chittyos · chitcommit · Sep 4, 2026 · Sep 4, 2026
diff --git a/canonical/.dispatch-state/agents/chittyagent-chatgpt.json b/canonical/.dispatch-state/agents/chittyagent-chatgpt.json
@@ -1,8 +1,8 @@
 {
-  "canonical_sha": "6004aab619b0171f37619f14a3a3bee899db9498",
+  "canonical_sha": "4414fb06191ec9f9033870f7ce643028f84e7470",
   "targets": {
-    "claude-code": "2c3e8a7005b718f4724dbcb0c123cdebfb120e3d",
-    "codex": "2c3e8a7005b718f4724dbcb0c123cdebfb120e3d",
-    "openclaw": "88989ad699c52b5e91b4a8e4dbeeb61275d0c60c"
+    "claude-code": "75447f59489fc06b19934a30976a387c892afdf8",
+    "codex": "75447f59489fc06b19934a30976a387c892afdf8",
+    "openclaw": "04d4b90d1d79c7a3588157a399410b3788e4a0c7"
   }
 }
diff --git a/canonical/.dispatch-state/agents/chittyagent-cloudflare.json b/canonical/.dispatch-state/agents/chittyagent-cloudflare.json
@@ -1,8 +1,8 @@
 {
-  "canonical_sha": "811827297b9915ab9ff58d32d85c29ae6a6b6d3a",
+  "canonical_sha": "85bdb26397ad7c77a6ec613be76afee49af8571a",
   "targets": {
-    "claude-code": "4049c291e03c0e684946755e69700d2b7c956fb7",
-    "codex": "4049c291e03c0e684946755e69700d2b7c956fb7",
-    "openclaw": "2ecf019414356593b5a8ef300e59f3e5ad7c95b3"
+    "claude-code": "df25b03afcd113996e8be15cbc12fdfcb31ae09b",
+    "codex": "df25b03afcd113996e8be15cbc12fdfcb31ae09b",
+    "openclaw": "c3ed97a078d800f358b7d6db0192aacb517df28b"
   }
 }
diff --git a/canonical/.dispatch-state/agents/chittyagent-notion.json b/canonical/.dispatch-state/agents/chittyagent-notion.json
@@ -1,8 +1,8 @@
 {
-  "canonical_sha": "7e464680620929b934d95b4d653de656a96d6862",
+  "canonical_sha": "7bebfecbb4422721a6ba3b14098dd186204439a7",
   "targets": {
-    "claude-code": "5cab5a901f45eba7b297f7c577c0191672020daa",
-    "codex": "5cab5a901f45eba7b297f7c577c0191672020daa",
-    "openclaw": "ef82b80f871024388a9c3393a8894aa5401c87ad"
+    "claude-code": "e1fa5f7d937ef9632f3dbdc3b00b1c9efef9fd35",
+    "codex": "e1fa5f7d937ef9632f3dbdc3b00b1c9efef9fd35",
+    "openclaw": "cfe2c6ba91a0dee89e7affb6cc25ac9f799105f0"
   }
 }
diff --git a/canonical/agents/chittyagent-chatgpt.md b/canonical/agents/chittyagent-chatgpt.md
@@ -11,56 +11,64 @@ runtimes:
 classification:
   - proxy
   - integration
+proxies: chittyagent-chatgpt (chittyentity/workers/chittyagent-chatgpt)
 ---
 
 # ChittyAgent ChatGPT
 
-This agent proxies ChatGPT integration operations to the remote ChittyAgent service.
+This definition proxies ChatGPT integration work to the deployed
+`chittyagent-chatgpt` worker. It is a definition (T); the worker it routes to is
+the actor.
 
