Run one headless agent turn

Runs ONE assistant turn over the supplied message history and responds synchronously with the final assistant text, the operations it invoked, references to any resources it created, and any actions awaiting human approval.

The caller owns conversation state: resend the full history each turn. The model is pinned server-side (hosted catalog) and billed to the project.

Tools are TIERED. Read operations and non-spending writes execute directly. Three categories are PROPOSAL-ONLY: operations that SPEND once (running a suite or a case, generating cases, cancelling a run), operations whose spend RECURS (setting a suite's schedule), and operations whose effects MCPJam cannot describe or undo because they leave MCPJam entirely (call_server_tool, which runs a tool on the caller's own MCP server). For each, the turn validates against the operation's real schema, persists a proposal, and returns it in proposedActions for a person to approve; confirmSeverity says which hazard the approver should be warned about. MCPJam-side deletions are excluded from the surface entirely — a proposal makes spend deliberate, but it does not make a deletion recoverable. Proposals are only offered when the request supplies a conversationId; without somewhere to collect a click there is nothing to approve, so the tools are withheld rather than offered and then refused.

Every tool invocation is hard-clamped to the path projectId. Turns are capped at 4 concurrent per organization (429 RATE_LIMITED; enforced per server instance) and ~90s wall clock (504 TIMEOUT). Guest callers are denied. Requires a hosted MCPJam deployment (422 FEATURE_NOT_SUPPORTED otherwise).

When a turn fails or times out AFTER work already persisted, the error body's details.createdResources and details.proposedActions carry what survived — check them before retrying.

Retry policy: send idempotencyKey as a STABLE identity for the triggering event (not a fresh uuid per attempt). Every write the turn performs derives its own key from it, so a retried turn's mutations land on the rows the first attempt created instead of duplicating them. The key makes a retry SAFE; it does not make one free — dedupe at your own trigger so most retries never re-run the turn at all. A retry whose model authors materially different arguments hashes differently and is correctly treated as a different write.