Ask what exists before you call it — operations, governed writes, recordable decisions, the LLM menu, and which platform features are switched on — then get the exact contract for any one operation with describe_handoff.

await rubicon.call('describe_handoff', { operation: 'op_screen_leads', include_past_examples: true })

Remember: every operation also answers dry_run: true with a vetted sample request + response.

Lists the pipeline rows sitting at one sourcing stage — the read most apps are built on. Lean by default and sorted newest-first; each row carries a stable candidate_ref and a canonical block of display fields.

const r = await c.env.rubicon.read('list_pipeline_by_stage', { sourcing_stage: 'needs-triage', limit: 50 });
if (r.ok === false) return c.json({ leads: [], error: r.code }, 502);  // refusals are data — surface them
return c.json({ leads: r.leads ?? [] });

Counts by stage, an optional preview of what fires next per entity, and time-travel — reconstruct the pipeline as of any timestamp straight from the audit log (no snapshot store).

await rubicon.call('get_pipeline_state', { pipeline_domain: 'sourcing', include_what_fires_next: true })

{
  "counts_by_stage": { "sourced": 120, "ready-for-review": 31,
    "outreach-drafted": 14, "outreach-approved": 9 },
  "what_fires_next": [{ "website": "https://acme-cad.com", "next": "op_partner_review" }]
}

One business object read live from the source system, with optional per-field provenance, write-eligibility hints, and resolved links to related records.

await rubicon.call('get_entity', { entity_type: 'opportunity', entity_id: '006Ab00000XyZ', include_links: true })

A wrapped search over any registered external source — find or confirm a signal before you act on it. Criteria are validated per-source by the adapter.

await rubicon.call('search_external_signal', {
  source: 'hunter', query_type: 'email_finder',
  criteria: { domain: 'acme-cad.com', first_name: 'Dana', last_name: 'Reyes' }
})

Query the accountability log: every governed action, filterable and aggregatable. Answers "why did we contact company X?" or "which partner has the highest screen-to-LOI rate?"

await rubicon.call('audit_trail', { filter: { entity_id: 'https://acme-cad.com' }, limit: 20 })

scrape_kickoff starts the deduped background website/LinkedIn enrichment for a scope of rows; scrape_status polls it by per-website job id (poll freely — status checks aren't metered). Dry-run either for the exact contract.

Each returns the exact backlog for the gate that follows it — the rows that still need that step — enriched and ready to decide on. They differ only in which rows they surface:

await rubicon.call('prep_for_partner_review', {
  inputs: { industry: 'Public Sector Software', owner: 'human:beau@qualitystandard.com' }
})

{
  "status": "applied",
  "count": 12,
  "leads": [
    { "website": "https://acme-cad.com", "company_name": "Acme CAD",
      "sourcing_stage": "ready-for-review", "employees": 42,
      "enrichment": { "hq": "Austin, TX", "linkedin": "…" } }
  ]
}

Sources new candidate companies from Grata — one parallel search per term (up to 10) — dedupes each by website against both your Salesforce accounts/opportunities and the destination bucket, scrapes the site + LinkedIn for context, and files the survivors into the right industry bucket. The messy bit it owns: Grata's industry labels aren't QS's verticals, so every candidate is re-bucketed into your taxonomy before it lands.

await rubicon.call('op_search_for_leads', {
  inputs: {
    search_terms: ['public safety records management', 'CAD dispatch software'],
    industry: 'Public Sector Software',
    min_employees: 15, max_employees: 120,
    location: { country: 'United States' }
  }
})

{
  "status": "applied",
  "outputs": {
    "counts": { "sourced": 63, "deduped_out": 18, "filed": 45 },
    "industry_bucket": "2-Public Sector Software",
    "candidates_sourced": [
      { "website": "https://acme-cad.com", "company_name": "Acme CAD",
        "employees": 42, "hq": "Austin, TX", "grata_industry": "Public Safety" }
    ]
  },
  "audit_chain_root": "a1b2c3d4-…"
}

