From 3d8a91bca14cfc1cf18013e00f56c72ce006f3c3 Mon Sep 17 00:00:00 2001
From: Factory <factory@overslash.dev>
Date: Thu, 29 Oct 2026 08:56:34 +0000
Subject: [PATCH 1/2] feat(templates): info.summary as a one-line catalog
 tagline

`info.description` is written for agents and runs to paragraphs, which
is too long for a catalog tile. Read the standard OpenAPI 3.1
`info.summary` as a short dashboard-facing tagline and expose it as an
optional `summary` on `/v1/templates` (list, search, detail, admin,
draft preview). It is omitted when unset, and agent-facing `/v1/search`
and MCP keep `description`.

- Compile warns (never refuses) on a multi-line value or one over 80
  chars. The same check covers a derived layer's new `delta.summary`
  relabel.
- Every shipped template, plus the synthetic `http` service, now has
  a summary. `every_shipped_template_has_a_short_summary` keeps them
  short.
- The dashboard Create Service cards show `summary ?? description`
  with the full description as a tooltip, and template search matches
  on summary too.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 SPEC.md                                       |   3 +-
 .../src/routes/actions/service_resolve.rs     |   1 +
 .../overslash-api/src/routes/approvals/dto.rs |   1 +
 .../src/routes/search/setup_hint.rs           |   1 +
 .../src/routes/templates/admin.rs             |   2 +
 .../src/routes/templates/drafts.rs            |   3 +
 .../overslash-api/src/routes/templates/dto.rs |  11 ++
 .../overslash-api/src/routes/templates/mod.rs |   5 +
 .../src/routes/templates/read.rs              |  10 ++
 .../src/services/platform_services/mod.rs     |   4 +
 .../src/services/platform_services/status.rs  |   1 +
 .../src/services/platform_services/verify.rs  |   1 +
 .../src/services/service_setup/slots.rs       |   1 +
 crates/overslash-api/tests/api.rs             |   1 +
 .../overslash-api/tests/templates_summary.rs  | 103 +++++++++++++++++
 crates/overslash-core/src/instance_config.rs  |   1 +
 .../overslash-core/src/openapi/compile/mod.rs |  34 ++++++
 .../src/openapi/compile/tests_summary.rs      | 104 ++++++++++++++++++
 crates/overslash-core/src/openapi/mod.rs      |   2 +-
 crates/overslash-core/src/registry/mod.rs     |   1 +
 crates/overslash-core/src/registry/tests.rs   |  25 +++++
 crates/overslash-core/src/search/mod.rs       |   1 +
 .../overslash-core/src/service_layer/apply.rs |  17 +++
 .../overslash-core/src/service_layer/mod.rs   |   1 +
 .../overslash-core/src/service_layer/types.rs |   3 +
 .../src/service_layer/validate.rs             |  23 ++++
 .../template_validation/core/action/tests.rs  |   1 +
 .../src/template_validation/core/mod.rs       |   2 +
 .../template_validation/core/service_shape.rs |  26 ++++-
 .../src/template_validation/json.rs           |   1 +
 .../src/template_validation/mod.rs            |   2 +-
 .../src/types/service/definition.rs           |   7 ++
 .../scripts/screenshot-template-summary.mjs   |  27 +++++
 .../components/services/TemplateCard.svelte   |   6 +-
 .../templates/TemplateCatalog.svelte          |   2 +-
 dashboard/src/lib/types.ts                    |   5 +
 .../src/routes/services/new/+page.svelte      |   2 +-
 services/deepwiki.yaml                        |   1 +
 services/email.yaml                           |   1 +
 services/eventbrite.yaml                      |   1 +
 services/figma.yaml                           |   1 +
 services/github.yaml                          |   1 +
 services/gmail.yaml                           |   1 +
 services/google_calendar.yaml                 |   1 +
 services/google_drive.yaml                    |   1 +
 services/google_keep.yaml                     |   1 +
 services/google_tasks.yaml                    |   1 +
 services/holded.yaml                          |   1 +
 services/hubspot.yaml                         |   1 +
 services/langfuse.yaml                        |   1 +
 services/linkedin.yaml                        |   1 +
 services/metabase.yaml                        |   1 +
 services/notion.yaml                          |   1 +
 services/outlook.yaml                         |   1 +
 services/overslash.yaml                       |   1 +
 services/resend.yaml                          |   1 +
 services/shortcut.yaml                        |   1 +
 services/slack.yaml                           |   1 +
 services/stripe.yaml                          |   1 +
 services/telegram.yaml                        |   1 +
 services/test_email.yaml                      |   1 +
 services/whatsapp.yaml                        |   1 +
 services/x.yaml                               |   1 +
 63 files changed, 459 insertions(+), 8 deletions(-)
 create mode 100644 crates/overslash-api/tests/templates_summary.rs
 create mode 100644 crates/overslash-core/src/openapi/compile/tests_summary.rs
 create mode 100644 dashboard/scripts/screenshot-template-summary.mjs

diff --git a/SPEC.md b/SPEC.md
index c22eb6c84..ea0e637cd 100644
--- a/SPEC.md
+++ b/SPEC.md
@@ -962,7 +962,7 @@ Templates live in a three-tier registry:
 
 **Org-admin visibility**: Org-admins can see all templates in the org (global + org + user-created) in a read-only list for security/compliance — they need to know what external APIs their users are connecting to.
 
-**Layers (`extends`/`delta`).** Each org/user template row is a **layer**. A **standalone** layer (`extends` NULL) holds a full OpenAPI doc (the classic org/user template). A **derived** layer (`extends` set) holds a *delta* over a base template named by `extends` (resolved by key: DB rows then the global registry), and its effective template is the **fold** `resolve(layer) = apply(delta, resolve(extends))`. The delta's **masks** are restrictive and order-independent — action `allowlist` (∩) / `denylist` (\), per-action `risk` clamp-**up**-only, additive `disclose`, relabel, template `hidden` — so `resolve(child) ⊆ resolve(base)` (a child can never re-expose what a parent hid); its **extensions** add new actions/hosts only (no auth, no rebinding). An **org** layer may additionally carry `instance_defaults` — non-secret presets (endpoint `url` + `x-overslash-instance-config` values) that every service instance created from the layer inherits unless it sets its own (every template's endpoint is overridable per instance; `x-overslash-promoted` on `servers[0]` or on a config field only decides whether the instance form shows it up front or behind "Show more options"), so an org running its own deployment (its overfwd Mailbox Gateway, its self-hosted MCP server) names it once instead of on every user's instance. `extends` is a **live pointer**: editing a base (or Overslash shipping a new global version) propagates to every descendant immediately. `extends` and the layer's own `key` are decoupled — reusing the base key shadows it (curation that agents get transparently), a distinct key is a separate catalog entry alongside the base. Discovery, instantiation, and **execution** all resolve through the fold, so a masked-out action is unreachable everywhere. See [DECISIONS.md D29](DECISIONS.md) and [docs/design/layered-service-templates.md](docs/design/layered-service-templates.md).
+**Layers (`extends`/`delta`).** Each org/user template row is a **layer**. A **standalone** layer (`extends` NULL) holds a full OpenAPI doc (the classic org/user template). A **derived** layer (`extends` set) holds a *delta* over a base template named by `extends` (resolved by key: DB rows then the global registry), and its effective template is the **fold** `resolve(layer) = apply(delta, resolve(extends))`. The delta's **masks** are restrictive and order-independent — action `allowlist` (∩) / `denylist` (\), per-action `risk` clamp-**up**-only, additive `disclose`, relabel (display name, description, summary), template `hidden` — so `resolve(child) ⊆ resolve(base)` (a child can never re-expose what a parent hid); its **extensions** add new actions/hosts only (no auth, no rebinding). An **org** layer may additionally carry `instance_defaults` — non-secret presets (endpoint `url` + `x-overslash-instance-config` values) that every service instance created from the layer inherits unless it sets its own (every template's endpoint is overridable per instance; `x-overslash-promoted` on `servers[0]` or on a config field only decides whether the instance form shows it up front or behind "Show more options"), so an org running its own deployment (its overfwd Mailbox Gateway, its self-hosted MCP server) names it once instead of on every user's instance. `extends` is a **live pointer**: editing a base (or Overslash shipping a new global version) propagates to every descendant immediately. `extends` and the layer's own `key` are decoupled — reusing the base key shadows it (curation that agents get transparently), a distinct key is a separate catalog entry alongside the base. Discovery, instantiation, and **execution** all resolve through the fold, so a masked-out action is unreachable everywhere. See [DECISIONS.md D29](DECISIONS.md) and [docs/design/layered-service-templates.md](docs/design/layered-service-templates.md).
 
