@aiwg/cli 2026.10.5 → 2026.10.7

package/dist/src/mcp/tools/agentic-sandbox.mjs

@@ -10,6 +10,7 @@
 
 import { readFile, stat } from 'node:fs/promises';
 import { z } from 'zod';
+import { integer, dateTime } from '../../schema/zod-validation.mjs';
 import { assertNoWorkerBinding, mcpError, mcpJson } from '../helpers.mjs';
 
 const FLEET_VERSION = 'agentic-orchestration/v1';
@@ -173,15 +174,15 @@ const scopeSchema = {
   instance_id: z.string().min(1).max(255).regex(/^[^\r\n]+$/),
   agent_id: z.string().min(1).max(255).regex(/^[^\r\n]+$/),
 };
-const activityFilterSchema = z.object({
+const activityFilterSchema = z.strictObject({
   event_name: z.string().min(1).max(255).optional(), collector: z.string().min(1).max(255).optional(),
   trust: z.string().min(1).max(255).optional(), plane: z.string().min(1).max(255).optional(),
   outcome: z.string().min(1).max(255).optional(), session_id: z.string().min(1).max(255).optional(),
   mission_id: z.string().min(1).max(255).optional(), task_id: z.string().min(1).max(255).optional(),
   tool_call_id: z.string().min(1).max(255).optional(), command_id: z.string().min(1).max(255).optional(),
   process_id: z.string().min(1).max(255).optional(), trace_id: z.string().regex(/^[0-9a-f]{32}$/).optional(),
-  since: z.string().datetime().optional(), until: z.string().datetime().optional(), limit: z.number().int().min(1).max(1000).optional(),
-}).strict().optional();
+  since: dateTime().optional(), until: dateTime().optional(), limit: integer().min(1).max(1000).optional(),
+}).optional();
 