Records a yes/no fit verdict per company (keyed by website URL). yes keeps the row and moves it to ready-for-review; no removes it from the pipeline. One decision per primary key, each attributed and evidenced. An AI verdict (acting_as: 'ai:…') must disclose method — model, a non-empty reasoning summary, and an explicit list of any tools it ran.

await rubicon.call('op_screen_leads', {
  inputs: { primary_keys: ['https://acme-cad.com'], industry: 'Public Sector Software' },
  decisions: [{
    candidate_ref: { entity_id: 'https://acme-cad.com' },
    verdict: 'yes',
    acting_as: 'human:sufi@qualitystandard.com',
    rationale: '42 FTE, vertical CAD/RMS for municipal PD, founder-owned — fits the thesis.'
  }]
})

{
  "status": "applied",
  "results": [
    { "primary_key": "https://acme-cad.com", "verdict": "yes",
      "outcome": "kept · stage→ready-for-review", "decision_id": "d-7781…" }
  ],
  "audit_chain_root": "e5f6…"
}

The partner's go / no-go on screened candidates, keyed by website URL. Same decision shape as screening, but locked to a human partner — an app or model cannot stamp it. yes advances the row toward outreach; no drops it.

await rubicon.call('op_partner_review', {
  inputs: { primary_keys: ['https://acme-cad.com'] },
  decisions: [{ candidate_ref: { entity_id: 'https://acme-cad.com' },
    verdict: 'yes', acting_as: 'human:beau@qualitystandard.com' }]
})

Composes the outbound email for one or more approved companies and saves it to the company's outreach record. Drafts start from what works — your top-performing Salesloft cadence emails for that motion are surfaced by prep_for_draft_outreach so the copy isn't from a blank page.

await rubicon.call('op_draft_outreach', {
  inputs: { outreach_targets: [{
    website: 'https://acme-cad.com',
    subject: 'Quality Standard × Acme CAD',
    email: 'Hi Dana — we back vertical software founders in public safety…'
  }] }
})

A partner approves or rejects drafted outreach, keyed by website URL. Approve flips the row to outreach-approved and arms the send; reject sends it back. Authorship and approval sit with different people on purpose — nothing self-approves.

await rubicon.call('op_approve_outreach', {
  inputs: { accounts: ['https://acme-cad.com'] },
  decisions: [{ candidate_ref: { website: 'https://acme-cad.com' },
    verdict: 'yes', acting_as: 'human:beau@qualitystandard.com' }]
})

Re-files one company between industry buckets — typically a lead that landed in Misc during sourcing or got bucketed wrong. Carries its outreach records along and logs the reason on the row.

await rubicon.call('op_move_company_between_industries', {
  inputs: { company_name: 'Acme CAD',
    source_industry: 'Misc', target_industry: 'Public Sector Software',
    override_reason: 'Vertical CAD/RMS for municipal PD — belongs in Public Safety, not Misc.' }
})

A governed field write in two phases. Preview evaluates expectations, shows the exact cascade, and returns a signed confirmation_token (5-min TTL). Commit requires that token — and an attested_override_reason if any soft expectation was unmet. The write lands in your system of record with a provenance breadcrumb.

// 1) preview — evaluate + get the token
const p = await rubicon.call('apply_signal_preview', {
  signal_key: 'advance_stage', object_type: 'opportunity',
  object_id: '006Ab00000XyZ', value: 'Outreach',
  acting_as: 'human:beau@qualitystandard.com'
});
// 2) commit — only if you accept p.governance + p.irreversibility
await rubicon.call('apply_signal_commit', {
  signal_key: 'advance_stage', object_type: 'opportunity',
  object_id: '006Ab00000XyZ', value: 'Outreach',
  acting_as: 'human:beau@qualitystandard.com',
  confirmation_token: p.confirmation_token
});

