textus 0.35.1 → 0.39.0

data/lib/textus/cursor_store.rb

@@ -0,0 +1,24 @@
+require "fileutils"
+
+module Textus
+  # Per-role cursor cache under <root>/.run/state/cursor.<role>. A convenience so
+  # `textus pulse` (no --since) means "since I last looked". Gitignored;
+  # losing it just re-emits recent deltas, never corrupts the store. ADR 0036/0038.
+  class CursorStore
+    def initialize(root:, role:)
+      @path = Textus::Layout.cursor(root, role)
+    end
+
+    def read
+      Integer(File.read(@path).strip)
+    rescue Errno::ENOENT, ArgumentError
+      0
+    end
+
+    def write(seq)
+      FileUtils.mkdir_p(File.dirname(@path))
+      File.write(@path, seq.to_s)
+      seq
+    end
+  end
+end

data/lib/textus/dispatcher.rb

@@ -6,6 +6,7 @@ module Textus
     VERBS = {
       # Write
       put: Textus::Write::Put,
+      propose: Textus::Write::Propose,
       delete: Textus::Write::Delete,
       mv: Textus::Write::Mv,
       accept: Textus::Write::Accept,
@@ -30,11 +31,12 @@ module Textus
       pulse: Textus::Read::Pulse,
       policy_explain: Textus::Read::PolicyExplain,
       published: Textus::Read::Published,
-      schema_envelope: Textus::Read::SchemaEnvelope,
+      schema: Textus::Read::SchemaEnvelope,
       validate_all: Textus::Read::ValidateAll,
       doctor: Textus::Read::Doctor,
       boot: Textus::Read::Boot,
       retainable: Textus::Read::Retainable,
+      rules: Textus::Read::Rules,
 
       # Maintenance
       migrate: Textus::Maintenance::Migrate,

data/lib/textus/doctor/check/audit_log.rb

@@ -3,7 +3,7 @@ module Textus
     class Check
       class AuditLog < Check
         def call
-          path = File.join(root, "audit.log")
+          path = Textus::Layout.audit_log(root)
           Textus::Ports::AuditLog.new(root).verify_integrity.map do |v|
             {
               "code" => "audit.parse_error",

data/lib/textus/doctor/check/fetch_locks.rb

@@ -1,7 +1,7 @@
 module Textus
   module Doctor
     class Check
-      # Lists per-key fetch lock files under <root>/.locks/ whose
+      # Lists per-key fetch lock files under <root>/.run/locks/ whose
       # recorded PID is no longer running. These are forensic artifacts only:
       # Fetch::Lock uses flock(2), which the kernel releases on process
       # death, so stale files do not block subsequent acquires. The check
@@ -9,7 +9,7 @@ module Textus
       # (e.g. a fetch path that crashes repeatedly).
       class FetchLocks < Check
         def call
-          dir = File.join(root, ".locks")
+          dir = Textus::Layout.locks(root)
           return [] unless File.directory?(dir)
 
           Dir.glob(File.join(dir, "*.lock")).filter_map { |path| inspect_lock(path) }

data/lib/textus/doctor/check/illegal_keys.rb

@@ -11,15 +11,18 @@ module Textus
             next unless File.directory?(base)
 
             index_fn = entry.respond_to?(:index_filename) ? entry.index_filename : nil
-            index_fn ? check_index_paths(entry, index_fn, base, out) : check_all_paths(base, out)
+            index_fn ? check_index_paths(entry, index_fn, base, out) : check_all_paths(entry, base, out)
           end
           out
         end
 
         private
 
-        def check_all_paths(base, out)
+        def check_all_paths(entry, base, out)
           walk_nested(base) do |abs_path, is_dir|
+            rel = abs_path.sub(%r{\A#{Regexp.escape(base)}/?}, "")
+            next if entry.ignored?(rel)
+
             basename = File.basename(abs_path)
             stem = is_dir ? basename : basename.sub(/#{Regexp.escape(File.extname(basename))}\z/, "")
             next if stem.match?(Key::Grammar::SEGMENT)
@@ -31,10 +34,13 @@ module Textus
         # When the entry uses `index_filename:`, only the parent-directory
         # segments leading to each index file participate in keys. Sibling
         # files and unrelated subtrees are not enumerated and must not be
-        # flagged. Each illegal segment is reported once per path.
-        def check_index_paths(_entry, index_fn, base, out)
+        # flagged. Each illegal segment is reported once per path. Paths under
+        # an ignored subtree (ADR 0042) are excluded before any segment check.
+        def check_index_paths(entry, index_fn, base, out)
           Dir.glob(File.join(base, "**", index_fn)).each do |fp|
             rel = fp.sub(%r{\A#{Regexp.escape(base)}/?}, "")
+            next if entry.ignored?(rel)
+
             File.dirname(rel).split("/").reject { |s| s.empty? || s == "." }.each do |seg|
               next if seg.match?(Key::Grammar::SEGMENT)
 