 ## Endpoint
 
 ```
-https://agent.chitty.cc/api/chatgpt
+https://agent.chitty.cc/chatgpt
 ```
 
-## Usage
+Matches the worker's declared route `agent.chitty.cc/chatgpt/*`
+(`wrangler.jsonc` → `env.production.routes`).
+
+## Routes
+
+Self-declared by the worker at `GET /chatgpt/`:
+
+| Route | Method | Purpose |
+|---|---|---|
+| `/health` | GET | Health check |
+| `/api/v1/status` | GET | ChittyRegister compliance status |
+| `/openapi.json` | GET | OpenAPI 3.1.0 spec for ChatGPT Actions |
+| `/mcp` | POST | MCP server design and implementation guidance |
+| `/actions` | POST | Custom GPT Actions design and implementation |
+| `/plugins` | POST | ChatGPT plugin operations |
+| `/troubleshoot` | POST | Integration debugging |
+
+The worker reports `system_class: chatgpt_integration_agent`,
+`governance_class: III`.
+
+There is **no** single dispatch route taking `{"operation": ...}`. Each concern
+is its own path — post to the route that matches the work.
 
-All ChatGPT integration operations should be forwarded to the remote ChittyAgent:
+## Usage
 
 ```bash
-curl -X POST https://agent.chitty.cc/api/chatgpt \
+curl -X POST https://agent.chitty.cc/chatgpt/actions \
   -H "Content-Type: application/json" \
   -H "Authorization: Bearer $CHITTY_SERVICE_TOKEN" \
-  -d '{
-    "operation": "mcp|actions|plugins|troubleshoot",
-    "payload": { ... }
-  }'
+  -d '{ }'
 ```
 
-## Capabilities
-
-The remote agent handles:
-- MCP Server development and configuration
-- Custom GPT Actions design and implementation
-- ChatGPT extensions and plugins
-- Integration troubleshooting
+`/mcp` on this worker serves design guidance over HTTP POST. It is not the
+streamable-HTTP MCP transport used by the other agent workers — do not send it
+an `Mcp-Session-Id` handshake.
 
 ## Authentication
 
-Authenticate via ChittyAuth service token. The remote agent handles OpenAI API authentication internally.
+ChittyAuth service token. The worker holds the OpenAI credential internally;
+never pass an OpenAI key here.
 
-## Example
+## Known state (verified 2026-09-04)
 
-```bash
-# Design MCP server architecture
-curl -X POST https://agent.chitty.cc/api/chatgpt \
-  -H "Content-Type: application/json" \
-  -H "Authorization: Bearer $CHITTY_SERVICE_TOKEN" \
-  -d '{
-    "operation": "mcp",
-    "action": "design",
-    "payload": {"use_case": "database integration"}
-  }'
-```
+`/health` → `{"status":"ok","checks":{"mcp":"ok"}}`, version 1.0.0. Fully live.
 
-Forward all ChatGPT integration requests to this endpoint. Do not execute OpenAI operations directly.
+Forward ChatGPT integration requests to this endpoint. Do not call the OpenAI API directly.
diff --git a/canonical/agents/chittyagent-cloudflare.md b/canonical/agents/chittyagent-cloudflare.md
@@ -11,62 +11,79 @@ runtimes:
 classification:
   - proxy
   - integration
+proxies: chittyagent-cloudflare (chittyentity/workers/chittyagent-cloudflare)
 ---
 
 # ChittyAgent Cloudflare
 
-This agent proxies Cloudflare operations to the remote ChittyAgent service.
+This definition proxies Cloudflare operations to the deployed
+`chittyagent-cloudflare` worker. It is a definition (T); the worker it routes to
+is the actor.
 
 ## Endpoint
 
 ```
-https://agent.chitty.cc/api/cloudflare
+https://agent.chitty.cc/cloudflare
 ```
 
-## Usage
+Matches the worker's declared route `agent.chitty.cc/cloudflare/*`
+(`wrangler.jsonc` → `env.production.routes`).
 
-All Cloudflare operations should be forwarded to the remote ChittyAgent:
+## Routes
 
-```bash
-curl -X POST https://agent.chitty.cc/api/cloudflare \
-  -H "Content-Type: application/json" \
-  -H "Authorization: Bearer $CHITTY_SERVICE_TOKEN" \
-  -d '{
-    "operation": "workers|pages|r2|d1|kv|dns|...",
-    "action": "deploy|configure|query|...",
-    "payload": { ... }
-  }'
-```
+| Route | Purpose |
+|---|---|
+| `/health` | Health + per-account reachability |
+| `/api/v1/status` | ChittyRegister compliance status |
+| `/workers/list` | List Workers |
+| `/kv/list` | List KV namespaces |
+| `/r2/list`, `/r2/inventory`, `/r2/inventory/all`, `/r2/create` | R2 buckets |
+| `/dns/zones` | DNS zones |
+| `/domains/list`, `/sync/domains` | Domains |
+| `/cf-api` | Generic Cloudflare API passthrough |
+| `/mcp` | MCP transport |
 
