Upload folder using huggingface_hub

scripts/documenso-cert/.passphrase

@@ -0,0 +1 @@
+PASSPHRASE=ed8a3ab79627281950bd22dcaada161a0182e1ab3a2d83455b369bf4318885b5

scripts/documenso-cert/README.md

@@ -0,0 +1,28 @@
+# Documenso signing certificate
+
+Documenso requires a signing certificate to digitally sign documents.
+The compose file mounts this directory read-only into the container at
+`/opt/documenso/cert`, and the app looks for `cert.p12` inside it.
+
+## Generate a self-signed cert (dev only)
+
+```bash
+openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem \
+  -days 365 -nodes -subj "/CN=MicProtocol Documenso"
+openssl pkcs12 -export -out scripts/documenso-cert/cert.p12 \
+  -inkey key.pem -in cert.pem \
+  -passout pass:"$(openssl rand -hex 32)"
+rm key.pem cert.pem
+```
+
+Then set in `.env`:
+
+```
+DOCUMENSO_SIGNING_PASSPHRASE=<the passphrase you used above>
+```
+
+## Production
+
+Use a CA-issued signing certificate (e.g. from a qualified trust
+provider). Never ship the cert or passphrase in git — keep both
+out of version control.

scripts/generate-secrets.sh

@@ -0,0 +1,148 @@
+#!/usr/bin/env bash
+# Generate all production secrets for MicProtocol self-hosted integrations
+# Run this once during initial setup. Save output to .env.production
+
+set -euo pipefail
+
+echo "# ============================================================"
+echo "# MicProtocol Production Secrets - Generated $(date -u +%Y-%m-%dT%H:%M:%SZ)"
+echo "# ============================================================"
+echo "# IMPORTANT: Save this output securely. Do not commit to git."
+echo "# ============================================================"
+echo ""
+
+# Core Infrastructure
+echo "# ─── Core Infrastructure ───────────────────────────────────"
+POSTGRES_PASSWORD=$(openssl rand -base64 32 | tr -d '/+=' | cut -c1-32)
+REDIS_PASSWORD=$(openssl rand -base64 32 | tr -d '/+=' | cut -c1-32)
+MEILISEARCH_API_KEY=$(openssl rand -base64 32 | tr -d '/+=' | cut -c1-32)
+MINIO_ROOT_USER="micprotocol_admin"
+MINIO_ROOT_PASSWORD=$(openssl rand -base64 32 | tr -d '/+=' | cut -c1-32)
+echo "POSTGRES_PASSWORD=${POSTGRES_PASSWORD}"
+echo "REDIS_PASSWORD=${REDIS_PASSWORD}"
+echo "MEILISEARCH_API_KEY=${MEILISEARCH_API_KEY}"
+echo "MINIO_ROOT_USER=${MINIO_ROOT_USER}"
+echo "MINIO_ROOT_PASSWORD=${MINIO_ROOT_PASSWORD}"
+echo ""
+
+# JWT/Encryption Keys (NEVER ROTATE THESE - data loss if rotated)
+echo "# ─── Encryption Keys (NEVER ROTATE) ────────────────────────"
+ENCRYPTION_KEY=$(openssl rand -hex 32)
+JWT_SECRET=$(openssl rand -base64 64 | tr -d '/+=' | cut -c1-64)
+NEXTAUTH_SECRET=$(openssl rand -base64 32)
+echo "ENCRYPTION_KEY=${ENCRYPTION_KEY}"
+echo "JWT_SECRET=${JWT_SECRET}"
+echo "NEXTAUTH_SECRET=${NEXTAUTH_SECRET}"
+echo ""
+
+# Chatwoot
+echo "# ─── Chatwoot (Customer Support) ──────────────────────────"
+CHATWOOT_SECRET_KEY_BASE=$(openssl rand -hex 64)
+CHATWOOT_WEBHOOK_SECRET=$(openssl rand -hex 32)
+echo "CHATWOOT_SECRET_KEY_BASE=${CHATWOOT_SECRET_KEY_BASE}"
+echo "CHATWOOT_WEBHOOK_SECRET=${CHATWOOT_WEBHOOK_SECRET}"
+echo "# Generate these in Chatwoot UI after setup:"
+echo "# CHATWOOT_INBOX_ID=<from Settings → Inboxes → Website>"
+echo "# NEXT_PUBLIC_CHATWOOT_WEBSITE_TOKEN=<from Settings → Inboxes → Website → Configuration>"
+echo ""
+
+# Cal.com
+echo "# ─── Cal.com (Scheduling) ──────────────────────────────────"
+CALCOM_NEXTAUTH_SECRET=$(openssl rand -base64 32)
+CALCOM_ENCRYPTION_KEY=$(openssl rand -hex 12)  # 24 chars, NEVER ROTATE
+CALCOM_WEBHOOK_SECRET=$(openssl rand -hex 32)
+echo "CALCOM_NEXTAUTH_SECRET=${CALCOM_NEXTAUTH_SECRET}"
+echo "CALCOM_ENCRYPTION_KEY=${CALCOM_ENCRYPTION_KEY}"
+echo "CALCOM_WEBHOOK_SECRET=${CALCOM_WEBHOOK_SECRET}"
+echo "# Generate in Cal.com Admin → API Keys:"
+echo "# CALCOM_API_KEY=cal_live_..."
+echo ""
+
+# Formbricks (v4 - 5 containers)
+echo "# ─── Formbricks (Surveys & Feedback) ──────────────────────"
+FORMBRICKS_NEXTAUTH_SECRET=$(openssl rand -base64 32)
+FORMBRICKS_ENCRYPTION_KEY=$(openssl rand -hex 32)  # NEVER ROTATE
+FORMBRICKS_CRON_SECRET=$(openssl rand -base64 16)
+FORMBRICKS_HUB_API_KEY=$(openssl rand -hex 32)
+FORMBRICKS_CUBE_API_SECRET=$(openssl rand -hex 32)
+FORMBRICKS_WEBHOOK_SECRET=$(openssl rand -hex 32)
+echo "FORMBRICKS_NEXTAUTH_SECRET=${FORMBRICKS_NEXTAUTH_SECRET}"
+echo "FORMBRICKS_ENCRYPTION_KEY=${FORMBRICKS_ENCRYPTION_KEY}"
+echo "FORMBRICKS_CRON_SECRET=${FORMBRICKS_CRON_SECRET}"
+echo "FORMBRICKS_HUB_API_KEY=${FORMBRICKS_HUB_API_KEY}"
+echo "FORMBRICKS_CUBE_API_SECRET=${FORMBRICKS_CUBE_API_SECRET}"
+echo "FORMBRICKS_WEBHOOK_SECRET=${FORMBRICKS_WEBHOOK_SECRET}"
+echo "# Generate in Formbricks UI after setup:"
+echo "# NEXT_PUBLIC_FORMBRICKS_ENVIRONMENT_ID=<from Settings → Environments>"
+echo "# FORMBRICKS_API_KEY=<from Settings → API Keys>"
+echo ""
+
+# Listmonk
+echo "# ─── Listmonk (Email Marketing) ───────────────────────────"
+LISTMONK_ADMIN_PASSWORD=$(openssl rand -base64 24 | tr -d '/+=' | cut -c1-24)
+echo "LISTMONK_ADMIN_PASSWORD=${LISTMONK_ADMIN_PASSWORD}"
+echo "# Generate in Listmonk Admin → Settings → API:"
+echo "# LISTMONK_API_TOKEN=<from API Keys page>"
+echo "# Create a list in Listmonk Admin → Lists → Copy UUID:"
+echo "# NEXT_PUBLIC_LISTMONK_LIST_UUID=<list-uuid>"
+echo ""
+
+# Documenso (if used)
+echo "# ─── Documenso (E-Signatures) ─────────────────────────────"
+DOCUMENSO_NEXTAUTH_SECRET=$(openssl rand -base64 32)
+DOCUMENSO_ENCRYPTION_KEY=$(openssl rand -hex 32)  # NEVER ROTATE
+DOCUMENSO_WEBHOOK_SECRET=$(openssl rand -hex 32)
+echo "DOCUMENSO_NEXTAUTH_SECRET=${DOCUMENSO_NEXTAUTH_SECRET}"
+echo "DOCUMENSO_ENCRYPTION_KEY=${DOCUMENSO_ENCRYPTION_KEY}"
+echo "DOCUMENSO_WEBHOOK_SECRET=${DOCUMENSO_WEBHOOK_SECRET}"
+echo "# Generate in Documenso Admin → Settings → API:"
+echo "# DOCUMENSO_API_KEY=<from API Keys>"
+echo ""
+
+# LiveKit
+echo "# ─── LiveKit (Recording Studio) ───────────────────────────"
+LIVEKIT_API_KEY="devkey"
+LIVEKIT_API_SECRET=$(openssl rand -base64 32 | tr -d '/+=' | cut -c1-32)
+LIVEKIT_WEBHOOK_SECRET=$(openssl rand -hex 32)
+echo "LIVEKIT_API_KEY=${LIVEKIT_API_KEY}"
+echo "LIVEKIT_API_SECRET=${LIVEKIT_API_SECRET}"
+echo "LIVEKIT_WEBHOOK_SECRET=${LIVEKIT_WEBHOOK_SECRET}"
+echo ""
+
+# Email (SMTP)
+echo "# ─── Email (SMTP) ─────────────────────────────────────────"
+echo "# Configure your production SMTP provider:"
+echo "# SMTP_HOST=smtp.sendgrid.net"
+echo "# SMTP_PORT=587"
+echo "# SMTP_USER=apikey"
+echo "# SMTP_PASSWORD=SG.xxx"
+echo "# EMAIL_FROM=MicProtocol <noreply@yourdomain.com>"
+echo ""
+
+# Clerk (Auth)
+echo "# ─── Clerk (Authentication) ───────────────────────────────"
+echo "# Get from Clerk Dashboard → API Keys:"
+echo "# NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=pk_live_..."
+echo "# CLERK_SECRET_KEY=sk_live_..."
+echo "# CLERK_WEBHOOK_SECRET=whsec_... (from Clerk → Webhooks)"
+echo ""
+
+# Sentry (Optional)
+echo "# ─── Sentry (Error Tracking) ──────────────────────────────"
+echo "# SENTRY_DSN=https://xxx@sentry.io/xxx"
+echo "# SENTRY_ORG=your-org"
+echo "# SENTRY_PROJECT=micprotocol"
+echo "# SENTRY_AUTH_TOKEN=xxx (for source maps upload)"
+echo ""
+
+# Umami (Analytics)
+echo "# ─── Umami (Analytics) ────────────────────────────────────"
+UMAMI_APP_SECRET=$(openssl rand -base64 32)
+echo "UMAMI_APP_SECRET=${UMAMI_APP_SECRET}"
+echo "# Generate in Umami UI after setup:"
+echo "# NEXT_PUBLIC_UMAMI_WEBSITE_ID=<website-id>"
+echo ""
+
+echo "# ============================================================"
+echo "# End of generated secrets"
+echo "# ============================================================"

scripts/init-databases.sql

@@ -0,0 +1,43 @@
+-- ═══════════════════════════════════════════════════════════
+-- MicProtocol - Database initialization
+-- Creates one DB per self-hosted integration. The MicProtocol
+-- API itself uses POSTGRES_DB (mirroring POSTGRES_USER) which is
+-- created automatically by the postgres image; these scripts add
+-- the rest.
+-- ═══════════════════════════════════════════════════════════
+
+-- Core extension used by MicProtocol itself.
+CREATE EXTENSION IF NOT EXISTS pgcrypto;
+-- pgvector is required by Chatwoot AND Formbricks. The image
+-- pgvector/pgvector:pg16 ships the extension; just enable it.
+CREATE EXTENSION IF NOT EXISTS vector;
+
+-- ─── MicProtocol integration DBs (each owns its own schema) ─
+CREATE DATABASE chatwoot;
+CREATE DATABASE calcom;
+CREATE DATABASE documenso;
+CREATE DATABASE formbricks;
+CREATE DATABASE listmonk;
+CREATE DATABASE umami;
+
+-- ─── Per-DB extensions ─────────────────────────────────────
+-- pgvector has to be enabled inside each database that needs it.
+\c chatwoot
+CREATE EXTENSION IF NOT EXISTS vector;
+CREATE EXTENSION IF NOT EXISTS pgcrypto;
+
+\c formbricks
+CREATE EXTENSION IF NOT EXISTS vector;
+CREATE EXTENSION IF NOT EXISTS pgcrypto;
+
+\c calcom
+CREATE EXTENSION IF NOT EXISTS pgcrypto;
+
+\c documenso
+CREATE EXTENSION IF NOT EXISTS pgcrypto;
+
+\c umami
+CREATE EXTENSION IF NOT EXISTS pgcrypto;
+
+\c listmonk
+CREATE EXTENSION IF NOT EXISTS pgcrypto;

scripts/render-build.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# ─────────────────────────────────────────────────────────────
+# Render Build Script – MicProtocol Monorepo
+# Called by each Render service with SERVICE_NAME env var.
+# Installs workspace deps from root, then builds the target.
+# ─────────────────────────────────────────────────────────────
+set -euo pipefail
+
+SERVICE="${1:-${SERVICE_NAME:-}}"
+if [ -z "$SERVICE" ]; then
+  echo "Usage: SERVICE_NAME=@micprotocol/api bash scripts/render-build.sh"
+  echo "       or: bash scripts/render-build.sh @micprotocol/api"
+  exit 1
+fi
+
+echo "→ Render build for: $SERVICE"
+echo "→ Installing workspace dependencies..."
+
+corepack enable
+pnpm install --frozen-lockfile --filter "$SERVICE" --filter "$SERVICE"^...
+
+echo "→ Building $SERVICE..."
+pnpm --filter "$SERVICE" build
+
+echo "→ Build complete."

