
-## Usage
+Matches the worker's declared route `agent.chitty.cc/chatgpt/*`
+(`wrangler.jsonc` → `env.production.routes`).
+
+## Routes
+
+Self-declared by the worker at `GET /chatgpt/`:
+
+| Route | Method | Purpose |
+|---|---|---|
+| `/health` | GET | Health check |
+| `/api/v1/status` | GET | ChittyRegister compliance status |
+| `/openapi.json` | GET | OpenAPI 3.1.0 spec for ChatGPT Actions |
+| `/mcp` | POST | MCP server design and implementation guidance |
+| `/actions` | POST | Custom GPT Actions design and implementation |
+| `/plugins` | POST | ChatGPT plugin operations |
+| `/troubleshoot` | POST | Integration debugging |
+
+The worker reports `system_class: chatgpt_integration_agent`,
+`governance_class: III`.
+
+There is **no** single dispatch route taking `{"operation": ...}`. Each concern
+is its own path — post to the route that matches the work.
 
-All ChatGPT integration operations should be forwarded to the remote ChittyAgent:
+## Usage
 
 ```bash
-curl -X POST https://agent.chitty.cc/api/chatgpt \
+curl -X POST https://agent.chitty.cc/chatgpt/actions \
   -H "Content-Type: application/json" \
   -H "Authorization: Bearer $CHITTY_SERVICE_TOKEN" \
-  -d '{
-    "operation": "mcp|actions|plugins|troubleshoot",
-    "payload": { ... }
-  }'
+  -d '{ }'
 ```
 
-## Capabilities
-
-The remote agent handles:
-- MCP Server development and configuration
-- Custom GPT Actions design and implementation
-- ChatGPT extensions and plugins
-- Integration troubleshooting
+`/mcp` on this worker serves design guidance over HTTP POST. It is not the
+streamable-HTTP MCP transport used by the other agent workers — do not send it
+an `Mcp-Session-Id` handshake.
 
 ## Authentication
 
-Authenticate via ChittyAuth service token. The remote agent handles OpenAI API authentication internally.
+ChittyAuth service token. The worker holds the OpenAI credential internally;
+never pass an OpenAI key here.
 
-## Example
+## Known state (verified 2026-09-04)
 
-```bash
-# Design MCP server architecture
-curl -X POST https://agent.chitty.cc/api/chatgpt \
-  -H "Content-Type: application/json" \
-  -H "Authorization: Bearer $CHITTY_SERVICE_TOKEN" \
-  -d '{
-    "operation": "mcp",
-    "action": "design",
-    "payload": {"use_case": "database integration"}
-  }'
-```
+`/health` → `{"status":"ok","checks":{"mcp":"ok"}}`, version 1.0.0. Fully live.
 
-Forward all ChatGPT integration requests to this endpoint. Do not execute OpenAI operations directly.
+Forward ChatGPT integration requests to this endpoint. Do not call the OpenAI API directly.
diff --git a/plugins/chittyos-proxy-agents/codex-skills/chittyagent-cloudflare/SKILL.md b/plugins/chittyos-proxy-agents/codex-skills/chittyagent-cloudflare/SKILL.md
index 4049c29..df25b03 100644
--- a/plugins/chittyos-proxy-agents/codex-skills/chittyagent-cloudflare/SKILL.md
+++ b/plugins/chittyos-proxy-agents/codex-skills/chittyagent-cloudflare/SKILL.md
@@ -2,62 +2,79 @@
 name: chittyagent-cloudflare
 description: Proxy to remote ChittyAgent Cloudflare service for infrastructure operations
 canon_uri: chittycanon://core/services/chittymarket#agents/chittyagent-cloudflare
+proxies: chittyagent-cloudflare (chittyentity/workers/chittyagent-cloudflare)
 ---
 
 # ChittyAgent Cloudflare
 
-This agent proxies Cloudflare operations to the remote ChittyAgent service.
+This definition proxies Cloudflare operations to the deployed
+`chittyagent-cloudflare` worker. It is a definition (T); the worker it routes to
+is the actor.
 