 function scopeHeaders(args) {
   return Object.fromEntries(Object.entries(SCOPE_HEADERS).map(([key, header]) => [header, args[key]]));
@@ -206,17 +207,17 @@ export function registerAgenticSandboxToolset(server, { client = new AgenticSand
     () => client.request('/api/v2/fleet/workloads', { validate: requireInventory }));
   register('sandbox-fleet-get', { title: 'Get Agentic Sandbox fleet workload', description: 'Read one revisioned fleet workload by child identity.', inputSchema: { contract_version: z.literal(FLEET_VERSION).default(FLEET_VERSION), child_id: z.string().min(1).max(255) }, annotations: { readOnlyHint: true, destructiveHint: false } },
     ({ child_id }) => client.request(`/api/v2/fleet/workloads/${encodeURIComponent(child_id)}`, { validate: requireFleetRecord }));
-  register('sandbox-fleet-reconcile-preview', { title: 'Preview fleet reconciliation', description: 'Compute a read-only reconciliation preview from inventory; never calls POST /reconcile.', inputSchema: { contract_version: z.literal(FLEET_VERSION).default(FLEET_VERSION), before_revision: z.number().int().min(0), child_ids: z.array(z.string().min(1).max(255)).max(1000) }, annotations: { readOnlyHint: true, destructiveHint: false } },
+  register('sandbox-fleet-reconcile-preview', { title: 'Preview fleet reconciliation', description: 'Compute a read-only reconciliation preview from inventory; never calls POST /reconcile.', inputSchema: { contract_version: z.literal(FLEET_VERSION).default(FLEET_VERSION), before_revision: integer().min(0), child_ids: z.array(z.string().min(1).max(255)).max(1000) }, annotations: { readOnlyHint: true, destructiveHint: false } },
     async ({ before_revision, child_ids }) => client.request('/api/v2/fleet/workloads', { validate: (value) => {
       const inventory = requireInventory(value);
       const byId = new Map(inventory.records.map((record) => [record.lineage.child_id, record]));
       return { document_type: 'reconciliation-preview', api_version: FLEET_VERSION, before_revision, inventory_revision: inventory.inventory_revision, stale: before_revision !== inventory.inventory_revision, rows: child_ids.map((child_id) => ({ child_id, present: byId.has(child_id), observed_state: byId.get(child_id)?.status?.observed_state ?? 'unknown', revision: byId.get(child_id)?.status?.revision ?? null })) };
     } }));
-  register('sandbox-fleet-admit', { title: 'Admit Agentic Sandbox fleet workload', description: 'Mutating fleet admission; requires an exact v1 workload and confirmed=true.', inputSchema: { contract_version: z.literal(FLEET_VERSION).default(FLEET_VERSION), workload: z.record(z.unknown()), confirmed: z.boolean().default(false) }, annotations: { readOnlyHint: false, destructiveHint: true } },
+  register('sandbox-fleet-admit', { title: 'Admit Agentic Sandbox fleet workload', description: 'Mutating fleet admission; requires an exact v1 workload and confirmed=true.', inputSchema: { contract_version: z.literal(FLEET_VERSION).default(FLEET_VERSION), workload: z.record(z.string(), z.unknown()), confirmed: z.boolean().default(false) }, annotations: { readOnlyHint: false, destructiveHint: true } },
     ({ workload, confirmed }) => confirmed ? client.request('/api/v2/fleet/workloads', { method: 'POST', body: requireFleetRecord(workload), validate: (value) => ({ replayed: value?.replayed === true, workload: requireFleetRecord(value?.workload) }) }) : confirmationError('sandbox-fleet-admit'));
-  register('sandbox-fleet-observe', { title: 'Record fleet workload observation', description: 'Mutating monotonic observation update; requires confirmed=true and expected revision.', inputSchema: { contract_version: z.literal(FLEET_VERSION).default(FLEET_VERSION), child_id: z.string().min(1).max(255), expected_revision: z.number().int().min(0), status: z.record(z.unknown()), runtime_identity: z.object({ session_id: z.string().optional(), task_id: z.string().optional(), command_id: z.string().optional() }).strict().optional(), confirmed: z.boolean().default(false) }, annotations: { readOnlyHint: false, destructiveHint: true } },
+  register('sandbox-fleet-observe', { title: 'Record fleet workload observation', description: 'Mutating monotonic observation update; requires confirmed=true and expected revision.', inputSchema: { contract_version: z.literal(FLEET_VERSION).default(FLEET_VERSION), child_id: z.string().min(1).max(255), expected_revision: integer().min(0), status: z.record(z.string(), z.unknown()), runtime_identity: z.strictObject({ session_id: z.string().optional(), task_id: z.string().optional(), command_id: z.string().optional() }).optional(), confirmed: z.boolean().default(false) }, annotations: { readOnlyHint: false, destructiveHint: true } },
     ({ child_id, expected_revision, status, runtime_identity, confirmed }) => confirmed ? client.request(`/api/v2/fleet/workloads/${encodeURIComponent(child_id)}/observations`, { method: 'POST', body: requireSafePayload({ expected_revision, status, ...(runtime_identity ? { runtime_identity } : {}) }, 'fleet observation'), validate: requireFleetRecord }) : confirmationError('sandbox-fleet-observe'));
-  register('sandbox-fleet-reconcile', { title: 'Reconcile fleet workloads', description: 'Mutating restart reconciliation; requires confirmed=true.', inputSchema: { contract_version: z.literal(FLEET_VERSION).default(FLEET_VERSION), before_revision: z.number().int().min(0), child_ids: z.array(z.string().min(1).max(255)).max(1000), confirmed: z.boolean().default(false) }, annotations: { readOnlyHint: false, destructiveHint: true } },
+  register('sandbox-fleet-reconcile', { title: 'Reconcile fleet workloads', description: 'Mutating restart reconciliation; requires confirmed=true.', inputSchema: { contract_version: z.literal(FLEET_VERSION).default(FLEET_VERSION), before_revision: integer().min(0), child_ids: z.array(z.string().min(1).max(255)).max(1000), confirmed: z.boolean().default(false) }, annotations: { readOnlyHint: false, destructiveHint: true } },
     ({ before_revision, child_ids, confirmed }) => confirmed ? client.request('/api/v2/fleet/reconcile', { method: 'POST', body: { before_revision, child_ids }, validate: requireReconciliation }) : confirmationError('sandbox-fleet-reconcile'));
 
   for (const [kind, eventsRequired] of [['coverage', false], ['timeline', true]]) {

package/dist/src/mcp/tools/command-run.mjs

@@ -17,6 +17,7 @@
  */
 
 import { z } from 'zod';
+import { integer } from '../../schema/zod-validation.mjs';
 import {
   runAiwgCli,
   loadCommandAllowList,
@@ -31,10 +32,10 @@ export function registerCommandRunTool(server) {
     description: 'Dispatch to any allow-listed AIWG CLI command (`aiwg <command> [args...]`). The full surface of ~94 commands is reachable. Destructive commands require `confirmed: true`.',
     inputSchema: {
       command: z.string().describe('Command name from `command-list` (e.g. "use", "discover", "doctor")'),
-      args: z.array(z.string()).default([]).describe('Argument array (never shell-interpreted)'),
+      args: z.array(z.string()).prefault([]).describe('Argument array (never shell-interpreted)'),
       project_dir: z.string().optional().describe('Working directory for the command'),
       confirmed: z.boolean().default(false).describe('Required for destructive commands (true to proceed)'),
-      timeout_ms: z.number().int().min(1000).max(600_000).default(120_000).describe('Timeout (1s–10min, default 2min)'),
+      timeout_ms: integer().min(1000).max(600_000).default(120_000).describe('Timeout (1s–10min, default 2min)'),
     },
     annotations: {
       destructiveHint: true,  // conservative default; many subcommands are read-only but the surface is broad