scripts/sync-env.sh

@@ -0,0 +1,95 @@
+#!/usr/bin/env bash
+# ═══════════════════════════════════════════════════════════════
+# sync-env.sh — Ensure .env has every key from .env.example
+#
+# Reads .env.example as the source of truth. For any key that is
+# missing in the local .env, appends the .env.example value (or
+# a placeholder) under the same section comment. Existing keys in
+# .env are preserved (never overwritten) so secrets stay intact.
+#
+# Usage:
+#   ./scripts/sync-env.sh                  # sync into .env
+#   ./scripts/sync-env.sh --check          # report missing keys only
+#   ./scripts/sync-env.sh --target .env.production
+# ═══════════════════════════════════════════════════════════════
+
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+EXAMPLE="${REPO_ROOT}/.env.example"
+COOLIFY="${REPO_ROOT}/.env.example.coolify"
+
+target=".env"
+mode="sync"
+for arg in "$@"; do
+  case "$arg" in
+    --check) mode="check" ;;
+    --target) shift; target="${1:-.env}" ;;
+    *) ;;
+  esac
+done
+TARGET="${REPO_ROOT}/${target}"
+
+if [[ ! -f "$EXAMPLE" ]]; then
+  echo "ERROR: $EXAMPLE not found" >&2
+  exit 1
+fi
+if [[ ! -f "$TARGET" ]]; then
+  echo "Creating $TARGET from $EXAMPLE template"
+  cp "$EXAMPLE" "$TARGET"
+  exit 0
+fi
+
+# Extract existing keys (handle values that span lines)
+declare -A existing
+while IFS= read -r line; do
+  # Skip comments / blanks
+  [[ "$line" =~ ^[[:space:]]*# ]] && continue
+  [[ -z "$line" ]] && continue
+  if [[ "$line" =~ ^[[:space:]]*([A-Z_][A-Z_0-9]*)= ]]; then
+    key="${BASH_REMATCH[1]}"
+    existing["$key"]=1
+  fi
+done < "$TARGET"
+
+missing=()
+total=0
+while IFS= read -r line; do
+  [[ "$line" =~ ^[[:space:]]*# ]] && continue
+  [[ -z "$line" ]] && continue
+  if [[ "$line" =~ ^[[:space:]]*([A-Z_][A-Z_0-9]*)= ]]; then
+    key="${BASH_REMATCH[1]}"
+    total=$((total + 1))
+    if [[ -z "${existing[$key]:-}" ]]; then
+      missing+=("$line")
+    fi
+  fi
+done < "$EXAMPLE"
+
+if [[ "$mode" == "check" ]]; then
+  echo "Checked $target against .env.example"
+  echo "  Total keys in .env.example: $total"
+  echo "  Already present in $target: $((total - ${#missing[@]}))"
+  echo "  Missing keys: ${#missing[@]}"
+  if [[ ${#missing[@]} -gt 0 ]]; then
+    echo ""
+    echo "Missing keys (add these to $target):"
+    printf '  %s\n' "${missing[@]}"
+    exit 1
+  fi
+  exit 0
+fi
+
+if [[ ${#missing[@]} -eq 0 ]]; then
+  echo "✓ $target already in sync with .env.example ($total keys)"
+  exit 0
+fi
+
+{
+  echo ""
+  echo "# ─── Auto-synced from .env.example ($(date -u +%Y-%m-%dT%H:%M:%SZ)) ──"
+  printf '%s\n' "${missing[@]}"
+} >> "$TARGET"
+
+echo "✓ Added ${#missing[@]} missing keys to $target"
+echo "  Total keys in $target: $total"

scripts/synthetic-agents/agents-manifest.json

@@ -0,0 +1,347 @@
+{
+  "version": "1.0.0",
+  "description": "MicProtocol Synthetic Agent Manifest - Real-world simulation credentials",
+  "apiBaseUrl": "http://localhost:4000/trpc",
+  "healthEndpoint": "http://localhost:4000/health",
+  "devMode": true,
+  "agents": [
+    {
+      "id": "agent-admin-01",
+      "name": "Admin Agent",
+      "role": "admin",
+      "email": "agent.admin@micprotocol.local",
+      "userId": "00000000-0000-4000-a000-000000000001",
+      "credential": "sk_admin_micprotocol_v1_agent_admin_01",
+      "description": "Platform admin - monitors all workspaces, manages global settings, billing oversight",
+      "workspaces": []
+    },
+    {
+      "id": "agent-workspace-morning",
+      "name": "Morning Brew Podcast Workspace",
+      "role": "owner",
+      "email": "agent.morning@micprotocol.local",
+      "userId": "00000000-0000-4000-a000-000000000010",
+      "credential": "sk_ws_morning_brew_v1_agent_01",
+      "description": "Daily business/tech podcast - morning show format, high-volume guest pipeline",
+      "workspaces": [
+        {
+          "id": "22222222-0000-4000-a000-000000000010",
+          "slug": "morning-brew-podcast",
+          "name": "Morning Brew Podcast",
+          "podcasts": [
+            {
+              "id": "33333333-0000-4000-a000-000000000011",
+              "title": "Morning Brew Daily",
+              "defaultPlatform": "riverside",
+              "preferredDurationMinutes": 30,
+              "guests": 15,
+              "episodes": 8
+            },
+            {
+              "id": "33333333-0000-4000-a000-000000000012",
+              "title": "Morning Brew Deep Dive",
+              "defaultPlatform": "zoom",
+              "preferredDurationMinutes": 60,
+              "guests": 8,
+              "episodes": 4
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "id": "agent-workspace-devops",
+      "name": "DevOps Thursday Workspace",
+      "role": "owner",
+      "email": "agent.devops@micprotocol.local",
+      "userId": "00000000-0000-4000-a000-000000000020",
+      "credential": "sk_ws_devops_thurs_v1_agent_02",
+      "description": "Technical podcast for infrastructure engineers - weekly deep dives",
+      "workspaces": [
+        {
+          "id": "22222222-0000-4000-a000-000000000020",
+          "slug": "devops-thursday",
+          "name": "DevOps Thursday",
+          "podcasts": [
+            {
+              "id": "33333333-0000-4000-a000-000000000021",
+              "title": "DevOps Thursday",
+              "defaultPlatform": "zoom",
+              "preferredDurationMinutes": 45,
+              "guests": 20,
+              "episodes": 12
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "id": "agent-workspace-creator",
+      "name": "Creator Economics Workspace",
+      "role": "owner",
+      "email": "agent.creator@micprotocol.local",
+      "userId": "00000000-0000-4000-a000-000000000030",
+      "credential": "sk_ws_creator_econ_v1_agent_03",
+      "description": "Creator economy podcast - monetization, platform strategy, audience building",
+      "workspaces": [
+        {
+          "id": "22222222-0000-4000-a000-000000000030",
+          "slug": "creator-economics",
+          "name": "Creator Economics",
+          "podcasts": [
+            {
+              "id": "33333333-0000-4000-a000-000000000031",
+              "title": "Creator Economics Show",
+              "defaultPlatform": "riverside",
+              "preferredDurationMinutes": 50,
+              "guests": 12,
+              "episodes": 6
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "id": "agent-workspace-climate",
+      "name": "Climate Frontiers Workspace",
+      "role": "owner",
+      "email": "agent.climate@micprotocol.local",
+      "userId": "00000000-0000-4000-a000-000000000040",
+      "credential": "sk_ws_climate_front_v1_agent_04",
+      "description": "Climate tech and sustainability podcast - founder stories and policy deep dives",
+      "workspaces": [
+        {
+          "id": "22222222-0000-4000-a000-000000000040",
+          "slug": "climate-frontiers",
+          "name": "Climate Frontiers",
+          "podcasts": [
+            {
+              "id": "33333333-0000-4000-a000-000000000041",
+              "title": "Climate Frontiers Podcast",
+              "defaultPlatform": "zoom",
+              "preferredDurationMinutes": 40,
+              "guests": 10,
+              "episodes": 5
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "id": "agent-workspace-security",
+      "name": "Zero Trust Podcast Workspace",
+      "role": "admin",
+      "email": "agent.security@micprotocol.local",
+      "userId": "00000000-0000-4000-a000-000000000050",
+      "credential": "sk_ws_zero_trust_v1_agent_05",
+      "description": "Cybersecurity podcast network - multiple shows on infosec topics",
+      "workspaces": [
+        {
+          "id": "22222222-0000-4000-a000-000000000050",
+          "slug": "zero-trust-podcast",
+          "name": "Zero Trust Security",
+          "podcasts": [
+            {
+              "id": "33333333-0000-4000-a000-000000000051",
+              "title": "Zero Trust Podcast",
+              "defaultPlatform": "riverside",
+              "preferredDurationMinutes": 55,
+              "guests": 18,
+              "episodes": 9
+            },
+            {
+              "id": "33333333-0000-4000-a000-000000000052",
+              "title": "Red Team Diaries",
+              "defaultPlatform": "zoom",
+              "preferredDurationMinutes": 35,
+              "guests": 6,
+              "episodes": 3
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "guestPool": [
+    {
+      "id": "guest-ai-01",
+      "email": "guest.aiml@micprotocol.local",
+      "fullName": "Dr. Sara Velez",
+      "expertise": ["Machine Learning", "NLP", "Responsible AI"],
+      "tier": "gold",
+      "verificationStatus": "featured"
+    },
+    {
+      "id": "guest-devops-01",
+      "email": "guest.k8s@micprotocol.local",
+      "fullName": "Raj Patel",
+      "expertise": ["Kubernetes", "Cloud Native", "SRE"],
+      "tier": "silver",
+      "verificationStatus": "verified"
+    },
+    {
+      "id": "guest-devops-02",
+      "email": "guest.sre@micprotocol.local",
+      "fullName": "Lena Schmidt",
+      "expertise": ["SRE", "Observability", "Incident Response"],
+      "tier": "gold",
+      "verificationStatus": "verified"
+    },
+    {
+      "id": "guest-creator-01",
+      "email": "guest.monetize@micprotocol.local",
+      "fullName": "Carlos Mendez",
+      "expertise": ["Creator Economy", "Memberships", "Newsletters"],
+      "tier": "gold",
+      "verificationStatus": "featured"
+    },
+    {
+      "id": "guest-creator-02",
+      "email": "guest.video@micprotocol.local",
+      "fullName": "Yuki Tanaka",
+      "expertise": ["Video Strategy", "YouTube", "Short Form"],
+      "tier": "silver",
+      "verificationStatus": "verified"
+    },
+    {
+      "id": "guest-climate-01",
+      "email": "guest.carbon@micprotocol.local",
+      "fullName": "Dr. Amara Obi",
+      "expertise": ["Carbon Removal", "Climate Policy", "Clean Tech"],
+      "tier": "gold",
+      "verificationStatus": "featured"
+    },
+    {
+      "id": "guest-climate-02",
+      "email": "guest.energy@micprotocol.local",
+      "fullName": "Tom Eriksson",
+      "expertise": ["Renewable Energy", "Grid Storage", "Hydrogen"],
+      "tier": "silver",
+      "verificationStatus": "verified"
+    },
+    {
+      "id": "guest-security-01",
+      "email": "guest.threat@micprotocol.local",
+      "fullName": "Maya Johansson",
+      "expertise": ["Threat Intelligence", "Zero Trust", "Cloud Security"],
+      "tier": "gold",
+      "verificationStatus": "featured"
+    },
+    {
+      "id": "guest-security-02",
+      "email": "guest.appsec@micprotocol.local",
+      "fullName": "David Kim",
+      "expertise": ["AppSec", "DevSecOps", "Supply Chain Security"],
+      "tier": "silver",
+      "verificationStatus": "verified"
+    },
+    {
+      "id": "guest-business-01",
+      "email": "guest.saas@micprotocol.local",
+      "fullName": "Emily Westerfeld",
+      "expertise": ["B2B SaaS", "GTM Strategy", "Venture Capital"],
+      "tier": "silver",
+      "verificationStatus": "verified"
+    },
+    {
+      "id": "guest-business-02",
+      "email": "guest.people@micprotocol.local",
+      "fullName": "James Okonkwo",
+      "expertise": ["People Ops", "Remote Work", "Culture"],
+      "tier": "bronze",
+      "verificationStatus": "basic"
+    }
+  ],
+  "testScenarios": [
+    {
+      "id": "sc-workspace-lifecycle",
+      "name": "Workspace Lifecycle",
+      "description": "CRUD operations on workspaces, member management, settings",
+      "agents": ["agent-workspace-morning", "agent-workspace-devops"]
+    },
+    {
+      "id": "sc-podcast-operations",
+      "name": "Podcast Operations",
+      "description": "Full podcast CRUD, recording settings, outreach defaults",
+      "agents": ["agent-workspace-creator", "agent-workspace-climate"]
+    },
+    {
+      "id": "sc-guest-pipeline",
+      "name": "Guest Pipeline Management",
+      "description": "Guest CRUD, status transitions, tagging, bulk operations",
+      "agents": ["agent-workspace-security", "agent-workspace-morning"]
+    },
+    {
+      "id": "sc-outreach-sequences",
+      "name": "Outreach Sequences",
+      "description": "Create sequences, add messages from templates, track opens/clicks",
+      "agents": ["agent-workspace-morning", "agent-workspace-creator"]
+    },
+    {
+      "id": "sc-booking-recording",
+      "name": "Booking & Recording",
+      "description": "Episode scheduling, booking confirmation, post-interview workflows",
+      "agents": ["agent-workspace-devops", "agent-workspace-climate"]
+    },
+    {
+      "id": "sc-verified-network",
+      "name": "Verified Guest Network",
+      "description": "Profile search, bookmarks, booking requests, reviews",
+      "agents": ["agent-workspace-security", "agent-workspace-creator"]
+    },
+    {
+      "id": "sc-billing-subscription",
+      "name": "Billing & Subscription",
+      "description": "Plan management, subscription upgrades, feature access checks",
+      "agents": ["agent-admin-01"]
+    },
+    {
+      "id": "sc-admin-operations",
+      "name": "Admin Operations",
+      "description": "System-wide operations, user management, security settings",
+      "agents": ["agent-admin-01"]
+    },
+    {
+      "id": "sc-service-administration",
+      "name": "Service Administration",
+      "description": "Clip-scorer lock/scratch and mic-realtime stats/traces access, admin-only",
+      "agents": ["agent-admin-01"]
+    },
+    {
+      "id": "sc-cross-workspace",
+      "name": "Cross-Workspace Collaboration",
+      "description": "Network operations between different workspace agents",
+      "agents": [
+        "agent-workspace-morning",
+        "agent-workspace-devops",
+        "agent-workspace-creator",
+        "agent-workspace-climate",
+        "agent-workspace-security"
+      ]
+    },
+    {
+      "id": "sc-support",
+      "name": "Customer Support",
+      "description": "Ticket creation, message exchange, status changes, CSAT rating, SLA breaches, categories, cross-workspace isolation",
+      "agents": ["agent-workspace-morning", "agent-workspace-security"]
+    },
+    {
+      "id": "sc-calcom",
+      "name": "Cal.com Scheduling",
+      "description": "List Cal.com event types, create booking, cross-workspace isolation",
+      "agents": ["agent-workspace-morning", "agent-workspace-devops"]
+    },
+    {
+      "id": "sc-documents",
+      "name": "Document Management",
+      "description": "Upload document, create share, verify integrity, access logs, cross-workspace isolation",
+      "agents": ["agent-workspace-morning"]
+    },
+    {
+      "id": "sc-security-policy",
+      "name": "Security Policy",
+      "description": "Sanction screening, blocklist management, flag/revoke workflows",
+      "agents": ["agent-admin-01"]
+    }
+  ]
+}

