@agdf/mcp-server 0.0.0-stage → 0.20.1

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/NOTICE

@@ -0,0 +1,10 @@
+AI Governance & Delivery Framework (AGDF)
+Copyright 2026 Arndt Gold
+
+This product includes software developed by the Model Context Protocol project.
+Dependency versions and licenses are recorded by the package lock and release inventory.
+
+AGDF(TM) and AI Governance & Delivery Framework(TM) are marks of Arndt Gold.
+The Apache License, Version 2.0 does not grant permission to use project names,
+trademarks, service marks or logos except as required for reasonable and
+customary description of the origin of the project.

package/README.md

@@ -1,3 +1,136 @@
-# Temporary Holding Version
+# @agdf/mcp-server
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Local STDIO MCP adapter for AGDF dispatch and control inspection.
+
+MCP tools: `agdf_dispatch`, `agdf_inspect`, `agdf_prepare`, `agdf_record`, `agdf_approve`, `agdf_revise`, `agdf_closeout`.
+
+The bounded write groups, selected contract/status reads, original-operation recovery and
+focused app-only decision facade are described in [Core and MCP command flow](../../docs/architecture/core-mcp-command-flow.md).
+Host tool permission is separate from a deliberate gate decision. The source candidate's
+click actions remain disabled while native app-only mediation is unqualified.
+
+`agdf_inspect` also exposes read-only draft preflight through `operation: artifact-readiness`:
+
+```json
+{
+  "operation": "artifact-readiness",
+  "presentation_language": "de",
+  "working_directory": "/absolute/repository",
+  "target_source": "explicit_target",
+  "primary_target": "/absolute/repository",
+  "run_id": "selected-run",
+  "gate": "PRD",
+  "expected_revision_id": "00000000-0000-4000-8000-000000000000"
+}
+```
+
+Supply the actual current revision. Supported drafts are UR, PRD, SD and TP; their canonical
+run-local path is derived by Core. `report.ready` means the existing authoring checks passed,
+including required localized summary and applicable product-decision/traceability checks.
+`checks`, `diagnostics` and `next_action` explain failures, with exact source digest and revision
+when available. Core uses a bounded, revalidated read snapshot. The operation never registers,
+reseals, prepares a presentation or approves anything; semantic derivation and reviewed source
+bindings remain separate. An absent or unsafe source, stale revision or current control blocker
+is unready. QA decisions and UAT are outside this authoring preflight.
+
+To read an existing prepared document, obtain the current run revision with `gate-check`, then
+read `operation-contract` with `module: agdf_prepare/presentation.prepare`. Its derived
+`inspect_contract` explains arguments/examples; `presentation_catalog` supplies validated
+`read_arguments`. A complete unique match is readable; several matches require selection.
+Absence or an unavailable/partial catalog cannot justify guessing or preparing another record.
+Follow every returned `next_cursor` with `presentation-document` to reconstruct the frozen bytes.
+Keep the original document revision, including for historical reads. Catalog pages contain at most
+16 candidates; scans stop at 256 records, 1 MiB of record bytes or 1024 directory entries. Catalog,
+document and preview cursors are not interchangeable. Prepared records prove no human approval.
+
+Dispatch follows the canonical skill-dispatch contract;
+inspect exposes read-only doctor, gate-check, delivery-map and contract operations.
+
+The shared Core continuation service may record one previously sealed relationship correction
+for an authorized bound `continue_delivery` request, then route the same run afresh. The routing
+service itself remains read-only. Accordingly, `agdf_dispatch` declares `readOnlyHint: false`;
+`agdf_inspect` declares `readOnlyHint: true`. Neither tool creates an approval.
+
+> [!IMPORTANT]
+> This package documents the repository development build. The previously published AGDF 0.14.5 release
+> did not include the MCP support described here. Repository assemblies and local plugin builds still
+> carry the canonical version `0.14.5`, but can contain these newer MCP features. The version alone
+> does not identify the payload: verify the assembly or installed runtime digests and the loaded session.
+> These development instructions do not establish what a current npm `@latest` resolution contains.
+
+The server requires Node.js 22 or later, exposes no generic shell, filesystem or network operation,
+and never grants AGDF approval or delivery authority. Use the `create-agdf` lifecycle command to
+prepare and register the exact version-matched server for a delivered host adapter. Host support
+remains unverified until direct registration, discovery, invocation, failure and removal evidence exists.
+
+The guided `codex`, `claude`, `copilot` and `opencode` installers can call that same lifecycle after
+the user explicitly chooses complete setup. In non-interactive use this requires `--with-mcp` and
+an entered absolute `--dir`; otherwise installation remains plugin-only. The plugin transaction and
+MCP transaction retain separate results and recovery. A verified plugin is never rolled back only
