diff --git a/lib/src/generated/fai/v1/hub.pb.dart b/lib/src/generated/fai/v1/hub.pb.dart
index 63f0a23..85da018 100644
--- a/lib/src/generated/fai/v1/hub.pb.dart
+++ b/lib/src/generated/fai/v1/hub.pb.dart
@@ -5431,6 +5431,100 @@ class ClearEventLogResponse extends $pb.GeneratedMessage {
   void clearChannel() => $_clearField(2);
 }
 
+class SetDefaultScopeRequest extends $pb.GeneratedMessage {
+  factory SetDefaultScopeRequest({
+    $core.Iterable<$core.String>? scope,
+  }) {
+    final $result = create();
+    if (scope != null) {
+      $result.scope.addAll(scope);
+    }
+    return $result;
+  }
+  SetDefaultScopeRequest._() : super();
+  factory SetDefaultScopeRequest.fromBuffer($core.List<$core.int> i, [$pb.ExtensionRegistry r = $pb.ExtensionRegistry.EMPTY]) => create()..mergeFromBuffer(i, r);
+  factory SetDefaultScopeRequest.fromJson($core.String i, [$pb.ExtensionRegistry r = $pb.ExtensionRegistry.EMPTY]) => create()..mergeFromJson(i, r);
+
+  static final $pb.BuilderInfo _i = $pb.BuilderInfo(_omitMessageNames ? '' : 'SetDefaultScopeRequest', package: const $pb.PackageName(_omitMessageNames ? '' : 'fai.v1'), createEmptyInstance: create)
+    ..pPS(1, _omitFieldNames ? '' : 'scope')
+    ..hasRequiredFields = false
+  ;
+
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  SetDefaultScopeRequest clone() => SetDefaultScopeRequest()..mergeFromMessage(this);
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  SetDefaultScopeRequest copyWith(void Function(SetDefaultScopeRequest) updates) => super.copyWith((message) => updates(message as SetDefaultScopeRequest)) as SetDefaultScopeRequest;
+
+  $pb.BuilderInfo get info_ => _i;
+
+  @$core.pragma('dart2js:noInline')
+  static SetDefaultScopeRequest create() => SetDefaultScopeRequest._();
+  SetDefaultScopeRequest createEmptyInstance() => create();
+  static $pb.PbList<SetDefaultScopeRequest> createRepeated() => $pb.PbList<SetDefaultScopeRequest>();
+  @$core.pragma('dart2js:noInline')
+  static SetDefaultScopeRequest getDefault() => _defaultInstance ??= $pb.GeneratedMessage.$_defaultFor<SetDefaultScopeRequest>(create);
+  static SetDefaultScopeRequest? _defaultInstance;
+
+  /// New `default_scope` value. The first entry is the
+  /// primary scope (the resolver consults the others in order
+  /// when the primary doesn't match). At least one entry is
+  /// required; the hub returns InvalidArgument otherwise.