scripts/synthetic-agents/lib/reporter.ts

@@ -0,0 +1,198 @@
+export interface TestResult {
+  scenarioId: string;
+  scenarioName: string;
+  agentId: string;
+  agentName: string;
+  operation: string;
+  status: "pass" | "fail" | "warn" | "error";
+  durationMs: number;
+  error?: string;
+  details?: Record<string, unknown>;
+}
+
+export interface WeaknessReport {
+  severity: "critical" | "high" | "medium" | "low" | "info";
+  category: "auth" | "validation" | "performance" | "business_logic" | "security" | "reliability" | "ux";
+  title: string;
+  description: string;
+  affectedEndpoints: string[];
+  evidence: string;
+  recommendation: string;
+}
+
+export class ResultsReporter {
+  private results: TestResult[] = [];
+  private weaknesses: WeaknessReport[] = [];
+  private startTime = Date.now();
+
+  record(result: TestResult): void {
+    this.results.push(result);
+    this.analyzeWeakness(result);
+  }
+
+  private analyzeWeakness(result: TestResult): void {
+    if (result.status === "fail" || result.status === "error") {
+      const errorMsg = result.error || "";
+      const op = result.operation;
+
+      // Authorization gaps
+      if (errorMsg.includes("UNAUTHORIZED") && op.includes("without")) {
+        this.weaknesses.push({
+          severity: "critical",
+          category: "auth",
+          title: "Insufficient auth guard coverage",
+          description: `Operation '${op}' exposed without proper auth: ${errorMsg}`,
+          affectedEndpoints: [op],
+          evidence: errorMsg,
+          recommendation: "Ensure all workspace-scoped procedures enforce authentication and workspace membership checks.",
+        });
+      }
+
+      // Input validation
+      if (errorMsg.includes("ZodError") || errorMsg.includes("validation") || errorMsg.includes("BAD_REQUEST")) {
+        this.weaknesses.push({
+          severity: "high",
+          category: "validation",
+          title: "Insufficient input validation",
+          description: `Operation '${op}' accepted invalid input: ${errorMsg}`,
+          affectedEndpoints: [op],
+          evidence: errorMsg,
+          recommendation: "Strengthen Zod schema validation with proper type guards, length limits, and format checks.",
+        });
+      }
+
+      // Rate limiting
+      if (errorMsg.includes("429") || errorMsg.includes("TOO_MANY_REQUESTS") || errorMsg.includes("rate limit")) {
+        this.weaknesses.push({
+          severity: "medium",
+          category: "performance",
+          title: "Rate limiting triggered",
+          description: `Operation '${op}' hit rate limit. Evaluate if limit is too restrictive or burst handling needed.`,
+          affectedEndpoints: [op],
+          evidence: errorMsg,
+          recommendation: "Implement per-user rate limiting with burst allowance and exponential backoff hints.",
+        });
+      }
+
+      // Subscription/feature gating
+      if (errorMsg.includes("subscription") || errorMsg.includes("UPGRADE") || errorMsg.includes("plan")) {
+        this.weaknesses.push({
+          severity: "medium",
+          category: "business_logic",
+          title: "Subscription gating inconsistency",
+          description: `Subscription check failed for '${op}': ${errorMsg}`,
+          affectedEndpoints: [op],
+          evidence: errorMsg,
+          recommendation: "Audit subscription feature gating to ensure plan tiers are consistently enforced across all procedures.",
+        });
+      }
+
+      // Forbidden access (potential privilege escalation)
+      if (errorMsg.includes("FORBIDDEN") || errorMsg.includes("access")) {
+        this.weaknesses.push({
+          severity: "high",
+          category: "security",
+          title: "Access control verification needed",
+          description: `Access denied for '${op}': ${errorMsg}`,
+          affectedEndpoints: [op],
+          evidence: errorMsg,
+          recommendation: "Verify that cross-workspace access is properly forbidden and role-based permissions are enforced.",
+        });
+      }
+    }
+
+    // Performance weakness detection
+    if (result.durationMs > 5000) {
+      this.weaknesses.push({
+        severity: "low",
+        category: "performance",
+        title: "Slow operation detected",
+        description: `Operation '${result.operation}' took ${result.durationMs}ms (threshold: 5000ms)`,
+        affectedEndpoints: [result.operation],
+        evidence: `${result.durationMs}ms`,
+        recommendation: "Consider adding database indexes, query optimization, or caching for slow operations.",
+      });
+    }
+  }
+
+  getResults(): TestResult[] {
+    return this.results;
+  }
+
+  getWeaknesses(): WeaknessReport[] {
+    return this.weaknesses;
+  }
+
+  generateReport(): string {
+    const elapsed = ((Date.now() - this.startTime) / 1000).toFixed(1);
+    const total = this.results.length;
+    const passed = this.results.filter((r) => r.status === "pass").length;
+    const failed = this.results.filter((r) => r.status === "fail" || r.status === "error").length;
+    const warned = this.results.filter((r) => r.status === "warn").length;
+    const passRate = total > 0 ? ((passed / total) * 100).toFixed(1) : "0.0";
+
+    const report: string[] = [
+      "╔═══════════════════════════════════════════════════════════════╗",
+      "║           MicProtocol - Synthetic Agent Test Report          ║",
+      "╚═══════════════════════════════════════════════════════════════╝",
+      "",
+      `Duration: ${elapsed}s`,
+      `Total operations: ${total}`,
+      `Passed: ${passed}  Failed: ${failed}  Warnings: ${warned}`,
+      `Pass rate: ${passRate}%`,
+      "",
+    ];
+
+    if (failed > 0) {
+      report.push("── Failed Operations ──");
+      for (const r of this.results.filter((r) => r.status === "fail" || r.status === "error")) {
+        report.push(`  ❌ [${r.agentId}] ${r.operation} (${r.durationMs}ms)`);
+        if (r.error) report.push(`     Error: ${r.error.slice(0, 200)}`);
+      }
+      report.push("");
+    }
+
+    if (this.weaknesses.length > 0) {
+      report.push("── Weaknesses & Vulnerabilities Detected ──");
+      const bySeverity = (sev: string) =>
+        this.weaknesses.filter((w) => w.severity === sev);
+
+      for (const w of bySeverity("critical")) {
+        report.push(`  🔴 CRITICAL: ${w.title}`);
+        report.push(`     ${w.description}`);
+        report.push(`     → ${w.recommendation}`);
+      }
+      for (const w of bySeverity("high")) {
+        report.push(`  🟠 HIGH: ${w.title}`);
+        report.push(`     ${w.description}`);
+        report.push(`     → ${w.recommendation}`);
+      }
+      for (const w of bySeverity("medium")) {
+        report.push(`  🟡 MEDIUM: ${w.title}`);
+        report.push(`     ${w.description}`);
+      }
+      for (const w of bySeverity("low")) {
+        report.push(`  🔵 LOW: ${w.title}`);
+      }
+      for (const w of bySeverity("info")) {
+        report.push(`  ⓘ INFO: ${w.title}`);
+      }
+
+      report.push("");
+      report.push("── Categorized Recommendations ──");
+
+      const categories = [...new Set(this.weaknesses.map((w) => w.category))];
+      for (const cat of categories) {
+        const items = this.weaknesses.filter((w) => w.category === cat);
+        report.push(`  📂 ${cat.toUpperCase()}: ${items.length} issue(s)`);
+        for (const item of items) {
+          report.push(`    • ${item.recommendation}`);
+        }
+      }
+    } else {
+      report.push("  ✅ No weaknesses detected.");
+    }
+
+    return report.join("\n");
+  }
+}

scripts/synthetic-agents/lib/scenario-runner.ts

@@ -0,0 +1,122 @@
+import type { AgentTrpcClient } from "./trpc-client";
+import type { TestResult, WeaknessReport } from "./reporter";
+import { ResultsReporter } from "./reporter";
+
+export interface AgentContext {
+  agentId: string;
+  agentName: string;
+  email: string;
+  userId: string;
+  credential: string;
+  client: AgentTrpcClient;
+  workspaceId?: string;
+  workspaceSlug?: string;
+  podcastIds: string[];
+}
+
+export type ScenarioFn = (ctx: AgentContext, report: ResultsReporter, allAgents: Map<string, AgentContext>) => Promise<void>;
+
+export interface ScenarioDefinition {
+  id: string;
+  name: string;
+  description: string;
+  requiredAgents: string[];
+  fn: ScenarioFn;
+}
+
+export function measureOperation<T>(
+  agentId: string,
+  agentName: string,
+  scenarioId: string,
+  scenarioName: string,
+  operation: string,
+  fn: () => Promise<T>,
+  report: ResultsReporter,
+): Promise<T> {
+  const start = Date.now();
+  return fn()
+    .then((result) => {
+      report.record({
+        scenarioId,
+        scenarioName,
+        agentId,
+        agentName,
+        operation,
+        status: "pass",
+        durationMs: Date.now() - start,
+      });
+      return result;
+    })
+    .catch((err: Error) => {
+      report.record({
+        scenarioId,
+        scenarioName,
+        agentId,
+        agentName,
+        operation,
+        status: "fail",
+        durationMs: Date.now() - start,
+        error: err.message,
+      });
+      throw err;
+    });
+}
+
+export function measureOperationWarn<T>(
+  agentId: string,
+  agentName: string,
+  scenarioId: string,
+  scenarioName: string,
+  operation: string,
+  fn: () => Promise<T>,
+  report: ResultsReporter,
+): Promise<T | null> {
+  const start = Date.now();
+  return fn()
+    .then((result) => {
+      report.record({
+        scenarioId,
+        scenarioName,
+        agentId,
+        agentName,
+        operation,
+        status: "pass",
+        durationMs: Date.now() - start,
+      });
+      return result;
+    })
+    .catch((err: Error) => {
+      report.record({
+        scenarioId,
+        scenarioName,
+        agentId,
+        agentName,
+        operation,
+        status: "warn",
+        durationMs: Date.now() - start,
+        error: err.message,
+      });
+      return null;
+    });
+}
+
+export function runScenario(
+  def: ScenarioDefinition,
+  agents: Map<string, AgentContext>,
+  report: ResultsReporter,
+): Promise<void> {
+  const agentContexts = def.requiredAgents
+    .map((id) => agents.get(id))
+    .filter((ctx): ctx is AgentContext => ctx !== undefined);
+
+  if (agentContexts.length < def.requiredAgents.length) {
+    const missing = def.requiredAgents.filter((id) => !agents.has(id));
+    console.warn(`  ⚠️  Scenario '${def.name}' skipped: missing agents [${missing.join(", ")}]`);
+    return Promise.resolve();
+  }
+
+  // Run for the first matching agent, passing all agents for multi-agent scenarios
+  return def.fn(agentContexts[0], report, agents).catch((err) => {
+    console.error(`  ❌ Scenario '${def.name}' crashed: ${err.message}`);
+  });
+}

scripts/synthetic-agents/lib/trpc-client.ts

@@ -0,0 +1,62 @@
+import { createTRPCClient, httpBatchLink } from "@trpc/client";
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+type AnyRouter = any;
+export type AgentTrpcClient = ReturnType<typeof createTRPCClient<AnyRouter>>;
+
+export interface TrpcClientOptions {
+  baseUrl: string;
+  userId: string;
+  credential: string;
+  workspaceId?: string;
+  devMode?: boolean;
+}
+
+export function createAgentClient(opts: TrpcClientOptions): AgentTrpcClient {
+  const headers: Record<string, string> = {};
+
+  if (opts.devMode) {
+    headers["x-user-id"] = opts.userId;
+    headers["x-credential"] = opts.credential;
+  }
+
+  if (opts.workspaceId) {
+    headers["x-workspace-id"] = opts.workspaceId;
+  }
+
+  return createTRPCClient<AnyRouter>({
+    links: [
+      httpBatchLink({
+        url: `${opts.baseUrl}`,
+        headers,
+        maxURLLength: 2048,
+        fetch: async (url, options) => {
+          const response = await fetch(url, {
+            ...options,
+            signal: AbortSignal.timeout(30000),
+          });
+          if (!response.ok) {
+            const body = await response.text().catch(() => "");
+            throw new Error(`tRPC request failed: ${response.status} ${response.statusText}\n${body}`);
+          }
+          return response;
+        },
+      }),
+    ],
+  });
+}
+
+export function withWorkspace(client: AgentTrpcClient, workspaceId: string): AgentTrpcClient {
+  return createTRPCClient<AnyRouter>({
+    links: [
+      httpBatchLink({
+        url: "http://localhost:4000/trpc",
+        headers: {
+          "x-user-id": "",
+          "x-workspace-id": workspaceId,
+        },
+        maxURLLength: 2048,
+      }),
+    ],
+  });
+}