+because MCP setup fails. Marketplace-only installation has no CLI callback and therefore remains
+plugin-only.
+
+`agdf_dispatch` requires `presentation_language` as one well-formed BCP 47 tag. The host selects it
+from the latest natural-language request: an explicit response-language instruction wins, otherwise
+the dominant language is used, with `en` for mixed or ambiguous input. Missing or invalid input is
+rejected by the MCP schema before governance evaluation. A valid unsupported tag is accepted and
+renders through the complete English locale pack. The production tests exercise this contract
+separately for protocol versions `2025-11-25` and `2026-07-28`.
+
+### Selected Cockpit draft authoring check
+
+`agdf_cockpit_read` additionally supports `artifact_readiness` with exactly `session_id`, `snapshot_id`, `run_id`, `gate` (`UR | PRD | SD | TP`) and `expected_revision_id`. It checks the currently observed, supported unapproved canonical draft, including an unregistered draft where supported. It accepts no target/path/writer/general-inspect override.
+
+The same Core authoring projection serves standalone inspection and the scoped reader. The selected descriptor captures the draft file or absence before the snapshot freezes. The check validates the old binding, replaces the read scope with a same-Run capture, revalidates revision/gate/source before publication, and reissues resource selectors. Session/worker/pool and source observers adopt that capture together; context cleanup quarantine and existing bounds remain enforced.
+
+The optional selected-detail `draft_check` contains source metadata, the unchanged authoring report and a Core-derived display/recovery state. A passed report never grants semantic review, registration, approval, implementation permission or QA. Old operations remain compatible; a client against a server lacking this descriptor shows bounded unavailable without a general-tool fallback.
+
+## Repository test dependencies
+
+Prepare the current source assembly before installing or running MCP package tests:
+
+```sh
+npm run build:prepare
+npm --prefix packages/mcp-server ci --ignore-scripts
+npm --prefix packages/mcp-server run test:protocol
+npm --prefix packages/mcp-server run test:safety
+```
+
+Run these commands from the repository root. The repository lock resolves `create-agdf` from
+`dist/npm/create-agdf`, which includes the assembled Core and generated resources. The published
+package dependency remains version-pinned. Safety and cockpit-gating tests import that assembly
+directly, so rebuilding it cannot leave those tests using an older same-version npm copy.
+Other package-consumer tests create their own isolated runtimes from the same assembly. Installing
+SDK dependencies is a separate preparation step; these tests neither update a host installation
+nor qualify a native session. A direct `node test/...` invocation also requires the preparation.
+
+Business failures use MCP `isError: true`, preserve the public domain result in
+`structuredContent` and the first text block, and append one bounded EN/DE
+explanation with the cause, known effect limit and supported correction. Success
+keeps its existing single block, including exact decision presentation text.
+Successful doctor, readiness, operation-status and freshness observations remain
+successful when they report blocked, not-ready or unknown state. SDK input errors
+and protocol errors retain their SDK-owned behavior.
+
+The producing runtime owns the pure `agdf-tool-result/1` projection. Its checked
+private descriptor travels with an old generation's result and is consumed before
+public serialization; generation qualification includes that contract version.
+Error-domain invariants are checked even though SDK 2 skips output validation for
+error results. Existing response limits include the explanation and fallback.
+Known parse rejection means not dispatched; timeout, cancellation after handoff or
+a lost connection cannot establish rollback. For an uncertain command, inspect
+`operation-status` with the original UUID and retain its exact payload. Recovery,
+receipts, approval eligibility and any permitted replay remain Core-owned.
+
+Worker requests retain a ten-second total deadline, including shutdown confirmation.
+Execution reserves up to one second (one quarter of shorter configured deadlines) for
+termination. Capacity and owned locks are released only after confirmed termination or
+an observed exit, including an exit after a rejected termination request. If shutdown
+remains unconfirmed, the error preserves the typed `cause_code` when one exists and the
+last allowlisted `worker_phase` in diagnostics and the bounded explanation. Result content
+and raw exception text never become a cause; an uncertain worker continues to block reuse.
+
+This follows the [MCP tool error contract](https://modelcontextprotocol.io/specification/2026-07-28/server/tools#error-handling)
+and [SDK error behavior](https://ts.sdk.modelcontextprotocol.io/v2/servers/errors).
+Local protocol, package and browser tests do not establish native host or agent
+performance; the unchanged ergonomics comparison records that evidence separately.

