@agdf/mcp-server 0.20.2 → 0.31.0

package/README.md

@@ -2,7 +2,7 @@
 
 Local STDIO MCP adapter.
 
-MCP tools: `agdf_dispatch`, `agdf_inspect`, `agdf_prepare`, `agdf_record`, `agdf_approve`, `agdf_revise`, `agdf_closeout`.
+MCP tools: `agdf_dispatch`, `agdf_inspect`, `agdf_project`, `agdf_run`, `agdf_prepare`, `agdf_record`, `agdf_approve`, `agdf_revise`, `agdf_closeout`.
 
 [Integration guide](../../docs/architecture/09-mcp-integrationsrichtlinien.md).
 [Command flow](../../docs/architecture/core-mcp-command-flow.md): bounded writes,
@@ -10,6 +10,13 @@ contract/status reads, original-operation recovery and the app-only decision fac
 Host tool permission is separate from a deliberate gate decision. The source candidate's
 click actions remain disabled while native app-only mediation is unqualified.
 
+`agdf_closeout` also ends active runs as `superseded` or `abandoned`. Kind `closure.preview` takes
+`{"entries":[{"run_id","outcome","reason","successor_run"|"successor_reference"}]}` and returns the
+preview text with the phrase `Close runs: <preview_id>`; kind `closure.apply` takes `preview_id`
+and the owner's verbatim `confirmation`. Both use a target-bound envelope without `run_id` or
+`expected_revision_id`; every other `agdf_closeout` kind keeps the per-run envelope. The agent
+forwards only the owner's reply and never supplies the phrase itself.
+
 `agdf_inspect` also exposes read-only draft preflight through `operation: artifact-readiness`:
 
 ```json
@@ -44,9 +51,69 @@ Keep the original document revision, including for historical reads. Catalog pag
 16 candidates; scans stop at 256 records, 1 MiB of record bytes or 1024 directory entries. Catalog,
 document and preview cursors are not interchangeable. Prepared records prove no human approval.
 
+For a known task target, always send `primary_target` together with its actual `target_source`:
+`explicit_target` for a named target, `continued_target` for a previously confirmed target, or
+`current_repository` for an unambiguous request about the current repository. `working_directory`
+alone never selects it. A bound `gate-check` returns `navigation.read_context`: copy those explicit
+selectors into later status reads, adding `operation: "gate-check"`. This is a reusable locator,
+not a connection session or permission; target and Run checks run again on every call. Never add
+`gate` or `expected_revision_id` to a status read. For document reads, copy the exact returned
+`read_arguments`, including the original revision. A uniquely selected document is the first
+`navigation.next_calls` entry, ahead of optional operation help. Follow every document page before
+that help. An ambiguous or incomplete catalog still requires selection and never chooses a record.
+
+Input-validation hints describe missing fields for the selected operation and invalid Run-ID
+syntax. They neither normalize IDs nor fill targets, replace revisions, replay writes or grant
+approval. The original SDK and Core validators continue to reject the original invalid request.
+For malformed status/document reads with individually valid explicit locators, the hint can include
+a complete new `gate-check` read. This suggestion is length-bounded, excludes write/revision/document
+selectors and is validated again when called. It never fabricates the missing presentation ID.
+Read the returned catalog and exact document arguments; `authoring-inputs` is not a substitute for
+reading the selected prepared document. A wrong operation group gets a correction only when the
+operation kind has exactly one registered owner; ambiguous kinds require contract discovery.
+
 Dispatch follows the canonical skill-dispatch contract;
 inspect exposes read-only doctor, gate-check, delivery-map and contract operations.
 
+`agdf_inspect/project-state` observes the confirmed existing Git project's setup without a Run.
+Deliberate `agdf_project/project.initialize` uses the shared Core initializer and fixed versioned
+plan, preserving authored initialized governance. It creates no Run, approval, installation,
+permission or Git effect and exposes no force/repair/arbitrary writer. Original request recovery
+uses `operation-status` module `project.initialize/<original UUID>`, distinct from Run creation.
+Unknown/unowned partial states remain blocked. Successful setup returns creation help.
+
+`agdf_run/run.create` creates an unapproved Run from a semantic title and original operation UUID;
+pre-Run `operation-status` resolves a lost response without inventing a second Run.
+`authoring-inputs` returns versioned templates and exact sources with bounded cursors.