 ## Endpoint
 
 ```
-https://agent.chitty.cc/api/cloudflare
+https://agent.chitty.cc/cloudflare
 ```
 
-## Usage
+Matches the worker's declared route `agent.chitty.cc/cloudflare/*`
+(`wrangler.jsonc` → `env.production.routes`).
 
-All Cloudflare operations should be forwarded to the remote ChittyAgent:
+## Routes
 
-```bash
-curl -X POST https://agent.chitty.cc/api/cloudflare \
-  -H "Content-Type: application/json" \
-  -H "Authorization: Bearer $CHITTY_SERVICE_TOKEN" \
-  -d '{
-    "operation": "workers|pages|r2|d1|kv|dns|...",
-    "action": "deploy|configure|query|...",
-    "payload": { ... }
-  }'
-```
+| Route | Purpose |
+|---|---|
+| `/health` | Health + per-account reachability |
+| `/api/v1/status` | ChittyRegister compliance status |
+| `/workers/list` | List Workers |
+| `/kv/list` | List KV namespaces |
+| `/r2/list`, `/r2/inventory`, `/r2/inventory/all`, `/r2/create` | R2 buckets |
+| `/dns/zones` | DNS zones |
+| `/domains/list`, `/sync/domains` | Domains |
+| `/cf-api` | Generic Cloudflare API passthrough |
+| `/mcp` | MCP transport |
 
 ## Capabilities
 
-The remote agent handles:
-- Workers deployment and management
-- Pages deployment and configuration
-- R2 object storage operations
-- D1 database operations
-- KV namespace management
-- DNS and zone configuration
-- WAF and security settings
-- Durable Objects
-- Queues and Workers AI
+The worker reports exactly: **`workers`, `kv`, `r2`, `dns`, `domains`**.
 
-## Authentication
+Pages, D1, WAF, Durable Objects, Queues, and Workers AI are **not** served by
+this agent. A previous revision of this document listed them; that was not
+backed by the deployment. Route those elsewhere.
 
-Authenticate via ChittyAuth service token. The remote agent handles Cloudflare API authentication internally.
+## Accounts
 
-## Example
+Multi-account. `/health` reports per-account reachability for `chittycorp`,
+`digitaldossier`, and `furnishedcondos`.
+
+## Usage
 
 ```bash
-# Deploy a worker
-curl -X POST https://agent.chitty.cc/api/cloudflare \
-  -H "Content-Type: application/json" \
-  -H "Authorization: Bearer $CHITTY_SERVICE_TOKEN" \
-  -d '{
-    "operation": "workers",
-    "action": "deploy",
-    "payload": {"name": "my-worker", "code": "..."}
-  }'
+curl -s https://agent.chitty.cc/cloudflare/workers/list \
+  -H "Authorization: Bearer $CHITTY_SERVICE_TOKEN"
 ```
 
-Forward all Cloudflare requests to this endpoint. Do not execute Cloudflare API calls directly.
+Each concern is its own path. There is no single dispatch route taking
+`{"operation": ..., "action": ...}`.
+
+## Authentication
+
+ChittyAuth service token. The worker holds Cloudflare API credentials
+internally; never pass a Cloudflare key or `X-Auth-Key` here.
+
+## Known state (verified 2026-09-04)
+
+- `/health` → `status: degraded`.
+- `GET /cloudflare/` → **403 `"Missing CHITTY_AUTH_SERVICE_TOKEN in env"`** — the
+  worker's own outbound service credential is absent from its environment.
+- Account reachability: `chittycorp` reachable; `digitaldossier` and
+  `furnishedcondos` both fail with `"Unknown X-Auth-Key or X-Auth-Email"`.
+
+Two of three accounts and the service token are credential faults, not routing
+faults. Repair routes through ChittyConnect (`/chico`), not through this
+definition.
+
+Note: `cloudflare.chitty.cc` returns **522**. It is a stale hostname with no
+worker behind it — not this service. Use the path form above.
+
+Forward Cloudflare requests to this endpoint. Do not call the Cloudflare API directly.
diff --git a/plugins/chittyos-proxy-agents/codex-skills/chittyagent-notion/SKILL.md b/plugins/chittyos-proxy-agents/codex-skills/chittyagent-notion/SKILL.md
index 5cab5a9..e1fa5f7 100644
--- a/plugins/chittyos-proxy-agents/codex-skills/chittyagent-notion/SKILL.md
+++ b/plugins/chittyos-proxy-agents/codex-skills/chittyagent-notion/SKILL.md
@@ -1,74 +1,86 @@
 ---
 name: chittyagent-notion
-description: Proxy to remote ChittyAgent Notion service for database operations
+description: Proxy to remote ChittyAgent Notion service for registry database operations
 canon_uri: chittycanon://core/services/chittymarket#agents/chittyagent-notion
+proxies: chittyagent-notion (chittyentity/workers/chittyagent-notion)
 ---
 
