Flags, scopes and errors

Surface	Required gate	Default
Builder routes	BUILDER_COHORT_API_ENABLED	false
Builder dispatch	BUILDER_COHORT_DISPATCH_ENABLED	false
Orchestrator	COHORT_PLANNER_MODE + COHORT_DISPATCH_ENABLED	off + false
Node	SemanticBridge + Memory + Tensor flags	false
Console execution	NEXT_PUBLIC_FEATURE_COHORTS + endpoint capability	false
Console operational health	same build flag + account role operator or higher	false
MCP	COLABHIVE_MCP_COHORT_TOOLS_ENABLED + Builder capability	false

Restrictive API keys need inference:execute. Account role is viewer for read/plan and operator for run/cancel. Empty scopes retain the legacy-key/session contract; Classic routes are unchanged by Cohort enforcement.

The operational health route also requires inference:execute and operator role server-side. The browser does not request it when either UI gate denies access.

Stable error codes include preview_not_enabled, insufficient_scope, endpoint_not_in_rollout, cohort_temporarily_unavailable, no_safe_cohort, cohort_rate_limited, idempotency_conflict and invalid_execution_policy.