+`authoring-inputs.material_call` supplies a bound form: fill its UTF-8 content and use
+`agdf_record/material.stage` action `put` to seal files of at most 48 KiB each within the 64 KiB whole JSON request bound in one call.
+The Core computes byte counts, material identities and digests. Larger files retain the bounded
+multipart path (16 KiB per part, 128 KiB per file). Each multipart action has its own operation UUID;
+only an identical retry reuses a UUID. Returned `recording_calls` provide the binding and material
+reference; fill only the listed author/review fields. Ready `next_calls` are executable as supplied;
+do not add intake/revision fields to a supplied `continue_delivery` dispatch.
+Pass authored Markdown as UTF-8 string data through structured input. If a host uses JavaScript,
+author with its file-editing tool and pass the UTF-8 file read as the content value; embedding
+the whole document in a backtick literal makes Markdown syntax executable JavaScript syntax.
+This guidance adds no server-side file reader and changes no byte or input limit.
+These Core-owned references feed existing typed writers, including reviewed formal artefacts, unapproved
+UR replacement, Verified Change and closeout. Code edits, actual tests and Git execution remain
+external work; none of these operations grants approval.
+
+MCP `doctor` observes an exact selected Run without enumerating unrelated histories. All-active
+diagnosis returns bounded pages and an opaque observation cursor; consume every `next_cursor`.
+Only complete accounted observations have an overall domain status. Partial, stale, expired or
+resource-limited reads never imply a clean pass. Read failures report elapsed/unmeasured timing
+and read recovery separately from uncertain writes and their original operation receipts.
+
+Preparation opens no UI. `presentation.prepare` freezes one Markdown decision document;
+`presentation.deliver` chooses its primary delivery once. The ordinary route returns the whole
+Markdown. Optional `agdf_decision_view` opens a non-primary read-only preview. UI primary delivery
+requires actual bound current-surface confirmation and gives Chat only a short pointer; action
+qualification remains separate. The current SDK adapter cannot establish that surface identity,
+so capability/qualification alone always keeps Markdown as the primary route. Replay adds no
+second question; explicit fallback retires a primary view before returning the same Markdown.
+
 The shared Core continuation service may record one previously sealed relationship correction
 for an authorized bound `continue_delivery` request, then route the same run afresh. The routing
 service itself remains read-only. Accordingly, `agdf_dispatch` declares `readOnlyHint: false`;
@@ -70,12 +137,37 @@ MCP transaction retain separate results and recovery. A verified plugin is never
 because MCP setup fails. Marketplace-only installation has no CLI callback and therefore remains
 plugin-only.
 
-`agdf_dispatch` requires `presentation_language` as one well-formed BCP 47 tag. The host selects it
-from the latest natural-language request: an explicit response-language instruction wins, otherwise
-the dominant language is used, with `en` for mixed or ambiguous input. Missing or invalid input is
-rejected by the MCP schema before governance evaluation. A valid unsupported tag is accepted and
-renders through the complete English locale pack. The production tests exercise this contract
-separately for protocol versions `2025-11-25` and `2026-07-28`.
+The nine regular MCP tools may omit `presentation_language`; the adapter resolves a valid explicit
+request override, then the confirmed project's `.agdf/control/config.json`, then the versioned
+`plugins/agdf/meta/agdf-defaults.json`. Shipped preferences are `chat_language: en`,
+`artifact_language: en`, `presentation_route: markdown`, and `gate_check_variant: null`.
+The existing complete project configuration remains the only project override file. The last two
+settings are optional siblings of its language fields. Explicit invalid input and present invalid
+recognized settings are errors; defaults never activate or repair missing/incomplete control.
+
+Set an explicit BCP 47 language when the current request differs from the configured language.
+A valid unsupported presentation tag selects one complete English pack; malformed tags/resources
+fail. Presentation overrides never change artefact language or approved material. Existing setup
+locale selection and stored project values remain; normal calls and package generation write no config.
+The seven command groups also allow omitted `schema_version` and `assurance`; their fixed values
+come from the contracts, not configuration or independent human proof. `presentation.deliver` may
+omit route; only inspect `gate-check` may inherit the configured variant. UI/approval owners stay unchanged.
+
+`working_directory` may be omitted only with private trustworthy invocation context. Current native
+adapters have no evidenced task-directory source and return `working_directory_required` on omission;
+supply the absolute execution directory explicitly. Neither target nor plugin/process directory is a substitute.