package/dist/src/mcp/tools/decision.mjs

@@ -1,102 +1,103 @@
 import { z } from 'zod';
+import { integer, number } from '../../schema/zod-validation.mjs';
 import { mcpError, mcpJson } from '../helpers.mjs';
 
 const STATUS = z.enum(['success', 'abstained', 'denied', 'unavailable', 'error', 'cancelled']);
-const ENVELOPE = z.object({ schema: z.string() }).passthrough();
-const LIVE_PLAN = z.object({ mode: z.literal('live'), status: z.enum(['ready', 'skipped', 'denied']), reason: z.string(), executes: z.literal(false) }).passthrough();
-const PATTERN_SUMMARY = z.object({
+const ENVELOPE = z.looseObject({ schema: z.string() });
+const LIVE_PLAN = z.looseObject({ mode: z.literal('live'), status: z.enum(['ready', 'skipped', 'denied']), reason: z.string(), executes: z.literal(false) });
+const PATTERN_SUMMARY = z.looseObject({
   id: z.string(),
   version: z.string(),
   status: z.string(),
   primitive: z.string().optional(),
-}).passthrough();
-const PATTERN_LIST = z.object({
+});
+const PATTERN_LIST = z.looseObject({
   schema: z.literal('aiwg-decision-pattern-list/v1'),
   patterns: z.array(PATTERN_SUMMARY),
-}).passthrough();
-const PATTERN_SHOW = z.object({
+});
+const PATTERN_SHOW = z.looseObject({
   schema: z.literal('aiwg-decision-pattern-show/v1'),
   pack: PATTERN_SUMMARY,
-  inputSchema: z.unknown(),
-  outputSchema: z.unknown(),
+  inputSchema: z.unknown().optional(),
+  outputSchema: z.unknown().optional(),
   livePlan: LIVE_PLAN,
-}).passthrough();
-const COMPACT_EVALUATION = z.object({
+});
+const COMPACT_EVALUATION = z.looseObject({
   status: STATUS,
   reason: z.string(),
-  attempts: z.number(),
-  value: z.unknown().nullable(),
-}).passthrough();
-const COMPACT_RESULT = z.object({
+  attempts: number(),
+  value: z.unknown().nullable().optional(),
+});
+const COMPACT_RESULT = z.looseObject({
   status: STATUS,
   rulesetStatus: z.string(),
   reason: z.string(),
   matchedRules: z.array(z.string()),
   evaluations: z.record(z.string(), COMPACT_EVALUATION),
-  outcome: z.unknown().nullable(),
-}).passthrough();
-const EVALUATE = z.object({
+  outcome: z.unknown().nullable().optional(),
+});
+const EVALUATE = z.looseObject({
   schema: z.literal('aiwg-decision-evaluate/v1'),
   status: STATUS,
   reason: z.string(),
-  exitCode: z.number(),
+  exitCode: number(),
   compact: COMPACT_RESULT.nullable().optional(),
-  result: z.unknown().nullable(),
-}).passthrough();
-const VALIDATION = z.object({
+  result: z.unknown().nullable().optional(),
+});
+const VALIDATION = z.looseObject({
   schema: z.literal('aiwg-decision-validation/v1'),
   target: z.enum(['request', 'definition', 'ruleset', 'binding']),
   valid: z.boolean(),
-  summary: z.object({
+  summary: z.looseObject({
     kind: z.string().nullable().optional(),
     apiVersion: z.string().nullable().optional(),
     id: z.string().nullable().optional(),
     version: z.string().nullable().optional(),
-  }).passthrough(),
+  }),
   errors: z.array(z.string()),
-}).passthrough();
-const CAPABILITIES = z.object({
+});
+const CAPABILITIES = z.looseObject({
   schema: z.literal('aiwg-decision-driver-capabilities/v1'),
   enabled: z.boolean(),
   offlineReady: z.boolean(),
   primitives: z.array(z.string()),
-  backend: z.object({ configured: z.boolean(), probed: z.boolean(), status: z.literal('not-probed') }).passthrough(),
-}).passthrough();
-const OFFLINE_RUN = z.object({
+  backend: z.looseObject({ configured: z.boolean(), probed: z.boolean(), status: z.literal('not-probed') }),
+});
+const OFFLINE_RUN = z.looseObject({
   schema: z.literal('aiwg-decision-offline-run/v1'),
   status: STATUS,
   route: z.enum(['accept', 'review', 'deny']),
   reason: z.string(),
-  evaluations: z.array(z.object({
+  evaluations: z.array(z.looseObject({
     alias: z.string(),
     primitive: z.string(),
     status: z.string(),
     reason: z.string(),
-    attempts: z.number(),
-    value: z.unknown(),
-  }).passthrough()),
+    attempts: number(),
+    value: z.unknown().optional(),
+  })),
   checks: z.array(z.unknown()),
-}).passthrough();
-const SYNTHETIC_SETUP = z.object({
+});
+const SYNTHETIC_SETUP = z.looseObject({
   schema: z.literal('aiwg-decision-synthetic-setup/v1'),
-  pattern: z.object({ id: z.string(), version: z.string() }).passthrough(),
+  pattern: z.looseObject({ id: z.string(), version: z.string() }),
   files: z.record(z.string(), z.unknown()),
-}).passthrough();
-const ASK = z.object({
+});
+const ASK = z.looseObject({
   schema: z.literal('aiwg-decision-ask/v1'),
   status: z.enum(['answered', 'fallback']),
-  answer: z.union([z.string(), z.boolean(), z.number()]).nullable(),
+  answer: z.union([z.string(), z.boolean(), number()]).nullable(),
   confidence: z.number().min(0).max(1).nullable(),
   probability: z.number().min(0).max(1).optional(),
   fallback: z.enum(['llm']).nullable(),
   reason: z.string(),
   model: z.string().nullable(),
   usage: z.object({
-    inputTokens: z.number().int().nonnegative().nullable(),
-    outputTokens: z.number().int().nonnegative().nullable(),
+    inputTokens: integer().nonnegative().nullable(),
+    outputTokens: integer().nonnegative().nullable(),
   }).nullable(),
-  latencyMs: z.number().nonnegative(),
-}).passthrough();
+  latencyMs: number().check(z.gte(0)).meta({ type: 'number', minimum: 0 }),
+});
 
