The fact.* family (3 verbs). Every verb enters through the one front door: it is capability-checked, permission-checked, scope-checked and audited before it runs (see Security & permissions). Each entry below lists its capability, risk class (which fixes the minimum autonomy level), the minimum caller permission, its availability tier, whether it is idempotent, and any outbound egress.
Listfact.list
| Property | Value |
|---|---|
| Capability | form.read |
| Risk class | Read - autonomy L0 |
| Min. permission | Member |
| Availability | Core - always on (MCP tier 1) |
| Idempotent | No |
| Egress | None - in-box (pure Postgres, no outbound call) |
| Render schema | Yes - drives an inline chat artefact and a GUI panel |
The facts for a named target ([2026] CC-OPBOX 24 gate (b)): the fact rows
form.ingest / doc.extract write but which only submission.get (target=submission) surfaced.
Generalises that read to any target + adds the OCR confidence / source_extraction (for passport-ocr /
extraction review). INV-7 facet-suppression is IDENTICAL to submission.get: value_encrypted is NEVER
selected (the ciphertext cannot enter the result set), and an encrypted fact’s value is the [encrypted]
sentinel - presence disclosed, the value never returned in clear. Per-target (targetType required), slim,
paginated, RLS-scoped. No new store/write/state.
Call POST /v/fact.list with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool fact.list.
Resolvefact.resolve
| Property | Value |
|---|---|
| Capability | form.read |
| Risk class | Read - autonomy L0 |
| Min. permission | Member |
| Availability | Core - always on (MCP tier 1) |
| Idempotent | No |
| Egress | None - in-box (pure Postgres, no outbound call) |
| Render schema | Yes - drives an inline chat artefact and a GUI panel |
{ fieldKey, scopes: [{targetType, targetId}, ...] }. The scopes are given MOST-SPECIFIC FIRST
(e.g. document -> matter -> party / entity). Walks them in order and returns the FIRST live value
for fieldKey, TOGETHER WITH the scope it came from (its provenance). This is the firm
standing-instructions read: “email Bill” set on the entity, overridden by “Susan” on the matter,
overridden by “Katie” on the document - the resolver returns the most-specific live value.
Pure READ/L0/MEMBER (CC-OPBOX 52 Limb 3-ii): grants no capability, raises no autonomy ceiling
(INV-15), and is fail-closed RLS-fenced - a value on a scope the actor cannot read is not returned
(workspace RLS + the per-row predicate). Capture-from-interaction is plain fact.set on the
more-specific target (CC-OPBOX 52 Limb 3-iii); the resolver thereafter returns it as most-specific.
Call POST /v/fact.resolve with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool fact.resolve.
Setfact.set
| Property | Value |
|---|---|
| Capability | form.write |
| Risk class | Write - autonomy L1 |
| Min. permission | Member |
| Availability | Core - always on (MCP tier 1) |
| Idempotent | Yes |
| Egress | None - in-box (pure Postgres, no outbound call) |
The ONE internal party-compliance-fact writer ([2026] CC-OPBOX 26 / LEXBY-FI 4): an idempotent upsert of a single party-bound compliance STATE (consent grant/revoke, the kyc review schedule, regulatory deadlines) over the EXISTING fact store. CONFINED to NON-submission targets
- submission facts go through
form.ingest(the EXTERNAL door), which FI 4 forbids this from touching. The write-side mirror of the gate-(b) one-read-verb ceiling: ONE verb, namespacing lives in the field_key. Governed by the INV-1 chokepoint + INV-8 hash-chained audit; INV-7 encrypt-before-write whenencryptis set.{ targetType, targetId, fieldKey, value, encrypt? }. No new store/enum/external-tier.
Call POST /v/fact.set with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool fact.set.