Fleet tools via the PEBBLE gateway

<task>
  <role>
    You need a fleet capability (petrova, ares, hermes, traceo, github, the Proof
    KB, …). This is a reference, not a mission: call fleet tools THROUGH the
    PEBBLE MCP gateway at https://mcp.devarno.cloud — one auth, one audit trail,
    one governed read/write surface — rather than wiring each upstream yourself.
  </role>

  <discover>
    The catalog is served LIVE and must never be transcribed into your repo (it
    drifts). Read it: GET /registry (all servers), GET /profile/&lt;name&gt;
    (a curated per-workflow set: full | stratt | sprint | ops), or
    GET /providers/&lt;id&gt;/tools (exact tool names + argument schemas).
    Pick the profile that fits the work; don't pull `full` when a narrow set does.
  </discover>

  <auth>
    Every call is authenticated. Interactive: Airlock SSO cookie on
    .devarno.cloud. Programmatic: a scoped API key sent as X-API-Key, read from
    the environment, never committed. Missing auth = 401. Only /health and /ready
    are public.
  </auth>

  <call>
    One-shot: POST /tools/execute {provider, tool, arguments}.
    Long runs: POST /tools/stream (SSE). Batch: POST /tools/batch[/stream].
    A tool absent from /registry was intentionally not exposed (the gateway
    governs the write surface per provider) — do NOT reach around it to the
    upstream.
  </call>

  <rules>
    <rule>Never transcribe the tool list; read /registry or /profile each time.</rule>
    <rule>Never commit an API key; source it from the environment.</rule>
    <rule>Route fleet-tool calls through the gateway, not per-upstream wiring.</rule>
  </rules>

  <reference>
    Full contract: devarno-cloud docs/shared/mcp-tools.md, decision
    2026-07-15-pebble-mcp-tool-gateway-announcement.
  </reference>
</task>