package/bin/agdf-mcp.js

@@ -0,0 +1,24 @@
+#!/usr/bin/env node
+import process from "node:process";
+
+const major = Number.parseInt(process.versions.node.split(".")[0], 10);
+if (!Number.isInteger(major) || major < 22) {
+  process.stderr.write("AGDF_MCP_NODE_UNSUPPORTED\n");
+  process.exitCode = 1;
+} else {
+  const args = process.argv.slice(2);
+  const valid = (args.length === 2 || args.length === 4 && ['codex', 'claude'].includes(args[1]) && args[2] === '--cockpit-dir')
+    && args[0] === "--surface"
+    && ["codex", "claude", "copilot", "opencode"].includes(args[1]);
+  if (!valid) {
+    process.stderr.write("AGDF_MCP_ARGUMENTS_INVALID\n");
+    process.exitCode = 1;
+  } else {
+    const { runMcpServer } = await import("../src/main.js");
+    try { await runMcpServer({ surface: args[1], cockpitDir: args.length === 4 ? args[3] : undefined }); }
+    catch (error) {
+      process.stderr.write(['AGDF_COCKPIT_TARGET_INVALID', 'AGDF_COCKPIT_UI_INVALID'].includes(error.message) ? `${error.message}\n` : 'AGDF_MCP_STARTUP_FAILED\n');
+      process.exitCode = 1;
+    }
+  }
+}

package/package.json

@@ -1,6 +1,43 @@
 {
   "name": "@agdf/mcp-server",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.20.1",
+  "description": "Local MCP adapter for version-matched AGDF dispatch and control inspection.",
+  "type": "module",
+  "files": [
+    "bin",
+    "src",
+    "README.md",
+    "NOTICE",
+    "ui"
+  ],
+  "bin": {
+    "agdf-mcp": "./bin/agdf-mcp.js"
+  },
+  "exports": {
+    ".": "./src/server.js"
+  },
+  "scripts": {},
+  "dependencies": {
+    "@modelcontextprotocol/server": "2.0.0",
+    "create-agdf": "0.20.1"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "keywords": [
+    "agdf",
+    "mcp",
+    "governance",
+    "coding-agents"
+  ],
+  "license": "Apache-2.0",
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ArndtGold/ai-native-governance-delivery-framework.git",
+    "directory": "packages/mcp-server"
+  },
+  "homepage": "https://agdf.iself.eu"
+}