data/lib/textus/domain/policy/evaluation.rb

@@ -3,16 +3,13 @@
 module Textus
   module Domain
     module Policy
-      # Immutable context handed to every predicate. `snapshot` is the
+      # Immutable context handed to every predicate. `manifest` is the
       # manifest (pure, no I/O); `envelope` is the entry under evaluation
       # (nil when no bytes exist yet, e.g. a fresh put). `origin`/`target`
       # are dotted keys; `transition` is the verb symbol.
       Evaluation = Data.define(
-        :actor, :transition, :origin, :target, :envelope, :snapshot
-      ) do
-        def manifest = snapshot
-        def role     = actor
-      end
+        :actor, :transition, :origin, :target, :envelope, :manifest
+      )
     end
   end
 end

data/lib/textus/init.rb

@@ -92,6 +92,10 @@ module Textus
       end
       File.write(File.join(target_root, "hooks", "README.md"), HOOKS_README)
       File.write(File.join(target_root, "manifest.yaml"), DEFAULT_MANIFEST)
+      FileUtils.mkdir_p(Textus::Layout.audit_dir(target_root))
+      FileUtils.mkdir_p(Textus::Layout.state(target_root))
+      FileUtils.mkdir_p(Textus::Layout.locks(target_root))
+      File.write(File.join(target_root, ".gitignore"), Textus::Layout::GITIGNORE)
       { "protocol" => PROTOCOL, "initialized" => target_root }
     end
   end

data/lib/textus/layout.rb

@@ -0,0 +1,41 @@
+module Textus
+  # Single source of truth for every path textus owns under a store root.
+  # All disposable runtime state nests under <root>/.run/ so the
+  # tracked/disposable boundary is a directory boundary. ADR 0038.
+  module Layout
+    RUN = ".run"
+
+    def self.run(root)
+      File.join(root, RUN)
+    end
+
+    def self.state(root)
+      File.join(run(root), "state")
+    end
+
+    def self.cursor(root, role)
+      File.join(state(root), "cursor.#{role}")
+    end
+
+    def self.locks(root)
+      File.join(run(root), "locks")
+    end
+
+    def self.build_lock(root)
+      File.join(run(root), "build.lock")
+    end
+
+    def self.audit_dir(root)
+      File.join(run(root), "audit")
+    end
+
+    def self.audit_log(root)
+      File.join(audit_dir(root), "audit.log")
+    end
+
+    GITIGNORE = <<~GITIGNORE
+      # textus runtime artifacts — safe to delete, never commit
+      #{RUN}/
+    GITIGNORE
+  end
+end

data/lib/textus/maintenance/key_delete_prefix.rb

@@ -2,6 +2,15 @@ module Textus
   module Maintenance
     # Bulk-delete every leaf key under `prefix`.
     class KeyDeletePrefix
+      extend Textus::Contract::DSL
+
+      verb     :key_delete_prefix
+      summary  "Bulk-delete every leaf key under prefix."
+      surfaces :cli, :ruby, :mcp
+      arg :prefix,  String, required: true
+      arg :dry_run, :boolean
+      response(&:to_h)
+
       def initialize(container:, call:)
         @container    = container
         @call         = call

data/lib/textus/maintenance/key_mv_prefix.rb

@@ -3,6 +3,16 @@ module Textus
     # Bulk-rename every leaf key under `from_prefix` to `to_prefix`.
     # Calls Write::Mv directly for each entry — emits one audit row per file moved.
     class KeyMvPrefix
+      extend Textus::Contract::DSL
+
+      verb     :key_mv_prefix
+      summary  "Bulk-rename every leaf key under from_prefix to to_prefix. Dry-run returns a Plan; apply with dry_run: false."
+      surfaces :cli, :ruby, :mcp
+      arg :from_prefix, String, required: true
+      arg :to_prefix,   String, required: true
+      arg :dry_run,     :boolean
+      response(&:to_h)
+
       def initialize(container:, call:)
         @container    = container
         @call         = call

