Expose company roster and evidence baseline to humans and agents

SI
6d ago
+389-3

Problem and result

Company onboarding needs one supported view of the roster and evidence already registered in Recoup. Add read_company_baseline to the shared Context operation used by POST /api/context and the standard MCP context tool, with an explicit organization and independent page cursors.

The view preserves artist/professional/source IDs, validates the database response and owner, and reports its limited coverage and missing relationships/review/rights information. It never dispatches collection or charges. This starts app#2116's reusable company onboarding path; it does not complete onboarding or create a saved assessment.

Validation

  • New positive/API authorization tests failed before implementation.
  • 63 focused tests across ten files pass, including synthetic HTTP/MCP output and denial checks through the actual RPC adapter.
  • Full lint, scoped formatting and diff checks pass.
  • Full TypeScript check reports errors outside changed files; no diagnostics in this change's files.
  • No production reads, paid calls or business mutations performed.

Release and remaining work

Deploy and verify https://github.com/recoupable/database/pull/89 first. The API requires migration 20261009160000_context_company_baseline.sql. No dependency on the pending wallet uniqueness change.

This is a paged live inventory, not immutable assessment or verified rights. Source-to-subject linkage, representative private imports, company relationships and saved assessment remain follow-up work. Registered legacy roster links do not establish representation. Hosted authentication/readback remain unverified; fixture parity does not establish live MCP parity. API#980 landed during this work and is merged into this branch. Its deliberate exclusion of professional roster data from delegated OAuth is preserved: the combined baseline remains excluded there pending the same organization-grant audit. The real MCP SDK catalog test verifies that exclusion. HTTP and standard Context MCP tests still exercise the shared read.

Part of https://github.com/recoupable/app/issues/2116 and https://github.com/recoupable/app/issues/2147; closes neither.