{
  "verb_phrase": "advance the deal stage",
  "object": { "type": "opportunity", "display_name": "Acme CAD" },
  "governance": { "dimension_4_preconditions": {
    "evaluated": [{ "name": "partner_review_passed", "result": "pass", "severity": "hard" }],
    "all_pass": true } },
  "irreversibility": { "level": "fully_reversible" },
  "confirmation_token": "wpf_9f3c….a4b1…",
  "token_expires_at": "2026-06-15T18:25:00Z",
  "will_proceed": true
}

The subjectivity boundary. Records a subjective judgment with mandatory attribution + evidence — Rubicon never originates a judgment. acting_as must be registered, and evidence is validated against the decision type's schema.

await rubicon.call('stage_decision', {
  decision_type: 'screening_decision',
  acting_as: 'ai:gpt-5.2',
  entity_ref: { entity_type: 'lead', entity_id: 'https://acme-cad.com' },
  evidence: { verdict: 'forward', score: 82,
    justification: 'Vertical CAD/RMS, founder-owned, 42 FTE.' }
})

The firm's governed LLM call. An app uses this instead of standing up its own model backend — the platform key lives server-side, so the app never holds a credential. Pass response_schema for strict typed JSON, or omit it for free text. Not an MCP tool — in a chat session the agent is the inference; infer is what a deployed app calls (from a capsule server: rubicon.read('infer', …), and list it in permissions.rubicon_ops).

Or pass a capability selector instead of a name and let the catalog resolve it:

const r = await rubicon.call('infer', {
  model: 'gpt-5-mini',                // or a selector: 'cheapest'
  system: 'You screen vertical-software acquisition targets for Quality Standard.',
  messages: [{ role: 'user', content: 'Company: Acme CAD — CAD/RMS for municipal PD, 42 FTE, founder-owned.' }],
  response_schema: { type: 'object', properties: {
    verdict: { type: 'string', enum: ['forward', 'defer', 'drop'] },
    score: { type: 'integer' }, justification: { type: 'string' } } }
});
// r.output → { verdict:'forward', score:82, justification:'…' }; r.model is the REAL model that answered

{
  "query_id": "q-44ad…", "source": "openai", "model": "gpt-5-mini",
  "output": { "verdict": "forward", "score": 82, "justification": "Vertical CAD/RMS, founder-owned, right size band." },
  "output_text": null, "grounded": false,
  "actor_id": "ai:gpt-5-mini",
  "method": { "model": {…}, "tool_invocations": [] },   // thread straight into op_screen_leads
  "usage": { "total_tokens": 214 },
  "provenance": { "is_stub_response": false }
}

Speech in and out, same keyless pattern as infer — audio rides as base64 in JSON and the server-side key does the work.

await rubicon.call('voice_speak', { text: 'Acme CAD has been approved for outreach.', voice: 'sage', format: 'mp3' })

Sends a real email through your own M365 (Microsoft Graph). Resolves a first name to the matching QS mailbox, or takes a literal address; omit the recipient inside a capsule worker and it emails the signed-in user. Sender is gated to an approved list, so nothing leaves from the wrong account.

await rubicon.call('outlook_send_email', {
  recipient: 'Dana', send_via: 'self',
  subject: 'Quality Standard × Acme CAD',
  body_html: '<p>Hi Dana — we back vertical software founders…</p>'
})

A future-dated, cross-system action with atomicity — the first failed step short-circuits the rest, and compensating actions roll back partial success. Powers touchpoints, review-window blocks, cadence pauses with calendar holds.

await rubicon.call('schedule_action', {
  action_type: 'touchpoint', acting_as: 'human:sufi@qualitystandard.com',
  scheduled_for: '2026-06-22T15:00:00Z',
  target_systems: [{ system: 'salesloft', step: 'add_to_cadence', kwargs: { person: 'dana@acme-cad.com' } }]
})

Ships a capsule: you send source_files (the manifest, src/App.tsx, server/index.ts), the platform type-checks, builds, and hosts it at /u/<app_id>/, pinned to the current API version. A failed build returns errors (file + line) and never touches the live version. Re-deploying with an app_id replaces the whole snapshot — for small edits use update_app_source instead. Start with dry_run: true — the sample request IS a minimal working capsule.