package/src/cockpit-resource.js

@@ -0,0 +1,20 @@
+import { readFileSync, lstatSync } from 'node:fs';
+import { createHash } from 'node:crypto';
+
+export function loadCockpitResource({ uri, mimeType, limit, kind = 'cockpit', directory = new URL('../ui/', import.meta.url) } = {}) {
+  try {
+    if (!['cockpit', 'decision'].includes(kind)) throw Error();
+    const manifestURL = new URL(kind === 'decision' ? 'decision-manifest.json' : 'manifest.json', directory), htmlURL = new URL(kind + '.html', directory);
+    for (const url of [directory, manifestURL, htmlURL]) if (lstatSync(url).isSymbolicLink()) throw Error();
+    const manifest = JSON.parse(readFileSync(manifestURL, 'utf8'));
+    const stat = lstatSync(htmlURL);
+    if (!stat.isFile() || !Number.isSafeInteger(limit) || stat.size > limit) throw Error();
+    const bytes = readFileSync(htmlURL);
+    const digest = createHash('sha256').update(bytes).digest('hex');
+    if (manifest.schema_version !== '1' || manifest.uri !== uri || manifest.mime_type !== mimeType
+      || manifest.bytes !== bytes.length || manifest.digest !== `sha256:${digest}`) throw Error();
+    const text = new TextDecoder('utf8', { fatal: true }).decode(bytes);
+    return { uri, mimeType, text, digest,
+      _meta: { ui: { csp: { connectDomains: [], resourceDomains: [], frameDomains: [], baseUriDomains: [] } } } };
+  } catch { throw new TypeError('AGDF_COCKPIT_UI_INVALID'); }
+}

