docs(giellie): document args-aware policy, trust semantics, env and PB rules

Also log the upstream assertBrowserSession 401s for orders.review,
orders.find_duplicates and dashboard.daily_summary as an open MCP request.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

AGENTS.md

@@ -137,6 +137,7 @@ hook utils — add new auto-updated fields there.
 
 The hook files are deployed by hand into the PB server's `pb_hooks/`
 (like select values, it's a manual step on the live instance).
+
 # Giellie agent (`/giellie`) — tools come from the MCP, policy lives in one file
 
 The sidebar "Giellie Agent" is a MiniMax chat agent (`src/lib/server/giellie-*.ts`,
@@ -154,5 +155,19 @@ in-process — a new MCP tool is automatically available to Giellie.
   without that check.
 - Config (key, model, base URL, on/off) is the existing `/settings/ai` row; Giellie
   uses its own system prompt in `giellie-system-prompt.ts`.
+- Classification is **args-aware**: use `classifyToolCall(name, input)` (not bare
+  `classifyTool`) for routing. A plain write whose input carries a contact-routing key
+  (`email*`, `bcc`, `cc`, `sender`, `recipient`, any depth ≤ 4) is escalated to "confirm".
+  `quotes.re_run_ai` is denied (it wipes every quote item); `orders.cancel`,
+  `delivery_notes.cancel` and `delivery_notes.combine` always ask.
+- The "Trust this chat" toggle is **per chat** and only auto-approves ordinary writes.
+  It never covers confirm-class actions: email/PO sends, cancels/merges, and changes to
+  email/contact fields.
+- Env: `AGENT_API_KEY` (server-side MCP auth, required) and, in containers,
+  `AGENT_API_BASE_URL` (a full `https://` origin) so the MCP's loopback calls reach the
+  app; scheme-less values like `localhost:4001` are ignored.
 - The `giellie_chats` collection is created by `npm run pb:migrate:giellie-chats`
-  (manual step on the live PB, like select values and pb_hooks).
+  (manual step on the live PB, like select values and pb_hooks). Its API rules are
+  stricter than the original spec: users may list/view their own chats only;
+  create/update/delete are null (all writes go through the admin client in
+  `giellie-chat-store.ts`).

src/app/api/mcp/FEATURE-REQUESTS.md

@@ -20,6 +20,14 @@ When one ships, move it to **Implemented** with a one-line commit/PR reference.
 
 ## Open requests
 
+### `orders.review`, `orders.find_duplicates`, `dashboard.daily_summary` 401 through the MCP
+- **Surfaced:** 2026-10-01 — whole-branch review of the Giellie agent. These three MCP handlers fetch upstream routes (`/api/v1/orders/[id]/review`, `/api/v1/orders/duplicates`, `/api/v1/dashboard`) that are guarded by `assertBrowserSession` (expects a PocketBase user token), but the MCP forwards `Bearer AGENT_API_KEY`, so the upstream call 401s. Affects both Hermes and Giellie.
+- **Workaround:** none through the MCP; the operator uses the dashboard pages directly.
+- **Severity:** now — `dashboard.daily_summary` and `orders.find_duplicates` are routinely asked for.
+- **Suggested fix:** let those routes accept the agent key (`assertAgentAuth`, as other `/api/v1` routes called by the MCP do), or have the MCP handlers call the underlying services directly instead of looping back over HTTP.
+- **Schema needs:** none
+- **Open questions:** should the agent key be accepted in addition to, or instead of, the browser session on these routes?
+
 ### ~~Orders: filter by customer~~
 **Resolved 2026-08-16 (Phase H).** `orders.list({customer, createdAfter, createdBefore, status})` shipped — see Implemented.