data/lib/textus/maintenance/migrate.rb

@@ -5,6 +5,15 @@ module Textus
     # Loads a YAML migration plan and dispatches each op to the
     # appropriate Maintenance use case. Concatenates resulting Plans.
     class Migrate
+      extend Textus::Contract::DSL
+
+      verb     :migrate
+      summary  "Run a YAML migration plan (multi-op)."
+      surfaces :cli, :ruby, :mcp
+      arg :plan_yaml, String, required: true
+      arg :dry_run,   :boolean
+      response(&:to_h)
+
       def initialize(container:, call:)
         @container    = container
         @call         = call

data/lib/textus/maintenance/rule_lint.rb

@@ -6,6 +6,14 @@ module Textus
     # YAML string. Returns a Plan describing rule additions/removals/
     # changes. Does NOT write anything.
     class RuleLint
+      extend Textus::Contract::DSL
+
+      verb     :rule_lint
+      summary  "Diff candidate manifest YAML's rules against the live manifest. No writes."
+      surfaces :cli, :ruby, :mcp
+      arg :candidate_yaml, String, required: true
+      response(&:to_h)
+
       def initialize(container:, call:)
         @container = container
         @call      = call

data/lib/textus/maintenance/zone_mv.rb

@@ -6,6 +6,16 @@ module Textus
     # the `zone:` field on every entry under the old zone, and moves
     # every file from zones/<old>/ to zones/<new>/.
     class ZoneMv
+      extend Textus::Contract::DSL
+
+      verb     :zone_mv
+      summary  "Rename a zone — manifest + files. Refuses if destination exists."
+      surfaces :cli, :ruby, :mcp
+      arg :from,    String, required: true
+      arg :to,      String, required: true
+      arg :dry_run, :boolean
+      response(&:to_h)
+
       def initialize(container:, call:)
         @container = container
         @call      = call

data/lib/textus/manifest/entry/base.rb

@@ -39,6 +39,11 @@ module Textus
         def events         = {}
         def publish_each   = nil
         def index_filename = nil
+        def ignore         = []
+
+        # Per-entry ignore (ADR 0042). Base entries enumerate no tree, so
+        # nothing is ever ignored; Nested overrides with real patterns.
+        def ignored?(_rel_path) = false
 
         # Minimal context object passed into entry `publish_via` hooks.
         # Everything beyond the three primitives is derived. Data.define

data/lib/textus/manifest/entry/ignore_matcher.rb

@@ -0,0 +1,46 @@
+module Textus
+  class Manifest
+    class Entry
+      # Pure glob matcher backing per-entry `ignore:` patterns (ADR 0042).
+      # `rel_path` is the slash-joined path of a candidate file relative to the
+      # entry's base directory.
+      #
+      # Matching is segment-wise so the `**` globstar means "zero or more path
+      # segments" — `File.fnmatch` alone cannot express this (under
+      # FNM_PATHNAME a trailing `**` will not cross a `/`; without it a leading
+      # `**/` will not match zero leading segments). So `**/node_modules/**`
+      # catches the `node_modules` subtree at any depth, including the store
+      # root, and the directory entry itself.
+      #
+      # Within a single segment, matching delegates to `File.fnmatch` with
+      # FNM_EXTGLOB, so a single `*` is anchored to that segment (it does not
+      # cross `/`) and `{a,b}` alternation works.
+      module IgnoreMatcher
+        SEGMENT_FLAGS = File::FNM_EXTGLOB
+
+        def self.match?(patterns, rel_path)
+          path_segs = rel_path.split("/").reject(&:empty?)
+          Array(patterns).any? do |pat|
+            match_segments(pat.split("/").reject(&:empty?), path_segs)
+          end
+        end
+
+        # Classic globstar matcher. `**` matches zero or more whole segments;
+        # any other pattern segment matches exactly one path segment via fnmatch.
+        def self.match_segments(pat_segs, path_segs)
+          return path_segs.empty? if pat_segs.empty?
+
+          if pat_segs.first == "**"
+            match_segments(pat_segs[1..], path_segs) ||
+              (!path_segs.empty? && match_segments(pat_segs, path_segs[1..]))
+          else
+            !path_segs.empty? &&
+              File.fnmatch?(pat_segs.first, path_segs.first, SEGMENT_FLAGS) &&
+              match_segments(pat_segs[1..], path_segs[1..])
+          end
+        end
+        private_class_method :match_segments
+      end
+    end
+  end
+end

data/lib/textus/manifest/entry/nested.rb

@@ -5,16 +5,22 @@ module Textus
         PUBLISH_EACH_VARS   = Validators::PublishEach::KNOWN_VARS
         PUBLISH_EACH_VAR_RE = Validators::PublishEach::VAR_RE
 