 ## Capabilities
 
-The remote agent handles:
-- Workers deployment and management
-- Pages deployment and configuration
-- R2 object storage operations
-- D1 database operations
-- KV namespace management
-- DNS and zone configuration
-- WAF and security settings
-- Durable Objects
-- Queues and Workers AI
+The worker reports exactly: **`workers`, `kv`, `r2`, `dns`, `domains`**.
 
-## Authentication
+Pages, D1, WAF, Durable Objects, Queues, and Workers AI are **not** served by
+this agent. A previous revision of this document listed them; that was not
+backed by the deployment. Route those elsewhere.
 
-Authenticate via ChittyAuth service token. The remote agent handles Cloudflare API authentication internally.
+## Accounts
 
-## Example
+Multi-account. `/health` reports per-account reachability for `chittycorp`,
+`digitaldossier`, and `furnishedcondos`.
+
+## Usage
 
 ```bash
-# Deploy a worker
-curl -X POST https://agent.chitty.cc/api/cloudflare \
-  -H "Content-Type: application/json" \
-  -H "Authorization: Bearer $CHITTY_SERVICE_TOKEN" \
-  -d '{
-    "operation": "workers",
-    "action": "deploy",
-    "payload": {"name": "my-worker", "code": "..."}
-  }'
+curl -s https://agent.chitty.cc/cloudflare/workers/list \
+  -H "Authorization: Bearer $CHITTY_SERVICE_TOKEN"
 ```
 
-Forward all Cloudflare requests to this endpoint. Do not execute Cloudflare API calls directly.
+Each concern is its own path. There is no single dispatch route taking
+`{"operation": ..., "action": ...}`.
+
+## Authentication
+
+ChittyAuth service token. The worker holds Cloudflare API credentials
+internally; never pass a Cloudflare key or `X-Auth-Key` here.
+
+## Known state (verified 2026-09-04)
+
+- `/health` → `status: degraded`.
+- `GET /cloudflare/` → **403 `"Missing CHITTY_AUTH_SERVICE_TOKEN in env"`** — the
+  worker's own outbound service credential is absent from its environment.
+- Account reachability: `chittycorp` reachable; `digitaldossier` and
+  `furnishedcondos` both fail with `"Unknown X-Auth-Key or X-Auth-Email"`.
+
+Two of three accounts and the service token are credential faults, not routing
+faults. Repair routes through ChittyConnect (`/chico`), not through this
+definition.
+
+Note: `cloudflare.chitty.cc` returns **522**. It is a stale hostname with no
+worker behind it — not this service. Use the path form above.
+
+Forward Cloudflare requests to this endpoint. Do not call the Cloudflare API directly.
diff --git a/canonical/agents/chittyagent-notion.md b/canonical/agents/chittyagent-notion.md
@@ -1,7 +1,7 @@
 ---
 name: chittyagent-notion
 canon_uri: chittycanon://core/services/chittymarket#agents/chittyagent-notion
-description: Proxy to remote ChittyAgent Notion service for database operations
+description: Proxy to remote ChittyAgent Notion service for registry database operations
 kind: agent
 plugin: chittyos-proxy-agents
 runtimes:
@@ -11,73 +11,85 @@ runtimes:
 classification:
   - proxy
   - integration
+proxies: chittyagent-notion (chittyentity/workers/chittyagent-notion)
 ---
 
 # ChittyAgent Notion
 
-This agent proxies Notion operations to the remote ChittyAgent service.
+This definition proxies Notion registry operations to the deployed
+`chittyagent-notion` worker. It is a definition (T); the worker it routes to is
+the actor.
 