+  @$pb.TagNumber(1)
+  $pb.PbList<$core.String> get scope => $_getList(0);
+}
+
+class DefaultScopeResponse extends $pb.GeneratedMessage {
+  factory DefaultScopeResponse({
+    $core.Iterable<$core.String>? scope,
+    $core.Iterable<$core.String>? knownProviders,
+  }) {
+    final $result = create();
+    if (scope != null) {
+      $result.scope.addAll(scope);
+    }
+    if (knownProviders != null) {
+      $result.knownProviders.addAll(knownProviders);
+    }
+    return $result;
+  }
+  DefaultScopeResponse._() : super();
+  factory DefaultScopeResponse.fromBuffer($core.List<$core.int> i, [$pb.ExtensionRegistry r = $pb.ExtensionRegistry.EMPTY]) => create()..mergeFromBuffer(i, r);
+  factory DefaultScopeResponse.fromJson($core.String i, [$pb.ExtensionRegistry r = $pb.ExtensionRegistry.EMPTY]) => create()..mergeFromJson(i, r);
+
+  static final $pb.BuilderInfo _i = $pb.BuilderInfo(_omitMessageNames ? '' : 'DefaultScopeResponse', package: const $pb.PackageName(_omitMessageNames ? '' : 'fai.v1'), createEmptyInstance: create)
+    ..pPS(1, _omitFieldNames ? '' : 'scope')
+    ..pPS(2, _omitFieldNames ? '' : 'knownProviders')
+    ..hasRequiredFields = false
+  ;
+
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  DefaultScopeResponse clone() => DefaultScopeResponse()..mergeFromMessage(this);
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  DefaultScopeResponse copyWith(void Function(DefaultScopeResponse) updates) => super.copyWith((message) => updates(message as DefaultScopeResponse)) as DefaultScopeResponse;
+
+  $pb.BuilderInfo get info_ => _i;
+
+  @$core.pragma('dart2js:noInline')
+  static DefaultScopeResponse create() => DefaultScopeResponse._();
+  DefaultScopeResponse createEmptyInstance() => create();
+  static $pb.PbList<DefaultScopeResponse> createRepeated() => $pb.PbList<DefaultScopeResponse>();
+  @$core.pragma('dart2js:noInline')
+  static DefaultScopeResponse getDefault() => _defaultInstance ??= $pb.GeneratedMessage.$_defaultFor<DefaultScopeResponse>(create);
+  static DefaultScopeResponse? _defaultInstance;
+
+  /// The current `default_scope` after the operation.
+  @$pb.TagNumber(1)
+  $pb.PbList<$core.String> get scope => $_getList(0);
+
+  /// Catalog-known publisher segments the operator may pick
+  /// from, sorted alphabetically. Surfaces a typeahead-friendly
+  /// shortlist in the Studio editor; arbitrary entries are
+  /// still allowed (operator may run a private publisher
+  /// segment that isn't in the central catalog).
+  @$pb.TagNumber(2)
+  $pb.PbList<$core.String> get knownProviders => $_getList(1);
+}
+
 class McpClientConfigEntry extends $pb.GeneratedMessage {
   factory McpClientConfigEntry({
     $core.String? name,
diff --git a/lib/src/generated/fai/v1/hub.pbgrpc.dart b/lib/src/generated/fai/v1/hub.pbgrpc.dart
index 33bd5fc..bccb407 100644
--- a/lib/src/generated/fai/v1/hub.pbgrpc.dart
+++ b/lib/src/generated/fai/v1/hub.pbgrpc.dart
@@ -207,6 +207,14 @@ class HubAdminClient extends $grpc.Client {
       '/fai.v1.HubAdmin/ClearEventLog',
       ($0.ClearEventLogRequest value) => value.writeToBuffer(),
       ($core.List<$core.int> value) => $0.ClearEventLogResponse.fromBuffer(value));
+  static final _$getDefaultScope = $grpc.ClientMethod<$1.Empty, $0.DefaultScopeResponse>(
+      '/fai.v1.HubAdmin/GetDefaultScope',
+      ($1.Empty value) => value.writeToBuffer(),
+      ($core.List<$core.int> value) => $0.DefaultScopeResponse.fromBuffer(value));
+  static final _$setDefaultScope = $grpc.ClientMethod<$0.SetDefaultScopeRequest, $0.DefaultScopeResponse>(
+      '/fai.v1.HubAdmin/SetDefaultScope',
+      ($0.SetDefaultScopeRequest value) => value.writeToBuffer(),
+      ($core.List<$core.int> value) => $0.DefaultScopeResponse.fromBuffer(value));
   static final _$listServices = $grpc.ClientMethod<$1.Empty, $0.ServiceList>(
       '/fai.v1.HubAdmin/ListServices',
       ($1.Empty value) => value.writeToBuffer(),
@@ -440,6 +448,22 @@ class HubAdminClient extends $grpc.Client {
     return $createUnaryCall(_$clearEventLog, request, options: options);
   }
 
+  /// Read the operator's `default_scope:` (the ordered list of
+  /// provider segments the bare-form capability resolver tries
+  /// when a flow names a capability without `<provider>/`
+  /// prefix). Always returns the current in-memory copy.