scripts/synthetic-agents/orchestrator.ts

@@ -0,0 +1,194 @@
+import { createAgentClient, type AgentTrpcClient } from "./lib/trpc-client";
+import { ResultsReporter } from "./lib/reporter";
+import { type AgentContext, type ScenarioDefinition } from "./lib/scenario-runner";
+import { runScenario } from "./lib/scenario-runner";
+import { allScenarios } from "./scenarios/index";
+import * as fs from "fs";
+import * as path from "path";
+
+interface Manifest {
+  apiBaseUrl: string;
+  healthEndpoint: string;
+  devMode: boolean;
+  agents: ManifestAgent[];
+  testScenarios: ManifestScenario[];
+}
+
+interface ManifestAgent {
+  id: string;
+  name: string;
+  role: string;
+  email: string;
+  userId: string;
+  credential: string;
+  workspaces: ManifestWorkspace[];
+}
+
+interface ManifestWorkspace {
+  id: string;
+  slug: string;
+  name: string;
+  podcasts: ManifestPodcast[];
+}
+
+interface ManifestPodcast {
+  id: string;
+  title: string;
+}
+
+interface ManifestScenario {
+  id: string;
+  name: string;
+  description: string;
+  agents: string[];
+}
+
+async function checkHealth(endpoint: string): Promise<boolean> {
+  try {
+    const res = await fetch(endpoint, { signal: AbortSignal.timeout(5000) });
+    return res.ok;
+  } catch {
+    return false;
+  }
+}
+
+function loadManifest(): Manifest {
+  const manifestPath = path.join(__dirname, "agents-manifest.json");
+  return JSON.parse(fs.readFileSync(manifestPath, "utf-8"));
+}
+
+function buildAgentContexts(manifest: Manifest): Map<string, AgentContext> {
+  const agents = new Map<string, AgentContext>();
+
+  for (const agent of manifest.agents) {
+    const podcastIds: string[] = [];
+    let workspaceId: string | undefined;
+    let workspaceSlug: string | undefined;
+
+    if (agent.workspaces.length > 0) {
+      workspaceId = agent.workspaces[0].id;
+      workspaceSlug = agent.workspaces[0].slug;
+      for (const ws of agent.workspaces) {
+        for (const podcast of ws.podcasts) {
+          podcastIds.push(podcast.id);
+        }
+      }
+    }
+
+    const client = createAgentClient({
+      baseUrl: manifest.apiBaseUrl,
+      userId: agent.userId,
+      credential: agent.credential,
+      workspaceId,
+      devMode: manifest.devMode,
+    });
+
+    agents.set(agent.id, {
+      agentId: agent.id,
+      agentName: agent.name,
+      email: agent.email,
+      userId: agent.userId,
+      credential: agent.credential,
+      client,
+      workspaceId,
+      workspaceSlug,
+      podcastIds,
+    });
+  }
+
+  return agents;
+}
+
+async function main() {
+  console.log("╔═══════════════════════════════════════════════════════════════╗");
+  console.log("║    MicProtocol - Synthetic Agent Orchestrator              ║");
+  console.log("╚═══════════════════════════════════════════════════════════════╝");
+  console.log("");
+
+  const manifest = loadManifest();
+
+  // 1. Health check
+  console.log(`🔍 Checking API health at ${manifest.healthEndpoint}...`);
+  const healthy = await checkHealth(manifest.healthEndpoint);
+  if (!healthy) {
+    console.error("❌ API is not healthy. Start the pod first:\n");
+    console.error("   cd scripts/synthetic-agents");
+    console.error("   podman-compose -f podman-compose.yml up -d");
+    console.error("   pnpm db:push");
+    console.error("   pnpm db:seed");
+    process.exit(1);
+  }
+  console.log("✅ API is healthy\n");
+
+  // 2. Build agent contexts
+  console.log("🤖 Building agent contexts...");
+  const agents = buildAgentContexts(manifest);
+  console.log(`   ${agents.size} agents initialized\n`);
+
+  for (const [, agent] of agents) {
+    console.log(`   👤 ${agent.agentName} (${agent.agentId})`);
+    console.log(`      Email: ${agent.email}`);
+    console.log(`      Workspace: ${agent.workspaceSlug || "N/A"}`);
+    if (agent.podcastIds.length > 0) {
+      console.log(`      Podcasts: ${agent.podcastIds.join(", ")}`);
+    }
+  }
+  console.log("");
+
+  // 3. Map scenarios
+  const scenarioMap = new Map<string, ScenarioDefinition>();
+  for (const sc of allScenarios) {
+    scenarioMap.set(sc.id, sc);
+  }
+
+  // 4. Run scenarios
+  const reporter = new ResultsReporter();
+  const enabledScenarioIds = new Set(manifest.testScenarios.map((s) => s.id));
+
+  console.log("🎬 Running test scenarios...\n");
+
+  for (const manifestScenario of manifest.testScenarios) {
+    const scenario = scenarioMap.get(manifestScenario.id);
+    if (!scenario) {
+      console.warn(`   ⚠️  Scenario '${manifestScenario.id}' not found, skipping`);
+      continue;
+    }
+
+    console.log(`── ${scenario.name} ──`);
+    console.log(`   ${scenario.description}`);
+    console.log(`   Agents: ${manifestScenario.agents.join(", ")}`);
+
+    try {
+      await runScenario(scenario, agents, reporter);
+      console.log(`   ✅ Completed\n`);
+    } catch (err) {
+      console.error(`   ❌ Failed: ${(err as Error).message}\n`);
+    }
+  }
+
+  // 5. Generate report
+  console.log("╔═══════════════════════════════════════════════════════════════╗");
+  console.log("║                    FINAL TEST REPORT                       ║");
+  console.log("╚═══════════════════════════════════════════════════════════════╝");
+  console.log("");
+  console.log(reporter.generateReport());
+
+  // 6. Write report to file
+  const reportPath = path.join(__dirname, "test-report.txt");
+  fs.writeFileSync(reportPath, reporter.generateReport());
+  console.log(`\n📄 Full report written to: ${reportPath}`);
+
+  // 7. Write weaknesses to structured JSON
+  const weaknessesPath = path.join(__dirname, "weaknesses.json");
+  fs.writeFileSync(weaknessesPath, JSON.stringify(reporter.getWeaknesses(), null, 2));
+  console.log(`📄 Weaknesses JSON written to: ${weaknessesPath}`);
+
+  // 8. Exit with appropriate code
+  const failed = reporter.getResults().filter((r) => r.status === "fail" || r.status === "error").length;
+  process.exit(failed > 0 ? 1 : 0);
+}
+
+main().catch((err) => {
+  console.error("Orchestrator crashed:", err);
+  process.exit(1);
+});

scripts/synthetic-agents/package.json

@@ -0,0 +1,18 @@
+{
+  "name": "@micprotocol/synthetic-agents",
+  "version": "0.1.0",
+  "private": true,
+  "scripts": {
+    "start": "bash run-agents.sh",
+    "orchestrator": "ts-node orchestrator.ts"
+  },
+  "dependencies": {
+    "@trpc/client": "^11.11.0",
+    "zod": "^4.3.6"
+  },
+  "devDependencies": {
+    "ts-node": "^10.9.2",
+    "typescript": "^5.9.3",
+    "@types/node": "^25.3.3"
+  }
+}

scripts/synthetic-agents/podman-compose.yml

@@ -0,0 +1,229 @@
+# ═══════════════════════════════════════════════════════════
+# MicProtocol - Podman Pod Orchestration
+# Podman-compatible alternative to docker-compose.yml
+# Uses a shared pod for infra isolation
+# ═══════════════════════════════════════════════════════════
+
+version: "3.8"
+
+x-pod: &pod
+  pod: micprotocol-pod
+  pod_options:
+    --infra-conmon
+    --network bridge
+    --publish 5432:5432
+    --publish 6379:6379
+    --publish 7700:7700
+    --publish 4000:4000
+    --publish 3000:3000
+    --publish 3001:3001
+    --publish 3002:3002
+    --publish 3003:3003
+    --publish 9000:9000
+    --publish 9001:9001
+    --publish 9090:9090
+
+services:
+  # ─── PostgreSQL Database ─────────────────────────────────
+  postgres:
+    image: docker.io/postgres:15-alpine
+    <<: *pod
+    container_name: micprotocol-pg
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: ${POSTGRES_USER:-micprotocol}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-micprotocol_secret}
+      POSTGRES_DB: ${POSTGRES_DB:-micprotocol}
+    volumes:
+      - pg_data:/var/lib/postgresql/data
+    healthcheck:
+      test: [ "CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-micprotocol}" ]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  # ─── Redis (Caching & Job Queue) ─────────────────────────
+  redis:
+    image: docker.io/redis:7-alpine
+    <<: *pod
+    container_name: micprotocol-redis
+    restart: unless-stopped
+    command: redis-server --requirepass ${REDIS_PASSWORD:-redis_secret}
+    volumes:
+      - redis_data:/data
+    healthcheck:
+      test: [ "CMD", "redis-cli", "-a", "${REDIS_PASSWORD:-redis_secret}", "ping" ]
+      interval: 10s
+      timeout: 3s
+      retries: 5
+
+  # ─── Meilisearch (Search Engine) ─────────────────────────
+  meilisearch:
+    image: docker.io/getmeili/meilisearch:v1.6
+    <<: *pod
+    container_name: micprotocol-meili
+    restart: unless-stopped
+    environment:
+      MEILI_MASTER_KEY: ${MEILISEARCH_API_KEY:-masterKey}
+      MEILI_NO_ANALYTICS: "true"
+    volumes:
+      - meili_data:/meili_data
+    healthcheck:
+      test: [ "CMD", "curl", "-f", "http://localhost:7700/health" ]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+
+  # ─── API Server ──────────────────────────────────────────
+  api:
+    build:
+      context: ../..
+      dockerfile: apps/api/Dockerfile
+    <<: *pod
+    container_name: micprotocol-api
+    restart: unless-stopped
+    environment:
+      NODE_ENV: development
+      API_PORT: 4000
+      DATABASE_URL: postgresql://${POSTGRES_USER:-micprotocol}:${POSTGRES_PASSWORD:-micprotocol_secret}@postgres:5432/${POSTGRES_DB:-micprotocol}?schema=public
+      REDIS_HOST: redis
+      REDIS_PORT: 6379
+      REDIS_PASSWORD: ${REDIS_PASSWORD:-redis_secret}
+      MEILISEARCH_HOST: http://meilisearch:7700
+      CLERK_SECRET_KEY: ${CLERK_SECRET_KEY:-sk_test_placeholder}
+      CLERK_PUBLISHABLE_KEY: ${CLERK_PUBLISHABLE_KEY:-pk_test_placeholder}
+      WEB_URL: ${WEB_URL:-http://localhost:3000}
+      API_URL: ${API_URL:-http://localhost:4000}
+      COOKIE_SECRET: ${COOKIE_SECRET:-cookie_secret_for_testing}
+      ENABLE_AI_FEATURES: "false"
+      ENABLE_CONTENT_STUDIO: "true"
+      ENABLE_ANALYTICS: "true"
+    depends_on:
+      postgres:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+    healthcheck:
+      test: [ "CMD", "wget", "-q", "--spider", "http://localhost:4000/health" ]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 40s
+
+  # ─── Background Workers ──────────────────────────────────
+  worker:
+    build:
+      context: ../..
+      dockerfile: apps/api/Dockerfile
+    <<: *pod
+    container_name: micprotocol-worker
+    restart: unless-stopped
+    command: npx bullmq-pro
+    environment:
+      NODE_ENV: development
+      DATABASE_URL: postgresql://${POSTGRES_USER:-micprotocol}:${POSTGRES_PASSWORD:-micprotocol_secret}@postgres:5432/${POSTGRES_DB:-micprotocol}?schema=public
+      REDIS_HOST: redis
+      REDIS_PORT: 6379
+      REDIS_PASSWORD: ${REDIS_PASSWORD:-redis_secret}
+    depends_on:
+      postgres:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+
+  calcom:
+    image: docker.io/calcom/cal.com:latest
+    <<: *pod
+    container_name: micprotocol-calcom
+    restart: unless-stopped
+    environment:
+      DATABASE_URL: postgresql://${POSTGRES_USER:-micprotocol}:${POSTGRES_PASSWORD:-micprotocol_secret}@postgres:5432/${POSTGRES_DB:-micprotocol}?schema=calcom
+      NEXTAUTH_SECRET: ${CALCOM_NEXTAUTH_SECRET:-calcom_secret}
+      CALENDSO_ENCRYPTION_KEY: ${CALCOM_ENCRYPTION_KEY:-calcom_encryption}
+      NEXT_PUBLIC_WEBAPP_URL: ${CALCOM_URL:-http://localhost:3002}
+      NEXTAUTH_URL: ${CALCOM_URL:-http://localhost:3002}
+    depends_on:
+      postgres:
+        condition: service_healthy
+
+  listmonk:
+    image: docker.io/listmonk/listmonk:latest
+    <<: *pod
+    container_name: micprotocol-listmonk
+    restart: unless-stopped
+    environment:
+      LISTMONK_app__address: "0.0.0.0:9000"
+      LISTMONK_db__host: postgres
+      LISTMONK_db__port: 5432
+      LISTMONK_db__user: ${POSTGRES_USER:-micprotocol}
+      LISTMONK_db__password: ${POSTGRES_PASSWORD:-micprotocol_secret}
+      LISTMONK_db__database: ${POSTGRES_DB:-micprotocol}
+      LISTMONK_db__ssl_mode: disable
+    command: [ "sh", "-c", "./listmonk --install --yes && ./listmonk" ]
+    depends_on:
+      postgres:
+        condition: service_healthy
+
+  formbricks:
+    image: docker.io/formbricks/formbricks:latest
+    <<: *pod
+    container_name: micprotocol-formbricks
+    restart: unless-stopped
+    environment:
+      DATABASE_URL: postgresql://${POSTGRES_USER:-micprotocol}:${POSTGRES_PASSWORD:-micprotocol_secret}@postgres:5432/${POSTGRES_DB:-micprotocol}?schema=formbricks
+      NEXTAUTH_URL: ${FORMBRICKS_URL:-http://localhost:3001}
+      NEXTAUTH_SECRET: ${FORMBRICKS_NEXTAUTH_SECRET:-formbricks_secret}
+      ENCRYPTION_KEY: ${FORMBRICKS_ENCRYPTION_KEY:-e12c4ab1239847123987123984723984}
+    depends_on:
+      postgres:
+        condition: service_healthy
+
+  minio:
+    image: docker.io/minio/minio:latest
+    <<: *pod
+    container_name: micprotocol-minio
+    restart: unless-stopped
+    environment:
+      MINIO_ROOT_USER: ${MINIO_ROOT_USER:-micprotocol_admin}
+      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:-micprotocol_secret}
+    command: server /data --console-address ":9090"
+    volumes:
+      - minio_data:/data
+
+  minio-createbuckets:
+    image: docker.io/minio/mc
+    <<: *pod
+    container_name: micprotocol-minio-mc
+    depends_on:
+      - minio
+    entrypoint: >
+      /bin/sh -c "
+      /usr/bin/mc alias set myminio http://minio:9000 ${MINIO_ROOT_USER:-micprotocol_admin} ${MINIO_ROOT_PASSWORD:-micprotocol_secret};
+      /usr/bin/mc mb myminio/micprotocol-storage --ignore-existing;
+      /usr/bin/mc anonymous set public myminio/micprotocol-storage;
+      exit 0;
+      "
+
+  umami:
+    image: ghcr.io/umami-software/umami:postgresql-latest
+    <<: *pod
+    container_name: micprotocol-umami
+    restart: unless-stopped
+    environment:
+      DATABASE_URL: postgresql://${POSTGRES_USER:-micprotocol}:${POSTGRES_PASSWORD:-micprotocol_secret}@postgres:5432/${POSTGRES_DB:-micprotocol}?schema=umami
+      DATABASE_TYPE: postgresql
+      APP_SECRET: ${UMAMI_APP_SECRET:-umami_secret_key_12345}
+    depends_on:
+      postgres:
+        condition: service_healthy
+
+# ─── Volumes ───────────────────────────────────────────────
+volumes:
+  pg_data:
+    driver: local
+  redis_data:
+    driver: local
+  meili_data:
+    driver: local
+  minio_data:
+    driver: local