-        attr_reader :index_filename, :publish_each
+        attr_reader :index_filename, :publish_each, :ignore
 
-        def initialize(index_filename: nil, publish_each: nil, **rest)
+        def initialize(index_filename: nil, publish_each: nil, ignore: nil, **rest)
           super(**rest)
           @index_filename = index_filename
           @publish_each = publish_each
+          @ignore = Array(ignore)
         end
 
         def nested? = true
 
+        # True when `rel_path` (slash-joined, relative to the entry base) matches
+        # any configured ignore glob. Evaluated ABOVE key-legality (ADR 0042):
+        # an ignored path is excluded, never judged.
+        def ignored?(rel_path) = IgnoreMatcher.match?(@ignore, rel_path)
+
         def publish_target_for(full_key)
           return nil if @publish_each.nil?
 
@@ -65,6 +71,7 @@ module Textus
           new(
             index_filename: raw["index_filename"],
             publish_each: raw["publish_each"],
+            ignore: raw["ignore"],
             **common,
           )
         end

data/lib/textus/manifest/entry/validators/ignore.rb

@@ -0,0 +1,28 @@
+module Textus
+  class Manifest
+    class Entry
+      module Validators
+        # Validates the per-entry `ignore:` field (ADR 0042): a list of
+        # non-empty glob strings, allowed only on nested entries.
+        module Ignore
+          def self.call(entry, policy: nil) # rubocop:disable Lint/UnusedMethodArgument
+            patterns = entry.raw["ignore"]
+            return if patterns.nil?
+
+            raise UsageError.new("entry '#{entry.key}': ignore requires nested: true") unless entry.nested?
+
+            raise UsageError.new("entry '#{entry.key}': ignore must be a list of glob strings") unless patterns.is_a?(Array)
+
+            patterns.each do |pat|
+              next if pat.is_a?(String) && !pat.empty?
+
+              raise UsageError.new(
+                "entry '#{entry.key}': each ignore pattern must be a non-empty string (got #{pat.inspect})",
+              )
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/textus/manifest/entry/validators.rb

@@ -7,6 +7,7 @@ module Textus
           PublishEach,
           InjectBoot,
           IndexFilename,
+          Ignore,
           FormatMatrix,
         ].freeze
 

data/lib/textus/manifest/resolver.rb

@@ -78,6 +78,8 @@ module Textus
 
       def nested_row_for(entry, base, path)
         rel = path.sub(%r{\A#{Regexp.escape(base)}/?}, "")
+        return nil if entry.ignored?(rel)
+
         entry_if = entry.index_filename
         stripped = entry_if ? File.dirname(rel) : rel.sub(/#{Regexp.escape(File.extname(rel))}\z/, "")
         segs = stripped.split("/").reject { |s| s.empty? || s == "." }

data/lib/textus/manifest/schema.rb

@@ -25,7 +25,7 @@ module Textus
       ENTRY_KEYS = %w[
         key path zone kind schema owner nested format
         compute template publish_to publish_each
-        intake events inject_boot index_filename
+        intake events inject_boot index_filename ignore
       ].freeze
       COMPUTE_KEYS = %w[kind select pluck sort_by limit transform command sources].freeze
       INTAKE_KEYS  = %w[handler config].freeze