+  $grpc.ResponseFuture<$0.DefaultScopeResponse> getDefaultScope($1.Empty request, {$grpc.CallOptions? options}) {
+    return $createUnaryCall(_$getDefaultScope, request, options: options);
+  }
+
+  /// Replace the operator's `default_scope:`. The hub validates
+  /// each entry against the namespace catalog before writing to
+  /// disk. Returns the resulting snapshot so the client can
+  /// refresh its UI in one round-trip.
+  $grpc.ResponseFuture<$0.DefaultScopeResponse> setDefaultScope($0.SetDefaultScopeRequest request, {$grpc.CallOptions? options}) {
+    return $createUnaryCall(_$setDefaultScope, request, options: options);
+  }
+
   /// List host services declared in the operator config. Each
   /// entry carries name + endpoint; reachability is operator-side
   /// (on-demand `fai service status` or Studio probe).
@@ -751,6 +775,20 @@ abstract class HubAdminServiceBase extends $grpc.Service {
         false,
         ($core.List<$core.int> value) => $0.ClearEventLogRequest.fromBuffer(value),
         ($0.ClearEventLogResponse value) => value.writeToBuffer()));
+    $addMethod($grpc.ServiceMethod<$1.Empty, $0.DefaultScopeResponse>(
+        'GetDefaultScope',
+        getDefaultScope_Pre,
+        false,
+        false,
+        ($core.List<$core.int> value) => $1.Empty.fromBuffer(value),
+        ($0.DefaultScopeResponse value) => value.writeToBuffer()));
+    $addMethod($grpc.ServiceMethod<$0.SetDefaultScopeRequest, $0.DefaultScopeResponse>(
+        'SetDefaultScope',
+        setDefaultScope_Pre,
+        false,
+        false,
+        ($core.List<$core.int> value) => $0.SetDefaultScopeRequest.fromBuffer(value),
+        ($0.DefaultScopeResponse value) => value.writeToBuffer()));
     $addMethod($grpc.ServiceMethod<$1.Empty, $0.ServiceList>(
         'ListServices',
         listServices_Pre,
@@ -991,6 +1029,14 @@ abstract class HubAdminServiceBase extends $grpc.Service {
     return clearEventLog($call, await $request);
   }
 
+  $async.Future<$0.DefaultScopeResponse> getDefaultScope_Pre($grpc.ServiceCall $call, $async.Future<$1.Empty> $request) async {
+    return getDefaultScope($call, await $request);
+  }
+
+  $async.Future<$0.DefaultScopeResponse> setDefaultScope_Pre($grpc.ServiceCall $call, $async.Future<$0.SetDefaultScopeRequest> $request) async {
+    return setDefaultScope($call, await $request);
+  }
+
   $async.Future<$0.ServiceList> listServices_Pre($grpc.ServiceCall $call, $async.Future<$1.Empty> $request) async {
     return listServices($call, await $request);
   }
@@ -1100,6 +1146,8 @@ abstract class HubAdminServiceBase extends $grpc.Service {
   $async.Future<$0.DecideApprovalResponse> decideApproval($grpc.ServiceCall call, $0.DecideApprovalRequest request);
   $async.Future<$0.VerifyEventChainResponse> verifyEventChain($grpc.ServiceCall call, $1.Empty request);
   $async.Future<$0.ClearEventLogResponse> clearEventLog($grpc.ServiceCall call, $0.ClearEventLogRequest request);
+  $async.Future<$0.DefaultScopeResponse> getDefaultScope($grpc.ServiceCall call, $1.Empty request);
+  $async.Future<$0.DefaultScopeResponse> setDefaultScope($grpc.ServiceCall call, $0.SetDefaultScopeRequest request);
   $async.Future<$0.ServiceList> listServices($grpc.ServiceCall call, $1.Empty request);
   $async.Future<$0.CheckUpdateResponse> checkUpdate($grpc.ServiceCall call, $1.Empty request);
   $async.Future<$0.ChannelStatusResponse> channelStatus($grpc.ServiceCall call, $1.Empty request);
diff --git a/lib/src/generated/fai/v1/hub.pbjson.dart b/lib/src/generated/fai/v1/hub.pbjson.dart
index a28c9fd..f5f174c 100644
--- a/lib/src/generated/fai/v1/hub.pbjson.dart
+++ b/lib/src/generated/fai/v1/hub.pbjson.dart
@@ -1167,6 +1167,32 @@ final $typed_data.Uint8List clearEventLogResponseDescriptor = $convert.base64Dec
     'ChVDbGVhckV2ZW50TG9nUmVzcG9uc2USFgoGcHVyZ2VkGAEgASgEUgZwdXJnZWQSGAoHY2hhbm'
     '5lbBgCIAEoCVIHY2hhbm5lbA==');
 
+@$core.Deprecated('Use setDefaultScopeRequestDescriptor instead')
+const SetDefaultScopeRequest$json = {
+  '1': 'SetDefaultScopeRequest',
+  '2': [
+    {'1': 'scope', '3': 1, '4': 3, '5': 9, '10': 'scope'},
+  ],
+};
+
+/// Descriptor for `SetDefaultScopeRequest`. Decode as a `google.protobuf.DescriptorProto`.
