Reconcile the release notes and the connector list with what shipped

CHANGELOG.md

@@ -8,6 +8,36 @@ Newest first. `Unreleased` is what is on `main` and not yet tagged.
 
 ## Unreleased
 
+### A deployment can broker its Bots into a few hundred apps through Composio
+
+Composio holds a person's connections to a few hundred SaaS apps behind one account. A deployment
+that sets `COMPOSIO_API_KEY` now has that broker: each person connects their own accounts, a Bot is
+granted an app's tools the way it is granted any other, and every call is decided and recorded
+through the gateway like the rest. Unset, there is nothing to connect, nothing to grant and no
+Composio tool for a Bot to call, and the Plugins page says so under **More apps** rather than
+pretending otherwise. See [docs/plugins/composio.md](docs/plugins/composio.md).
+
+### A skill's grants are removed when it is uninstalled
+
+Uninstalling a skill deleted the skill but left its tool grants, which are keyed by its slug. A new
+skill created under the same slug then inherited them, and was offered on the Bots the old skill had
+been granted to with no grant ever made for it. Uninstalling now removes a skill's grants along with
+it, in one transaction, and an upgrade drops any grants already left orphaned this way.
+
+### Malformed requests are refused instead of coerced, and a fail-open is closed
+
+A pass across the write and query surface answers a malformed request with a 400 that names the bad
+field, rather than coercing it, failing at the store, or letting it through: the plugin server and
+tool-call endpoints, the admin people search and credential input, skill tools and grant ids, blank
+route ids on routines, host-access, agents and channels, the routing text length, routine dispatch
+and page-frame params, and the runtime env, tokens and model content the computer and supervisor
+read. The app reads these responses more defensively too, degrading rather than throwing on a shape
+it did not expect.
+
+One of these closed a hole rather than tightening an edge: a skill installed with a non-string entry
+in its `tools` list had that entry silently dropped, so the skill declared nothing and installed as a
+success. It is refused now.
+
 ### Naming a conversation asks the endpoint OPENAI_BASE_URL names, not OpenAI
 
 The job that names a conversation sent its request to api.openai.com whatever `OPENAI_BASE_URL` said,

README.md

@@ -170,7 +170,7 @@ Leave `EMBEDDED_POSTGRES` off and set `DATABASE_URL` to point at a database you
 - **Secrets never enter the transcript**: the trail records that a secret was requested and how long it was, not what it said.
 - **Bring your own agent**: any AG-UI endpoint is a Bot, on a framework or hand-written. Endpoints are validated with the same target checks used for browser navigation, and an auth header is stored write-only.
 - **Components instead of prose**: compiled React components live in `app/src/components/gallery/`, sandboxed ones are authored in `/admin/playground` and published with no deployment. Every call asks the server whether the component exists, is published, and is not withheld from that Bot. Data functions are granted per component.
-- **Governed MCP**: Google Drive and Notion ship in the catalogue, reached as the person asking. The catalogue carries only vendors this deployment stands behind, so adding one is a review of that vendor. Custom servers must pass URL checks; unknown tools and custom-server tools are treated as writes, and a catalogue tool the server advertises but does not name as a write classifies as a read. A Bot is told which connectors exist here and which it holds, so it says it has not been granted one rather than browsing to the vendor's website.
+- **Governed MCP**: Google Drive and Notion ship in the catalogue, and Composio brokers a few hundred more apps behind one account, each reached as the person asking. The catalogue carries only vendors this deployment stands behind, so adding one is a review of that vendor. Custom servers must pass URL checks; unknown tools and custom-server tools are treated as writes, and a catalogue tool the server advertises but does not name as a write classifies as a read. A Bot is told which connectors exist here and which it holds, so it says it has not been granted one rather than browsing to the vendor's website.
 - **Skills are instructions, not capabilities**: personal skills attach only to Bots their author owns, deployment skills are admin-owned, and both are invoked with `/` in the composer. A Bot granted the shipped `skill-creator` skill can write one with you in the conversation, and saves it only when you press the button on the card.
 - **Sign in with what your company already has**: Google, Microsoft or Okta from the environment, or a company's own SAML or OpenID Connect provider registered while the deployment runs and routed by email domain. Any one turns sign-in on; several may be configured at once.
 - **Decide who gets in**: `/admin/people` lists everybody who has signed in, promotes and demotes them, and removes access, which ends the session they are using and stops the next sign-in. Every change is on the audit trail.