+All target/Run/revision/operation/presentation/digest/reply bindings remain explicit. The SDK accepts
+the public omission schema; existing Core owners receive and validate the complete effective envelope.
+Existing explicit clients remain usable. Existing inspect/help reports expose effective values and sources
+without a mandatory extra lookup before each ordinary call.
+
+Existing family records retain original resolution in their versioned `resolved/1` extension. New readers
+validate its original family version and original logical/effective request digests. Unchanged complete-envelope
+digest and existing family recovery stay authoritative. A same-UUID retry restores original values after
+configuration changes; another logical request conflicts. Prepared language/material/identity remain immutable.
+Legacy records are read unchanged; old binaries can reject new record versions. No shadow ledger or automatic
+history/config migration is introduced. Repository/SDK, native CLI transport, installed plugin and human UI
+acceptance require separate evidence; a smaller definition or green build alone proves no task-efficiency gain.
 
 ### Selected Cockpit draft authoring check
 
@@ -134,3 +226,47 @@ This follows the [MCP tool error contract](https://modelcontextprotocol.io/speci
 and [SDK error behavior](https://ts.sdk.modelcontextprotocol.io/v2/servers/errors).
 Local protocol, package and browser tests do not establish native host or agent
 performance; the unchanged ergonomics comparison records that evidence separately.
+
+
+### Owned thread execution
+
+New packages declare `agdfExecutionModel: owner_threads_v1` and the exact owner-protocol
+import/export. The existing launcher and detached retention owner remain OS processes.
+That owner hosts one genuine SDK facade Worker and at most three counted generation
+Workers. Per-request Workers keep their existing execution and lock owners. Public
+STDIO uses native streams and backpressure; generation output cannot write MCP STDOUT.
+One entry-owned SDK output queue serializes actual writes, bounding queued frames/bytes
+without lowering existing per-result or UI resource limits. A blocked reader therefore
+does not create a parallel drain/error listener for every response.
+The private channel accepts bounded finite JSON with exact fields, a per-connection
+token/epoch, publication identity and original operation identity. It limits pending
+frames and bytes, and requalifies replacement candidates through the existing immutable
+publisher. Historical packages retain their declared process path and digest entry sets.
+
+Executable claims bind once to actual native Worker objects. Successful actual exit
+and a complete close acknowledgement are both required for release. Facade loss drains
+surviving work without replay; unconfirmed exits, uncertain effects and nested locks
+remain protected. Fatal failure of the shared owner process can lose all its Workers;
+original operation receipts and retained claims remain the recovery evidence. No PID
+scan, claim garbage collection or timeout alone establishes safe termination.
+
+Repository tests exercise both actual STDIO protocols, replacement, bounded channel
+admission and real write/lock interruption in disposable, fully rehashed fault candidates.
+They do not qualify an installed host or another OS. The fixed performance test selects
+the actual owned plugin launcher with 20/20 samples and p95 limits of 2500 ms cold /
+1000 ms warm. Performance acceptance and native qualification are separate
+required evidence, not consequences of the topology declaration.
+
+The normal MCP path is `next_action.call`: either a ready call forwarded unchanged or a form with named `required_inputs` such as `content`, `title`, `reviewer`, `reviewed` or `response`. The adapter maps those names to the stored canonical payload fields. It retains the original target, Run, revision, permission group and operation UUID; it never fills authored content, review attestations or approval replies. The former competing `submit` form is absent. Raw requests remain accepted for compatibility, but the full original request is exposed only under the explicit `recovery_only` branch, with the exact field map and original UUID. Retain that branch and the actual submitted inputs for uncertain-outcome recovery; do not generate a replacement identity.
+
+Verified owned plugin launchers retain offered templates in a private bounded journal under their existing MCP data root. The namespace includes the serving surface, version and server/dispatcher/SDK identity. A reconnect at that same identity can resolve the original reference without a new UUID or refreshed revision. The original 30-minute lifetime is never renewed. No submitted author/review/reply inputs or execution receipts are added to this journal; it is transport storage, not canonical Run State or authority. Direct transports without this verified owner remain connection-local. Private material buffers have their separate existing generation lifetime and still require exact semantic-byte recovery after generation loss.
+
+Empty, malformed, unknown and known-expired references remain distinct. An unavailable live reference returns `prepared_call_unknown`, rather than blaming the authored command schema. Store failures are distinguished from missing references. A failed publication of a future reference never discards an already successful operation receipt; its exact original request remains in recovery. Every restored call still passes the current SDK, permission-group, Core and revision checks.
