The version.* family (4 verbs). Every verb enters through the one front door: it is capability-checked, permission-checked, scope-checked and audited before it runs (see Security & permissions). Each entry below lists its capability, risk class (which fixes the minimum autonomy level), the minimum caller permission, its availability tier, whether it is idempotent, and any outbound egress.
Getversion.get
| Property | Value |
|---|---|
| Capability | version.read |
| Risk class | Read - autonomy L0 |
| Min. permission | Member |
| Availability | Admin only (CLI/HTTP; never advertised over MCP) |
| Idempotent | No |
| Egress | None - in-box (pure Postgres, no outbound call) |
| Render schema | Yes - drives an inline chat artefact and a GUI panel |
one version. { parentType, parentId, version } (or { id }).
Call POST /v/version.get with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.
Listversion.list
| Property | Value |
|---|---|
| Capability | version.read |
| Risk class | Read - autonomy L0 |
| Min. permission | Member |
| Availability | Admin only (CLI/HTTP; never advertised over MCP) |
| Idempotent | No |
| Egress | None - in-box (pure Postgres, no outbound call) |
| Render schema | Yes - drives an inline chat artefact and a GUI panel |
the changelog history for a parent. { parentType, parentId }.
Call POST /v/version.list with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.
Mintversion.mint
| Property | Value |
|---|---|
| Capability | version.author |
| Risk class | Destructive - autonomy L3 |
| Min. permission | Admin |
| Availability | Admin only (CLI/HTTP; never advertised over MCP) |
| Idempotent | No |
| Egress | None - in-box (pure Postgres, no outbound call) |
cut the next immutable Version of any parent. { parentType, parentId, snapshot, changelog? }.
Forward-mint: version = max(version)+1; the new row becomes is_current. Snapshot is immutable (INV-8).
Call POST /v/version.mint with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.
Rollbackversion.rollback
| Property | Value |
|---|---|
| Capability | version.write |
| Risk class | Write - autonomy L1 |
| Min. permission | Admin |
| Availability | On demand (MCP tier 2) |
| Idempotent | No |
| Egress | None - in-box (pure Postgres, no outbound call) |
Re-point the live snapshot at a PRIOR version: flip
is_current off the version that currently holds it and ON the named version of the same parent.
{ parentType, parentId, version } (the target version to make current). Reversible (a forward
rollback to the latest is the inverse), audited (INV-8), workspace-scoped (RLS + an explicit
workspace_id = $N predicate). The immutable snapshots are NEVER rewritten (INV-8 - rollback moves
the pointer, it does not mint or mutate a snapshot, distinct from version.mint); the
uq_version_one_current partial unique index (migration 0002) guarantees at most one current row per
parent, so the two flips below leave EXACTLY one current.
Call POST /v/version.rollback with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool version.rollback.