 ### Template Definition
 
@@ -1041,6 +1041,7 @@ paths:
 - **`x-overslash-pagination` / `pagination:`** — on an operation (or MCP tool), that this action returns one *page* of a larger collection, and how to reach the next one. Two halves. `page_size: {param, default, max}` names the declared numeric parameter that bounds a page; `default` **seeds that parameter's own `default:`** at compile time when it declares none, so the bound reaches the wire through `apply_defaults` like any other default (and appears on `/v1/search` rows for the same reason) rather than through a second injection path — a parameter that already declares one keeps it, and the two disagreeing is a warning. `max` is declarative: it bounds `default` at validation time and is *not* enforced against a caller who explicitly asks for more. `next: {style, param, from}` names the continuation: `cursor` (an opaque value read from the dotted body path in `from` — Slack's `cursor`, Notion's `start_cursor`, Google's `pageToken`), `offset` (advance `param` by the effective page size), `page` (increment `param` — whose own `default:` is required, since it is the only place a template says whether pages count from 0 or from 1), or `link` (the response names the whole next URL and the gateway lifts the declared query keys out of it — from the RFC 8288 `Link: <…>; rel="next"` header by default, or from the dotted body path in `from`, which is where Shortcut, Zendesk and Twilio put theirs; `param` there names the single query key the next URL may introduce although page one never sent it. Needs `from` on an MCP tool, whose results carry no headers). Optional `items` (dotted path to the principal collection) and `has_more` (dotted path to an explicit boolean) are how a last page is recognised. A **paged result** carries `_pagination: {has_more, next: {service, action, params}}`, where `params` is the *difference* between the call just made and the next one, in the action's own parameter names — merge it into what you sent. The gateway never follows a page itself. A malformed block is a template *error* and the action goes back to being unpaged; a `page_size.param` naming a parameter the action does not declare is an error too, since it reads as a bound and applies none. See §12b.
 - **`x-overslash-default_timeout_ms` / `default_timeout_ms:`** — under `info`, the same thing one rung less specific: the timeout every action of this service inherits unless it declares its own. The one-line answer to "this whole upstream is slow".
 - **`x-overslash-icon` / `icon:`** — under `info`, the mark the dashboard shows for this service. Two forms: `builtin:<name>`, an asset Overslash ships and serves at `/icons/<name>.svg`, and an `https://` URL hosted elsewhere. **Usually omitted**: a template whose key matches a shipped asset resolves to `builtin:<key>` implicitly, which is why the shipped templates declare nothing. Explicit values are for the two cases the convention can't express — a key that deliberately differs from the asset it reuses, or a remote URL. Resolved server-side and surfaced as an absolute `icon_url` on the template and service-instance responses; a template with nothing renderable omits the field, and the dashboard falls back to a letter tile. Only `https://` ever reaches a browser — `http:`, `data:` and `javascript:` are template *errors*, checked both at write time and again when the response is built. Overslash never fetches a remote icon (that would be an SSRF vector and a boot-time network dependency), so there is no size or format validation of one. `${VAR}` expansion applies like anywhere else, which is how a self-hoster points the set at their own CDN. Icons are deliberately **not** on `/v1/search`: it fans out up to 100 rows per (instance × action) and the field would cost an agent's context window for something no model can render.
+- **`summary:`** (standard OpenAPI 3.1 `info.summary`, not an extension) — under `info`, a one-line tagline for UI catalogs: one plain sentence, at most 80 characters, no trailing period. `info.description` is written for agents (it is folded into the text every action is scored against) and runs to paragraphs; `summary` is what a catalog tile shows, and consumers render `summary ?? description`. Surfaced as `summary` on `GET /v1/templates` (list, search, detail, admin, draft preview) and omitted when unset. Deliberately **not** on `/v1/search` or MCP: agents keep `description`. A multi-line or over-long value compiles with an `openapi_invalid` warning (an imported spec still loads); a derived layer may relabel it through `delta.summary`, which takes the same warnings. Every shipped template carries one, enforced by `every_shipped_template_has_a_short_summary`.
 - **`x-overslash-additional-properties` / `additional-properties:`** — on an operation or MCP tool, that the action's declared parameter set is a **floor, not a fence**: an argument the template never declared is forwarded upstream instead of returning `invalid_action_args`, and a declared `enum` names the members we know of rather than all of them. `required` is still enforced either way — it is a statement about the operation, not about how completely we transcribed it. Also settable under `info` as a service-wide default, where the nearest value wins, so an operation may write `false` to re-tighten under a service that relaxed globally. **Defaults to `false`**, and a malformed value (`additional-properties: "true"`) warns and stays strict, so a quoting mistake cannot grant the relaxation by accident. The name is borrowed from JSON Schema, where it governs undeclared keys only; here it deliberately covers `enum` too, because the same template that cannot name every parameter is the one whose enum snapshot has gone stale. For a relaxed action whose operation declares no `requestBody`, a non-`GET` call synthesizes a JSON body so the accepted argument actually reaches the wire; declaring the key on a body-carrying method whose `requestBody` is **non-JSON** is a template *error* (`additional_properties_needs_a_json_body`), since only JSON bodies are serialised and the argument would otherwise pass validation and then be dropped. **Not read on a platform action**: those answer from this process against a param set Overslash owns, so an undeclared argument would pass the gate and then be silently dropped — strictly worse than the 400. What the author gives up is the Levenshtein "did you mean" on a typo: a misspelled optional param now reaches the upstream instead of returning a self-correctable 400. Two security notes, both consequences of the gateway not knowing a name exists: permission-key derivation (`x-overslash-scope_param`) reads declared params only, so an undeclared argument can change what a call does without changing the key the chain checks; and `x-overslash-redact` cannot cover a path it has never seen, so a relaxed action's approval payload and audit row may carry undeclared values in the clear. Surfaced to agents as `additional_properties` on `/v1/search` rows, and to the dashboard on the action-detail response, which is what turns the API Explorer's enum `<select>` into an open combobox and adds its free-form argument rows.
 - **`x-overslash-success` / `success:`** — a jq predicate over the parsed response body that says whether a below-400 response actually succeeded, for upstreams that report failure in-band (Slack answers `200 {"ok": false, "error": …}`; `services/slack.yaml` declares `success: ".ok == true"` under `info`). It can be set under `info` as a service-wide default, which an operation's own value overrides, and is read on **HTTP operations only**: an MCP tool already reports `isError`, and a platform action answers with a status it chose. The verdict passes only when the predicate emits at least one value and every value is exactly `true`. `false`, a truthy non-boolean, no output, or a jq runtime error mark the result `body_failed`, which counts as an upstream error for the call's `is_error`, the `action.executed` audit row, `errors_only` response capture, and pagination (no `next` is offered). The HTTP status reported to the caller stays the upstream's real one, and the body is returned unchanged, so the agent still reads the upstream's error code. A body that is not JSON, or a predicate that times out (bounded by `FILTER_TIMEOUT_MS`), keeps the status-only verdict. Streamed responses are never judged, because their body is not buffered. The predicate is snapshotted onto the stored replay payload, so a gated or async call is judged by the rule that was in force when it was made. A malformed value warns at `info` and is an error on an operation, and a predicate that is not valid jq is refused at the template register gate (`success_invalid_jq`).
 - **`x-overslash-subactions` / `subactions:`** — on an operation or MCP tool, the **variants** of one overloaded action, classified per call from its own arguments. `each:` (jq over the params; default `.`, the whole call as one item) splits a call into items — one per object in a batch — and each item is matched to the first variant whose `match:` jq predicate is truthy. A variant carries the controls an action does: `description`, `risk` (defaults to the parent's), `scope_param` (resolved against the item), `disclose` (appended to the parent's; its filters see `.items`, the variant's own items), `redact`, `timeout_ms`, `required_scopes`, and `vars:` (named jq over the item, exposed as `{item.<name>}`). A matched call is keyed `{service}:{parent}/{variant}:{arg}` and needs every matched variant's key; an item no variant claims keeps the parent's key, label and risk, and a classifier error or timeout gates the whole call as the parent. A rule on the parent (`hubspot:manage_crm_objects:*`) **covers every variant**; a rule naming one (`…/create_contact:*`) is narrower. Descriptions compose per item: each variant's `verb` + `phrase` group into clauses (`Create contact 'jane@acme.com' and deal 'Acme renewal'; update deal 'Big Co'`), a variant `summary` overrides when every item is that variant, and a block-level `summary` overrides everything. Label templates add `{item.<path>}`, `{count}` and `{enumerate(<template>)}` (English list, `… and N more` past 5) to the `{param}`/`[optional]` grammar. A variant with `input_schema` + `transform` (jq from its params to the parent's) is also **callable** by its own name; the call is rewritten into the parent, validated as the parent, and must classify entirely as that variant, so it mints the same keys as the raw call. Not allowed on `risk: dynamic` actions. A layer denying the parent hides its callable variants; a risk clamp on either reaches classification. See `docs/design/subactions.md`.
diff --git a/crates/overslash-api/src/routes/actions/service_resolve.rs b/crates/overslash-api/src/routes/actions/service_resolve.rs
index 3fca2984f..c3d41b1e9 100644
--- a/crates/overslash-api/src/routes/actions/service_resolve.rs
+++ b/crates/overslash-api/src/routes/actions/service_resolve.rs
@@ -413,6 +413,7 @@ mod verb_host_path_tests {
             key: "github".into(),
             display_name: "GitHub".into(),
             description: None,
+            summary: None,
             url_promoted: false,
             hosts: hosts.into_iter().map(String::from).collect(),
             category: None,
diff --git a/crates/overslash-api/src/routes/approvals/dto.rs b/crates/overslash-api/src/routes/approvals/dto.rs
index 1b0c6f211..6febc9e23 100644
--- a/crates/overslash-api/src/routes/approvals/dto.rs
+++ b/crates/overslash-api/src/routes/approvals/dto.rs
@@ -156,6 +156,7 @@ mod risk_tests {
             key: key.into(),
             display_name: key.into(),
             description: None,
+            summary: None,
             url_promoted: false,
             hosts: vec![],
             category: None,
diff --git a/crates/overslash-api/src/routes/search/setup_hint.rs b/crates/overslash-api/src/routes/search/setup_hint.rs
index 57a915be0..7f60ef282 100644
--- a/crates/overslash-api/src/routes/search/setup_hint.rs
+++ b/crates/overslash-api/src/routes/search/setup_hint.rs
@@ -257,6 +257,7 @@ mod tests {
             key: "acme".into(),
             display_name: "Acme".into(),
             description: None,
+            summary: None,
             url_promoted: false,
             hosts: vec!["api.acme.test".into()],
             category: None,
diff --git a/crates/overslash-api/src/routes/templates/admin.rs b/crates/overslash-api/src/routes/templates/admin.rs
index 6be291841..059a9fe8a 100644
--- a/crates/overslash-api/src/routes/templates/admin.rs
+++ b/crates/overslash-api/src/routes/templates/admin.rs
@@ -33,6 +33,7 @@ pub(super) async fn list_templates_admin(
             key: svc.key.clone(),
             display_name: svc.display_name.clone(),
             description: svc.description.clone(),
+            summary: svc.summary.clone(),
             category: svc.category.clone(),
             hosts: svc.hosts.clone(),
             action_count: svc.actions.len(),
@@ -61,6 +62,7 @@ pub(super) async fn list_templates_admin(
             key: t.key,
             display_name: s.display_name,
             description: s.description,
+            summary: s.summary,
             category: s.category,
             hosts: s.hosts,
             action_count: s.action_count,
diff --git a/crates/overslash-api/src/routes/templates/drafts.rs b/crates/overslash-api/src/routes/templates/drafts.rs
index c018083e8..120c39f85 100644
--- a/crates/overslash-api/src/routes/templates/drafts.rs
+++ b/crates/overslash-api/src/routes/templates/drafts.rs
@@ -59,6 +59,8 @@ struct TemplatePreview {
     key: String,
     display_name: String,
     description: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    summary: Option<String>,
     category: Option<String>,
     hosts: Vec<String>,
     auth: Vec<serde_json::Value>,
@@ -516,6 +518,7 @@ fn preview_from_compiled(def: &ServiceDefinition) -> TemplatePreview {
         key: def.key.clone(),
         display_name: def.display_name.clone(),
         description: def.description.clone(),
+        summary: def.summary.clone(),
         category: def.category.clone(),
         hosts: def.hosts.clone(),
         auth: serde_json::to_value(&def.auth)
