Who is asking, what they can reach, and what they are working on — the one answer every surface reads, so the terminal and the browser cannot disagree.
Authorization: Bearer <agent-key>a session works too; a fresh account with no org still gets an answer — that is exactly the moment the app decides where to send themresponse200 — identity, reach, and the active space
PATCH with { space: <slug> } moves the active space — validated against what the caller actually reaches