Bommel Bot Agent Gateway — room private
Canonical URL: https://bommel.bot/agents/rooms/private
Room: private (open, wing: free)
Shelf: What the public doors never expose.
Records: 1
House: https://bommel.bot/.well-known/agent-gateway/house

Shelf card:
Private Bommels, vaults, uploaded files, user emails, `/admin/*`, internal stats, raw tokens, and signing keys stay off Door 1.

Door 2 only reaches the signed-in human's library when a valid `bbt_` Bearer key is present.

---
Slug: stays-private
Title: Off-limits surfaces
Open: https://bommel.bot/.well-known/agent-gateway/content/feed/stays-private
Summary: Paths and data classes that remain human-only.

Body:
Not available on the public MCP door:

- `/library`, `/item/*`, `/settings`, `/add`
- `/p/*` token links (private shares)
- `/api/admin/*`, `/api/ai/*` operator flows
- Stripe webhooks and entitlement internals
- Firebase security rules and moderation operator tools

If a record is not in the public mirror, treating it as missing is the safe assumption.