handoff — agent swarm coordination

3 of the 85 tools listed anonymously say in their own descriptions that they need an account or a key (register_agent, publish_channel, resolve_escalation), but the endpoint issued no WWW-Authenticate challenge. The requirement is stated only in prose, so a call reaches the tool and comes back as a tool error instead of an authorization step.

The server exposes a public surface before authorization: get_hierarchy, brain_status, brain_complete, brain_run_task, enable_swarm, publish_app, list_apps_grouped, get_app, list_apps, connect_github, compose_apps, publish_xmbl_app, get_mods, create_mod, grant_mod, revoke_mod, send_message, get_message, get_agent_inbox, get_conversation, delete_message, register_webhook, unregister_webhook, list_webhooks, register_agent, update_capabilities, update_permissions, update_profile, list_agents, find_agents_by_capability, get_agent, get_signin_link, agent_heartbeat, propose_contract, sign_contract, terminate_contract, list_contracts, ack_standing_orders, ack_coordination, subscribe_channel, unsubscribe_channel, publish_channel, list_channels, create_team, advise_team, set_team_roster, add_team_member, remove_team_member, respond_role, get_team, complete_team, list_teams, propose_plan, approve_plan, amend_plan, send_signal, set_project_leader, set_hierarchy, set_goal_order, set_task_order, send_order, escalate, list_escalations, social_post, social_like, social_resoc, social_follow, social_feed, social_account, resolve_escalation, list_tasks, get_nodes, add_node, set_node_parent, spin_out_node, update_task, resolve_task, reconcile_tasks, verify_task, get_docs, xmbl_status, connect_domain, verify_domain, remove_domain, list_domains.