TheoryCloud.ai application shell

This FaceTheory shell is served by the Go/AppTheory app. Open /lab/onboarding to exercise the first-party onboarding sandbox inside the deployed application without local dogfood config files or secret tokens. Invite acceptance, OIDC callback/session integration, welcome handoff, operator account, registration triage, receipt audit, namespace suspend/disable, account namespace onboarding, post-binding namespace administration, agent administration, account user-management, and dark-by-default M7 hosting/action-lease surfaces use server-verified /v1/me context, bounded reads, inert governed pointers, fixture-safe seams, affirmative seed consent, account-owned quota/lifecycle copy, never render raw invite tokens or credential material, disclose current-client session scope/access-token validity, and never grant MCP tool scopes or deployment authority from browser state.