diff --git a/crates/overslash-api/src/routes/templates/dto.rs b/crates/overslash-api/src/routes/templates/dto.rs
index 3544c6e5e..32c84e249 100644
--- a/crates/overslash-api/src/routes/templates/dto.rs
+++ b/crates/overslash-api/src/routes/templates/dto.rs
@@ -10,6 +10,10 @@ pub(super) struct TemplateSummary {
     pub(super) key: String,
     pub(super) display_name: String,
     pub(super) description: Option<String>,
+    /// `info.summary` — one-line catalog tagline. UI catalogs show it in
+    /// place of `description`, which is written for agents. Omitted when unset.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub(super) summary: Option<String>,
     pub(super) category: Option<String>,
     pub(super) hosts: Vec<String>,
     pub(super) action_count: usize,
@@ -41,6 +45,10 @@ pub(super) struct TemplateDetail {
     pub(super) key: String,
     pub(super) display_name: String,
     pub(super) description: Option<String>,
+    /// `info.summary` — one-line catalog tagline. UI catalogs show it in
+    /// place of `description`, which is written for agents. Omitted when unset.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub(super) summary: Option<String>,
     pub(super) category: Option<String>,
     pub(super) hosts: Vec<String>,
     /// Absolute URL of the catalog icon, resolved from the template's
@@ -179,6 +187,9 @@ pub(super) struct AdminTemplateSummary {
     pub(super) key: String,
     pub(super) display_name: String,
     pub(super) description: Option<String>,
+    /// See [`TemplateSummary::summary`].
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub(super) summary: Option<String>,
     pub(super) category: Option<String>,
     pub(super) hosts: Vec<String>,
     pub(super) action_count: usize,
diff --git a/crates/overslash-api/src/routes/templates/mod.rs b/crates/overslash-api/src/routes/templates/mod.rs
index a6c7b192e..baa23bacb 100644
--- a/crates/overslash-api/src/routes/templates/mod.rs
+++ b/crates/overslash-api/src/routes/templates/mod.rs
@@ -432,6 +432,7 @@ async fn db_row_to_detail(
         key: t.key,
         display_name: def.display_name.clone(),
         description: def.description.clone().filter(|s| !s.is_empty()),
+        summary: def.summary.clone().filter(|s| !s.is_empty()),
         category: def.category.clone().filter(|s| !s.is_empty()),
         hosts: def.hosts.clone(),
         icon_url: resolve_icon_url(def.icon.as_ref(), &state.config.public_url),
@@ -585,6 +586,7 @@ fn mcp_detail_from(def: &ServiceDefinition, openapi: &serde_json::Value) -> Opti
 struct RowSummary {
     display_name: String,
     description: Option<String>,
+    summary: Option<String>,
     category: Option<String>,
     hosts: Vec<String>,
     action_count: usize,
@@ -604,6 +606,7 @@ async fn resolved_summary(
             RowSummary {
                 display_name: d.display_name,
                 description: d.description.filter(|s| !s.is_empty()),
+                summary: d.summary.filter(|s| !s.is_empty()),
                 category: d.category.filter(|s| !s.is_empty()),
                 hosts: d.hosts,
                 action_count: d.actions.len(),
@@ -616,6 +619,8 @@ async fn resolved_summary(
         Err(_) => RowSummary {
             display_name: t.display_name.clone(),
             description: Some(t.description.clone()).filter(|s| !s.is_empty()),
+            // No denormalized column: the summary lives only in the openapi doc.
+            summary: None,
             category: Some(t.category.clone()).filter(|s| !s.is_empty()),
             hosts: t.hosts.clone(),
             action_count: 0,
diff --git a/crates/overslash-api/src/routes/templates/read.rs b/crates/overslash-api/src/routes/templates/read.rs
index 4d1c6e9f3..91e43ddc9 100644
--- a/crates/overslash-api/src/routes/templates/read.rs
+++ b/crates/overslash-api/src/routes/templates/read.rs
@@ -23,6 +23,7 @@ pub(super) async fn list_templates(
             key: svc.key.clone(),
             display_name: svc.display_name.clone(),
             description: svc.description.clone(),
+            summary: svc.summary.clone(),
             category: svc.category.clone(),
             hosts: svc.hosts.clone(),
             action_count: svc.actions.len(),
@@ -51,6 +52,7 @@ pub(super) async fn list_templates(
             key: t.key,
             display_name: s.display_name,
             description: s.description,
+            summary: s.summary,
             category: s.category,
             hosts: s.hosts,
             action_count: s.action_count,
@@ -116,6 +118,7 @@ pub(super) async fn search_templates(
             key: svc.key.clone(),
             display_name: svc.display_name.clone(),
             description: svc.description.clone(),
+            summary: svc.summary.clone(),
             category: svc.category.clone(),
             hosts: svc.hosts.clone(),
             action_count: svc.actions.len(),
@@ -149,12 +152,18 @@ pub(super) async fn search_templates(
                 .unwrap_or("")
                 .to_lowercase()
                 .contains(&q)
+            || s.summary
+                .as_deref()
+                .unwrap_or("")
+                .to_lowercase()
+                .contains(&q)
         {
             let tier = if is_user_tier { "user" } else { "org" };
             results.push(TemplateSummary {
                 key: t.key,
                 display_name: s.display_name,
                 description: s.description,
+                summary: s.summary,
                 category: s.category,
                 hosts: s.hosts,
                 action_count: s.action_count,
@@ -226,6 +235,7 @@ pub(super) async fn get_template(
         key: svc.key.clone(),
         display_name: svc.display_name.clone(),
         description: svc.description.clone(),
+        summary: svc.summary.clone(),
         category: svc.category.clone(),
         hosts: svc.hosts.clone(),
         icon_url: resolve_icon_url(svc.icon.as_ref(), &state.config.public_url),
diff --git a/crates/overslash-api/src/services/platform_services/mod.rs b/crates/overslash-api/src/services/platform_services/mod.rs
index 27a8c040b..88a477802 100644
--- a/crates/overslash-api/src/services/platform_services/mod.rs
+++ b/crates/overslash-api/src/services/platform_services/mod.rs
@@ -91,6 +91,7 @@ mod test_fixtures {
             key: "t".into(),
             display_name: "T".into(),
             description: None,
+            summary: None,
             url_promoted: false,
             hosts: vec![],
             category: None,
@@ -120,6 +121,7 @@ mod test_fixtures {
             key: "t".into(),
             display_name: "T".into(),
             description: None,
+            summary: None,
             url_promoted: false,
             hosts: vec![],
             category: None,
@@ -152,6 +154,7 @@ mod test_fixtures {
             key: "t".into(),
             display_name: "T".into(),
             description: None,
+            summary: None,
             url_promoted: false,
             hosts: vec![],
             category: None,
@@ -226,6 +229,7 @@ mod test_fixtures {
             key: "t".into(),
             display_name: "T".into(),
             description: None,
+            summary: None,
             url_promoted: false,
             hosts: vec![],
             category: None,
diff --git a/crates/overslash-api/src/services/platform_services/status.rs b/crates/overslash-api/src/services/platform_services/status.rs
index 7ed8730a4..a718e368e 100644
--- a/crates/overslash-api/src/services/platform_services/status.rs
+++ b/crates/overslash-api/src/services/platform_services/status.rs
@@ -567,6 +567,7 @@ mod tests {
             key: "t".into(),
             display_name: "T".into(),
             description: None,
+            summary: None,
             url_promoted: false,
             hosts: vec![],
             category: None,
diff --git a/crates/overslash-api/src/services/platform_services/verify.rs b/crates/overslash-api/src/services/platform_services/verify.rs
index b526a7d27..06e36ddf2 100644
--- a/crates/overslash-api/src/services/platform_services/verify.rs
+++ b/crates/overslash-api/src/services/platform_services/verify.rs
@@ -94,6 +94,7 @@ mod create_status_tests {
             key: "resend".into(),
             display_name: "Resend".into(),
             description: None,
+            summary: None,
             url_promoted: false,
             hosts: vec!["api.resend.test".into()],
             category: None,
diff --git a/crates/overslash-api/src/services/service_setup/slots.rs b/crates/overslash-api/src/services/service_setup/slots.rs
index b2554bc6d..4ee4a45d2 100644
--- a/crates/overslash-api/src/services/service_setup/slots.rs
+++ b/crates/overslash-api/src/services/service_setup/slots.rs
@@ -295,6 +295,7 @@ mod tests {
             key: "acme".into(),
             display_name: "Acme".into(),
             description: None,
+            summary: None,
             url_promoted: false,
             hosts: vec!["api.acme.test".into()],
             category: None,
diff --git a/crates/overslash-api/tests/api.rs b/crates/overslash-api/tests/api.rs
index c0ed7336e..2cf17895c 100644
--- a/crates/overslash-api/tests/api.rs
+++ b/crates/overslash-api/tests/api.rs
@@ -194,6 +194,7 @@ mod template_endpoint_fields;
 mod template_validation;
 mod templates;
 mod templates_import;
+mod templates_summary;
 mod trial;
 mod uploads;
 mod upstream_credential_echo;
diff --git a/crates/overslash-api/tests/templates_summary.rs b/crates/overslash-api/tests/templates_summary.rs
new file mode 100644
index 000000000..d62ee8eca
--- /dev/null
+++ b/crates/overslash-api/tests/templates_summary.rs
@@ -0,0 +1,103 @@
+//! `info.summary` on the `/v1/templates` surfaces: the one-line catalog
+//! tagline UI catalogs show in place of the agent-facing `description`.
+
+use crate::common;
+
+use reqwest::Client;
+use serde_json::{Value, json};
+
+fn auth(key: &str) -> (&'static str, String) {
+    ("Authorization", format!("Bearer {key}"))
+}
+
+fn minimal_openapi(key: &str, display_name: &str) -> String {
+    common::render_openapi(
+        include_str!("fixtures/openapi/minimal.yaml.tmpl"),
+        &[("key", key), ("display_name", display_name)],
+    )
+}
+
+/// The minimal fixture with an `info.summary` line added under `title`.
+fn openapi_with_summary(key: &str, summary: &str) -> String {
+    minimal_openapi(key, "Summarized").replacen(
+        "  title: Summarized\n",
+        &format!("  title: Summarized\n  summary: {summary}\n"),
+        1,
+    )
+}
+
+async fn get_json(client: &Client, url: String, key: &str) -> Value {
+    let resp = client
+        .get(url)
+        .header(auth(key).0, auth(key).1)
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 200);
+    resp.json().await.unwrap()
+}
+
+fn find<'a>(list: &'a Value, key: &str) -> &'a Value {
+    list.as_array()
+        .unwrap()
+        .iter()
+        .find(|t| t["key"] == key)
+        .unwrap_or_else(|| panic!("{key} missing from {list}"))
+}
+
+#[tokio::test]
+async fn global_template_summary_is_on_list_detail_and_admin() {
+    let (pool, fixtures) = common::test_pool_bootstrapped().await;
+    let (base, client) = common::start_api_with_registry(pool, None).await;
+    let key = &fixtures.admin_key;
+
+    let list = get_json(&client, format!("{base}/v1/templates"), key).await;
+    let gh = find(&list, "github");
+    let summary = gh["summary"].as_str().expect("github has a summary");
+    assert!(!summary.contains('\n') && summary.chars().count() <= 80);
+    assert_ne!(gh["summary"], gh["description"]);
+
+    let detail = get_json(&client, format!("{base}/v1/templates/github"), key).await;
+    assert_eq!(detail["summary"], gh["summary"]);
+
+    let admin = get_json(&client, format!("{base}/v1/templates/admin"), key).await;
+    assert_eq!(find(&admin, "github")["summary"], gh["summary"]);
+}
+
+#[tokio::test]
+async fn org_template_summary_is_present_when_set_and_omitted_when_unset() {
+    let (pool, fixtures) = common::test_pool_bootstrapped().await;
+    let (addr, client) = common::start_api(pool).await;
+    let base = format!("http://{addr}");
+    let key = &fixtures.admin_key;
+
+    for openapi in [
+        openapi_with_summary("tagged-api", "Short catalog tagline"),
+        minimal_openapi("untagged-api", "Untagged"),
+    ] {
+        let resp = client
+            .post(format!("{base}/v1/templates"))
+            .header(auth(key).0, auth(key).1)
+            .json(&json!({ "openapi": openapi }))
+            .send()
+            .await
+            .unwrap();
+        assert_eq!(resp.status(), 200, "{}", resp.text().await.unwrap());
+    }
+
+    let list = get_json(&client, format!("{base}/v1/templates"), key).await;
+    assert_eq!(
+        find(&list, "tagged-api")["summary"],
+        "Short catalog tagline"
+    );
+    let untagged = find(&list, "untagged-api");
+    assert!(
+        !untagged.as_object().unwrap().contains_key("summary"),
+        "an unset summary is omitted, not null: {untagged}"
+    );
+
+    let detail = get_json(&client, format!("{base}/v1/templates/tagged-api"), key).await;
+    assert_eq!(detail["summary"], "Short catalog tagline");
+    let detail = get_json(&client, format!("{base}/v1/templates/untagged-api"), key).await;
+    assert!(!detail.as_object().unwrap().contains_key("summary"));
+}
diff --git a/crates/overslash-core/src/instance_config.rs b/crates/overslash-core/src/instance_config.rs
index b4dbe0aeb..87dd1b53f 100644
--- a/crates/overslash-core/src/instance_config.rs
+++ b/crates/overslash-core/src/instance_config.rs
@@ -183,6 +183,7 @@ mod tests {
             key: "t".into(),
             display_name: "T".into(),
             description: None,
+            summary: None,
             url_promoted: false,
             hosts: vec!["api.example.com".into()],
             category: None,
diff --git a/crates/overslash-core/src/openapi/compile/mod.rs b/crates/overslash-core/src/openapi/compile/mod.rs
index 7207a8cda..0e43104e6 100644
--- a/crates/overslash-core/src/openapi/compile/mod.rs
+++ b/crates/overslash-core/src/openapi/compile/mod.rs
@@ -62,6 +62,8 @@ pub fn compile_service(
         .and_then(Value::as_str)
         .map(str::to_string);
 