scripts/synthetic-agents/run-agents.sh

@@ -0,0 +1,146 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# ═══════════════════════════════════════════════════════════
+# MicProtocol - Synthetic Agent Runner
+# Orchestrates: podman pod + seed + agent simulation
+# ═══════════════════════════════════════════════════════════
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+API_DIR="$REPO_ROOT/apps/api"
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+CYAN='\033[0;36m'
+NC='\033[0m' # No Color
+
+log()  { echo -e "${GREEN}[✓]${NC} $1"; }
+warn() { echo -e "${YELLOW}[!]${NC} $1"; }
+err()  { echo -e "${RED}[✗]${NC} $1"; }
+info() { echo -e "${CYAN}[→]${NC} $1"; }
+
+cleanup() {
+    info "Cleaning up..."
+    cd "$SCRIPT_DIR" && podman-compose -f podman-compose.yml down 2>/dev/null || true
+}
+trap cleanup EXIT ERR
+
+echo ""
+echo "╔═══════════════════════════════════════════════════════════════╗"
+echo "║       MicProtocol - Synthetic Agent Test Runner             ║"
+echo "╚═══════════════════════════════════════════════════════════════╝"
+echo ""
+
+# ─── Phase 1: Check prerequisites ────────────────────────────
+info "Phase 1: Checking prerequisites..."
+
+command -v podman >/dev/null 2>&1 || { err "podman is required"; exit 1; }
+command -v podman-compose >/dev/null 2>&1 || { err "podman-compose is required (pip install podman-compose)"; exit 1; }
+command -v pnpm >/dev/null 2>&1 || { err "pnpm is required"; exit 1; }
+
+log "All prerequisites satisfied"
+
+# ─── Phase 2: Start podman pod ───────────────────────────────
+info "Phase 2: Starting podman pod with infra services..."
+
+cd "$SCRIPT_DIR"
+
+# Load env vars from repo root .env if present
+if [ -f "$REPO_ROOT/.env" ]; then
+    export $(grep -v '^\s*#' "$REPO_ROOT/.env" | grep -v '^\s*$' | xargs)
+fi
+
+export NODE_ENV=development
+
+podman-compose -f podman-compose.yml up -d postgres redis meilisearch
+log "Podman infra services started"
+
+# Wait for services
+info "Waiting for Postgres..."
+until podman exec micprotocol-pg pg_isready -U micprotocol >/dev/null 2>&1; do
+    sleep 2
+done
+log "Postgres is ready"
+
+info "Waiting for Redis..."
+until podman exec micprotocol-redis redis-cli -a "${REDIS_PASSWORD:-redis_secret}" ping >/dev/null 2>&1; do
+    sleep 1
+done
+log "Redis is ready"
+
+info "Waiting for Meilisearch..."
+until curl -s http://localhost:7700/health >/dev/null 2>&1; do
+    sleep 1
+done
+log "Meilisearch is ready"
+
+# ─── Phase 3: Start API ──────────────────────────────────────
+info "Phase 3: Starting API server..."
+
+cd "$API_DIR"
+
+# Generate Prisma client
+pnpm prisma:generate
+log "Prisma client generated"
+
+# Push schema
+DATABASE_URL="postgresql://${POSTGRES_USER:-micprotocol}:${POSTGRES_PASSWORD:-micprotocol_secret}@localhost:5432/${POSTGRES_DB:-micprotocol}?schema=public" \
+    pnpm prisma:push --skip-generate
+log "Database schema pushed"
+
+# Seed the database with agent data
+info "Seeding agent data..."
+DATABASE_URL="postgresql://${POSTGRES_USER:-micprotocol}:${POSTGRES_PASSWORD:-micprotocol_secret}@localhost:5432/${POSTGRES_DB:-micprotocol}?schema=public" \
+    npx ts-node "$SCRIPT_DIR/../../apps/api/prisma/seed-agents.ts"
+log "Agent seed data loaded"
+
+# Start the API in background
+cd "$REPO_ROOT"
+pnpm --filter @micprotocol/api start:dev &
+API_PID=$!
+log "API server starting (PID: $API_PID)..."
+
+# Wait for API health
+info "Waiting for API at http://localhost:4000/health..."
+for i in $(seq 1 60); do
+    if curl -s http://localhost:4000/health >/dev/null 2>&1; then
+        log "API is healthy"
+        break
+    fi
+    if [ "$i" -eq 60 ]; then
+        err "API failed to start within 60s"
+        exit 1
+    fi
+    sleep 2
+done
+
+# ─── Phase 4: Run agent orchestrator ─────────────────────────
+info "Phase 4: Running synthetic agent scenarios..."
+
+cd "$SCRIPT_DIR"
+
+# Install dependencies for the orchestrator
+pnpm install --no-frozen-lockfile 2>/dev/null || true
+
+# Use the local ts-node from pnpm
+./node_modules/.bin/ts-node orchestrator.ts 2>&1
+ORCHESTRATOR_EXIT=$?
+
+# ─── Phase 5: Summary ────────────────────────────────────────
+echo ""
+if [ $ORCHESTRATOR_EXIT -eq 0 ]; then
+    log "All agent scenarios completed successfully!"
+else
+    warn "Some agent scenarios detected issues. Check test-report.txt"
+fi
+
+echo ""
+info "Test report: $SCRIPT_DIR/test-report.txt"
+info "Weaknesses:   $SCRIPT_DIR/weaknesses.json"
+
+# Kill API
+kill $API_PID 2>/dev/null || true
+
+exit $ORCHESTRATOR_EXIT

scripts/synthetic-agents/scenarios/admin-operations.ts

@@ -0,0 +1,86 @@
+import type { ScenarioDefinition, AgentContext } from "../lib/scenario-runner";
+import { measureOperation, measureOperationWarn } from "../lib/scenario-runner";
+import type { ResultsReporter } from "../lib/reporter";
+
+async function run(ctx: AgentContext, report: ResultsReporter) {
+  const sId = "sc-admin-operations";
+  const sName = "Admin Operations";
+
+  console.log("  🛡️  Running admin operations...");
+
+  // Try accessing admin-level network operations that require auth
+  const searchResults = await measureOperation(
+    ctx.agentId, ctx.agentName, sId, sName,
+    "admin.network.search",
+    () => ctx.client.network.search.query({ query: "AI", limit: 20 }),
+    report,
+  );
+  console.log(`  🔍 Admin search returned ${searchResults?.length || 0} results`);
+
+  // Get trending as admin
+  await measureOperation(
+    ctx.agentId, ctx.agentName, sId, sName,
+    "admin.network.trending",
+    () => ctx.client.network.trending.query({ region: "global", limit: 10 }),
+    report,
+  );
+
+  // Create a profile (admin creating their own network profile)
+  const myProfile = await measureOperationWarn(
+    ctx.agentId, ctx.agentName, sId, sName,
+    "admin.network.getMyProfile",
+    () => ctx.client.network.getMyProfile.query(),
+    report,
+  );
+
+  if (!myProfile) {
+    await measureOperationWarn(
+      ctx.agentId, ctx.agentName, sId, sName,
+      "admin.network.createProfile",
+      () => ctx.client.network.createProfile.mutate({
+        isPublic: true,
+        vanityUrl: `admin-${Date.now()}`,
+        headline: "Platform Administrator",
+        fullBio: "System administrator for MicProtocol synthetic testing.",
+        country: "Global",
+        timezone: "UTC",
+        languages: ["English"],
+        verificationStatus: "featured" as any,
+        tier: "gold" as any,
+      }),
+      report,
+    );
+  }
+
+  // Test billing operations as admin
+  await measureOperationWarn(
+    ctx.agentId, ctx.agentName, sId, sName,
+    "admin.billing.listPlans",
+    () => ctx.client.billing.listPlans.query(),
+    report,
+  );
+
+  // Test system-wide profile views
+  await measureOperationWarn(
+    ctx.agentId, ctx.agentName, sId, sName,
+    "admin.network.getViewStats",
+    () => ctx.client.network.getViewStats.query({
+      profileId: "44444444-0000-4000-a000-000000000001",
+      days: 30,
+    }),
+    report,
+  );
+
+  // Try non-admin endpoints (these should still work for admin)
+  console.log("  ✅ Admin operations completed");
+}
+
+export const adminScenarios: ScenarioDefinition[] = [
+  {
+    id: "sc-admin-operations",
+    name: "Admin Operations",
+    description: "System-wide admin operations, user management, security",
+    requiredAgents: ["agent-admin-01"],
+    fn: run,
+  },
+];

scripts/synthetic-agents/scenarios/booking-recording.ts

@@ -0,0 +1,99 @@
+import type { ScenarioDefinition, AgentContext } from "../lib/scenario-runner";
+import { measureOperation, measureOperationWarn } from "../lib/scenario-runner";
+import type { ResultsReporter } from "../lib/reporter";
+
+async function run(ctx: AgentContext, report: ResultsReporter) {
+  const sId = "sc-booking-recording";
+  const sName = "Booking & Recording";
+
+  for (const podcastId of ctx.podcastIds) {
+    // List episodes with filters
+    const episodes = await measureOperation(
+      ctx.agentId, ctx.agentName, sId, sName,
+      `scheduling.listEpisodes.${podcastId.slice(-8)}`,
+      () => ctx.client.scheduling.listEpisodes.query({ podcastId, limit: 20 }),
+      report,
+    );
+    console.log(`  📺 ${episodes.length} episodes in podcast ${podcastId.slice(-8)}`);
+
+    // Get upcoming episodes
+    await measureOperation(
+      ctx.agentId, ctx.agentName, sId, sName,
+      `scheduling.upcoming.${podcastId.slice(-8)}`,
+      () => ctx.client.scheduling.upcoming.query({ podcastId, days: 30 }),
+      report,
+    );
+
+    // Get individual episode details
+    if (episodes.length > 0) {
+      for (const ep of episodes.slice(0, 4)) {
+        await measureOperation(
+          ctx.agentId, ctx.agentName, sId, sName,
+          `scheduling.getEpisode.${ep.id.slice(-8)}`,
+          () => ctx.client.scheduling.getEpisode.query({ id: ep.id }),
+          report,
+        );
+
+        // Try post-interview workflow for recorded/published episodes
+        if (ep.status === "recorded" || ep.status === "published") {
+          const workflow = await measureOperationWarn(
+            ctx.agentId, ctx.agentName, sId, sName,
+            `scheduling.getPostInterviewWorkflow.${ep.id.slice(-8)}`,
+            () => ctx.client.scheduling.getPostInterviewWorkflow.query({ episodeId: ep.id }),
+            report,
+          );
+
+          // Initialize workflow if not exists
+          if (!workflow) {
+            await measureOperationWarn(
+              ctx.agentId, ctx.agentName, sId, sName,
+              `scheduling.initializePostInterviewWorkflow.${ep.id.slice(-8)}`,
+              () => ctx.client.scheduling.initializePostInterviewWorkflow.mutate({
+                episodeId: ep.id,
+                tasks: [
+                  { taskType: "send_recording_link", status: "pending" as const },
+                  { taskType: "request_testimonial", status: "pending" as const },
+                  { taskType: "provide_clips", status: "pending" as const },
+                ],
+              }),
+              report,
+            );
+          }
+        }
+      }
+    }
+
+    // Try creating a new episode with invalid data
+    await measureOperationWarn(
+      ctx.agentId, ctx.agentName, sId, sName,
+      "scheduling.createEpisode.invalid",
+      () => ctx.client.scheduling.createEpisode.mutate({
+        podcastId,
+        guestId: "invalid-id",
+        title: "",
+        status: "draft" as any,
+      }),
+      report,
+    );
+  }
+
+  // Try accessing calendar integration
+  for (const podcastId of ctx.podcastIds) {
+    await measureOperationWarn(
+      ctx.agentId, ctx.agentName, sId, sName,
+      `scheduling.getCalendarIntegration.${podcastId.slice(-8)}`,
+      () => ctx.client.scheduling.getCalendarIntegration.query({ podcastId }),
+      report,
+    );
+  }
+}
+
+export const bookingRecordingScenarios: ScenarioDefinition[] = [
+  {
+    id: "sc-booking-recording",
+    name: "Booking & Recording",
+    description: "Episode scheduling, booking, post-interview workflows",
+    requiredAgents: ["agent-workspace-devops", "agent-workspace-climate"],
+    fn: run,
+  },
+];

scripts/synthetic-agents/scenarios/calcom-scenario.ts

@@ -0,0 +1,100 @@
+import type { ScenarioDefinition, AgentContext } from "../lib/scenario-runner";
+import { measureOperation, measureOperationWarn } from "../lib/scenario-runner";
+import type { ResultsReporter } from "../lib/reporter";
+
+async function run(ctx: AgentContext, report: ResultsReporter, allAgents: Map<string, AgentContext>) {
+  const sId = "sc-calcom";
+  const sName = "Cal.com Scheduling";
+  const workspaceId = ctx.workspaceId;
+
+  if (!workspaceId) {
+    console.warn(`  ⚠️  Scenario '${sName}' skipped: no workspace context for agent ${ctx.agentId}`);
+    return;
+  }
+
+  // ── 1. List Cal.com event types ──
+  let eventTypes: unknown[] = [];
+  await measureOperation(
+    ctx.agentId, ctx.agentName, sId, sName,
+    `calcom.listEventTypes.${workspaceId.slice(-8)}`,
+    async () => {
+      const result = await ctx.client.integrations.listCalComEventTypes.query({ workspaceId });
+      eventTypes = Array.isArray(result) ? result : [];
+      return result;
+    },
+    report,
+  );
+  console.log(`  📋 Found ${eventTypes.length} Cal.com event types`);
+
+  // ── 2. Create a Cal.com booking ──
+  const futureStart = new Date(Date.now() + 86400000 * 7).toISOString(); // 7 days from now
+  let bookingCreated = false;
+  if (eventTypes.length > 0) {
+    const firstEvent = eventTypes[0] as { id: number };
+    await measureOperationWarn(
+      ctx.agentId, ctx.agentName, sId, sName,
+      `calcom.createBooking.${workspaceId.slice(-8)}`,
+      () => ctx.client.integrations.createCalComBooking.mutate({
+        workspaceId,
+        eventTypeId: firstEvent.id,
+        start: futureStart,
+        attendee: {
+          email: "synthetic-test@micprotocol.local",
+          name: "Synthetic Test Guest",
+          timeZone: "UTC",
+        },
+        meetingUrl: undefined,
+      }),
+      report,
+    );
+    bookingCreated = true;
+    console.log(`  📅 Booking created via Cal.com event type ${firstEvent.id}`);
+  } else {
+    console.log(`  ⚠️  No Cal.com event types available — skipping createBooking`);
+  }
+
+  // ── 3. Cross-workspace isolation: try to list another workspace's event types ──
+  const otherAgent = Array.from(allAgents.values()).find(
+    (a) => a.workspaceId && a.workspaceId !== workspaceId,
+  );
+  if (otherAgent) {
+    await measureOperationWarn(
+      ctx.agentId, ctx.agentName, sId, sName,
+      `calcom.crossWorkspaceListEventTypes.${otherAgent.workspaceId.slice(-8)}`,
+      () => ctx.client.integrations.listCalComEventTypes.query({ workspaceId: otherAgent.workspaceId! }),
+      report,
+    );
+    console.log(`  🔒 Cross-workspace list attempted against ${otherAgent.workspaceId.slice(-8)}`);
+  }
+
+  // ── 4. Cross-workspace isolation: try to create a booking for another workspace ──
+  if (otherAgent && bookingCreated) {
+    await measureOperationWarn(
+      ctx.agentId, ctx.agentName, sId, sName,
+      `calcom.crossWorkspaceCreateBooking.${otherAgent.workspaceId.slice(-8)}`,
+      () => ctx.client.integrations.createCalComBooking.mutate({
+        workspaceId: otherAgent.workspaceId!,
+        eventTypeId: (eventTypes[0] as { id: number }).id,
+        start: futureStart,
+        attendee: {
+          email: "synthetic-test@micprotocol.local",
+          name: "Cross Workspace Test",
+          timeZone: "UTC",
+        },
+        meetingUrl: undefined,
+      }),
+      report,
+    );
+    console.log(`  🔒 Cross-workspace createBooking attempted against ${otherAgent.workspaceId.slice(-8)}`);
+  }
+}
+
+export const calcomScenarios: ScenarioDefinition[] = [
+  {
+    id: "sc-calcom",
+    name: "Cal.com Scheduling",
+    description: "Connect Cal.com via API key, list event types, create booking, cross-workspace isolation",
+    requiredAgents: ["agent-workspace-morning", "agent-workspace-devops"],
+    fn: run,
+  },
+];