 # ChittyAgent Notion
 
-This agent proxies Notion operations to the remote ChittyAgent service.
+This definition proxies Notion registry operations to the deployed
+`chittyagent-notion` worker. It is a definition (T); the worker it routes to is
+the actor.
 
 ## Endpoint
 
 ```
-https://agent.chitty.cc/api/notion
+https://agent.chitty.cc/notion
 ```
 
-## Usage
+Matches the worker's declared route `agent.chitty.cc/notion/*`
+(`wrangler.jsonc` → `env.production.routes`). MCP is at `/notion/mcp`
+(streamable HTTP; requires an `Mcp-Session-Id` header).
 
-All Notion database operations should be forwarded to the remote ChittyAgent:
+## Routes
+
+| Route | Method | Purpose |
+|---|---|---|
+| `/health` | GET | Health + per-registry token reachability |
+| `/api/v1/status` | GET | ChittyRegister compliance status |
+| `/query` | POST | Query a registry |
+| `/execute` | POST | Create / update / archive |
+| `/registries` | GET | List registries with `database_id` |
+| `/blocks`, `/update-page-content`, `/page/{id}/blocks` | POST | Page content |
+| `/bulk`, `/run-now`, `/sync-domains`, `/sync/status`, `/sync/health` | — | Sync |
+| `/discover`, `/audit`, `/manifest`, `/governance` | — | Introspection |
+| `/webhook` | POST | Webhook receiver |
+| `/refresh-cache` | POST | Clear `data_source_id` cache |
+
+## Query
+
+`registry` **or** `database_id` is required.
 
 ```bash
-curl -X POST https://agent.chitty.cc/api/notion \
+curl -X POST https://agent.chitty.cc/notion/query \
   -H "Content-Type: application/json" \
   -H "Authorization: Bearer $CHITTY_SERVICE_TOKEN" \
-  -d '{
-    "operation": "query|create|update|archive",
-    "registry": "service|domain|systems|...",
-    "payload": { ... }
-  }'
+  -d '{"registry": "service", "filter": {...}, "page_size": 100}'
 ```
 
-## Available Registries
-
-The remote agent has access to all canonical registries:
-- Domain Registry
-- Service Registry
-- Systems Registry
-- GitHub Repository Registry
-- Legal Entities Registry
-- Authority Registry
-- Context Registry
-- Asset Registry
-- Document Registry
-- Property Resources Registry
-- Central Registry of Registries
-
-## Operations
-
-| Operation | Description |
-|-----------|-------------|
-| `query` | Query database entries with filters |
-| `create` | Create new database entry |
-| `update` | Update existing entry by page ID |
-| `archive` | Soft delete entry by page ID |
+Optional: `filter`, `sorts`, `page_size` (default 100). Returns `registry`,
+`database_id`, `data_source_id`, `count`, `results`, `has_more`.
 