+    let summary = parse_summary(info.and_then(|i| i.get("summary")), &mut warnings);
+
     let category = info
         .and_then(|i| ext::get(i, Pos::Info, Ext::Category))
         .and_then(Value::as_str)
@@ -345,6 +347,7 @@ pub fn compile_service(
             key,
             display_name,
             description,
+            summary,
             hosts,
             url_promoted,
             category,
@@ -367,6 +370,35 @@ pub fn compile_service(
     ))
 }
 
+/// Longest `info.summary` that renders on a catalog tile without truncation.
+pub const SUMMARY_MAX_CHARS: usize = 80;
+
+/// `info.summary` — standard OpenAPI 3.1, read here as the dashboard tagline.
+/// Warnings, not errors, for the same reason as `hidden`: an imported spec
+/// whose summary runs long should still load. An over-long or multi-line value
+/// is kept (the consumer can clamp it); only a non-string is dropped.
+fn parse_summary(raw: Option<&Value>, warnings: &mut Vec<ValidationIssue>) -> Option<String> {
+    let s = match raw? {
+        Value::String(s) => s.trim(),
+        other => {
+            warnings.push(ValidationIssue::new(
+                "openapi_invalid",
+                format!("summary must be a string (got {other})"),
+                "info.summary",
+            ));
+            return None;
+        }
+    };
+    if s.is_empty() {
+        return None;
+    }
+    warnings.extend(crate::template_validation::summary_warnings(
+        s,
+        "info.summary",
+    ));
+    Some(s.to_string())
+}
+
 // ── End-to-end tests (public API, YAML ↔ compile round-trips) ──────────
 
