Declare scopes; let the Controller own credentials

Request a reviewed scope set in shimpz.toml

[integrations.cloudflare]
scopes = ["zone.read", "dns.read", "dns.write", "offline_access"]

The current catalog registers cloudflare with zone.read, dns.read, dns.write, and offline_access. Unknown providers, unsupported scopes, duplicates, and empty lists fail admission. A DNS mutation Action must separately declare and perform auth:password before its first provider call; that ceremony both proves the mechanism and authorizes the exact pending Action. The scope declaration alone does not satisfy that gate. Shimpz is pre-production and dns.write is not yet enabled on the Cloudflare OAuth client, so a four-scope grant cannot currently be completed and DNS mutation Actions cannot execute.

Attach the Integration and call the provider through Team

from typing import TypedDict

from shimpz import Context, action


class ZoneResult(TypedDict):
    zone_id: str
    status: str


@action(
    integrations=["cloudflare"],
    description="Show whether one of your domains is active on Cloudflare.",
)
async def run(domain: str, *, ctx: Context) -> ZoneResult:
    response = await ctx.fetch(
        "GET",
        f"https://api.cloudflare.com/client/v4/zones?name={domain}",
        headers={"Accept": "application/json"},
    )
    zone = response.json()["result"][0]
    return {"zone_id": zone["id"], "status": zone["status"]}

An Action receives only Integrations listed in its @action(integrations=[...]) declaration. One Action may list at most four Integration ids, and every Integration declared in shimpz.toml must be used by at least one Action. The Action never reads the bearer token: it asks Team for each call with await ctx.fetch(...), and Team adds Authorization: Bearer only on that provider's reviewed API hosts, which must also be in allowed_hosts.

The token never enters the Assistant

1. The Controller resolves provider metadata from its reviewed catalog.
2. The person authorizes the exact scopes; Shimpz stores tokens encrypted and refreshes them.
3. The Action sends each provider call to Team over its execution channel, without any credential.
4. Team adds the bearer token only to calls an Action that declares the Integration makes to the provider's reviewed API hosts, sends it through the Assistant's egress policy, and audits the call.
5. Team refuses a response that echoes the token, so it never reaches the Action or the Brain.