scripts/synthetic-agents/scenarios/cross-workspace.ts

@@ -0,0 +1,174 @@
+import type { ScenarioDefinition, AgentContext } from "../lib/scenario-runner";
+import { measureOperation, measureOperationWarn } from "../lib/scenario-runner";
+import type { ResultsReporter } from "../lib/reporter";
+
+async function run(
+  primaryCtx: AgentContext,
+  report: ResultsReporter,
+  allAgents?: Map<string, AgentContext>,
+) {
+  const sId = "sc-cross-workspace";
+  const sName = "Cross-Workspace Collaboration";
+
+  console.log("  🌐 Running cross-workspace collaboration tests...");
+
+  // Search across all profiles (public, no workspace needed)
+  const searchResults = await measureOperation(
+    primaryCtx.agentId, primaryCtx.agentName, sId, sName,
+    "cross.network.search.global",
+    () => primaryCtx.client.network.search.query({ query: "expert", limit: 20 }),
+    report,
+  );
+  console.log(`  🔍 Cross-workspace search: ${searchResults?.length || 0} results`);
+
+  // Track views on profiles from other workspaces
+  if (searchResults && searchResults.length > 0) {
+    for (const profile of searchResults.slice(0, 3)) {
+      await measureOperation(
+        primaryCtx.agentId, primaryCtx.agentName, sId, sName,
+        `cross.network.trackView.${profile.id.slice(-8)}`,
+        () => primaryCtx.client.network.trackView.mutate({
+          profileId: profile.id,
+          source: "search" as any,
+        }),
+        report,
+      );
+    }
+  }
+
+  // Get trending (no workspace needed)
+  await measureOperation(
+    primaryCtx.agentId, primaryCtx.agentName, sId, sName,
+    "cross.network.trending",
+    () => primaryCtx.client.network.trending.query({ limit: 20 }),
+    report,
+  );
+
+  // Each agent tries to access other workspaces' podcasts (tests workspace isolation)
+  const allPodcastIds = allAgents
+    ? [...allAgents.values()].flatMap((a) => a.podcastIds)
+    : [];
+
+  const myPodcastIds = new Set(primaryCtx.podcastIds);
+  const foreignIds = allPodcastIds.filter((id) => !myPodcastIds.has(id));
+
+  for (const pid of foreignIds) {
+    await measureOperationWarn(
+      primaryCtx.agentId, primaryCtx.agentName, sId, sName,
+      `cross.podcast.access.foreign.${pid.slice(-8)}`,
+      () => primaryCtx.client.podcast.get.query({ id: pid }),
+      report,
+    );
+  }
+
+  // Test guest list isolation
+  for (const pid of foreignIds) {
+    await measureOperationWarn(
+      primaryCtx.agentId, primaryCtx.agentName, sId, sName,
+      `cross.guest.list.foreign.${pid.slice(-8)}`,
+      () => primaryCtx.client.guest.list.query({ podcastId: pid }),
+      report,
+    );
+  }
+
+  // Test outreach isolation
+  for (const pid of foreignIds.slice(0, 2)) {
+    await measureOperationWarn(
+      primaryCtx.agentId, primaryCtx.agentName, sId, sName,
+      `cross.outreach.stats.foreign.${pid.slice(-8)}`,
+      () => primaryCtx.client.outreach.stats.query({ podcastId: pid }),
+      report,
+    );
+  }
+
+  // Test scheduling isolation
+  for (const pid of foreignIds.slice(0, 2)) {
+    await measureOperationWarn(
+      primaryCtx.agentId, primaryCtx.agentName, sId, sName,
+      `cross.scheduling.upcoming.foreign.${pid.slice(-8)}`,
+      () => primaryCtx.client.scheduling.upcoming.query({ podcastId: pid, days: 30 }),
+      report,
+    );
+  }
+
+  // Verify that booking requests from one workspace are visible to the correct workspace
+  if (searchResults && searchResults.length > 0) {
+    const profile = searchResults[0];
+
+    // Bookmark from primary workspace
+    await measureOperationWarn(
+      primaryCtx.agentId, primaryCtx.agentName, sId, sName,
+      "cross.network.bookmark.cross",
+      () => primaryCtx.client.network.bookmark.mutate({
+        profileId: profile.id,
+        podcastId: primaryCtx.podcastIds[0],
+        status: "saved" as any,
+        notes: "Cross-workspace bookmark test",
+      }),
+      report,
+    );
+
+    // List bookmarks for own workspace
+    await measureOperation(
+      primaryCtx.agentId, primaryCtx.agentName, sId, sName,
+      "cross.network.listBookmarks",
+      () => primaryCtx.client.network.listBookmarks.query({
+        podcastId: primaryCtx.podcastIds[0],
+      }),
+      report,
+    );
+
+    // Create booking request to a profile
+    await measureOperationWarn(
+      primaryCtx.agentId, primaryCtx.agentName, sId, sName,
+      "cross.network.createBookingRequest",
+      () => primaryCtx.client.network.createBookingRequest.mutate({
+        toProfileId: profile.id,
+        fromPodcastId: primaryCtx.podcastIds[0],
+        message: `Cross-workspace test from ${primaryCtx.agentName}`,
+        proposedTopics: ["technology", "collaboration"],
+        proposedDates: [new Date(Date.now() + 14 * 86400000).toISOString()],
+      }),
+      report,
+    );
+  }
+
+  // Now test from EVERY agent's perspective for comprehensive isolation checking
+  if (allAgents) {
+    for (const [agentId, agentCtx] of allAgents) {
+      if (agentId === primaryCtx.agentId) continue;
+
+      console.log(`    Testing isolation from ${agentCtx.agentName}...`);
+
+      // Each agent tries accessing every other agent's podcasts
+      for (const pid of allPodcastIds) {
+        if (!agentCtx.podcastIds.includes(pid)) {
+          await measureOperationWarn(
+            agentId, agentCtx.agentName, sId, sName,
+            `iso.podcast.get.${pid.slice(-8)}.from.${agentId.slice(-8)}`,
+            () => agentCtx.client.podcast.get.query({ id: pid }),
+            report,
+          );
+        }
+      }
+    }
+  }
+
+  console.log("  ✅ Cross-workspace tests completed");
+}
+
+export const crossWorkspaceScenarios: ScenarioDefinition[] = [
+  {
+    id: "sc-cross-workspace",
+    name: "Cross-Workspace Collaboration",
+    description: "Network operations between different workspace agents",
+    requiredAgents: [
+      "agent-workspace-morning",
+      "agent-workspace-devops",
+      "agent-workspace-creator",
+      "agent-workspace-climate",
+      "agent-workspace-security",
+    ],
+    fn: run,
+  },
+];

scripts/synthetic-agents/scenarios/document-scenario.ts

@@ -0,0 +1,138 @@
+import type { ScenarioDefinition, AgentContext } from "../lib/scenario-runner";
+import { measureOperation, measureOperationWarn } from "../lib/scenario-runner";
+import type { ResultsReporter } from "../lib/reporter";
+
+async function run(ctx: AgentContext, report: ResultsReporter, allAgents: Map<string, AgentContext>) {
+  const sId = "sc-documents";
+  const sName = "Document Management";
+  const workspaceId = ctx.workspaceId;
+
+  if (!workspaceId) {
+    console.warn(`  ⚠️  Scenario '${sName}' skipped: no workspace context for agent ${ctx.agentId}`);
+    return;
+  }
+
+  // ── 1. List documents ──
+  let documents: unknown[] = [];
+  await measureOperation(
+    ctx.agentId, ctx.agentName, sId, sName,
+    `documents.list.${workspaceId.slice(-8)}`,
+    async () => {
+      const result = await ctx.client.documents.list.query({ workspaceId, page: 1, limit: 25 });
+      documents = Array.isArray(result?.documents) ? result.documents : [];
+      return result;
+    },
+    report,
+  );
+  console.log(`  📄 Found ${documents.length} documents`);
+
+  // ── 2. Upload a document ──
+  let uploadedDocId: string | null = null;
+  await measureOperationWarn(
+    ctx.agentId, ctx.agentName, sId, sName,
+    `documents.upload.${workspaceId.slice(-8)}`,
+    async () => {
+      const sha256 = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855";
+      const result = await ctx.client.documents.upload.mutate({
+        workspaceId,
+        title: "Synthetic Test Document",
+        description: "Uploaded by synthetic agent scenario",
+        mimeType: "application/pdf",
+        sizeBytes: 1024,
+        storageKey: "synthetic-test-doc-001",
+        sha256,
+      });
+      uploadedDocId = (result as any)?.id ?? null;
+      return result;
+    },
+    report,
+  );
+  if (uploadedDocId) {
+    console.log(`  📤 Document uploaded: ${uploadedDocId.slice(-8)}`);
+  } else {
+    console.log(`  ⚠️  Document upload skipped (feature may be gated)`);
+  }
+
+  // ── 3. Get document details ──
+  if (uploadedDocId) {
+    await measureOperationWarn(
+      ctx.agentId, ctx.agentName, sId, sName,
+      `documents.get.${uploadedDocId.slice(-8)}`,
+      () => ctx.client.documents.get.query({ id: uploadedDocId }),
+      report,
+    );
+  }
+
+  // ── 4. Create share link ──
+  if (uploadedDocId) {
+    await measureOperationWarn(
+      ctx.agentId, ctx.agentName, sId, sName,
+      `documents.createShare.${uploadedDocId.slice(-8)}`,
+      async () => {
+        const result = await ctx.client.documents.createShare.mutate({
+          documentId: uploadedDocId,
+          shareType: "public",
+          expiresAt: new Date(Date.now() + 86400000 * 7).toISOString(),
+          maxDownloads: 10,
+        });
+        return result;
+      },
+      report,
+    );
+    console.log(`  🔗 Share link created for document ${uploadedDocId.slice(-8)}`);
+  }
+
+  // ── 5. Verify document integrity ──
+  if (uploadedDocId) {
+    await measureOperationWarn(
+      ctx.agentId, ctx.agentName, sId, sName,
+      `documents.verifyIntegrity.${uploadedDocId.slice(-8)}`,
+      () => ctx.client.documents.verifyIntegrity.query({ documentId: uploadedDocId }),
+      report,
+    );
+  }
+
+  // ── 6. Access logs ──
+  if (uploadedDocId) {
+    await measureOperationWarn(
+      ctx.agentId, ctx.agentName, sId, sName,
+      `documents.accessLogs.${uploadedDocId.slice(-8)}`,
+      () => ctx.client.documents.accessLogs.query({ documentId: uploadedDocId, page: 1, limit: 20 }),
+      report,
+    );
+  }
+
+  // ── 7. Cross-workspace isolation: try to list another workspace's documents ──
+  const otherAgent = Array.from(allAgents.values()).find(
+    (a) => a.workspaceId && a.workspaceId !== workspaceId,
+  );
+  if (otherAgent) {
+    await measureOperationWarn(
+      ctx.agentId, ctx.agentName, sId, sName,
+      `documents.crossWorkspaceList.${otherAgent.workspaceId.slice(-8)}`,
+      () => ctx.client.documents.list.query({ workspaceId: otherAgent.workspaceId!, page: 1, limit: 25 }),
+      report,
+    );
+    console.log(`  🔒 Cross-workspace document list attempted against ${otherAgent.workspaceId.slice(-8)}`);
+  }
+
+  // ── 8. Cleanup: delete uploaded document ──
+  if (uploadedDocId) {
+    await measureOperationWarn(
+      ctx.agentId, ctx.agentName, sId, sName,
+      `documents.delete.${uploadedDocId.slice(-8)}`,
+      () => ctx.client.documents.delete.mutate({ id: uploadedDocId }),
+      report,
+    );
+  }
+}
+
+export const documentScenarios: ScenarioDefinition[] = [
+  {
+    id: "sc-documents",
+    name: "Document Management",
+    description: "Upload document, create share, verify integrity, access logs, cross-workspace isolation",
+    requiredAgents: ["agent-workspace-morning"],
+    fn: run,
+  },
+];

scripts/synthetic-agents/scenarios/guest-pipeline.ts

@@ -0,0 +1,110 @@
+import type { ScenarioDefinition, AgentContext } from "../lib/scenario-runner";
+import { measureOperation, measureOperationWarn } from "../lib/scenario-runner";
+import type { ResultsReporter } from "../lib/reporter";
+
+async function run(ctx: AgentContext, report: ResultsReporter) {
+  const sId = "sc-guest-pipeline";
+  const sName = "Guest Pipeline";
+
+  for (const podcastId of ctx.podcastIds) {
+    // List guests with various status filters
+    const allGuests = await measureOperation(
+      ctx.agentId, ctx.agentName, sId, sName,
+      `guest.list.${podcastId.slice(-8)}`,
+      () => ctx.client.guest.list.query({ podcastId }),
+      report,
+    );
+    console.log(`  👥 ${allGuests.length} guests in podcast ${podcastId.slice(-8)}`);
+
+    // Get status counts
+    await measureOperation(
+      ctx.agentId, ctx.agentName, sId, sName,
+      `guest.statusCounts.${podcastId.slice(-8)}`,
+      () => ctx.client.guest.statusCounts.query({ podcastId }),
+      report,
+    );
+
+    // Get priority guests
+    await measureOperation(
+      ctx.agentId, ctx.agentName, sId, sName,
+      `guest.topPriority.${podcastId.slice(-8)}`,
+      () => ctx.client.guest.topPriority.query({ podcastId, limit: 5 }),
+      report,
+    );
+
+    // Check for guests needing follow-up
+    await measureOperation(
+      ctx.agentId, ctx.agentName, sId, sName,
+      `guest.needsFollowUp.${podcastId.slice(-8)}`,
+      () => ctx.client.guest.needsFollowUp.query({ podcastId, days: 14 }),
+      report,
+    );
+
+    // List tags
+    await measureOperation(
+      ctx.agentId, ctx.agentName, sId, sName,
+      `guest.listTags.${podcastId.slice(-8)}`,
+      () => ctx.client.guest.listTags.query({ podcastId }),
+      report,
+    );
+
+    // Update each guest's status through the pipeline
+    if (allGuests.length > 0) {
+      for (const guest of allGuests.slice(0, 3)) {
+        const nextStatus = getNextStatus(guest.status);
+        if (nextStatus) {
+          await measureOperationWarn(
+            ctx.agentId, ctx.agentName, sId, sName,
+            `guest.updateStatus.${guest.id.slice(-8)}.to.${nextStatus}`,
+            () => ctx.client.guest.updateStatus.mutate({
+              podcastId,
+              id: guest.id,
+              status: nextStatus as any,
+            }),
+            report,
+          );
+        }
+
+        // Get individual guest
+        await measureOperation(
+          ctx.agentId, ctx.agentName, sId, sName,
+          `guest.get.${guest.id.slice(-8)}`,
+          () => ctx.client.guest.get.query({ podcastId, id: guest.id }),
+          report,
+        );
+      }
+    }
+
+    // Create a new guest
+    const newGuestId = `guest-${Date.now()}`;
+    await measureOperationWarn(
+      ctx.agentId, ctx.agentName, sId, sName,
+      "guest.create.new",
+      () => ctx.client.guest.create.mutate({
+        podcastId,
+        data: {
+          email: `test-${Date.now()}@micprotocol.local`,
+          fullName: `Test Guest ${Date.now()}`,
+        },
+      }),
+      report,
+    );
+  }
+}
+
+function getNextStatus(current: string): string | null {
+  const flow = ["prospect", "contacted", "scheduled", "recorded"];
+  const idx = flow.indexOf(current);
+  if (idx >= 0 && idx < flow.length - 1) return flow[idx + 1];
+  return null;
+}
+
+export const guestPipelineScenarios: ScenarioDefinition[] = [
+  {
+    id: "sc-guest-pipeline",
+    name: "Guest Pipeline Management",
+    description: "Guest CRUD, status transitions, tagging, priority scoring",
+    requiredAgents: ["agent-workspace-security", "agent-workspace-morning"],
+    fn: run,
+  },
+];

