Runtime composite — alignment + protection + capabilities in one call
Returns the agent’s complete operational envelope as a single response: composed alignment card, composed protection card, and a capabilities[] array of full tool definitions (from the W1.1 tools registry — {name, class, domain, description, schema, source_connector, grant_provenance}, NOT bare name strings). SDK consumers (first-party SDKs, future Tier-1 customers, OSC instances) call this instead of assembling the envelope client-side. ETag-driven 304 short-circuit; Cache-Control: private, max-age=60. cards-as-primitive Phase 4 W2.3.
Authorizations
Supabase JWT token in Authorization: Bearer header
Path Parameters
Agent identifier (e.g. smolt-abc123)
Response
Runtime state envelope.
Unified alignment card (ADR-008). Authored in YAML or JSON; composed server-side with platform defaults, org template, and active exemptions before storage.
Unified protection card (ADR-037). Safe House thresholds + trusted-source policy for a single agent. Shape matches src/composition/types.ts::UnifiedProtectionCard (canonical) and what the runtime validator at src/composition/validate.ts accepts. The customer-facing docs at /concepts/protection-card and /specifications/protection-card-schema document this same shape.
^sha256:[0-9a-f]{64}$x >= 1