consumer,credential_arm,auth_transport,read_targets,write_targets,delete_targets,admin_surface_needed,pg_direct,notes incomex-nuxt,static token,Directus REST Bearer (service client),"workflows; collections behind /api/registry/*, /api/discovery/relations, /api/transitive/[code]",workflows (updateWorkflowRecord),none,NONE,no,"single token arm (all fallbacks UNSET: DIRECTUS_ADMIN_TOKEN/DIRECTUS_SERVER_TOKEN/DIRECTUS_TOKEN); SSR anonymous client is separate (.with(rest()) no token)" incomex-agent-data,static token,Directus REST Bearer,"sync-target collections (GET x16; exact set is dynamic -> enumerate in S1)",none observed (verbs were GET/DELETE),"sync-target items (DELETE x1)",NONE,no (uses Directus API for sync; separate PG creds exist for its own store),"directus_sync.py + event_system.py; sync registered only if DIRECTUS_ADMIN_TOKEN set" reconcile-tasks,password (login->session),Directus REST (session token from /auth/login),tasks; task_comments,tasks; task_comments,none,NONE,no,runs inside agent-data container via docker exec reconcile-knowledge,password (login->session),Directus REST,knowledge_documents,knowledge_documents,none,NONE,no,runs inside agent-data container via docker exec dot-collection-health,password (login->session),Directus REST to CLOUD directus.incomexsaigoncorp.vn,"system_issues; collection metadata",system_issues (POST),none,NONE,partial (some psql reads),host localhost:8055 not published -> environment.sh selects CLOUD url dot-apr-health,password (login->session),Directus REST to CLOUD,"system_issues; approval metadata",system_issues (POST),none,NONE,partial (psql reads),same cloud-url fallback dot-dot-coverage,password (armed; API unconfirmed),environment.sh (token-or-login),coverage/health tables,unconfirmed,none,NONE,likely PG-primary,confirm API vs PG in S1 dot-dot-health,password (VESTIGIAL),n/a (pure PG),health tables (PG),none via API,none,NONE,YES (docker exec postgres psql x4),credential export is dead weight dot-orphan-scanner,token (VESTIGIAL),n/a (pure PG),"meta_catalog, collection_registry, species_map (PG)",approval_requests (PG INSERT),none,NONE,YES (docker exec postgres psql),token export is dead weight dot-misclass-scanner,token (VESTIGIAL),n/a (pure PG),classification tables (PG),approval_requests (PG INSERT),none,NONE,YES (docker exec postgres psql),token export is dead weight dot-apr-execute,password+SYNC_SECRET (BROKEN),n/a (curl 7),n/a,n/a,none,NONE,attempts localhost:8055,dead; SYNC_SECRET==admin token claude-mcp,tac-agent token (NON-admin),Directus REST Bearer,per tac-agent-policy,per tac-agent-policy,per policy,NONE,no,unaffected by admin rotation == UNION (Option A transitional identity) ==,non-admin token,Directus REST Bearer,"workflows; registry/discovery/transitive; tasks; task_comments; knowledge_documents; system_issues; agent-data sync collections","workflows; tasks; task_comments; knowledge_documents; system_issues","agent-data sync items",NONE (explicitly deny directus_users/directus_roles/directus_policies/directus_permissions/directus_access/directus_settings/schema DDL),no,"scanners keep PG-direct path (out of Directus policy scope)"