 let driverPromise;
 
@@ -176,7 +177,7 @@ export function registerDecisionToolset(server) {
     description: 'Validate a request, definition, ruleset or binding without importing modules or resolving secrets.',
     inputSchema: {
       target: z.enum(['request', 'definition', 'ruleset', 'binding']),
-      document: z.unknown().describe('Inline decision document or dispatcher request object'),
+      document: z.unknown().optional().describe('Inline decision document or dispatcher request object'),
     },
     annotations: { readOnlyHint: true },
   }, async ({ target, document }) => (await driver()).validateDecisionValue(target, document, 'mcp-inline'), VALIDATION);
@@ -198,12 +199,12 @@ export function registerDecisionToolset(server) {
       question: z.string().min(1),
       yes_no: z.boolean().default(false),
       choices: z.array(z.string()).min(2).max(255).optional().describe('Choice ids, each optionally written as id=description so Jev knows what the option means'),
-      scale: z.object({ low: z.number().int(), high: z.number().int() }).optional(),
+      scale: z.object({ low: integer(), high: integer() }).optional(),
       context: z.string().optional(),
       threshold: z.number().min(0).max(1).default(0.8),
-      timeout_ms: z.number().int().positive().default(15000),
-      passes: z.number().int().positive().optional(),
-      escalation_passes: z.number().int().positive().optional(),
+      timeout_ms: integer().positive().default(15000),
+      passes: integer().positive().optional(),
+      escalation_passes: integer().positive().optional(),
       caller: z.string().optional().describe('Optional decision-point attribution tag, recorded in the decision ledger (#2946)'),
     },
     annotations: { readOnlyHint: true, destructiveHint: false, openWorldHint: true },

package/dist/src/mcp/tools/discovery.mjs

@@ -6,12 +6,12 @@
  *
  *   - discover          (cross-type ranked search)
  *   - skill-list        (enumerate canonical skill corpus)
- *   - skill-show        (fetch SKILL.md body)
+ *   - skill-show        (metadata card + drill-ins)
  *   - command-list      (enumerate CLI commands)
- *   - command-show      (fetch command definition)
+ *   - command-show      (metadata card + drill-ins)
  *   - rule-list         (enumerate rules)
- *   - rule-show         (fetch rule body)
- *   - agent-show        (fetch agent definition; agent-list pre-exists)
+ *   - rule-show         (metadata card + drill-ins)
+ *   - agent-show        (metadata card + drill-ins; agent-list pre-exists)
  *   - template-list     (enumerate templates)
  *   - template-show     (fetch raw template body)
  *
@@ -22,10 +22,33 @@
  */
 
 import { z } from 'zod';
+import { integer } from '../../schema/zod-validation.mjs';
 import { runAiwgCli, mcpError, mcpJson, AIWG_ROOT } from '../helpers.mjs';
 import path from 'node:path';
 import { pinContainedRoot, readContainedFile, listContainedFiles, validateContainedPath } from '../../utils/contained-filesystem.mjs';
 