+
+For a unique Core-supplied normal next step, the adapter may execute one exact `agdf_inspect` call for `authoring-inputs`, `gate-check` or `operation-contract` and include it as `next_read.result`. `next_action.context_path` names that already-loaded context. The original operation outcome and receipt remain intact if this separate read fails. No dispatch, write, presentation or approval is chained automatically; `agdf_dispatch` is not read-only. Source pagination remains explicit. Internal read attempts/failures are accounted separately from outer MCP invocations in native observations.
+
+`authoring-inputs` supports `bundle:true` for bounded multi-document pages. Read every chunk and cursor without a duplicate writer-contract lookup. A retained first-page form is reusable only for the same exact manifest and an available connection reference; otherwise use the supplied first-page read. Page transport does not prove source review.
+
+Prepared references also retain explicitly offered `agdf_inspect` reads, including source pages, contract help and original-operation status. Read inputs stay `{}`; the original SDK schema validates the complete supplied request before registration. Target, Run, revision, cursor and original status selection are never inferred or refreshed. The actual `next_read.tool/arguments` remain the record of an already executed read; its separate `next_read.call` is the exact prepared retry. Explicit recovery reads remain Raw for reconnect, and dispatch retains its original schema. No reference changes permission or bypasses canonical validation.
+
+Bundled authoring reports use `document_bundle_v2`: `documents` contains complete text, `document_manifest` is metadata only, and `fragments` must be joined by identity and byte offsets across all cursors before editing. Missing content must never be coerced into a replacement string.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agdf/mcp-server",
-  "version": "0.20.2",
+  "version": "0.31.0",
   "description": "Local MCP adapter for version-matched AGDF dispatch and control inspection.",
   "type": "module",
   "files": [
@@ -16,10 +16,14 @@
   "exports": {
     ".": "./src/server.js"
   },
+  "imports": {
+    "#agdf-dispatch-worker": "create-agdf/mcp-worker-runtime",
+    "#agdf-owner-protocol": "create-agdf/mcp-owner-protocol"
+  },
   "scripts": {},
   "dependencies": {
     "@modelcontextprotocol/server": "2.0.0",
-    "create-agdf": "0.20.2"
+    "create-agdf": "0.31.0"
   },
   "engines": {
     "node": ">=22"
@@ -39,5 +43,6 @@
     "url": "git+https://github.com/ArndtGold/ai-native-governance-delivery-framework.git",
     "directory": "packages/mcp-server"
   },
-  "homepage": "https://agdf.iself.eu"
+  "homepage": "https://agdf.iself.eu",
+  "agdfExecutionModel": "owner_threads_v1"
 }

package/src/generation-entry.js

@@ -1,86 +1,4 @@
-// A directly owned private child. It never reads or writes public MCP STDIO.
+// Explicit process adapter retained for undeclared/direct runtimes.
 import process from 'node:process';
-import { createAgdfWorkerExecutor } from './server.js';
-import { loadCockpitResource } from './cockpit-resource.js';
-import { generationMessage, validGenerationMessage, generationManifest, generationFailureReason } from './generation-protocol.js';
-import { createMcpDispatchRuntime, createMcpDecisionRuntime, createMcpCockpitRuntime, DECISION_UI_URI,
-  inspectMcpDispatcherRuntime, releaseAbandonedOwnedLock } from 'create-agdf/mcp-dispatch-runtime';
-const epoch = process.argv[2], generation = Number(process.argv[3]);
-let runtime, executor, starting = false, closing = false, inflight = 0, serverDigest, sdkDigest, uiDigest;
-const observed = new Set(), unknown = new Set();
-function status() {
-  const owned = runtime?.inspectOwnership?.() ?? { views: 0 };
-  return { ...owned, inflight: inflight + (starting ? 1 : 0) + (owned.inflight ?? 0),
-    executor: executor?.active ? 1 : 0, uncertain: unknown.size + (owned.uncertain ?? 0), closing };
-}
-function send(input, kind, payload) {
-  const reply = generationMessage(epoch, generation, kind, payload, {}, input.original_operation_id, input.request_id);
-  if (validGenerationMessage(reply, { epoch, generation, reply: true })) process.send?.(reply);
-  else process.send?.(generationMessage(epoch, generation, 'failure', { reason: 'generation_result_limit' }, {}, input.original_operation_id, input.request_id));
-}
-process.on('message', async input => {
-  if (!validGenerationMessage(input, { epoch, generation }) || observed.has(input.request_id)) return;