package/src/generation-entry.js

@@ -0,0 +1,86 @@
+// A directly owned private child. It never reads or writes public MCP STDIO.
+import process from 'node:process';
+import { createAgdfWorkerExecutor } from './server.js';
+import { loadCockpitResource } from './cockpit-resource.js';
+import { generationMessage, validGenerationMessage, generationManifest, generationFailureReason } from './generation-protocol.js';
+import { createMcpDispatchRuntime, createMcpDecisionRuntime, createMcpCockpitRuntime, DECISION_UI_URI,
+  inspectMcpDispatcherRuntime, releaseAbandonedOwnedLock } from 'create-agdf/mcp-dispatch-runtime';
+const epoch = process.argv[2], generation = Number(process.argv[3]);
+let runtime, executor, starting = false, closing = false, inflight = 0, serverDigest, sdkDigest, uiDigest;
+const observed = new Set(), unknown = new Set();
+function status() {
+  const owned = runtime?.inspectOwnership?.() ?? { views: 0 };
+  return { ...owned, inflight: inflight + (starting ? 1 : 0) + (owned.inflight ?? 0),
+    executor: executor?.active ? 1 : 0, uncertain: unknown.size + (owned.uncertain ?? 0), closing };
+}
+function send(input, kind, payload) {
+  const reply = generationMessage(epoch, generation, kind, payload, {}, input.original_operation_id, input.request_id);
+  if (validGenerationMessage(reply, { epoch, generation, reply: true })) process.send?.(reply);
+  else process.send?.(generationMessage(epoch, generation, 'failure', { reason: 'generation_result_limit' }, {}, input.original_operation_id, input.request_id));
+}
+process.on('message', async input => {
+  if (!validGenerationMessage(input, { epoch, generation }) || observed.has(input.request_id)) return;
+  if (observed.size >= 8192) { send(input, 'failure', { reason: 'generation_request_capacity' }); return; }
+  observed.add(input.request_id);
+  try {
+    if (input.kind === 'qualify') {
+      if (runtime || starting || closing) throw Error('generation_already_initialized');
+      starting = true;
+      const { surface, commandGroups, cockpitDir, cockpitMode } = input.payload;
+      const inspected = inspectMcpDispatcherRuntime();
+      if (inspected.provenanceStatus !== 'matched') throw Error('runtime_provenance_invalid');
+      runtime = cockpitDir || cockpitMode ? await createMcpCockpitRuntime({ surface, cockpitDir, cockpitMode, inspected })
+        : createMcpDispatchRuntime({ surface, commandGroups, inspected });
+      if (!cockpitDir && !cockpitMode && surface === 'codex') {
+        const ui = { uri: DECISION_UI_URI, mimeType: 'text/html;profile=mcp-app', limit: 4 * 1024 ** 2, kind: 'decision' };
+        ui.digest = loadCockpitResource(ui).digest;
+        runtime = await createMcpDecisionRuntime({ runtime, ui });
+      }
+      if (runtime.ui) uiDigest = loadCockpitResource(runtime.ui).digest;
+      // Inspect reports package-owned immutable identities, not caller evidence.
+      sdkDigest = inspected.generationIdentity.sdk_digest; serverDigest = inspected.generationIdentity.server_digest;
+      executor = runtime.mode === 'cockpit' ? null : createAgdfWorkerExecutor(runtime, { releaseOwnedLock: releaseAbandonedOwnedLock });
+      const support = { ui: Boolean(runtime.ui), app_mediation: runtime.mode === 'decision'
+        && runtime.trustedContext.decisionQualification(input.context.client, uiDigest) === true };
+      starting = false;
+      send(input, 'qualified', { manifest: generationManifest(runtime, uiDigest, sdkDigest),
+        producer: { server_digest: serverDigest, dispatcher_digest: inspected.generationIdentity.dispatcher_digest, sdk_digest: sdkDigest }, support });
+    } else if (input.kind === 'session_inspect') {
+      send(input, 'status', status());
+    } else if (input.kind === 'shutdown') {
+      if (closing || starting || inflight || unknown.size) throw Error('generation_work_protected');
+      closing = true;
+      await executor?.close(); await runtime?.close?.();
+      const remaining = status();
+      if (remaining.views || remaining.inflight || remaining.executor || remaining.uncertain) throw Error('generation_cleanup_unconfirmed');
+      send(input, 'closed', remaining);
+      process.disconnect(); // Natural exit, no kill, after all owned work is closed.
+    } else {
+      if (!runtime || closing) throw Error('generation_unavailable');
+      const { name, arguments: args } = input.payload, tool = runtime.tool?.(name) ?? runtime.tools.find(t => t.name === name);
+      if (!tool || tool.requiresUi && input.context.uiSupported !== true) throw Error('resource_denied');
+      ++inflight;
+      let result, phase = tool.parentOwned || !executor ? 'parse' : 'execute';
+      try {
+        if (tool.parentOwned || !executor) {
+          const parsed = tool.parse(args); phase = 'execute';
+          result = await tool.execute(parsed, undefined, input.context);
+        } else result = await executor.execute(args, { toolName: name });
+        if (runtime.postprocessToolResult) result = await runtime.postprocessToolResult(name, args, result, input.context);
+        if (input.original_operation_id && result.outcome === 'effect_unknown') unknown.add(input.original_operation_id);
+        if (name === 'agdf_inspect' && args.operation === 'operation-status' && result.report?.status === 'recorded'
+          && result.report.receipt?.operation_id === args.module) unknown.delete(args.module);
+        send(input, 'result', runtime.projectToolResult(name, args, result));
+      } catch (error) {
+        const facts = runtime.normalizeFailure(error, { phase });
+        if (input.original_operation_id && facts.dispatch !== 'not_dispatched') unknown.add(input.original_operation_id);
+        send(input, 'result', runtime.projectToolResult(name, args, runtime.failure(facts.code, name, args, facts), facts));
+      } finally { --inflight; }
+    }
+  } catch (error) { if (input.kind === 'qualify') starting = false; send(input, 'failure', { reason: generationFailureReason(error) }); }
+});
+process.on('disconnect', () => {
+  // Loss of the facade does not cancel or replay business effects. Timers and
+  // existing worker/view owners retain their bounds; no process-wide force kill.
+  if (!closing) { void executor?.close().catch(() => {}); void runtime?.close?.().catch(() => {}); }
+});