 ## Endpoint
 
 ```
-https://agent.chitty.cc/api/notion
+https://agent.chitty.cc/notion
 ```
 
-## Usage
+Matches the worker's declared route `agent.chitty.cc/notion/*`
+(`wrangler.jsonc` → `env.production.routes`). MCP is at `/notion/mcp`
+(streamable HTTP; requires an `Mcp-Session-Id` header).
 
-All Notion database operations should be forwarded to the remote ChittyAgent:
+## Routes
+
+| Route | Method | Purpose |
+|---|---|---|
+| `/health` | GET | Health + per-registry token reachability |
+| `/api/v1/status` | GET | ChittyRegister compliance status |
+| `/query` | POST | Query a registry |
+| `/execute` | POST | Create / update / archive |
+| `/registries` | GET | List registries with `database_id` |
+| `/blocks`, `/update-page-content`, `/page/{id}/blocks` | POST | Page content |
+| `/bulk`, `/run-now`, `/sync-domains`, `/sync/status`, `/sync/health` | — | Sync |
+| `/discover`, `/audit`, `/manifest`, `/governance` | — | Introspection |
+| `/webhook` | POST | Webhook receiver |
+| `/refresh-cache` | POST | Clear `data_source_id` cache |
+
+## Query
+
+`registry` **or** `database_id` is required.
 
 ```bash
-curl -X POST https://agent.chitty.cc/api/notion \
+curl -X POST https://agent.chitty.cc/notion/query \
   -H "Content-Type: application/json" \
   -H "Authorization: Bearer $CHITTY_SERVICE_TOKEN" \
-  -d '{
-    "operation": "query|create|update|archive",
-    "registry": "service|domain|systems|...",
-    "payload": { ... }
-  }'
+  -d '{"registry": "service", "filter": {...}, "page_size": 100}'
 ```
 
-## Available Registries
-
-The remote agent has access to all canonical registries:
-- Domain Registry
-- Service Registry
-- Systems Registry
-- GitHub Repository Registry
-- Legal Entities Registry
-- Authority Registry
-- Context Registry
-- Asset Registry
-- Document Registry
-- Property Resources Registry
-- Central Registry of Registries
-
-## Operations
-
-| Operation | Description |
-|-----------|-------------|
-| `query` | Query database entries with filters |
-| `create` | Create new database entry |
-| `update` | Update existing entry by page ID |
-| `archive` | Soft delete entry by page ID |
+Optional: `filter`, `sorts`, `page_size` (default 100). Returns `registry`,
+`database_id`, `data_source_id`, `count`, `results`, `has_more`.
 
-## Authentication
+## Execute
 
-Authenticate via ChittyAuth service token. The remote agent handles Notion API authentication internally.
-
-## Example
+`action` is required, plus `registry` **or** `database_id`.
 
 ```bash
-# Query all active services
-curl -X POST https://agent.chitty.cc/api/notion \
+curl -X POST https://agent.chitty.cc/notion/execute \
   -H "Content-Type: application/json" \
   -H "Authorization: Bearer $CHITTY_SERVICE_TOKEN" \
-  -d '{
-    "operation": "query",
-    "registry": "service",
-    "filter": {"status": "Active"}
-  }'
+  -d '{"action": "create", "registry": "service", "properties": { }}'
 ```
 
-Forward all Notion requests to this endpoint. Do not execute Notion API calls directly.
+`action: create` passes a **triage gate**. An unclassified create returns
+`{"deferred": true, "triage": {...}}` instead of writing — it is not an error.
+Use a registered registry name, or `triage_override: true` to bypass.
+
+## Registries
+
+`domain`, `service`, `systems`, `github`, `legal`, `authority`, `asset`,
+`context`, `document`, `central` — confirmed live via `GET /registries`.
+
+## Authentication
+
+ChittyAuth service token. The worker holds the Notion credential internally;
+never pass a Notion token here.
+
+## Known state (verified 2026-09-04)
+
+`/health` reports `status: degraded`, `mode: EXECUTION_ONLY`. The worker's own
+Notion token returns **401 — "API token is invalid"**, so every registry read
+currently fails upstream. The route and contract are live; the credential is
+not. Credential repair routes through ChittyConnect (`/chico`), not through
+this definition.
+
+Forward Notion registry requests to this endpoint. Do not call the Notion API directly.