-  if (observed.size >= 8192) { send(input, 'failure', { reason: 'generation_request_capacity' }); return; }
-  observed.add(input.request_id);
-  try {
-    if (input.kind === 'qualify') {
-      if (runtime || starting || closing) throw Error('generation_already_initialized');
-      starting = true;
-      const { surface, commandGroups, cockpitDir, cockpitMode } = input.payload;
-      const inspected = inspectMcpDispatcherRuntime();
-      if (inspected.provenanceStatus !== 'matched') throw Error('runtime_provenance_invalid');
-      runtime = cockpitDir || cockpitMode ? await createMcpCockpitRuntime({ surface, cockpitDir, cockpitMode, inspected })
-        : createMcpDispatchRuntime({ surface, commandGroups, inspected });
-      if (!cockpitDir && !cockpitMode && surface === 'codex') {
-        const ui = { uri: DECISION_UI_URI, mimeType: 'text/html;profile=mcp-app', limit: 4 * 1024 ** 2, kind: 'decision' };
-        ui.digest = loadCockpitResource(ui).digest;
-        runtime = await createMcpDecisionRuntime({ runtime, ui });
-      }
-      if (runtime.ui) uiDigest = loadCockpitResource(runtime.ui).digest;
-      // Inspect reports package-owned immutable identities, not caller evidence.
-      sdkDigest = inspected.generationIdentity.sdk_digest; serverDigest = inspected.generationIdentity.server_digest;
-      executor = runtime.mode === 'cockpit' ? null : createAgdfWorkerExecutor(runtime, { releaseOwnedLock: releaseAbandonedOwnedLock });
-      const support = { ui: Boolean(runtime.ui), app_mediation: runtime.mode === 'decision'
-        && runtime.trustedContext.decisionQualification(input.context.client, uiDigest) === true };
-      starting = false;
-      send(input, 'qualified', { manifest: generationManifest(runtime, uiDigest, sdkDigest),
-        producer: { server_digest: serverDigest, dispatcher_digest: inspected.generationIdentity.dispatcher_digest, sdk_digest: sdkDigest }, support });
-    } else if (input.kind === 'session_inspect') {
-      send(input, 'status', status());
-    } else if (input.kind === 'shutdown') {
-      if (closing || starting || inflight || unknown.size) throw Error('generation_work_protected');
-      closing = true;
-      await executor?.close(); await runtime?.close?.();
-      const remaining = status();
-      if (remaining.views || remaining.inflight || remaining.executor || remaining.uncertain) throw Error('generation_cleanup_unconfirmed');
-      send(input, 'closed', remaining);
-      process.disconnect(); // Natural exit, no kill, after all owned work is closed.
-    } else {
-      if (!runtime || closing) throw Error('generation_unavailable');
-      const { name, arguments: args } = input.payload, tool = runtime.tool?.(name) ?? runtime.tools.find(t => t.name === name);
-      if (!tool || tool.requiresUi && input.context.uiSupported !== true) throw Error('resource_denied');
-      ++inflight;
-      let result, phase = tool.parentOwned || !executor ? 'parse' : 'execute';
-      try {
-        if (tool.parentOwned || !executor) {
-          const parsed = tool.parse(args); phase = 'execute';
-          result = await tool.execute(parsed, undefined, input.context);
-        } else result = await executor.execute(args, { toolName: name });
-        if (runtime.postprocessToolResult) result = await runtime.postprocessToolResult(name, args, result, input.context);
-        if (input.original_operation_id && result.outcome === 'effect_unknown') unknown.add(input.original_operation_id);
-        if (name === 'agdf_inspect' && args.operation === 'operation-status' && result.report?.status === 'recorded'
-          && result.report.receipt?.operation_id === args.module) unknown.delete(args.module);
-        send(input, 'result', runtime.projectToolResult(name, args, result));
-      } catch (error) {
-        const facts = runtime.normalizeFailure(error, { phase });
-        if (input.original_operation_id && facts.dispatch !== 'not_dispatched') unknown.add(input.original_operation_id);
-        send(input, 'result', runtime.projectToolResult(name, args, runtime.failure(facts.code, name, args, facts), facts));
-      } finally { --inflight; }
-    }
-  } catch (error) { if (input.kind === 'qualify') starting = false; send(input, 'failure', { reason: generationFailureReason(error) }); }
-});
-process.on('disconnect', () => {
-  // Loss of the facade does not cancel or replay business effects. Timers and
-  // existing worker/view owners retain their bounds; no process-wide force kill.