package/src/generation-protocol.js

@@ -0,0 +1,44 @@
+import { createHash } from 'node:crypto';
+export const GENERATION_LIMITS = Object.freeze({ slots: 3, input: 65536, result: 1048576, qualify: 30000, close: 10000, receipts: 256, routes: 4096 });
+const uuid = value => typeof value === 'string' && /^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/u.test(value);
+const fields = ['schema_version', 'owner_epoch', 'generation_id', 'request_id', 'kind', 'original_operation_id', 'payload', 'context'];
+export function validGenerationMessage(value, { epoch, generation, reply = false } = {}) {
+  if (!value || typeof value !== 'object' || Array.isArray(value) || Object.keys(value).sort().join() !== [...fields].sort().join()
+    || value.schema_version !== '1' || value.owner_epoch !== epoch || value.generation_id !== generation
+    || !uuid(value.request_id) || !(value.original_operation_id === null || uuid(value.original_operation_id))
+    || !Number.isSafeInteger(value.generation_id) || value.generation_id < 1
+    || !(reply ? ['qualified', 'result', 'status', 'closed', 'failure'] : ['qualify', 'invoke', 'session_inspect', 'shutdown']).includes(value.kind)
+    || !value.context || typeof value.context !== 'object' || Array.isArray(value.context)) return false;
+  try { return Buffer.byteLength(JSON.stringify(value)) <= (reply ? GENERATION_LIMITS.result : GENERATION_LIMITS.input); } catch { return false; }
+}
+export function generationMessage(epoch, generation, kind, payload, context = {}, original = null, requestId) {
+  return { schema_version: '1', owner_epoch: epoch, generation_id: generation, request_id: requestId,
+    kind, original_operation_id: original, payload, context };
+}
+export function generationManifest(runtime, uiDigest, sdkDigest) {
+  if (typeof runtime.toolErrorContract !== 'string' || !runtime.toolErrorContract
+    || typeof runtime.projectToolResult !== 'function' || typeof runtime.consumeToolResult !== 'function'
+    || typeof runtime.normalizeFailure !== 'function') throw Error('generation_manifest_incompatible');
+  // Stable transport shape, never business eligibility or a human-origin proof.
+  return { schema_version: '1', mode: runtime.mode ?? 'headless', sdk_digest: sdkDigest,
+    protocol: 'mcp-sdk/2:stdio-legacy-and-modern', tool_error_contract: runtime.toolErrorContract,
+    tools: runtime.tools.map(tool => ({ name: tool.name, definition: tool.definition })),
+    resource: runtime.ui ? { uri: runtime.ui.uri, mimeType: runtime.ui.mimeType, digest: uiDigest } : null,
+    command_groups: [...(runtime.trustedContext.commandGroups ?? [])] };
+}
+export const manifestDigest = manifest => createHash('sha256').update(JSON.stringify(manifest)).digest('hex');
+
+const FAILURE_REASONS = new Set([
+  'generation_unavailable', 'generation_input_limit', 'generation_response_unknown', 'generation_connection_lost',
+  'generation_capacity_protected', 'generation_manifest_incompatible', 'generation_result_limit',
+  'generation_request_capacity', 'generation_already_initialized', 'generation_work_protected',
+  'generation_cleanup_unconfirmed', 'resource_denied', 'runtime_provenance_invalid', 'runtime_version_mismatch',
+  'dispatch_busy', 'dispatch_cancelled', 'dispatch_timeout', 'dispatch_worker_failed', 'dispatch_worker_termination_unconfirmed',
+  'runtime_publication_unowned', 'runtime_candidate_manifest_invalid', 'runtime_candidate_unowned', 'runtime_candidate_digest_mismatch',
+  'AGDF_MCP_EXECUTABLE_CLAIM_INVALID', 'AGDF_MCP_EXECUTABLE_CLAIM_CONTENDED',
+  'AGDF_MCP_EXECUTABLE_CLAIM_LOCK_UNCONFIRMED', 'AGDF_MCP_PUBLICATION_DEADLINE_EXCEEDED',
+]);
+export function generationFailureReason(error) {
+  const reason = error?.code ?? error?.message;
+  return FAILURE_REASONS.has(reason) ? reason : 'generation_runtime_failed';
+}