Tasks, recipes, shopping, pantry
list_my_tasks, complete_task; create_todo/routine/habit/goal — assigning a todo to someone else needs an adult (owner, admin, or member). create_chore, and a goal targeting a child, need owner or admin.
bulk_complete_tasks — clears a member's open work, replay-safe; completing for anyone but yourself needs owner or admin. suggest_eta — typical duration.
search_recipes, preview_recipe_import, save_recipe; get_cookable_recipes needs recipes.read AND pantry.read.
get_pantry_staples, get_ingredient_substitutions, add_pantry_items, get_shopping_list, add_shopping_items.
Meal plan, nutrition, recovery
get_meal_plan, upsert_meal_plan_entries — a projection, not a food log.
confirm_planned_meal — the only way a planned meal counts; idempotent. log_macros — off-plan food, needs a dedupe_key.
get_macro_summary, get_macro_targets, set_macro_targets (adult only).
list_missed_work and preview_catch_up use recovery.read. preview_recurring_completions also uses exact recovery.read to expand one recurring task over a supported preset or inclusive past-only range of at most 31 household-local dates and 50 applicable scheduled occurrences; it returns exact dates/slots, already-complete and unscheduled statuses, canonical payout/equity/streak effects, totals, and a 15-minute preview_id.
apply_catch_up uses recovery.write and needs the preview_id plus an idempotency_key; exact replay returns the original batch without duplicate completion or credit. undo_catch_up uses recovery.write to reverse that batch.
The recurring member defaults to the connected member. Only owner/admin may target another eligible household member; child and non-admin member accounts are self-only. Medication records are user-attested and described as “recorded from your report,” never medically verified.
Calendar, household, garden, points, lists, wellness
list_events, create_event; list_members (name/role/age group only); create_house_rule (adult only).
get_garden_status, get_plant_care_recommendations — no serials/credentials; get_points_leaderboard — no wallet data.
get_lists, add_list_item; get_wellness_metrics (opt-in) — only the connected member's own metrics.
Financial goals and wallet earmarks
finance.read: get_finance_overview, list_finance_goals, get_finance_goal, get_money_flow, list_external_funding_requests.
finance.write: create_finance_goal, update_finance_goal, allocate_goal_funds, move_goal_funds, release_goal_funds, record_external_funding, approve_external_funding, reject_external_funding, request_goal_purchase, approve_goal_purchase, reject_goal_purchase, correct_goal_funding, cancel_finance_goal.
Every finance mutation first returns an unapplied preview with preview_id and a persisted typed projection of before/after balances, pending versus immediate effect, and affected goals. Repeat the exact arguments with that preview_id to apply; changing arguments fails closed, and a stable idempotency key makes exact replay return the original result.
External funding supports gift, parent_contribution, allowance, refund, and other. A child external-funding request stays pending and changes neither wallet nor goal; owner/admin external funding immediately credits the wallet and optional goal. A child purchase request stays pending with no balance effect; an owner/admin purchase request immediately debits wallet total and the matching earmark and completes the goal. Approval/rejection tools resolve pending child requests; owners/admins can reject purchases with an audit reason and append compensating funding corrections without changing wallet total. A funded goal keeps its earmark until a purchase applies or cancellation releases it.
Mutation and permission boundaries
Biggest mutations: finance actions, apply_catch_up/undo_catch_up, bulk_complete_tasks, set_macro_targets, and upsert_meal_plan_entries. Child and non-admin member permissions remain narrower than owner/admin permissions. No delete, member-admin, credential, bank-connection, or generic HTTP tools exist.