-  if (!closing) { void executor?.close().catch(() => {}); void runtime?.close?.().catch(() => {}); }
-});
+import { startGenerationRuntime } from './generation-runtime.js';
+startGenerationRuntime({ epoch: process.argv[2], generation: Number(process.argv[3]), channel: { on: (...args) => process.on(...args), send: value => process.send?.(value), close: () => process.disconnect() } });

package/src/generation-protocol.js

@@ -1,44 +1,2 @@
-import { createHash } from 'node:crypto';
-export const GENERATION_LIMITS = Object.freeze({ slots: 3, input: 65536, result: 1048576, qualify: 30000, close: 10000, receipts: 256, routes: 4096 });
-const uuid = value => typeof value === 'string' && /^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/u.test(value);
-const fields = ['schema_version', 'owner_epoch', 'generation_id', 'request_id', 'kind', 'original_operation_id', 'payload', 'context'];
-export function validGenerationMessage(value, { epoch, generation, reply = false } = {}) {
-  if (!value || typeof value !== 'object' || Array.isArray(value) || Object.keys(value).sort().join() !== [...fields].sort().join()
-    || value.schema_version !== '1' || value.owner_epoch !== epoch || value.generation_id !== generation
-    || !uuid(value.request_id) || !(value.original_operation_id === null || uuid(value.original_operation_id))
-    || !Number.isSafeInteger(value.generation_id) || value.generation_id < 1
-    || !(reply ? ['qualified', 'result', 'status', 'closed', 'failure'] : ['qualify', 'invoke', 'session_inspect', 'shutdown']).includes(value.kind)
-    || !value.context || typeof value.context !== 'object' || Array.isArray(value.context)) return false;
-  try { return Buffer.byteLength(JSON.stringify(value)) <= (reply ? GENERATION_LIMITS.result : GENERATION_LIMITS.input); } catch { return false; }
-}
-export function generationMessage(epoch, generation, kind, payload, context = {}, original = null, requestId) {
-  return { schema_version: '1', owner_epoch: epoch, generation_id: generation, request_id: requestId,
-    kind, original_operation_id: original, payload, context };
-}
-export function generationManifest(runtime, uiDigest, sdkDigest) {
-  if (typeof runtime.toolErrorContract !== 'string' || !runtime.toolErrorContract
-    || typeof runtime.projectToolResult !== 'function' || typeof runtime.consumeToolResult !== 'function'
-    || typeof runtime.normalizeFailure !== 'function') throw Error('generation_manifest_incompatible');
-  // Stable transport shape, never business eligibility or a human-origin proof.
-  return { schema_version: '1', mode: runtime.mode ?? 'headless', sdk_digest: sdkDigest,
-    protocol: 'mcp-sdk/2:stdio-legacy-and-modern', tool_error_contract: runtime.toolErrorContract,
-    tools: runtime.tools.map(tool => ({ name: tool.name, definition: tool.definition })),
-    resource: runtime.ui ? { uri: runtime.ui.uri, mimeType: runtime.ui.mimeType, digest: uiDigest } : null,
-    command_groups: [...(runtime.trustedContext.commandGroups ?? [])] };
-}
-export const manifestDigest = manifest => createHash('sha256').update(JSON.stringify(manifest)).digest('hex');
-
-const FAILURE_REASONS = new Set([
-  'generation_unavailable', 'generation_input_limit', 'generation_response_unknown', 'generation_connection_lost',
-  'generation_capacity_protected', 'generation_manifest_incompatible', 'generation_result_limit',
-  'generation_request_capacity', 'generation_already_initialized', 'generation_work_protected',
-  'generation_cleanup_unconfirmed', 'resource_denied', 'runtime_provenance_invalid', 'runtime_version_mismatch',
-  'dispatch_busy', 'dispatch_cancelled', 'dispatch_timeout', 'dispatch_worker_failed', 'dispatch_worker_termination_unconfirmed',
-  'runtime_publication_unowned', 'runtime_candidate_manifest_invalid', 'runtime_candidate_unowned', 'runtime_candidate_digest_mismatch',
-  'AGDF_MCP_EXECUTABLE_CLAIM_INVALID', 'AGDF_MCP_EXECUTABLE_CLAIM_CONTENDED',
-  'AGDF_MCP_EXECUTABLE_CLAIM_LOCK_UNCONFIRMED', 'AGDF_MCP_PUBLICATION_DEADLINE_EXCEEDED',
-]);
-export function generationFailureReason(error) {
-  const reason = error?.code ?? error?.message;
-  return FAILURE_REASONS.has(reason) ? reason : 'generation_runtime_failed';
-}
+// One SDK-free protocol owner, shared with the actual lifecycle owner.