-## Authentication
+## Execute
 
-Authenticate via ChittyAuth service token. The remote agent handles Notion API authentication internally.
-
-## Example
+`action` is required, plus `registry` **or** `database_id`.
 
 ```bash
-# Query all active services
-curl -X POST https://agent.chitty.cc/api/notion \
+curl -X POST https://agent.chitty.cc/notion/execute \
   -H "Content-Type: application/json" \
   -H "Authorization: Bearer $CHITTY_SERVICE_TOKEN" \
-  -d '{
-    "operation": "query",
-    "registry": "service",
-    "filter": {"status": "Active"}
-  }'
+  -d '{"action": "create", "registry": "service", "properties": { }}'
 ```
 
-Forward all Notion requests to this endpoint. Do not execute Notion API calls directly.
+`action: create` passes a **triage gate**. An unclassified create returns
+`{"deferred": true, "triage": {...}}` instead of writing — it is not an error.
+Use a registered registry name, or `triage_override: true` to bypass.
+
+## Registries
+
+`domain`, `service`, `systems`, `github`, `legal`, `authority`, `asset`,
+`context`, `document`, `central` — confirmed live via `GET /registries`.
+
+## Authentication
+
+ChittyAuth service token. The worker holds the Notion credential internally;
+never pass a Notion token here.
+
+## Known state (verified 2026-09-04)
+
+`/health` reports `status: degraded`, `mode: EXECUTION_ONLY`. The worker's own
+Notion token returns **401 — "API token is invalid"**, so every registry read
+currently fails upstream. The route and contract are live; the credential is
+not. Credential repair routes through ChittyConnect (`/chico`), not through
+this definition.
+
+Forward Notion registry requests to this endpoint. Do not call the Notion API directly.
diff --git a/plugins/chittyos-proxy-agents/openclaw-agents/chittyagent-chatgpt.yaml b/plugins/chittyos-proxy-agents/openclaw-agents/chittyagent-chatgpt.yaml
index 88989ad..04d4b90 100644
--- a/plugins/chittyos-proxy-agents/openclaw-agents/chittyagent-chatgpt.yaml
+++ b/plugins/chittyos-proxy-agents/openclaw-agents/chittyagent-chatgpt.yaml
@@ -3,53 +3,61 @@ description: Proxy to remote ChittyAgent ChatGPT integration service
 instructions: |
   # ChittyAgent ChatGPT
 
-  This agent proxies ChatGPT integration operations to the remote ChittyAgent service.
+  This definition proxies ChatGPT integration work to the deployed
+  `chittyagent-chatgpt` worker. It is a definition (T); the worker it routes to is
+  the actor.
 
   ## Endpoint
 
   ```
-  https://agent.chitty.cc/api/chatgpt
+  https://agent.chitty.cc/chatgpt
   ```
 
-  ## Usage
+  Matches the worker's declared route `agent.chitty.cc/chatgpt/*`
+  (`wrangler.jsonc` → `env.production.routes`).
+
+  ## Routes
+
+  Self-declared by the worker at `GET /chatgpt/`:
+
+  | Route | Method | Purpose |
+  |---|---|---|
+  | `/health` | GET | Health check |
+  | `/api/v1/status` | GET | ChittyRegister compliance status |
+  | `/openapi.json` | GET | OpenAPI 3.1.0 spec for ChatGPT Actions |
+  | `/mcp` | POST | MCP server design and implementation guidance |
+  | `/actions` | POST | Custom GPT Actions design and implementation |
+  | `/plugins` | POST | ChatGPT plugin operations |
+  | `/troubleshoot` | POST | Integration debugging |
+
+  The worker reports `system_class: chatgpt_integration_agent`,
+  `governance_class: III`.
+
+  There is **no** single dispatch route taking `{"operation": ...}`. Each concern
+  is its own path — post to the route that matches the work.
 
-  All ChatGPT integration operations should be forwarded to the remote ChittyAgent:
+  ## Usage
 
   ```bash
-  curl -X POST https://agent.chitty.cc/api/chatgpt \
+  curl -X POST https://agent.chitty.cc/chatgpt/actions \
     -H "Content-Type: application/json" \
     -H "Authorization: Bearer $CHITTY_SERVICE_TOKEN" \
-    -d '{
-      "operation": "mcp|actions|plugins|troubleshoot",
-      "payload": { ... }
-    }'
+    -d '{ }'
   ```
 
-  ## Capabilities
-
-  The remote agent handles:
-  - MCP Server development and configuration
-  - Custom GPT Actions design and implementation
-  - ChatGPT extensions and plugins
-  - Integration troubleshooting
+  `/mcp` on this worker serves design guidance over HTTP POST. It is not the
+  streamable-HTTP MCP transport used by the other agent workers — do not send it
+  an `Mcp-Session-Id` handshake.
 