// First: get the complete working template + the hard rules, free
await rubicon.call('deploy_app_source', { dry_run: true })
// Then ship for real
await rubicon.call('deploy_app_source', {
  name: 'Screening Queue', change_summary: 'initial ship',
  source_files: { 'rubicon.app.json': '…', 'src/App.tsx': '…', 'server/index.ts': '…' }
})

{
  "status": "deployed", "app_id": "app_1a2b3c4d5e6f",
  "url": "/u/app_1a2b3c4d5e6f/", "version": 1,
  "api_version": "2026-07-01",
  "build": { "policy": "ok", "typecheck": "ok", "frontend_build": "ok", "server_bundle": "ok" },
  "context_summary": { "api_routes": 4, "rubicon_ops_used": 4, "workers": ["screenAll"] }
}

The iterate loop. get_app_context returns the app's map (routes, ops used, files, versions, its API-version pin); get_app_source fetches just the file(s) you'll change; update_app_source patches → rebuilds → promotes atomically — a failed build leaves the live version serving.

await rubicon.call('update_app_source', {
  app_id: 'app_1a2b3c4d5e6f', base_version: 1,
  change_summary: 'add a rationale input to the screen action',
  edits: [{ path: 'src/App.tsx',
    find: '<h1>Screening Queue</h1>',
    replace: '<h1>Screening Queue</h1><p>Mark each company yes/no with a reason.</p>' }]
})

Every deploy and edit snapshots a version with who made it, when, and its change_summary. list_app_versions reads that history; rollback_app restores any version instantly — no rebuild, the old bundle just starts serving again.

await rubicon.call('list_app_versions', { app_id: 'app_1a2b3c4d5e6f' })
await rubicon.call('rollback_app', { app_id: 'app_1a2b3c4d5e6f', version: 1 })

Fleet management for hosted apps: list them, inspect one, promote between development and production (what the landing page badges), delete, and grant/revoke per-principal access to restricted apps.

Durable key-value state owned by the app (in a capsule: rubicon.state). Two gotchas: state.get(key) returns the raw stored value (or null) — not an envelope — and keys are app-scoped, not per-user: prefix with rubicon.whoami() for private-to-the-signed-in-user data. Declare namespaces in rubicon.app.json under permissions.state_namespaces.

await c.env.rubicon.state.set('review-notes:acme-cad', { note: 'call back in Q3' });
const v = await c.env.rubicon.state.get('review-notes:acme-cad');  // the raw value, or null

The job surface behind capsule workers: inspect a run with get_job (status, progress, result), list history, cancel. Inside a capsule you rarely call these directly — declare export const workers and use rubicon.startJob / rubicon.getJob; the platform owns durability and the run survives the tab closing.

Scheduled automations — a recipe of governed operations that runs on an interval or wall-clock cron, with the same governance and audit as an app. Each gets a status page at /a/<automation_id>/. Dry-run deploy_automation for the recipe shape.

Records what an app did as a machine-readable manifest, replayed nightly against your real stack (with synthetic data) to catch API/catalog drift before it breaks an app. Called as the last step after composing an app.

Render partner-readable documents into M365. Excel gives one worksheet per industry in the canonical pipeline column order; Word gives one company's full outreach history with partner margin comments; export_report_docx is the generic artifact sink — an app or automation drops any report as a Word doc. Every export is audited with who exported what and where it landed.

await rubicon.call('export_pipeline_excel', {
  industries: ['Public Sector Software'], filters: { 'Partner Review': 'yes' }
})
// → { url: 'https://…sharepoint.com/…/Rubicon/_exports/pipeline/…xlsx' }