 #[cfg(test)]
@@ -377,3 +409,5 @@ mod tests_relaxed_args;
 mod tests_subactions;
 #[cfg(test)]
 mod tests_success;
+#[cfg(test)]
+mod tests_summary;
diff --git a/crates/overslash-core/src/openapi/compile/tests_summary.rs b/crates/overslash-core/src/openapi/compile/tests_summary.rs
new file mode 100644
index 000000000..2dcaf0465
--- /dev/null
+++ b/crates/overslash-core/src/openapi/compile/tests_summary.rs
@@ -0,0 +1,104 @@
+//! Compile-time tests for `info.summary`, the one-line catalog tagline: how it
+//! is read, and the single-line / length warnings.
+//!
+//! A sibling of [`super::tests`] for the line-cap reason `tests_relaxed_args`
+//! gives.
+
+use super::*;
+use crate::openapi::{lint_extensions, normalize_aliases};
+use serde_json::json;
+
+fn compile_info(info: Value) -> (ServiceDefinition, Vec<ValidationIssue>) {
+    let mut doc = json!({"openapi": "3.1.0", "info": info, "paths": {}});
+    assert!(normalize_aliases(&mut doc).is_empty());
+    compile_service(&doc).unwrap()
+}
+
+fn summary_warnings(warnings: &[ValidationIssue]) -> Vec<&ValidationIssue> {
+    warnings
+        .iter()
+        .filter(|w| w.path == "info.summary")
+        .collect()
+}
+
+#[test]
+fn summary_is_read_from_info_and_trimmed() {
+    let (svc, warnings) = compile_info(json!({
+        "title": "GitHub", "key": "github",
+        "summary": "  Repositories, issues, and pull requests  ",
+        "description": "A long agent-facing paragraph.",
+    }));
+    assert_eq!(
+        svc.summary.as_deref(),
+        Some("Repositories, issues, and pull requests")
+    );
+    assert_eq!(
+        svc.description.as_deref(),
+        Some("A long agent-facing paragraph.")
+    );
+    assert!(summary_warnings(&warnings).is_empty(), "{warnings:?}");
+}
+
+#[test]
+fn absent_or_blank_summary_is_none_without_a_warning() {
+    for info in [
+        json!({"title": "T", "key": "t"}),
+        json!({"title": "T", "key": "t", "summary": "   "}),
+    ] {
+        let (svc, warnings) = compile_info(info);
+        assert_eq!(svc.summary, None);
+        assert!(summary_warnings(&warnings).is_empty(), "{warnings:?}");
+    }
+}
+
+#[test]
+fn multi_line_summary_warns_and_is_kept() {
+    let (svc, warnings) = compile_info(json!({
+        "title": "T", "key": "t", "summary": "First line\nsecond line",
+    }));
+    assert_eq!(svc.summary.as_deref(), Some("First line\nsecond line"));
+    let w = summary_warnings(&warnings);
+    assert_eq!(w.len(), 1, "{warnings:?}");
+    assert_eq!(w[0].code, "openapi_invalid");
+    assert!(w[0].message.contains("single line"), "{}", w[0].message);
+}
+
+/// Counted in chars, not bytes: 80 multi-byte chars is within the cap even
+/// though it is 160 bytes.
+#[test]
+fn summary_length_cap_counts_chars() {
+    let at_cap = "é".repeat(SUMMARY_MAX_CHARS);
+    let (_, warnings) = compile_info(json!({"title": "T", "key": "t", "summary": at_cap}));
+    assert!(summary_warnings(&warnings).is_empty(), "{warnings:?}");
+
+    let over = "é".repeat(SUMMARY_MAX_CHARS + 1);
+    let (svc, warnings) = compile_info(json!({"title": "T", "key": "t", "summary": over}));
+    assert_eq!(svc.summary.as_deref(), Some(over.as_str()));
+    let w = summary_warnings(&warnings);
+    assert_eq!(w.len(), 1, "{warnings:?}");
+    assert!(w[0].message.contains("at most 80"), "{}", w[0].message);
+}
+
+#[test]
+fn non_string_summary_warns_and_is_dropped() {
+    let (svc, warnings) = compile_info(json!({"title": "T", "key": "t", "summary": 42}));
+    assert_eq!(svc.summary, None);
+    assert_eq!(summary_warnings(&warnings).len(), 1, "{warnings:?}");
+}
+
+/// `summary` is the standard OpenAPI key, so it is lint-clean; a misspelling is
+/// not.
+#[test]
+fn summary_is_lint_clean_and_a_typo_is_flagged() {
+    let doc = json!({"openapi": "3.1.0", "info": {"title": "T", "summary": "Short"}, "paths": {}});
+    assert!(lint_extensions(&doc).is_empty());
+
+    let doc = json!({"openapi": "3.1.0", "info": {"title": "T", "sumary": "Short"}, "paths": {}});
+    let issues = lint_extensions(&doc);
+    assert!(
+        issues
+            .iter()
+            .any(|i| i.path == "info.sumary" && i.code == "unknown_template_key"),
+        "{issues:?}"
+    );
+}
diff --git a/crates/overslash-core/src/openapi/mod.rs b/crates/overslash-core/src/openapi/mod.rs
index 35ce367f3..a92a5c674 100644
--- a/crates/overslash-core/src/openapi/mod.rs
+++ b/crates/overslash-core/src/openapi/mod.rs
@@ -39,7 +39,7 @@ mod yaml;
 // ── Public API ───────────────────────────────────────────────────────
 
 pub use alias::normalize_aliases;
-pub use compile::compile_service;
+pub use compile::{SUMMARY_MAX_CHARS, compile_service};
 pub use extract::overlay_discovered_tools;
 pub use extract::url_to_host;
 pub use lint::{LINT_CODES, lint_extensions};
diff --git a/crates/overslash-core/src/registry/mod.rs b/crates/overslash-core/src/registry/mod.rs
index 4613091f0..882600a2a 100644
--- a/crates/overslash-core/src/registry/mod.rs
+++ b/crates/overslash-core/src/registry/mod.rs
@@ -40,6 +40,7 @@ fn http_pseudo_service() -> ServiceDefinition {
         description: Some(
             "Raw HTTP — caller supplies the full URL. Per-call secrets injection only.".to_string(),
         ),
+        summary: Some("Call any HTTP API by full URL, with secrets injected per call".to_string()),
         url_promoted: false,
         hosts: Vec::new(),
         category: Some("Platform".to_string()),
diff --git a/crates/overslash-core/src/registry/tests.rs b/crates/overslash-core/src/registry/tests.rs
index eef561b84..a721f5936 100644
--- a/crates/overslash-core/src/registry/tests.rs
+++ b/crates/overslash-core/src/registry/tests.rs
@@ -279,6 +279,31 @@ fn every_shipped_template_resolves_to_a_shipped_icon() {
     }
 }
 
+#[test]
+fn every_shipped_template_has_a_short_summary() {
+    // `info.summary` is what a catalog tile shows; `description` is written
+    // for agents and runs to paragraphs. Every shipped template carries one,
+    // and it has to fit the tile.
+    let reg = ServiceRegistry::load_from_dir(&shipped_services_dir(), Vars::for_tests()).unwrap();
+
+    for def in reg.all() {
+        let key = def.key.as_str();
+        let summary = def
+            .summary
+            .as_deref()
+            .unwrap_or_else(|| panic!("template '{key}' has no info.summary"));
+        assert!(
+            !summary.contains(['\n', '\r']),
+            "template '{key}' summary must be one line: {summary:?}"
+        );
+        assert!(
+            summary.chars().count() <= crate::openapi::SUMMARY_MAX_CHARS,
+            "template '{key}' summary is over {} chars: {summary:?}",
+            crate::openapi::SUMMARY_MAX_CHARS
+        );
+    }
+}
+
 #[test]
 fn shipped_email_host_comes_from_the_deployment_variable() {
     // The whole point of D44: `hosts[0]` — which is what
diff --git a/crates/overslash-core/src/search/mod.rs b/crates/overslash-core/src/search/mod.rs
index 821ee225e..13d70a615 100644
--- a/crates/overslash-core/src/search/mod.rs
+++ b/crates/overslash-core/src/search/mod.rs
@@ -235,6 +235,7 @@ mod tests {
             key: key.into(),
             display_name: display.into(),
             description: desc.map(String::from),
+            summary: None,
             url_promoted: false,
             hosts: vec![],
             category: None,
diff --git a/crates/overslash-core/src/service_layer/apply.rs b/crates/overslash-core/src/service_layer/apply.rs
index fcb91a4ff..4a5ca2d27 100644
--- a/crates/overslash-core/src/service_layer/apply.rs
+++ b/crates/overslash-core/src/service_layer/apply.rs
@@ -171,6 +171,7 @@ pub fn apply_delta(
             .description
             .clone()
             .or_else(|| base.description.clone()),
+        summary: delta.summary.clone().or_else(|| base.summary.clone()),
         url_promoted: false,
         hosts,
         category: base.category.clone(),
@@ -636,6 +637,22 @@ mod tests {
         );
     }
 