scripts/synthetic-agents/scenarios/index.ts

@@ -0,0 +1,30 @@
+import type { ScenarioDefinition } from "../lib/scenario-runner";
+import { workspaceLifecycleScenarios } from "./workspace-lifecycle";
+import { podcastOperationsScenarios } from "./podcast-operations";
+import { guestPipelineScenarios } from "./guest-pipeline";
+import { outreachScenarios } from "./outreach-sequences";
+import { bookingRecordingScenarios } from "./booking-recording";
+import { verifiedNetworkScenarios } from "./verified-network";
+import { adminScenarios } from "./admin-operations";
+import { serviceAdministrationScenarios } from "./service-administration";
+import { crossWorkspaceScenarios } from "./cross-workspace";
+import { supportScenarios } from "./support-scenario";
+import { calcomScenarios } from "./calcom-scenario";
+import { documentScenarios } from "./document-scenario";
+import { securityPolicyScenarios } from "./security-policy-scenario";
+
+export const allScenarios: ScenarioDefinition[] = [
+  ...workspaceLifecycleScenarios,
+  ...podcastOperationsScenarios,
+  ...guestPipelineScenarios,
+  ...outreachScenarios,
+  ...bookingRecordingScenarios,
+  ...verifiedNetworkScenarios,
+  ...adminScenarios,
+  ...serviceAdministrationScenarios,
+  ...crossWorkspaceScenarios,
+  ...supportScenarios,
+  ...calcomScenarios,
+  ...documentScenarios,
+  ...securityPolicyScenarios,
+];

scripts/synthetic-agents/scenarios/outreach-sequences.ts

@@ -0,0 +1,79 @@
+import type { ScenarioDefinition, AgentContext } from "../lib/scenario-runner";
+import { measureOperation, measureOperationWarn } from "../lib/scenario-runner";
+import type { ResultsReporter } from "../lib/reporter";
+
+async function run(ctx: AgentContext, report: ResultsReporter) {
+  const sId = "sc-outreach-sequences";
+  const sName = "Outreach Sequences";
+
+  for (const podcastId of ctx.podcastIds) {
+    // Get available templates
+    const templates = await measureOperation(
+      ctx.agentId, ctx.agentName, sId, sName,
+      `outreach.getAvailableTemplates.${podcastId.slice(-8)}`,
+      () => ctx.client.outreach.getAvailableTemplates.query(),
+      report,
+    );
+    console.log(`  📝 ${templates.length} outreach templates available`);
+
+    // List outreach sequences for podcast
+    const sequences = await measureOperation(
+      ctx.agentId, ctx.agentName, sId, sName,
+      `outreach.listByPodcast.${podcastId.slice(-8)}`,
+      () => ctx.client.outreach.listByPodcast.query({ podcastId, page: 1, limit: 20 }),
+      report,
+    );
+    console.log(`  📬 ${sequences.items?.length || 0} outreach sequences`);
+
+    // Get outreach stats
+    await measureOperation(
+      ctx.agentId, ctx.agentName, sId, sName,
+      `outreach.stats.${podcastId.slice(-8)}`,
+      () => ctx.client.outreach.stats.query({ podcastId }),
+      report,
+    );
+
+    // Create a sequence for a guest if guests exist
+    const guests = await ctx.client.guest.list.query({ podcastId }).catch(() => null);
+    if (guests && guests.length > 0) {
+      const guest = guests[0];
+
+      // Try to create sequence (may fail if not Creator plan)
+      await measureOperationWarn(
+        ctx.agentId, ctx.agentName, sId, sName,
+        `outreach.createSequence.${guest.id.slice(-8)}`,
+        () => ctx.client.outreach.createSequence.mutate({
+          guestId: guest.id,
+          podcastId,
+          status: "active" as any,
+        }),
+        report,
+      );
+    }
+
+    // Track a message open (even without creating one, tests the endpoint)
+    await measureOperationWarn(
+      ctx.agentId, ctx.agentName, sId, sName,
+      "outreach.trackOpen.fake",
+      () => ctx.client.outreach.trackOpen.mutate({ messageId: "00000000-0000-4000-a000-000000000000" }),
+      report,
+    );
+
+    await measureOperationWarn(
+      ctx.agentId, ctx.agentName, sId, sName,
+      "outreach.trackClick.fake",
+      () => ctx.client.outreach.trackClick.mutate({ messageId: "00000000-0000-4000-a000-000000000000" }),
+      report,
+    );
+  }
+}
+
+export const outreachScenarios: ScenarioDefinition[] = [
+  {
+    id: "sc-outreach-sequences",
+    name: "Outreach Sequences",
+    description: "Create sequences, messages, track opens/clicks",
+    requiredAgents: ["agent-workspace-morning", "agent-workspace-creator"],
+    fn: run,
+  },
+];

scripts/synthetic-agents/scenarios/podcast-operations.ts

@@ -0,0 +1,58 @@
+import type { ScenarioDefinition, AgentContext } from "../lib/scenario-runner";
+import { measureOperation, measureOperationWarn } from "../lib/scenario-runner";
+import type { ResultsReporter } from "../lib/reporter";
+
+async function run(ctx: AgentContext, report: ResultsReporter) {
+  const sId = "sc-podcast-operations";
+  const sName = "Podcast Operations";
+
+  for (const podcastId of ctx.podcastIds) {
+    // Get podcast details
+    const podcast = await measureOperation(
+      ctx.agentId, ctx.agentName, sId, sName,
+      `podcast.get.${podcastId.slice(-8)}`,
+      () => ctx.client.podcast.get.query({ id: podcastId }),
+      report,
+    );
+
+    console.log(`  🎙️  Podcast: ${podcast.title}`);
+
+    // Get podcast stats
+    await measureOperation(
+      ctx.agentId, ctx.agentName, sId, sName,
+      `podcast.stats.${podcastId.slice(-8)}`,
+      () => ctx.client.podcast.stats.query({ id: podcastId }),
+      report,
+    );
+
+    // Update podcast
+    await measureOperation(
+      ctx.agentId, ctx.agentName, sId, sName,
+      `podcast.update.${podcastId.slice(-8)}`,
+      () => ctx.client.podcast.update.mutate({
+        id: podcastId,
+        data: { recordingSettings: { defaultPlatform: "zoom", preferredDurationMinutes: 45 } },
+      }),
+      report,
+    );
+  }
+
+  // Try access to another workspace's podcast (should be forbidden)
+  const foreignPodcastId = "33333333-0000-4000-a000-000000000031";
+  await measureOperationWarn(
+    ctx.agentId, ctx.agentName, sId, sName,
+    "podcast.get.foreign.workspace",
+    () => ctx.client.podcast.get.query({ id: foreignPodcastId }),
+    report,
+  );
+}
+
+export const podcastOperationsScenarios: ScenarioDefinition[] = [
+  {
+    id: "sc-podcast-operations",
+    name: "Podcast Operations",
+    description: "CRUD on podcasts, stats, recording settings",
+    requiredAgents: ["agent-workspace-creator", "agent-workspace-climate"],
+    fn: run,
+  },
+];

scripts/synthetic-agents/scenarios/security-policy-scenario.ts

@@ -0,0 +1,87 @@
+import type { ScenarioDefinition, AgentContext } from "../lib/scenario-runner";
+import { measureOperationWarn } from "../lib/scenario-runner";
+import type { ResultsReporter } from "../lib/reporter";
+
+async function run(ctx: AgentContext, report: ResultsReporter, allAgents: Map<string, AgentContext>) {
+  const sId = "sc-security-policy";
+  const sName = "Security Policy";
+
+  // ── 1. Screen an email domain against blocklist ──
+  await measureOperationWarn(
+    ctx.agentId, ctx.agentName, sId, sName,
+    `securityPolicy.screenEmail`,
+    () => ctx.client.securityPolicy.screenEmail.query({ email: "user@sanctioned-domain.com" }),
+    report,
+  );
+
+  // ── 2. Screen an IP against blocklist ──
+  await measureOperationWarn(
+    ctx.agentId, ctx.agentName, sId, sName,
+    `securityPolicy.screenIp`,
+    () => ctx.client.securityPolicy.screenIp.query({ ip: "10.0.0.99" }),
+    report,
+  );
+
+  // ── 3. Screen a workspace slug ──
+  await measureOperationWarn(
+    ctx.agentId, ctx.agentName, sId, sName,
+    `securityPolicy.screenWorkspaceSlug`,
+    () => ctx.client.securityPolicy.screenWorkspaceSlug.query({ slug: "sanctioned-workspace" }),
+    report,
+  );
+
+  // ── 4. Add to blocklist ──
+  let blocklistEntryId: string | null = null;
+  await measureOperationWarn(
+    ctx.agentId, ctx.agentName, sId, sName,
+    `securityPolicy.addToBlocklist`,
+    async () => {
+      const result = await ctx.client.securityPolicy.addToBlocklist.mutate({
+        type: "EMAIL_DOMAIN",
+        value: "synthetic-sanctioned.com",
+        reason: "Synthetic agent test - sanctioned domain screening",
+      });
+      blocklistEntryId = (result as any)?.id ?? null;
+      return result;
+    },
+    report,
+  );
+
+  // ── 5. List blocklist ──
+  await measureOperationWarn(
+    ctx.agentId, ctx.agentName, sId, sName,
+    `securityPolicy.listBlocklist`,
+    () => ctx.client.securityPolicy.listBlocklist.query({ activeOnly: true }),
+    report,
+  );
+
+  // ── 6. Review queue ──
+  await measureOperationWarn(
+    ctx.agentId, ctx.agentName, sId, sName,
+    `securityPolicy.reviewQueue`,
+    () => ctx.client.securityPolicy.reviewQueue.query({ page: 1, limit: 20 }),
+    report,
+  );
+
+  // ── 7. Remove from blocklist (cleanup) ──
+  if (blocklistEntryId) {
+    await measureOperationWarn(
+      ctx.agentId, ctx.agentName, sId, sName,
+      `securityPolicy.removeFromBlocklist`,
+      () => ctx.client.securityPolicy.removeFromBlocklist.mutate({ id: blocklistEntryId }),
+      report,
+    );
+  }
+
+  console.log(`  🛡️  Security policy screening and blocklist operations complete`);
+}
+
+export const securityPolicyScenarios: ScenarioDefinition[] = [
+  {
+    id: "sc-security-policy",
+    name: "Security Policy",
+    description: "Sanction screening, blocklist management, flag/revoke workflows",
+    requiredAgents: ["agent-admin-01"],
+    fn: run,
+  },
+];

scripts/synthetic-agents/scenarios/service-administration.ts

@@ -0,0 +1,102 @@
+import type { ScenarioDefinition, AgentContext } from "../lib/scenario-runner";
+import { measureOperation } from "../lib/scenario-runner";
+import type { ResultsReporter } from "../lib/reporter";
+import { createAgentClient } from "../lib/trpc-client";
+
+async function run(ctx: AgentContext, report: ResultsReporter, allAgents: Map<string, AgentContext>) {
+  const sId = "sc-service-administration";
+  const sName = "Service Administration";
+  console.log("  🛠️  Running service administration (clip-scorer + mic-realtime)...");
+
+  // ── Platform-level service admin reads (admin agent only) ──────────────
+  await measureOperation(ctx.agentId, ctx.agentName, sId, sName, "admin.clipScorer.locks",
+    () => ctx.client.admin.clipScorer.locks.query(), report);
+  await measureOperation(ctx.agentId, ctx.agentName, sId, sName, "admin.clipScorer.scratch",
+    () => ctx.client.admin.clipScorer.scratch.query(), report);
+  await measureOperation(ctx.agentId, ctx.agentName, sId, sName, "admin.realtime.stats",
+    () => ctx.client.admin.realtime.stats.query(), report);
+  await measureOperation(ctx.agentId, ctx.agentName, sId, sName, "admin.realtime.metrics",
+    () => ctx.client.admin.realtime.metrics.query(), report);
+  await measureOperation(ctx.agentId, ctx.agentName, sId, sName, "admin.realtime.traces",
+    () => ctx.client.admin.realtime.traces.query({ limit: 20 }), report);
+
+  // ── Privilege escalation check: a non-admin workspace owner must be FORBIDDEN ─────
+  const workspaceAgent = allAgents.get("agent-workspace-morning");
+  if (workspaceAgent) {
+    const wsClient = createAgentClient({
+      baseUrl: "http://localhost:4000/trpc",
+      userId: workspaceAgent.userId,
+      credential: workspaceAgent.credential,
+      devMode: true,
+    });
+    await expectForbidden(report, sId, sName, workspaceAgent.agentId, workspaceAgent.agentName,
+      "admin.clipScorer.locks (non-admin)", () => wsClient.admin.clipScorer.locks.query());
+    await expectForbidden(report, sId, sName, workspaceAgent.agentId, workspaceAgent.agentName,
+      "admin.realtime.stats (non-admin)", () => wsClient.admin.realtime.stats.query());
+    await expectForbidden(report, sId, sName, workspaceAgent.agentId, workspaceAgent.agentName,
+      "admin.realtime.traces (non-admin)", () => wsClient.admin.realtime.traces.query({ limit: 5 }));
+  }
+
+  console.log("  ✅ Service administration completed");
+}
+
+/** Records pass only when the call is correctly rejected with FORBIDDEN/403.
+ *  A success here signals a privilege-escalation weakness and is recorded as fail. */
+async function expectForbidden(
+  report: ResultsReporter,
+  sId: string,
+  sName: string,
+  agentId: string,
+  agentName: string,
+  operation: string,
+  fn: () => Promise<unknown>,
+): Promise<void> {
+  const start = Date.now();
+  try {
+    await fn();
+    report.record({
+      scenarioId: sId,
+      scenarioName: sName,
+      agentId,
+      agentName,
+      operation,
+      status: "fail",
+      durationMs: Date.now() - start,
+      error: "Expected FORBIDDEN but request succeeded (potential privilege escalation)",
+    });
+  } catch (err) {
+    const msg = (err as Error).message;
+    if (msg.includes("FORBIDDEN") || msg.includes("403")) {
+      report.record({
+        scenarioId: sId,
+        scenarioName: sName,
+        agentId,
+        agentName,
+        operation,
+        status: "pass",
+        durationMs: Date.now() - start,
+      });
+    } else {
+      report.record({
+        scenarioId: sId,
+        scenarioName: sName,
+        agentId,
+        agentName,
+        operation,
+        status: "fail",
+        durationMs: Date.now() - start,
+        error: msg,
+      });
+    }
+  }
+}
+
+export const serviceAdministrationScenarios: ScenarioDefinition[] = [
+  {
+    id: "sc-service-administration",
+    name: "Service Administration",
+    description: "Clip-scorer lock/scratch and mic-realtime stats/traces access, admin-only",
+    requiredAgents: ["agent-admin-01"],
+    fn: run,
+  },
+];