+export * from '#agdf-owner-protocol';

package/src/generation-runtime.js

@@ -0,0 +1,103 @@
+// A directly owned private child. It never reads or writes public MCP STDIO.
+import { createAgdfWorkerExecutor } from './worker.js';
+import { loadCockpitResource } from './cockpit-resource.js';
+import { generationMessage, validGenerationMessage, generationManifest, generationFailureReason } from './generation-protocol.js';
+import { createMcpDispatchRuntime, createMcpDecisionRuntime, createMcpCockpitRuntime, DECISION_UI_URI,
+  inspectMcpDispatcherRuntime, releaseAbandonedOwnedLock } from 'create-agdf/mcp-worker-runtime';
+export function startGenerationRuntime({ epoch, generation, channel }) {
+  let runtime, executor, starting = false, closing = false, inflight = 0, serverDigest, sdkDigest, uiDigest;
+  const observed = new Set(), unknown = new Set();
+  function status() {
+    const owned = runtime?.inspectOwnership?.() ?? { views: 0 };
+    return { ...owned, inflight: inflight + (starting ? 1 : 0) + (owned.inflight ?? 0),
+      executor: executor?.active ? 1 : 0, uncertain: unknown.size + (owned.uncertain ?? 0), closing };
+  }
+  // Companion events (SD SDD-006): this generation executed the call, so it journals the final result
+  // once, before the result leaves; a failing journal never changes or delays the result.
+  function journal(name, args, projected) {
+    try { runtime.observeOutcome?.(name, args, projected); } catch { /* notification only */ }
+  }
+  function send(input, kind, payload) {
+    const reply = generationMessage(epoch, generation, kind, payload, {}, input.original_operation_id, input.request_id);
+    if (validGenerationMessage(reply, { epoch, generation, reply: true })) channel.send(reply);
+    else channel.send(generationMessage(epoch, generation, 'failure', { reason: 'generation_result_limit' }, {}, input.original_operation_id, input.request_id));
+  }
+  channel.on('message', async input => {
+    if (!validGenerationMessage(input, { epoch, generation }) || observed.has(input.request_id)) return;
+    if (observed.size >= 8192) { send(input, 'failure', { reason: 'generation_request_capacity' }); return; }
+    observed.add(input.request_id);
+    try {
+      if (input.kind === 'qualify') {
+        if (runtime || starting || closing) throw Error('generation_already_initialized');
+        starting = true;
+        const { surface, commandGroups, cockpitDir, cockpitMode } = input.payload;
+        const inspected = inspectMcpDispatcherRuntime();
+        if (inspected.provenanceStatus !== 'matched') throw Error('runtime_provenance_invalid');
+        runtime = cockpitDir || cockpitMode ? await createMcpCockpitRuntime({ surface, cockpitDir, cockpitMode, inspected })
+          : createMcpDispatchRuntime({ surface, commandGroups, inspected });
+        if (!cockpitDir && !cockpitMode && surface === 'codex') {
+          const ui = { uri: DECISION_UI_URI, mimeType: 'text/html;profile=mcp-app', limit: 4 * 1024 ** 2, kind: 'decision' };
+          ui.digest = loadCockpitResource(ui).digest;
+          runtime = await createMcpDecisionRuntime({ runtime, ui });
+        }
+        if (runtime.ui) uiDigest = loadCockpitResource(runtime.ui).digest;
+        // Inspect reports package-owned immutable identities, not caller evidence.