   ## Authentication
 
-  Authenticate via ChittyAuth service token. The remote agent handles OpenAI API authentication internally.
+  ChittyAuth service token. The worker holds the OpenAI credential internally;
+  never pass an OpenAI key here.
 
-  ## Example
+  ## Known state (verified 2026-09-04)
 
-  ```bash
-  # Design MCP server architecture
-  curl -X POST https://agent.chitty.cc/api/chatgpt \
-    -H "Content-Type: application/json" \
-    -H "Authorization: Bearer $CHITTY_SERVICE_TOKEN" \
-    -d '{
-      "operation": "mcp",
-      "action": "design",
-      "payload": {"use_case": "database integration"}
-    }'
-  ```
+  `/health` → `{"status":"ok","checks":{"mcp":"ok"}}`, version 1.0.0. Fully live.
 
-  Forward all ChatGPT integration requests to this endpoint. Do not execute OpenAI operations directly.
+  Forward ChatGPT integration requests to this endpoint. Do not call the OpenAI API directly.
 canon_uri: chittycanon://core/services/chittymarket#agents/chittyagent-chatgpt
+proxies: chittyagent-chatgpt (chittyentity/workers/chittyagent-chatgpt)
diff --git a/plugins/chittyos-proxy-agents/openclaw-agents/chittyagent-cloudflare.yaml b/plugins/chittyos-proxy-agents/openclaw-agents/chittyagent-cloudflare.yaml
index 2ecf019..c3ed97a 100644
--- a/plugins/chittyos-proxy-agents/openclaw-agents/chittyagent-cloudflare.yaml
+++ b/plugins/chittyos-proxy-agents/openclaw-agents/chittyagent-cloudflare.yaml
@@ -3,59 +3,76 @@ description: Proxy to remote ChittyAgent Cloudflare service for infrastructure o
 instructions: |
   # ChittyAgent Cloudflare
 
-  This agent proxies Cloudflare operations to the remote ChittyAgent service.
+  This definition proxies Cloudflare operations to the deployed
+  `chittyagent-cloudflare` worker. It is a definition (T); the worker it routes to
+  is the actor.
 
   ## Endpoint
 
   ```
-  https://agent.chitty.cc/api/cloudflare
+  https://agent.chitty.cc/cloudflare
   ```
 
-  ## Usage
+  Matches the worker's declared route `agent.chitty.cc/cloudflare/*`
+  (`wrangler.jsonc` → `env.production.routes`).
 
-  All Cloudflare operations should be forwarded to the remote ChittyAgent:
+  ## Routes
 
-  ```bash
-  curl -X POST https://agent.chitty.cc/api/cloudflare \
-    -H "Content-Type: application/json" \
-    -H "Authorization: Bearer $CHITTY_SERVICE_TOKEN" \
-    -d '{
-      "operation": "workers|pages|r2|d1|kv|dns|...",
-      "action": "deploy|configure|query|...",
-      "payload": { ... }
-    }'
-  ```
+  | Route | Purpose |
+  |---|---|
+  | `/health` | Health + per-account reachability |
+  | `/api/v1/status` | ChittyRegister compliance status |
+  | `/workers/list` | List Workers |
+  | `/kv/list` | List KV namespaces |
+  | `/r2/list`, `/r2/inventory`, `/r2/inventory/all`, `/r2/create` | R2 buckets |
+  | `/dns/zones` | DNS zones |
+  | `/domains/list`, `/sync/domains` | Domains |
+  | `/cf-api` | Generic Cloudflare API passthrough |
+  | `/mcp` | MCP transport |
 
   ## Capabilities
 
-  The remote agent handles:
-  - Workers deployment and management
-  - Pages deployment and configuration
-  - R2 object storage operations
-  - D1 database operations
-  - KV namespace management
-  - DNS and zone configuration
-  - WAF and security settings
-  - Durable Objects
-  - Queues and Workers AI
+  The worker reports exactly: **`workers`, `kv`, `r2`, `dns`, `domains`**.
 