+    #[test]
+    fn summary_relabel_overrides_and_otherwise_inherits() {
+        let mut base = base_with(&[("a", Risk::Read)]);
+        base.summary = Some("Base tagline".into());
+
+        let (def, _) = apply_delta(&Delta::default(), &base);
+        assert_eq!(def.summary.as_deref(), Some("Base tagline"));
+
+        let delta = Delta {
+            summary: Some("Acme's GitHub".into()),
+            ..Default::default()
+        };
+        let (def, _) = apply_delta(&delta, &base);
+        assert_eq!(def.summary.as_deref(), Some("Acme's GitHub"));
+    }
+
     #[test]
     fn dead_entries_warn() {
         let base = base_with(&[("a", Risk::Read)]);
diff --git a/crates/overslash-core/src/service_layer/mod.rs b/crates/overslash-core/src/service_layer/mod.rs
index 6a1763a09..3a50d2705 100644
--- a/crates/overslash-core/src/service_layer/mod.rs
+++ b/crates/overslash-core/src/service_layer/mod.rs
@@ -201,6 +201,7 @@ pub(crate) mod fixtures {
             key: "github".into(),
             display_name: "GitHub".into(),
             description: Some("d".into()),
+            summary: None,
             url_promoted: false,
             hosts: vec!["api.github.com".into()],
             category: Some("Dev".into()),
diff --git a/crates/overslash-core/src/service_layer/types.rs b/crates/overslash-core/src/service_layer/types.rs
index 86c887c4f..c50f3fd3d 100644
--- a/crates/overslash-core/src/service_layer/types.rs
+++ b/crates/overslash-core/src/service_layer/types.rs
@@ -26,6 +26,9 @@ pub struct Delta {
     /// Relabel the description. `None` → inherit the base's description.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub description: Option<String>,
+    /// Relabel the catalog tagline. `None` → inherit the base's summary.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub summary: Option<String>,
     /// Rebrand the template. `None` → inherit the base's icon, including one
     /// the base got implicitly from its key — a layer's own key rarely matches
     /// a shipped asset, so inheritance is what keeps it looking like the
diff --git a/crates/overslash-core/src/service_layer/validate.rs b/crates/overslash-core/src/service_layer/validate.rs
index 9ad538354..ae42ea13a 100644
--- a/crates/overslash-core/src/service_layer/validate.rs
+++ b/crates/overslash-core/src/service_layer/validate.rs
@@ -30,6 +30,13 @@ pub fn validate_delta(
     // hold here too or the derived-layer write path is an unvalidated back door
     // into it.
     crate::template_validation::check_service_icon(delta.icon.as_ref(), "icon", &mut issues);
+    // `summary` is inert too, but takes the same one-line/length warnings as
+    // `info.summary` so a relabel can't put a paragraph back on a catalog tile.
+    if let Some(summary) = &delta.summary {
+        for w in crate::template_validation::summary_warnings(summary, "summary") {
+            issues.warn(w.code, w.message, w.path);
+        }
+    }
 
     // The base's FULL keyset (there is no hidden-vs-visible split once compiled;
     // every base action key is off-limits for an extension).
@@ -243,6 +250,22 @@ mod tests {
         }
     }
 
+    #[test]
+    fn validate_warns_on_a_multi_line_delta_summary() {
+        let base = base_with(&[("a", Risk::Read)]);
+        let delta = Delta {
+            summary: Some("One\ntwo".into()),
+            ..Default::default()
+        };
+        let report = validate_delta(&delta, &base, false);
+        assert!(report.valid, "a summary warning never refuses the layer");
+        assert!(
+            report.warnings.iter().any(|w| w.path == "summary"),
+            "{:?}",
+            report.warnings
+        );
+    }
+
     #[test]
     fn validate_accepts_an_https_delta_icon() {
         let base = base_with(&[("a", Risk::Read)]);
diff --git a/crates/overslash-core/src/template_validation/core/action/tests.rs b/crates/overslash-core/src/template_validation/core/action/tests.rs
index 6f6502e26..a0d0a1582 100644
--- a/crates/overslash-core/src/template_validation/core/action/tests.rs
+++ b/crates/overslash-core/src/template_validation/core/action/tests.rs
@@ -567,6 +567,7 @@ fn platform_namespace_action_allowed() {
         key: "overslash".into(),
         display_name: "Overslash".into(),
         description: None,
+        summary: None,
         url_promoted: false,
         hosts: vec![],
         category: Some("platform".into()),
diff --git a/crates/overslash-core/src/template_validation/core/mod.rs b/crates/overslash-core/src/template_validation/core/mod.rs
index 51497a571..8c6a4efa3 100644
--- a/crates/overslash-core/src/template_validation/core/mod.rs
+++ b/crates/overslash-core/src/template_validation/core/mod.rs
@@ -132,6 +132,7 @@ mod tests {
             key: "svc".into(),
             display_name: "Service".into(),
             description: None,
+            summary: None,
             url_promoted: false,
             hosts: vec!["api.example.com".into()],
             category: None,
@@ -283,6 +284,7 @@ mod tests {
             key: "linear_mcp".into(),
             display_name: "Linear".into(),
             description: None,
+            summary: None,
             url_promoted: false,
             hosts: vec![],
             category: None,
diff --git a/crates/overslash-core/src/template_validation/core/service_shape.rs b/crates/overslash-core/src/template_validation/core/service_shape.rs
index ff5db1147..21e93fc6c 100644
--- a/crates/overslash-core/src/template_validation/core/service_shape.rs
+++ b/crates/overslash-core/src/template_validation/core/service_shape.rs
@@ -1,5 +1,6 @@
+use crate::openapi::SUMMARY_MAX_CHARS;
 use crate::service_icon::{MAX_ICON_LEN, ServiceIcon};
-use crate::template_validation::Issues;
+use crate::template_validation::{Issues, ValidationIssue};
 use crate::types::{Runtime, ServiceDefinition};
 
 // --- service-level ---------------------------------------------------------
@@ -46,6 +47,29 @@ pub(super) fn check_service_shape(def: &ServiceDefinition, issues: &mut Issues)
 /// and `javascript:` are refused outright rather than dropped silently: a
 /// dropped value teaches the author it worked, and a reviewer reading the
 /// validation report wants the attempt named.
+/// Shape warnings for a catalog tagline (`info.summary`, or a derived layer's
+/// `summary` relabel). Warnings, not errors: the dashboard can clamp a long
+/// value, and refusing a whole template over its tagline is the worse failure.
+pub(crate) fn summary_warnings(summary: &str, path: &str) -> Vec<ValidationIssue> {
+    let mut out = Vec::new();
+    if summary.contains(['\n', '\r']) {
+        out.push(ValidationIssue::new(
+            "openapi_invalid",
+            "summary must be a single line (put longer text in `description`)",
+            path,
+        ));
+    }
+    let len = summary.chars().count();
+    if len > SUMMARY_MAX_CHARS {
+        out.push(ValidationIssue::new(
+            "openapi_invalid",
+            format!("summary must be at most {SUMMARY_MAX_CHARS} characters (got {len})"),
+            path,
+        ));
+    }
+    out
+}
+
 pub(crate) fn check_service_icon(icon: Option<&ServiceIcon>, path: &str, issues: &mut Issues) {
     let Some(icon) = icon else {
         return;
diff --git a/crates/overslash-core/src/template_validation/json.rs b/crates/overslash-core/src/template_validation/json.rs
index 243e79862..b138e9bcc 100644
--- a/crates/overslash-core/src/template_validation/json.rs
+++ b/crates/overslash-core/src/template_validation/json.rs
@@ -67,6 +67,7 @@ pub fn parse_template_parts(
         key: key.to_string(),
         display_name: display_name.to_string(),
         description: description.map(|s| s.to_string()),
+        summary: None,
         url_promoted: false,
         hosts: hosts.to_vec(),
         category: category.map(|s| s.to_string()),
diff --git a/crates/overslash-core/src/template_validation/mod.rs b/crates/overslash-core/src/template_validation/mod.rs
index 75d387ffc..97e4dd14c 100644
--- a/crates/overslash-core/src/template_validation/mod.rs
+++ b/crates/overslash-core/src/template_validation/mod.rs
@@ -35,7 +35,7 @@ pub mod json;
 #[cfg(feature = "yaml")]
 pub mod yaml;
 