+final $typed_data.Uint8List setDefaultScopeRequestDescriptor = $convert.base64Decode(
+    'ChZTZXREZWZhdWx0U2NvcGVSZXF1ZXN0EhQKBXNjb3BlGAEgAygJUgVzY29wZQ==');
+
+@$core.Deprecated('Use defaultScopeResponseDescriptor instead')
+const DefaultScopeResponse$json = {
+  '1': 'DefaultScopeResponse',
+  '2': [
+    {'1': 'scope', '3': 1, '4': 3, '5': 9, '10': 'scope'},
+    {'1': 'known_providers', '3': 2, '4': 3, '5': 9, '10': 'knownProviders'},
+  ],
+};
+
+/// Descriptor for `DefaultScopeResponse`. Decode as a `google.protobuf.DescriptorProto`.
+final $typed_data.Uint8List defaultScopeResponseDescriptor = $convert.base64Decode(
+    'ChREZWZhdWx0U2NvcGVSZXNwb25zZRIUCgVzY29wZRgBIAMoCVIFc2NvcGUSJwoPa25vd25fcH'
+    'JvdmlkZXJzGAIgAygJUg5rbm93blByb3ZpZGVycw==');
+
 @$core.Deprecated('Use mcpClientConfigEntryDescriptor instead')
 const McpClientConfigEntry$json = {
   '1': 'McpClientConfigEntry',
diff --git a/lib/src/hub_client.dart b/lib/src/hub_client.dart
index 7e74a96..00d47ee 100644
--- a/lib/src/hub_client.dart
+++ b/lib/src/hub_client.dart
@@ -158,6 +158,35 @@ class HubClient {
     return r.events;
   }
 
+  /// Read the operator's `default_scope:` — the ordered list of
+  /// provider segments the bare-form capability resolver
+  /// consults when a flow names a capability without an explicit
+  /// `<provider>/` prefix. Also returns a sorted list of catalog-
+  /// known publisher segments so editors can offer a typeahead
+  /// shortlist (arbitrary entries are still allowed).
+  Future<({List<String> scope, List<String> knownProviders})>
+      getDefaultScope() async {
+    final r = await _admin.getDefaultScope(Empty());
+    return (
+      scope: List<String>.from(r.scope),
+      knownProviders: List<String>.from(r.knownProviders),
+    );
+  }
+
+  /// Replace the operator's `default_scope:`. The hub validates
+  /// the list (non-empty after trimming), persists to
+  /// `~/.fai/config.yaml`, and hot-swaps the in-memory copy
+  /// without a daemon restart. Returns the snapshot.
+  Future<({List<String> scope, List<String> knownProviders})>
+      setDefaultScope(List<String> scope) async {
+    final req = pb.SetDefaultScopeRequest()..scope.addAll(scope);
+    final r = await _admin.setDefaultScope(req);
+    return (
+      scope: List<String>.from(r.scope),
+      knownProviders: List<String>.from(r.knownProviders),
+    );
+  }
+
   /// Server-streaming audit-log subscription. The hub first
   /// replays up to [backfill] historical events (oldest-last so
   /// the receiver sees them in chronological order), then keeps