-  ## Authentication
+  Pages, D1, WAF, Durable Objects, Queues, and Workers AI are **not** served by
+  this agent. A previous revision of this document listed them; that was not
+  backed by the deployment. Route those elsewhere.
 
-  Authenticate via ChittyAuth service token. The remote agent handles Cloudflare API authentication internally.
+  ## Accounts
 
-  ## Example
+  Multi-account. `/health` reports per-account reachability for `chittycorp`,
+  `digitaldossier`, and `furnishedcondos`.
+
+  ## Usage
 
   ```bash
-  # Deploy a worker
-  curl -X POST https://agent.chitty.cc/api/cloudflare \
-    -H "Content-Type: application/json" \
-    -H "Authorization: Bearer $CHITTY_SERVICE_TOKEN" \
-    -d '{
-      "operation": "workers",
-      "action": "deploy",
-      "payload": {"name": "my-worker", "code": "..."}
-    }'
+  curl -s https://agent.chitty.cc/cloudflare/workers/list \
+    -H "Authorization: Bearer $CHITTY_SERVICE_TOKEN"
   ```
 
-  Forward all Cloudflare requests to this endpoint. Do not execute Cloudflare API calls directly.
+  Each concern is its own path. There is no single dispatch route taking
+  `{"operation": ..., "action": ...}`.
+
+  ## Authentication
+
+  ChittyAuth service token. The worker holds Cloudflare API credentials
+  internally; never pass a Cloudflare key or `X-Auth-Key` here.
+
+  ## Known state (verified 2026-09-04)
+
+  - `/health` → `status: degraded`.
+  - `GET /cloudflare/` → **403 `"Missing CHITTY_AUTH_SERVICE_TOKEN in env"`** — the
+    worker's own outbound service credential is absent from its environment.
+  - Account reachability: `chittycorp` reachable; `digitaldossier` and
+    `furnishedcondos` both fail with `"Unknown X-Auth-Key or X-Auth-Email"`.
+
+  Two of three accounts and the service token are credential faults, not routing
+  faults. Repair routes through ChittyConnect (`/chico`), not through this
+  definition.
+
+  Note: `cloudflare.chitty.cc` returns **522**. It is a stale hostname with no
+  worker behind it — not this service. Use the path form above.
+
+  Forward Cloudflare requests to this endpoint. Do not call the Cloudflare API directly.
 canon_uri: chittycanon://core/services/chittymarket#agents/chittyagent-cloudflare
+proxies: chittyagent-cloudflare (chittyentity/workers/chittyagent-cloudflare)
diff --git a/plugins/chittyos-proxy-agents/openclaw-agents/chittyagent-notion.yaml b/plugins/chittyos-proxy-agents/openclaw-agents/chittyagent-notion.yaml
index ef82b80..cfe2c6b 100644
--- a/plugins/chittyos-proxy-agents/openclaw-agents/chittyagent-notion.yaml
+++ b/plugins/chittyos-proxy-agents/openclaw-agents/chittyagent-notion.yaml
@@ -1,72 +1,84 @@
 name: chittyagent-notion
-description: Proxy to remote ChittyAgent Notion service for database operations
+description: Proxy to remote ChittyAgent Notion service for registry database operations
 instructions: |
   # ChittyAgent Notion
 
-  This agent proxies Notion operations to the remote ChittyAgent service.
+  This definition proxies Notion registry operations to the deployed
+  `chittyagent-notion` worker. It is a definition (T); the worker it routes to is
+  the actor.
 
   ## Endpoint
 
   ```
-  https://agent.chitty.cc/api/notion
+  https://agent.chitty.cc/notion
   ```
 
-  ## Usage
+  Matches the worker's declared route `agent.chitty.cc/notion/*`
+  (`wrangler.jsonc` → `env.production.routes`). MCP is at `/notion/mcp`
+  (streamable HTTP; requires an `Mcp-Session-Id` header).
 