data/lib/textus/mcp/catalog.rb

@@ -0,0 +1,72 @@
+module Textus
+  module MCP
+    # Derives the entire MCP tool surface from the per-verb contracts
+    # (ADR 0039). `tool_schemas` feeds tools/list; `call` is the generic
+    # tools/call dispatch: map JSON args -> (positional, keyword) per the
+    # contract, invoke the verb through the role scope, then shape the
+    # return value with the contract's response block. No per-tool code.
+    module Catalog
+      module_function
+
+      # Contracts of every MCP-surfaced verb, in Dispatcher order.
+      def specs
+        Textus::Dispatcher::VERBS.values
+                                 .select { |k| k.respond_to?(:contract?) && k.contract? && k.contract.mcp? }
+                                 .map(&:contract)
+      end
+
+      def tool_schemas
+        specs.map do |s|
+          { name: s.verb.to_s, description: s.summary, inputSchema: s.input_schema }
+        end.freeze
+      end
+
+      def names
+        specs.map { |s| s.verb.to_s }
+      end
+
+      def call(name, session:, store:, args:)
+        klass = Textus::Dispatcher::VERBS[name.to_sym]
+        raise ToolError.new("unknown tool: #{name}") unless klass.respond_to?(:contract?) && klass.contract? && klass.contract.mcp?
+
+        spec = klass.contract
+        pos, kw = map_args(spec, args || {}, session)
+        result = store.as(session.role).public_send(spec.verb, *pos, **kw)
+        spec.response.call(result)
+      rescue ContractDrift, CursorExpired
+        raise
+      rescue Textus::Error => e
+        raise ToolError.new("#{name}: #{e.message}")
+      end
+
+      # Splits the raw JSON arg hash into the positional list and keyword hash
+      # the use-case expects, validating required presence first.
+      # Session-default args (session_default: :method_name) are injected from
+      # the session when absent from the wire; they are never treated as missing.
+      # Positional args are emitted in contract declaration order; use-case signatures must match.
+      def map_args(spec, raw, session = nil)
+        missing = spec.required_args.map { |a| a.name.to_s } - raw.keys
+        raise ToolError.new("#{spec.verb}: missing #{missing.join(", ")}") unless missing.empty?
+
+        positional = []
+        keyword = {}
+        spec.args.each do |a|
+          if raw.key?(a.name.to_s)
+            value = raw[a.name.to_s]
+          elsif a.session_default && session
+            value = session.public_send(a.session_default)
+          else
+            next
+          end
+
+          if a.positional
+            positional << value
+          else
+            keyword[a.name] = value
+          end
+        end
+        [positional, keyword]
+      end
+    end
+  end
+end

data/lib/textus/mcp/server.rb

@@ -49,8 +49,11 @@ module Textus
       end
 
       def handle_initialize(rid, _params)
-        proposer = @store.manifest.policy.proposer_role
-        propose_zone = @store.manifest.policy.propose_zone_for(proposer)
+        # The acting role IS the resolved connection role (ADR 0040): the MCP
+        # transport defaults to `agent`, which can write the queue, so its
+        # propose_zone resolves directly. If a connection's role cannot propose,
+        # propose_zone is nil and the `propose` tool reports that honestly.
+        propose_zone = @store.manifest.policy.propose_zone_for(@role)
 
         @session = Session.new(
           role: @role,
@@ -67,7 +70,7 @@ module Textus
       end
 
       def handle_tools_list(rid)
-        emit_result(rid, { "tools" => ToolSchemas.all })
+        emit_result(rid, { "tools" => Catalog.tool_schemas })
       end
 
       def handle_tools_call(rid, params)
@@ -80,8 +83,8 @@ module Textus
 
         name = params["name"]
         args = params["arguments"] || {}
-        result = Tools.call(name, session: @session, store: @store, args: args)
-        @session = @session.advance_cursor(@store.audit_log.latest_seq) if name == "tick"
+        result = Catalog.call(name, session: @session, store: @store, args: args)
+        @session = @session.advance_cursor(@store.audit_log.latest_seq) if name == "pulse"
 
         emit_result(rid, {
                       "content" => [{ "type" => "text", "text" => JSON.dump(result) }],

data/lib/textus/mcp/session.rb

@@ -1,24 +1,7 @@
 module Textus
   module MCP
-    # Per-connection state held by the server. Immutable Data value;
-    # advance_cursor returns a new instance via #with.
-    Session = Data.define(:role, :cursor, :propose_zone, :manifest_etag) do
-      def advance_cursor(new_cursor) = with(cursor: new_cursor)
-
-      def check_etag!(observed_etag)
-        return if observed_etag == manifest_etag
-
-        raise ContractDrift.new(
-          "manifest changed (was #{short_etag(manifest_etag)}, now #{short_etag(observed_etag)}); re-run boot",
-        )
-      end
-
-      private
-
-      # First 8 hex chars after the "sha256:" prefix — a stable short id for
-      # the drift diagnostic. Tolerates non-prefixed values (delete_prefix is
-      # a no-op when the prefix is absent).
-      def short_etag(etag) = etag.to_s.delete_prefix("sha256:")[0, 8]
-    end
+    # The session value now lives in core (ADR 0036); retained here as an
+    # alias so existing MCP references keep resolving.
+    Session = Textus::Session
   end
 end

