Server team confirmed /api/v1/agents/config is the only AGENT-role config read route; the env-scoped URL from the 2026-04-16 design returns 403 in practice. This spec documents the agent-side flip, retains strict response env validation, and drops the now-unused application parameter from fetchApplicationConfig. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>