scripts/synthetic-agents/scenarios/support-scenario.ts

@@ -0,0 +1,152 @@
+import type { ScenarioDefinition, AgentContext } from "../lib/scenario-runner";
+import { measureOperation, measureOperationWarn } from "../lib/scenario-runner";
+import type { ResultsReporter } from "../lib/reporter";
+
+async function run(ctx: AgentContext, report: ResultsReporter, allAgents: Map<string, AgentContext>) {
+  const sId = "sc-support";
+  const sName = "Customer Support";
+  const workspaceId = ctx.workspaceId;
+
+  if (!workspaceId) {
+    console.warn(`  ⚠️  Scenario '${sName}' skipped: no workspace context for agent ${ctx.agentId}`);
+    return;
+  }
+
+  // ── 1. List tickets (no filters) ──
+  await measureOperation(
+    ctx.agentId, ctx.agentName, sId, sName,
+    `support.listTickets.${workspaceId.slice(-8)}`,
+    () => ctx.client.support.list.query({ workspaceId }),
+    report,
+  );
+
+  // ── 2. List tickets with status filter ──
+  await measureOperation(
+    ctx.agentId, ctx.agentName, sId, sName,
+    `support.listTickets.open.${workspaceId.slice(-8)}`,
+    () => ctx.client.support.list.query({ workspaceId, filter: { status: "open", page: 1, limit: 25 } }),
+    report,
+  );
+
+  // ── 3. Create a support ticket ──
+  let ticketId: string | null = null;
+  const createResult = await measureOperationWarn(
+    ctx.agentId, ctx.agentName, sId, sName,
+    `support.createTicket.${workspaceId.slice(-8)}`,
+    () => ctx.client.support.create.mutate({
+      subject: "Test ticket from synthetic agent",
+      description: "This is a test ticket created by the synthetic support scenario.",
+      category: "technical",
+      priority: "high",
+    }),
+    report,
+  );
+
+  if (createResult && typeof createResult === "object" && (createResult as any).id) {
+    ticketId = (createResult as any).id;
+    console.log(`  🎫 Created ticket ${ticketId.slice(-8)}`);
+  }
+
+  // ── 4. Get ticket details ──
+  if (ticketId) {
+    await measureOperation(
+      ctx.agentId, ctx.agentName, sId, sName,
+      `support.getTicket.${ticketId.slice(-8)}`,
+      () => ctx.client.support.get.query({ ticketId }),
+      report,
+    );
+
+    // ── 5. Get ticket with messages ──
+    await measureOperation(
+      ctx.agentId, ctx.agentName, sId, sName,
+      `support.getTicketWithMessages.${ticketId.slice(-8)}`,
+      () => ctx.client.support.getWithMessages.query({ ticketId }),
+      report,
+    );
+
+    // ── 6. Create a message on the ticket ──
+    await measureOperation(
+      ctx.agentId, ctx.agentName, sId, sName,
+      `support.createMessage.${ticketId.slice(-8)}`,
+      () => ctx.client.support.createMessage.mutate({
+        ticketId,
+        body: "This is a test message from the synthetic support scenario.",
+        messageType: "inbound",
+      }),
+      report,
+    );
+
+    // ── 7. Update ticket status ──
+    await measureOperationWarn(
+      ctx.agentId, ctx.agentName, sId, sName,
+      `support.updateTicket.${ticketId.slice(-8)}`,
+      () => ctx.client.support.update.mutate({
+        ticketId,
+        status: "pending",
+      }),
+      report,
+    );
+  }
+
+  // ── 8. List categories (admin operation) ──
+  await measureOperationWarn(
+    ctx.agentId, ctx.agentName, sId, sName,
+    `support.listCategories.${workspaceId.slice(-8)}`,
+    () => ctx.client.support.adminListCategories.query({ workspaceId }),
+    report,
+  );
+
+  // ── 9. CSAT summary ──
+  await measureOperationWarn(
+    ctx.agentId, ctx.agentName, sId, sName,
+    `support.csatSummary.${workspaceId.slice(-8)}`,
+    () => ctx.client.support.csatSummary.query({}),
+    report,
+  );
+
+  // ── 10. SLA breaches ──
+  await measureOperationWarn(
+    ctx.agentId, ctx.agentName, sId, sName,
+    `support.slaBreaches.${workspaceId.slice(-8)}`,
+    () => ctx.client.support.slaBreaches.query({}),
+    report,
+  );
+
+  // ── 11. Cross-workspace isolation: try to access another workspace's ticket ──
+  // Find another agent with a workspace
+  const otherAgent = Array.from(allAgents.values()).find(
+    (a) => a.workspaceId && a.workspaceId !== workspaceId,
+  );
+  if (otherAgent && ticketId) {
+    await measureOperationWarn(
+      ctx.agentId, ctx.agentName, sId, sName,
+      `support.crossWorkspaceAccess.${ticketId.slice(-8)}`,
+      () => ctx.client.support.get.query({ ticketId, workspaceId: otherAgent.workspaceId! }),
+      report,
+    );
+  }
+
+  // ── 12. Rate satisfaction (if ticket exists) ──
+  if (ticketId) {
+    await measureOperationWarn(
+      ctx.agentId, ctx.agentName, sId, sName,
+      `support.rateSatisfaction.${ticketId.slice(-8)}`,
+      () => ctx.client.support.rateSatisfaction.mutate({
+        ticketId,
+        rating: 5,
+        comment: "Great support experience!",
+      }),
+      report,
+    );
+  }
+}
+
+export const supportScenarios: ScenarioDefinition[] = [
+  {
+    id: "sc-support",
+    name: "Customer Support",
+    description: "Ticket creation, message exchange, status changes, CSAT rating, SLA breaches, categories, cross-workspace isolation",
+    requiredAgents: ["agent-workspace-morning", "agent-workspace-security"],
+    fn: run,
+  },
+];

scripts/synthetic-agents/scenarios/verified-network.ts

@@ -0,0 +1,118 @@
+import type { ScenarioDefinition, AgentContext } from "../lib/scenario-runner";
+import { measureOperation, measureOperationWarn } from "../lib/scenario-runner";
+import type { ResultsReporter } from "../lib/reporter";
+
+async function run(ctx: AgentContext, report: ResultsReporter) {
+  const sId = "sc-verified-network";
+  const sName = "Verified Guest Network";
+
+  // Search for guest profiles
+  const searchResults = await measureOperation(
+    ctx.agentId, ctx.agentName, sId, sName,
+    "network.search",
+    () => ctx.client.network.search.query({
+      query: "security cloud",
+      limit: 10,
+    }),
+    report,
+  );
+  console.log(`  🔍 Search returned ${searchResults?.length || 0} results`);
+
+  // Get trending profiles
+  const trending = await measureOperation(
+    ctx.agentId, ctx.agentName, sId, sName,
+    "network.trending",
+    () => ctx.client.network.trending.query({ limit: 5 }),
+    report,
+  );
+  console.log(`  🔥 ${trending?.length || 0} trending profiles`);
+
+  // Get my profile
+  const myProfile = await measureOperationWarn(
+    ctx.agentId, ctx.agentName, sId, sName,
+    "network.getMyProfile",
+    () => ctx.client.network.getMyProfile.query(),
+    report,
+  );
+
+  // Get profile by vanity URL (if search returned results)
+  if (searchResults && searchResults.length > 0) {
+    const profile = searchResults[0];
+    await measureOperation(
+      ctx.agentId, ctx.agentName, sId, sName,
+      "network.getProfileById",
+      () => ctx.client.network.getProfileById.query({ id: profile.id }),
+      report,
+    );
+
+    // Track a profile view
+    await measureOperation(
+      ctx.agentId, ctx.agentName, sId, sName,
+      "network.trackView",
+      () => ctx.client.network.trackView.mutate({
+        profileId: profile.id,
+        source: "search" as any,
+      }),
+      report,
+    );
+
+    // Create a bookmark
+    const bookmark = await measureOperationWarn(
+      ctx.agentId, ctx.agentName, sId, sName,
+      "network.bookmark",
+      () => ctx.client.network.bookmark.mutate({
+        guestProfileId: profile.id,
+        podcastId: ctx.podcastIds[0],
+        notes: `Bookmarked via ${ctx.agentName} synthetic agent`,
+      }),
+      report,
+    );
+
+    // List bookmarks
+    await measureOperation(
+      ctx.agentId, ctx.agentName, sId, sName,
+      "network.listBookmarks",
+      () => ctx.client.network.listBookmarks.query({
+        podcastId: ctx.podcastIds[0],
+      }),
+      report,
+    );
+
+    // Send a booking request
+    const bookingRequest = await measureOperationWarn(
+      ctx.agentId, ctx.agentName, sId, sName,
+      "network.createBookingRequest",
+      () => ctx.client.network.createBookingRequest.mutate({
+        toProfileId: profile.id,
+        fromPodcastId: ctx.podcastIds[0],
+        message: `Synthetic test: would love to feature you!`,
+        proposedTopics: ["technology", "innovation"],
+        proposedDates: [new Date(Date.now() + 30 * 86400000).toISOString()],
+      }),
+      report,
+    );
+
+    // Respond to booking request (accept)
+    if (bookingRequest) {
+      await measureOperationWarn(
+        ctx.agentId, ctx.agentName, sId, sName,
+        "network.respondToBookingRequest",
+        () => ctx.client.network.respondToBookingRequest.mutate({
+          requestId: bookingRequest.id,
+          status: "accepted" as any,
+        }),
+        report,
+      );
+    }
+  }
+}
+
+export const verifiedNetworkScenarios: ScenarioDefinition[] = [
+  {
+    id: "sc-verified-network",
+    name: "Verified Guest Network",
+    description: "Profile search, bookmarks, booking requests, reviews",
+    requiredAgents: ["agent-workspace-security", "agent-workspace-creator"],
+    fn: run,
+  },
+];

scripts/synthetic-agents/scenarios/workspace-lifecycle.ts

@@ -0,0 +1,77 @@
+import type { ScenarioDefinition, AgentContext } from "../lib/scenario-runner";
+import { measureOperation } from "../lib/scenario-runner";
+import type { ResultsReporter } from "../lib/reporter";
+
+async function run(ctx: AgentContext, report: ResultsReporter) {
+  const sId = "sc-workspace-lifecycle";
+  const sName = "Workspace Lifecycle";
+
+  // List workspaces
+  const workspaces = await measureOperation(
+    ctx.agentId, ctx.agentName, sId, sName,
+    "workspace.list",
+    () => ctx.client.workspace.list.query(),
+    report,
+  );
+  console.log(`  📋 Found ${workspaces.length} workspace(s)`);
+
+  if (workspaces.length > 0) {
+    const ws = workspaces[0];
+
+    // Get workspace details
+    const wsDetail = await measureOperation(
+      ctx.agentId, ctx.agentName, sId, sName,
+      "workspace.get",
+      () => ctx.client.workspace.get.query({ id: ws.id }),
+      report,
+    );
+
+    // Update workspace
+    await measureOperation(
+      ctx.agentId, ctx.agentName, sId, sName,
+      "workspace.update",
+      () => ctx.client.workspace.update.mutate({
+        id: ws.id,
+        data: { name: `${wsDetail.name} (Agent Test)` },
+      }),
+      report,
+    );
+
+    // Restore original name
+    await measureOperation(
+      ctx.agentId, ctx.agentName, sId, sName,
+      "workspace.update.restore",
+      () => ctx.client.workspace.update.mutate({
+        id: ws.id,
+        data: { name: wsDetail.name },
+      }),
+      report,
+    );
+  }
+
+  // Try workspace operations without workspace context (should fail)
+  try {
+    await ctx.client.workspace.list.query();
+  } catch (e) {
+    report.record({
+      scenarioId: sId,
+      scenarioName: sName,
+      agentId: ctx.agentId,
+      agentName: ctx.agentName,
+      operation: "workspace.list.without.workspace",
+      status: "warn",
+      durationMs: 0,
+      error: (e as Error).message,
+    });
+  }
+}
+
+export const workspaceLifecycleScenarios: ScenarioDefinition[] = [
+  {
+    id: "sc-workspace-lifecycle",
+    name: "Workspace Lifecycle",
+    description: "CRUD operations on workspaces",
+    requiredAgents: ["agent-workspace-morning", "agent-workspace-devops"],
+    fn: run,
+  },
+];

scripts/synthetic-agents/test-report.txt

@@ -0,0 +1,10 @@
+╔═══════════════════════════════════════════════════════════════╗
+║           MicProtocol - Synthetic Agent Test Report          ║
+╚═══════════════════════════════════════════════════════════════╝
+
+Duration: 20.9s
+Total operations: 100
+Passed: 49  Failed: 0  Warnings: 51
+Pass rate: 49.0%
+
+  ✅ No weaknesses detected.

scripts/synthetic-agents/tsconfig.json

@@ -0,0 +1,13 @@
+{
+  "compilerOptions": {
+    "target": "ES2020",
+    "module": "commonjs",
+    "moduleResolution": "node10",
+    "ignoreDeprecations": "6.0",
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "resolveJsonModule": true,
+    "rootDir": "."
+  },
+  "include": ["**/*.ts"]
+}

scripts/synthetic-agents/weaknesses.json

@@ -0,0 +1 @@
+[]