+        sdkDigest = inspected.generationIdentity.sdk_digest; serverDigest = inspected.generationIdentity.server_digest;
+        executor = runtime.mode === 'cockpit' ? null : createAgdfWorkerExecutor(runtime, { releaseOwnedLock: releaseAbandonedOwnedLock });
+        const support = { ui: Boolean(runtime.ui), app_mediation: runtime.mode === 'decision'
+          && runtime.trustedContext.decisionQualification(input.context.client, uiDigest) === true };
+        starting = false;
+        send(input, 'qualified', { manifest: generationManifest(runtime, uiDigest, sdkDigest),
+          producer: { server_digest: serverDigest, dispatcher_digest: inspected.generationIdentity.dispatcher_digest, sdk_digest: sdkDigest }, support });
+      } else if (input.kind === 'session_inspect') {
+        send(input, 'status', status());
+      } else if (input.kind === 'shutdown') {
+        if (closing || starting || inflight || unknown.size) throw Error('generation_work_protected');
+        closing = true;
+        await executor?.close(); await runtime?.close?.();
+        const remaining = status();
+        if (remaining.views || remaining.inflight || remaining.executor || remaining.uncertain) throw Error('generation_cleanup_unconfirmed');
+        send(input, 'closed', remaining);
+        channel.close(); // Natural exit, no kill, after all owned work is closed.
+      } else {
+        if (!runtime || closing) throw Error('generation_unavailable');
+        const { name } = input.payload;
+        let args = input.payload.arguments;
+        const tool = runtime.tool?.(name) ?? runtime.tools.find(t => t.name === name);
+        if (!tool || tool.requiresUi && input.context.uiSupported !== true) throw Error('resource_denied');
+        ++inflight;
+        const parentOwned = typeof tool.parentOwned === 'function' ? tool.parentOwned(args) : tool.parentOwned;
+        const started = performance.now();
+        let result, phase = parentOwned || !executor ? 'parse' : 'execute';
+        try {
+          phase = 'parse';
+          args = runtime.prepareInput?.(name, args) ?? args;
+          phase = parentOwned || !executor ? 'parse' : 'execute';
+          if (parentOwned || !executor) {
+            const parsed = tool.parse(args); phase = 'execute';
+            result = await tool.execute(parsed, undefined, input.context);
+          } else result = await executor.execute(args, { toolName: name, trusted: runtime.prepareDispatch?.(name, args) });
+          if (runtime.postprocessToolResult) result = await runtime.postprocessToolResult(name, args, result, input.context);
+          if (input.original_operation_id && result.outcome === 'effect_unknown') unknown.add(input.original_operation_id);
+          if (name === 'agdf_inspect' && args.operation === 'operation-status' && result.report?.status === 'recorded'
+            && (result.report.receipt?.operation_id ?? result.report.receipt?.operation?.operation_id) === args.module.split('/').at(-1)) unknown.delete(args.module.split('/').at(-1));
+          const projected = runtime.projectToolResult(name, args, result);
+          journal(name, args, projected);
+          send(input, 'result', projected);
+        } catch (error) {
+          const facts = runtime.normalizeFailure(error, { phase });
+          if (input.original_operation_id && facts.dispatch !== 'not_dispatched') unknown.add(input.original_operation_id);
+          const projected = runtime.projectToolResult(name, args, runtime.failure(facts.code, name, args, { ...facts, elapsed_ms: performance.now() - started }), facts);
+          journal(name, args, projected);
+          send(input, 'result', projected);
+        } finally { --inflight; }
+      }
+    } catch (error) { if (input.kind === 'qualify') starting = false; send(input, 'failure', { reason: generationFailureReason(error) }); }
+  });
+  channel.on('disconnect', () => {
+    // Loss of the facade does not cancel or replay business effects. Timers and
+    // existing worker/view owners retain their bounds; no process-wide force kill.
+    if (!closing) { void executor?.close().catch(() => {}); void runtime?.close?.().catch(() => {}); }
+  });
+
+}

package/src/generation-thread-entry.js

@@ -0,0 +1,8 @@
+// Genuine owner-hosted Worker; no public STDIO and no process impersonation.
+import { parentPort, workerData } from 'node:worker_threads';
+import { startGenerationRuntime } from './generation-runtime.js';
+if (!parentPort) throw Error('generation_unavailable');
+startGenerationRuntime({ epoch: workerData.epoch, generation: workerData.generation,
+  channel: { on: (kind, listener) => parentPort.on(kind === 'disconnect' ? 'close' : kind,
+    kind === 'message' ? wire => { try { listener(JSON.parse(wire)); } catch {} } : listener),
+    send: value => parentPort.postMessage(JSON.stringify(value)), close: () => parentPort.close() } });