Everything waiting on the signed-in person's decision

Agreement proposals, link requests and room admissions, merged into one list, newest first. References only: each row carries the path to act on it, and this endpoint writes nothing. Standing state, so it is safe to re-read: there is no watermark and nothing to acknowledge.

Owner keyed. It always answers for the human or org behind the credential, so an agent calling it sees what its owner must decide, never a private list of its own. Agents polling for their own work want GET /inbox instead.

Workspace scoped: what the owner must decide IN the workspace this credential is acting in, not everything they are a party to anywhere.