The flow.* family (2 verbs). Every verb enters through the one front door: it is capability-checked, permission-checked, scope-checked and audited before it runs (see Security & permissions). Each entry below lists its capability, risk class (which fixes the minimum autonomy level), the minimum caller permission, its availability tier, whether it is idempotent, and any outbound egress.
Consumeflow.event.consume
| Property | Value |
|---|---|
| Capability | flow.event.write |
| Risk class | Write - autonomy L1 |
| Min. permission | Admin |
| Availability | Admin only (CLI/HTTP; never advertised over MCP) |
| Idempotent | Yes |
| Egress | None - in-box (pure Postgres, no outbound call) |
| Legal basis | CC-OPBOX 61 |
(a WAKE row id). WRITE/ADMIN, idempotent. Appends an ACK row consuming the WAKE (CC-OPBOX 17 C3: consumption is an APPEND, never an UPDATE). A re-consume is a no-op (the uq_flow_event_ack backstop).
Input { id } (fields ending in ? are optional)
Call POST /v/flow.event.consume with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.
Pollflow.event.poll
| Property | Value |
|---|---|
| Capability | flow.event.read |
| Risk class | Read - autonomy L0 |
| Min. permission | Admin |
| Availability | Admin only (CLI/HTTP; never advertised over MCP) |
| Idempotent | No |
| Egress | None - in-box (pure Postgres, no outbound call) |
| Render schema | Yes - drives an inline chat artefact and a GUI panel |
| Legal basis | CC-OPBOX 61 |
Returns the workspace’s UNCONSUMED WAKE rows (a WAKE with no matching ACK), oldest first. Workspace-scoped (RLS + the explicit predicate).
Input { subjectType?, subjectId?, wakeKind?, limit? } (fields ending in ? are optional)
Call POST /v/flow.event.poll with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.