-  All Notion database operations should be forwarded to the remote ChittyAgent:
+  ## Routes
+
+  | Route | Method | Purpose |
+  |---|---|---|
+  | `/health` | GET | Health + per-registry token reachability |
+  | `/api/v1/status` | GET | ChittyRegister compliance status |
+  | `/query` | POST | Query a registry |
+  | `/execute` | POST | Create / update / archive |
+  | `/registries` | GET | List registries with `database_id` |
+  | `/blocks`, `/update-page-content`, `/page/{id}/blocks` | POST | Page content |
+  | `/bulk`, `/run-now`, `/sync-domains`, `/sync/status`, `/sync/health` | — | Sync |
+  | `/discover`, `/audit`, `/manifest`, `/governance` | — | Introspection |
+  | `/webhook` | POST | Webhook receiver |
+  | `/refresh-cache` | POST | Clear `data_source_id` cache |
+
+  ## Query
+
+  `registry` **or** `database_id` is required.
 
   ```bash
-  curl -X POST https://agent.chitty.cc/api/notion \
+  curl -X POST https://agent.chitty.cc/notion/query \
     -H "Content-Type: application/json" \
     -H "Authorization: Bearer $CHITTY_SERVICE_TOKEN" \
-    -d '{
-      "operation": "query|create|update|archive",
-      "registry": "service|domain|systems|...",
-      "payload": { ... }
-    }'
+    -d '{"registry": "service", "filter": {...}, "page_size": 100}'
   ```
 
-  ## Available Registries
-
-  The remote agent has access to all canonical registries:
-  - Domain Registry
-  - Service Registry
-  - Systems Registry
-  - GitHub Repository Registry
-  - Legal Entities Registry
-  - Authority Registry
-  - Context Registry
-  - Asset Registry
-  - Document Registry
-  - Property Resources Registry
-  - Central Registry of Registries
-
-  ## Operations
-
-  | Operation | Description |
-  |-----------|-------------|
-  | `query` | Query database entries with filters |
-  | `create` | Create new database entry |
-  | `update` | Update existing entry by page ID |
-  | `archive` | Soft delete entry by page ID |
+  Optional: `filter`, `sorts`, `page_size` (default 100). Returns `registry`,
+  `database_id`, `data_source_id`, `count`, `results`, `has_more`.
 
-  ## Authentication
+  ## Execute
 
-  Authenticate via ChittyAuth service token. The remote agent handles Notion API authentication internally.
-
-  ## Example
+  `action` is required, plus `registry` **or** `database_id`.
 
   ```bash
-  # Query all active services
-  curl -X POST https://agent.chitty.cc/api/notion \
+  curl -X POST https://agent.chitty.cc/notion/execute \
     -H "Content-Type: application/json" \
     -H "Authorization: Bearer $CHITTY_SERVICE_TOKEN" \
-    -d '{
-      "operation": "query",
-      "registry": "service",
-      "filter": {"status": "Active"}
-    }'
+    -d '{"action": "create", "registry": "service", "properties": { }}'
   ```
 
-  Forward all Notion requests to this endpoint. Do not execute Notion API calls directly.
+  `action: create` passes a **triage gate**. An unclassified create returns
+  `{"deferred": true, "triage": {...}}` instead of writing — it is not an error.
+  Use a registered registry name, or `triage_override: true` to bypass.
+
+  ## Registries
+
+  `domain`, `service`, `systems`, `github`, `legal`, `authority`, `asset`,
+  `context`, `document`, `central` — confirmed live via `GET /registries`.
+
+  ## Authentication
+
+  ChittyAuth service token. The worker holds the Notion credential internally;
+  never pass a Notion token here.
+
+  ## Known state (verified 2026-09-04)
+
+  `/health` reports `status: degraded`, `mode: EXECUTION_ONLY`. The worker's own
+  Notion token returns **401 — "API token is invalid"**, so every registry read
+  currently fails upstream. The route and contract are live; the credential is
+  not. Credential repair routes through ChittyConnect (`/chico`), not through
+  this definition.
+
+  Forward Notion registry requests to this endpoint. Do not call the Notion API directly.
 canon_uri: chittycanon://core/services/chittymarket#agents/chittyagent-notion
+proxies: chittyagent-notion (chittyentity/workers/chittyagent-notion)