-pub(crate) use core::service_shape::check_service_icon;
+pub(crate) use core::service_shape::{check_service_icon, summary_warnings};
 pub use core::validate_service_definition;
 pub use json::{parse_template_parts, validate_template_parts};
 #[cfg(feature = "yaml")]
diff --git a/crates/overslash-core/src/types/service/definition.rs b/crates/overslash-core/src/types/service/definition.rs
index b7671a7f8..95e59266f 100644
--- a/crates/overslash-core/src/types/service/definition.rs
+++ b/crates/overslash-core/src/types/service/definition.rs
@@ -71,6 +71,11 @@ pub struct ServiceDefinition {
     pub display_name: String,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub description: Option<String>,
+    /// `info.summary` — a one-line tagline for UI catalogs (at most
+    /// [`SUMMARY_MAX_CHARS`](crate::openapi::SUMMARY_MAX_CHARS) chars).
+    /// Agents keep `description`; this is never put on `/v1/search` or MCP.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub summary: Option<String>,
     pub hosts: Vec<String>,
     /// `servers[0].x-overslash-promoted`: the instance form shows the endpoint
     /// URL in its main section instead of behind "Show more options". Every
@@ -598,6 +603,7 @@ mod tests {
             key: "slack".into(),
             display_name: "Slack".into(),
             description: None,
+            summary: None,
             url_promoted: false,
             hosts: vec!["slack.com".into()],
             category: None,
@@ -661,6 +667,7 @@ mod tests {
             key: "linear_mcp".into(),
             display_name: "Linear".into(),
             description: None,
+            summary: None,
             url_promoted: false,
             hosts: vec![],
             category: Some("Development".into()),
diff --git a/dashboard/scripts/screenshot-template-summary.mjs b/dashboard/scripts/screenshot-template-summary.mjs
new file mode 100644
index 000000000..27667a472
--- /dev/null
+++ b/dashboard/scripts/screenshot-template-summary.mjs
@@ -0,0 +1,27 @@
+// Real-stack screenshots for `info.summary` — the one-line catalog tagline.
+//
+// Every shipped template carries a summary, so no seeding is needed: the
+// Create Service picker's cards render `summary ?? description` straight from
+// /v1/templates, with the full agent-facing description kept as the tooltip.
+//
+// Prereq: `make e2e-up`. Output:
+//   dashboard/screenshots/template-summary-create-service.png
+
+import { login, makeSnapper } from '../tests/scenarios/index.mjs';
+
+const adminSession = await login('admin');
+
+const snap = await makeSnapper(adminSession);
+try {
+	const { ctx } = await snap.navigateAndSnap('template-summary-create-service', '/services/new', {
+		viewport: { width: 1280, height: 1000 },
+		waitFor: async (p) => {
+			await p.locator('text=Repositories, issues, pull requests').first().waitFor({ timeout: 15_000 });
+		}
+	});
+	await ctx.close();
+
+	console.log('[template-summary] done');
+} finally {
+	await snap.close();
+}
diff --git a/dashboard/src/lib/components/services/TemplateCard.svelte b/dashboard/src/lib/components/services/TemplateCard.svelte
index 6ae95c272..679e29ae5 100644
--- a/dashboard/src/lib/components/services/TemplateCard.svelte
+++ b/dashboard/src/lib/components/services/TemplateCard.svelte
@@ -31,8 +31,10 @@
 		</span>
 	</div>
 	<div class="key">{template.key}</div>
-	{#if template.description}
-		<p class="desc">{template.description}</p>
+	{#if template.summary ?? template.description}
+		<p class="desc" title={template.summary ? template.description : undefined}>
+			{template.summary ?? template.description}
+		</p>
 	{/if}
 	<div class="meta">
 		<span>{template.action_count} action{template.action_count === 1 ? '' : 's'}</span>
diff --git a/dashboard/src/lib/components/templates/TemplateCatalog.svelte b/dashboard/src/lib/components/templates/TemplateCatalog.svelte
index 0f44973e9..51b363089 100644
--- a/dashboard/src/lib/components/templates/TemplateCatalog.svelte
+++ b/dashboard/src/lib/components/templates/TemplateCatalog.svelte
@@ -119,7 +119,7 @@
 			for (const expr of filterTerms(searchValue)) {
 				if (!matchesExpression(t, expr)) return false;
 			}
-			return matchesAllText([t.key, t.display_name, t.description ?? ''], searchValue);
+			return matchesAllText([t.key, t.display_name, t.summary ?? '', t.description ?? ''], searchValue);
 		})
 	);
 
diff --git a/dashboard/src/lib/types.ts b/dashboard/src/lib/types.ts
index 8c3401d22..4dd361912 100644
--- a/dashboard/src/lib/types.ts
+++ b/dashboard/src/lib/types.ts
@@ -285,6 +285,8 @@ export interface TemplateSummary {
   key: string;
   display_name: string;
   description?: string | null;
+  /** `info.summary` — one-line catalog tagline; prefer it over `description`. */
+  summary?: string | null;
   category?: string | null;
   hosts: string[];
   action_count: number;
@@ -374,6 +376,7 @@ export interface Delta {
   /** Relabel the template / description. */
   display_name?: string;
   description?: string;
+  summary?: string;
   /** Keep only these action keys (∩). `[]` = expose nothing; omit = keep all. */
   allowlist?: string[];
   /** Drop these action keys (\). */
@@ -417,6 +420,8 @@ export interface TemplateDetail {
   key: string;
   display_name: string;
   description?: string | null;
+  /** `info.summary` — one-line catalog tagline; prefer it over `description`. */
+  summary?: string | null;
   category?: string | null;
   hosts: string[];
   /** Absolute URL of the catalog icon, resolved server-side (a built-in asset
diff --git a/dashboard/src/routes/services/new/+page.svelte b/dashboard/src/routes/services/new/+page.svelte
index 039ecf352..738371250 100644
--- a/dashboard/src/routes/services/new/+page.svelte
+++ b/dashboard/src/routes/services/new/+page.svelte
@@ -234,7 +234,7 @@
 			for (const expr of filterTerms(searchValue)) {
 				if (!templateMatches(t, expr)) return false;
 			}
-			return matchesAllText([t.key, t.display_name, t.description ?? ''], searchValue);
+			return matchesAllText([t.key, t.display_name, t.summary ?? '', t.description ?? ''], searchValue);
 		})
 	);
 