data/lib/textus/mcp/tool_schemas.rb

@@ -1,70 +1,14 @@
 module Textus
   module MCP
-    # JSON-Schema definitions for every MCP tool's inputSchema. Returned by
-    # the server in tools/list. Static today — a follow-up will enrich with
-    # manifest-derived enums for `zone`, `key`, etc.
+    # Kept for name stability (ADR 0039). The JSON schemas are DERIVED from
+    # per-verb contracts; this delegates to MCP::Catalog. The hand-written
+    # array is gone — a kwarg rename now updates the schema automatically (and
+    # the signature guard fails if the contract lags the use-case).
     module ToolSchemas
       module_function
 
-      def all # rubocop:disable Metrics/MethodLength
-        [
-          tool("boot", "Return the orientation contract: zones, entries, schemas, write_flows, agent_quickstart.", {}, []),
-          tool("tick", "Delta since cursor. Returns {cursor, changed, stale, pending_review, doctor}.",
-               { "since" => { "type" => "integer", "minimum" => 0 } }, []),
-          tool("find", "List keys filtered by zone and/or prefix.",
-               { "zone" => { "type" => "string" }, "prefix" => { "type" => "string" } }, []),
-          tool("read", "Read one entry. Returns the envelope (uid, etag, _meta, body, freshness).",
-               { "key" => { "type" => "string" } }, ["key"]),
-          tool("write", "Create or update an entry. Schema-validated. Returns {uid, etag}.",
-               {
-                 "key" => { "type" => "string" },
-                 "meta" => { "type" => "object" },
-                 "body" => { "type" => "string" },
-                 "content" => { "type" => "object" },
-                 "if_etag" => { "type" => "string" },
-               }, %w[key meta]),
-          tool("propose", "Write a proposal to the session's propose_zone. Auto-prefixes the key.",
-               {
-                 "key" => { "type" => "string", "description" => "Key relative to propose_zone, e.g. 'proposal.feature-x'" },
-                 "meta" => { "type" => "object" },
-                 "body" => { "type" => "string" },
-               }, %w[key meta]),
-          tool("fetch", "Run an intake fetch for one key. Returns the fetch Outcome.",
-               { "key" => { "type" => "string" } }, ["key"]),
-          tool("fetch_stale", "Fetch all stale intake entries, optionally scoped by zone/prefix.",
-               {
-                 "zone" => { "type" => "string" },
-                 "prefix" => { "type" => "string" },
-               }, []),
-          tool("schema", "Return the schema (field shape) for an entry family.",
-               { "family" => { "type" => "string" } }, ["family"]),
-          tool("rules", "Return effective rules for a key (fetch, promote, ...).",
-               { "key" => { "type" => "string" } }, ["key"]),
-          tool("key_mv_prefix",
-               "Bulk-rename every leaf key under from_prefix to to_prefix. Dry-run returns a Plan; apply with dry_run: false.",
-               { "from_prefix" => { "type" => "string" }, "to_prefix" => { "type" => "string" }, "dry_run" => { "type" => "boolean" } },
-               %w[from_prefix to_prefix]),
-          tool("key_delete_prefix", "Bulk-delete every leaf key under prefix.",
-               { "prefix" => { "type" => "string" }, "dry_run" => { "type" => "boolean" } },
-               ["prefix"]),
-          tool("zone_mv", "Rename a zone — manifest + files. Refuses if destination exists.",
-               { "from" => { "type" => "string" }, "to" => { "type" => "string" }, "dry_run" => { "type" => "boolean" } },
-               %w[from to]),
-          tool("rule_lint", "Diff candidate manifest YAML's rules against the live manifest. No writes.",
-               { "candidate_yaml" => { "type" => "string" } },
-               ["candidate_yaml"]),
-          tool("migrate", "Run a YAML migration plan (multi-op).",
-               { "plan_yaml" => { "type" => "string" }, "dry_run" => { "type" => "boolean" } },
-               ["plan_yaml"]),
-        ].freeze
-      end
-
-      def tool(name, description, properties, required)
-        {
-          name: name,
-          description: description,
-          inputSchema: { type: "object", properties: properties, required: required },
-        }
+      def all
+        Catalog.tool_schemas
       end
     end
   end