diff --git a/services/deepwiki.yaml b/services/deepwiki.yaml
index e9730b5eb..f2250a01a 100644
--- a/services/deepwiki.yaml
+++ b/services/deepwiki.yaml
@@ -1,6 +1,7 @@
 openapi: 3.1.0
 info:
   title: DeepWiki
+  summary: Browse wikis and ask questions about public GitHub repositories
   key: deepwiki
   category: Documentation
   description: >
diff --git a/services/email.yaml b/services/email.yaml
index 402dff35e..41459c954 100644
--- a/services/email.yaml
+++ b/services/email.yaml
@@ -1,6 +1,7 @@
 openapi: 3.1.0
 info:
   title: Email
+  summary: Read and send mail on any IMAP/SMTP mailbox, like Fastmail, iCloud, or Zoho
   key: email
   category: Communication
   # Folded into the text every action is scored against
diff --git a/services/eventbrite.yaml b/services/eventbrite.yaml
index 5443cb7db..c3587dc65 100644
--- a/services/eventbrite.yaml
+++ b/services/eventbrite.yaml
@@ -1,6 +1,7 @@
 openapi: 3.1.0
 info:
   title: Eventbrite
+  summary: Look up events, ticket classes, attendees, and your orders on Eventbrite
   key: eventbrite
   category: Events
 servers:
diff --git a/services/figma.yaml b/services/figma.yaml
index b891395e8..cadf30165 100644
--- a/services/figma.yaml
+++ b/services/figma.yaml
@@ -16,6 +16,7 @@
 openapi: 3.1.0
 info:
   title: Figma
+  summary: Read Figma files, renders, and design systems; leave comments and dev links
   key: figma
   category: Design
   description: >-
diff --git a/services/github.yaml b/services/github.yaml
index b07f8821a..e2579b719 100644
--- a/services/github.yaml
+++ b/services/github.yaml
@@ -16,6 +16,7 @@
 openapi: 3.1.0
 info:
   title: GitHub
+  summary: Repositories, issues, pull requests, and code on GitHub
   key: github
   category: Development
   description: >-
diff --git a/services/gmail.yaml b/services/gmail.yaml
index 57f0d24c1..4eda1a1e6 100644
--- a/services/gmail.yaml
+++ b/services/gmail.yaml
@@ -1,6 +1,7 @@
 openapi: 3.1.0
 info:
   title: Gmail
+  summary: Send, read, search, and organize Gmail messages, labels, and drafts
   description: Gmail API — send, read, search, and manage email messages, labels, and drafts.
   key: gmail
   category: Communication
diff --git a/services/google_calendar.yaml b/services/google_calendar.yaml
index 2378abdf7..037424d46 100644
--- a/services/google_calendar.yaml
+++ b/services/google_calendar.yaml
@@ -1,6 +1,7 @@
 openapi: 3.1.0
 info:
   title: Google Calendar
+  summary: View, create, update, and delete events on your Google calendars
   key: google_calendar
   category: Productivity
 servers:
diff --git a/services/google_drive.yaml b/services/google_drive.yaml
index a2f7568d9..c21622b8e 100644
--- a/services/google_drive.yaml
+++ b/services/google_drive.yaml
@@ -1,6 +1,7 @@
 openapi: 3.1.0
 info:
   title: Google Drive
+  summary: Find, read, share, and organize files and folders in Google Drive
   description: Google Drive API — files, folders, permissions, and sharing.
   key: google_drive
   category: Storage
diff --git a/services/google_keep.yaml b/services/google_keep.yaml
index 2837fdb2b..f9fcba1c9 100644
--- a/services/google_keep.yaml
+++ b/services/google_keep.yaml
@@ -1,6 +1,7 @@
 openapi: 3.1.0
 info:
   title: Google Keep
+  summary: Create, read, and delete Google Keep notes and checklists
   description: Google Keep — create, list, read, and delete notes (text or checklist).
   key: google_keep
   category: Productivity
diff --git a/services/google_tasks.yaml b/services/google_tasks.yaml
index 62e534cda..3a96688cd 100644
--- a/services/google_tasks.yaml
+++ b/services/google_tasks.yaml
@@ -1,6 +1,7 @@
 openapi: 3.1.0
 info:
   title: Google Tasks
+  summary: Manage task lists and to-dos in Google Tasks
   key: google_tasks
   category: Productivity
 servers:
diff --git a/services/holded.yaml b/services/holded.yaml
index 3d1e826fc..3a63152f5 100644
--- a/services/holded.yaml
+++ b/services/holded.yaml
@@ -28,6 +28,7 @@
 openapi: 3.1.0
 info:
   title: Holded
+  summary: Invoices, contacts, payments, and bookkeeping in Holded ERP
   key: holded
   category: Finance
   description: >-
diff --git a/services/hubspot.yaml b/services/hubspot.yaml
index 8d485078d..7cbd8e646 100644
--- a/services/hubspot.yaml
+++ b/services/hubspot.yaml
@@ -20,6 +20,7 @@
 openapi: 3.1.0
 info:
   title: HubSpot
+  summary: Contacts, companies, deals, tickets, and campaign analytics in HubSpot CRM
   key: hubspot
   category: CRM
   description: >-
diff --git a/services/langfuse.yaml b/services/langfuse.yaml
index c1cf9ef2c..6a07b03a1 100644
--- a/services/langfuse.yaml
+++ b/services/langfuse.yaml
@@ -86,6 +86,7 @@
 openapi: 3.1.0
 info:
   title: Langfuse
+  summary: LLM traces, cost and latency metrics, evaluation scores, and prompts
   key: langfuse
   category: Analytics
   # Folded into the text every action is scored against, so the wording is a
diff --git a/services/linkedin.yaml b/services/linkedin.yaml
index e65084d0d..27b96c2fb 100644
--- a/services/linkedin.yaml
+++ b/services/linkedin.yaml
@@ -1,6 +1,7 @@
 openapi: 3.1.0
 info:
   title: LinkedIn
+  summary: Read your LinkedIn profile, publish posts, and look up organizations
   description: >-
     LinkedIn Marketing & member APIs — read the authenticated member's profile
     (OpenID Connect), publish member shares (UGC Posts), and look up
diff --git a/services/metabase.yaml b/services/metabase.yaml
index 29b51aea9..5e8b86e3a 100644
--- a/services/metabase.yaml
+++ b/services/metabase.yaml
@@ -1,6 +1,7 @@
 openapi: 3.1.0
 info:
   title: Metabase
+  summary: Run saved questions and SQL queries against your Metabase instance
   key: metabase
   category: Analytics
   description: >-
diff --git a/services/notion.yaml b/services/notion.yaml
index 4eb19bde4..2ded2722e 100644
--- a/services/notion.yaml
+++ b/services/notion.yaml
@@ -1,6 +1,7 @@
 openapi: 3.1.0
 info:
   title: Notion
+  summary: Search Notion, query databases, and create or extend pages
   key: notion
   category: Productivity
 servers:
diff --git a/services/outlook.yaml b/services/outlook.yaml
index 096988a37..327448122 100644
--- a/services/outlook.yaml
+++ b/services/outlook.yaml
@@ -1,6 +1,7 @@
 openapi: 3.1.0
 info:
   title: Outlook
+  summary: Send, read, search, and organize Outlook mail, drafts, and folders
   description: Microsoft Outlook mail via the Graph API — send, read, search, and manage email messages, drafts, and mail folders.
   key: outlook
   category: Communication
diff --git a/services/overslash.yaml b/services/overslash.yaml
index fc55643d1..866c222c2 100644
--- a/services/overslash.yaml
+++ b/services/overslash.yaml
@@ -2,6 +2,7 @@ openapi: 3.1.0
 x-overslash-runtime: platform
 info:
   title: Overslash Platform
+  summary: Manage identities, secrets, services, and permissions in your org
   description: Administrative access to the Overslash platform
   key: overslash
   category: Platform
diff --git a/services/resend.yaml b/services/resend.yaml
index 1ffb1558c..60e053f87 100644
--- a/services/resend.yaml
+++ b/services/resend.yaml
@@ -1,6 +1,7 @@
 openapi: 3.1.0
 info:
   title: Resend
+  summary: Send email and list sending domains with Resend
   key: resend
   category: Communication
 servers:
diff --git a/services/shortcut.yaml b/services/shortcut.yaml
index 85a4d96eb..188a8e975 100644
--- a/services/shortcut.yaml
+++ b/services/shortcut.yaml
@@ -14,6 +14,7 @@
 openapi: 3.1.0
 info:
   title: Shortcut
+  summary: Stories, epics, iterations, and comments in Shortcut
   key: shortcut
   category: Development
   description: >-
diff --git a/services/slack.yaml b/services/slack.yaml
index 884439062..870cacb60 100644
--- a/services/slack.yaml
+++ b/services/slack.yaml
@@ -1,6 +1,7 @@
 openapi: 3.1.0
 info:
   title: Slack
+  summary: Read channels, search, and send messages in Slack as yourself
   key: slack
   category: Communication
   description: >
diff --git a/services/stripe.yaml b/services/stripe.yaml
index 17f2aa213..54335969b 100644
--- a/services/stripe.yaml
+++ b/services/stripe.yaml
@@ -1,6 +1,7 @@
 openapi: 3.1.0
 info:
   title: Stripe
+  summary: List customers and charges, and create charges, in Stripe
   key: stripe
   category: Payments
 servers:
diff --git a/services/telegram.yaml b/services/telegram.yaml
index d457cd0f8..1aefff139 100644
--- a/services/telegram.yaml
+++ b/services/telegram.yaml
@@ -1,6 +1,7 @@
 openapi: 3.1.0
 info:
   title: Telegram
+  summary: Read and send Telegram messages from your own account
   key: telegram
   category: Communication
   description: >
diff --git a/services/test_email.yaml b/services/test_email.yaml
index 09d013d76..af6d8261a 100644
--- a/services/test_email.yaml
+++ b/services/test_email.yaml
@@ -1,6 +1,7 @@
 openapi: 3.1.0
 info:
   title: Test Mail
+  summary: Test mailbox for end-to-end evals
   # Description is weighted by keyword search, so phrase it around the actions
   # the eval scenarios ask for ("send an email", "list messages").
   description: Test email service for end-to-end evals — send an email message and list recent messages.
diff --git a/services/whatsapp.yaml b/services/whatsapp.yaml
index ef43b1fda..b15a0d08b 100644
--- a/services/whatsapp.yaml
+++ b/services/whatsapp.yaml
@@ -20,6 +20,7 @@
 openapi: 3.1.0
 info:
   title: WhatsApp
+  summary: Read and send WhatsApp messages from your paired phone
   key: whatsapp
   category: Communication
   description: >
diff --git a/services/x.yaml b/services/x.yaml
index 40ba6211a..695bd8e47 100644
--- a/services/x.yaml
+++ b/services/x.yaml
@@ -1,6 +1,7 @@
 openapi: 3.1.0
 info:
   title: X (Twitter)
+  summary: Post and delete tweets, and read user timelines on X
   key: x
   category: Social
 servers:

From fdaa51096b3814d2f3f3546b4cd1196a6d908720 Mon Sep 17 00:00:00 2001
From: Factory <factory@overslash.dev>
Date: Thu, 29 Oct 2026 09:07:19 +0000
Subject: [PATCH 2/2] fix(templates): a blank delta.summary inherits instead of
 blanking the base

Trim the relabel like info.summary, and treat whitespace-only as unset.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../overslash-core/src/service_layer/apply.rs | 28 ++++++++++++++++++-
 .../src/service_layer/validate.rs             |  2 +-
 2 files changed, 28 insertions(+), 2 deletions(-)

diff --git a/crates/overslash-core/src/service_layer/apply.rs b/crates/overslash-core/src/service_layer/apply.rs
index 4a5ca2d27..fbf15bf75 100644
--- a/crates/overslash-core/src/service_layer/apply.rs
+++ b/crates/overslash-core/src/service_layer/apply.rs
@@ -171,7 +171,15 @@ pub fn apply_delta(
             .description
             .clone()
             .or_else(|| base.description.clone()),
-        summary: delta.summary.clone().or_else(|| base.summary.clone()),
+        // Trimmed like `info.summary`; a blank relabel inherits rather than
+        // blanking the base's tagline.
+        summary: delta
+            .summary
+            .as_deref()
+            .map(str::trim)
+            .filter(|s| !s.is_empty())
+            .map(str::to_string)
+            .or_else(|| base.summary.clone()),
         url_promoted: false,
         hosts,
         category: base.category.clone(),
@@ -651,6 +659,24 @@ mod tests {
         };
         let (def, _) = apply_delta(&delta, &base);
         assert_eq!(def.summary.as_deref(), Some("Acme's GitHub"));
+
+        let delta = Delta {
+            summary: Some("  Padded  ".into()),
+            ..Default::default()
+        };
+        let (def, _) = apply_delta(&delta, &base);
+        assert_eq!(def.summary.as_deref(), Some("Padded"));
+
+        let delta = Delta {
+            summary: Some("   ".into()),
+            ..Default::default()
+        };
+        let (def, _) = apply_delta(&delta, &base);
+        assert_eq!(
+            def.summary.as_deref(),
+            Some("Base tagline"),
+            "a blank relabel inherits instead of blanking the base"
+        );
     }
 
     #[test]
diff --git a/crates/overslash-core/src/service_layer/validate.rs b/crates/overslash-core/src/service_layer/validate.rs
index ae42ea13a..ed284911e 100644
--- a/crates/overslash-core/src/service_layer/validate.rs
+++ b/crates/overslash-core/src/service_layer/validate.rs
@@ -33,7 +33,7 @@ pub fn validate_delta(
     // `summary` is inert too, but takes the same one-line/length warnings as
     // `info.summary` so a relabel can't put a paragraph back on a catalog tile.
     if let Some(summary) = &delta.summary {
-        for w in crate::template_validation::summary_warnings(summary, "summary") {
+        for w in crate::template_validation::summary_warnings(summary.trim(), "summary") {
             issues.warn(w.code, w.message, w.path);
         }
     }