+/** Shared CLI/MCP drill-in vocabulary for all discovery cards. */
+export const showDrillInSchema = {
+  body: z.boolean().optional().describe('Fetch the full authored body'),
+  section: z.array(z.string()).optional().describe('Exact headings (case-insensitive fallback); repeatable'),
+  rules: z.boolean().optional().describe('Show governing rule summaries and required checks'),
+  with_rule_bodies: z.boolean().optional().describe('Include full governing rule bodies'),
+  bound_rule_bodies: z.boolean().optional().describe('Legacy alias for with_rule_bodies'),
+  resources: z.boolean().optional().describe('List companion resources'),
+  resource: z.string().optional().describe('Fetch one resource path from the card'),
+};
+export function showDrillInArgs(input) {
+  return [
+    ...(input.body ? ['--body'] : []),
+    ...(input.section ?? []).flatMap(heading => ['--section', heading]),
+    ...(input.rules ? ['--rules'] : []),
+    ...(input.with_rule_bodies ? ['--with-rule-bodies'] : []),
+    ...(input.bound_rule_bodies ? ['--bound-rule-bodies'] : []),
+    ...(input.resources ? ['--resources'] : []),
+    ...(input.resource ? ['--resource', input.resource] : []),
+  ];
+}
+
 /**
  * Register discovery tools on the MCP server.
  *
@@ -42,7 +65,7 @@ export function registerDiscoveryTools(server, { corpusStore } = {}) {
     inputSchema: {
       phrase: z.string().describe('Natural-language capability description (e.g. "create intake form")'),
       type: z.enum(['skill', 'agent', 'command', 'rule', 'flow', 'runbook', 'template', 'behavior']).optional().describe('Restrict to one artifact type'),
-      limit: z.number().int().min(1).max(50).default(5).describe('Maximum results (default 5)'),
+      limit: integer().min(1).max(50).default(5).describe('Maximum results (default 5)'),
     },
     annotations: { readOnlyHint: true, openWorldHint: false },
   }, async ({ phrase, type, limit }) => {
@@ -67,7 +90,7 @@ export function registerDiscoveryTools(server, { corpusStore } = {}) {
     description: 'Enumerate available AIWG skills from the canonical corpus. Optional filter by name pattern.',
     inputSchema: {
       filter: z.string().optional().describe('Substring or glob filter on skill name'),
-      limit: z.number().int().min(1).max(500).default(50).describe('Maximum results'),
+      limit: integer().min(1).max(500).default(50).describe('Maximum results'),
     },
     annotations: { readOnlyHint: true },
   }, async ({ filter, limit }) => {
@@ -83,15 +106,15 @@ export function registerDiscoveryTools(server, { corpusStore } = {}) {
 
   server.registerTool('skill-show', {
     title: 'Show AIWG Skill',
-    description: 'Fetch the full body of an AIWG SKILL.md by name. Returns path + content envelope.',
+    description: 'Return the AIWG metadata card with governing rules, outline, resources, and drill-in guidance. Use body/section for authored content.',
     inputSchema: {
-      bound_rule_bodies: z.boolean().optional().describe('Include full bound rule bodies'),
+      ...showDrillInSchema,
       name: z.string().describe('Skill name (slug; e.g. "intake-wizard")'),
     },
     annotations: { readOnlyHint: true },
-  }, async ({ name, bound_rule_bodies }) => {
+  }, async ({ name, ...drillIn }) => {
     try {
-      const { stdout, code, stderr } = await runAiwgCli(['show', 'skill', name, '--json', ...(bound_rule_bodies ? ['--bound-rule-bodies'] : [])]);
+      const { stdout, code, stderr } = await runAiwgCli(['show', 'skill', name, '--json', ...showDrillInArgs(drillIn)]);
       if (code !== 0) return mcpError(`skill-show failed: ${stderr}`);
       return mcpJson(stdout);
     } catch (err) {
@@ -122,14 +145,15 @@ export function registerDiscoveryTools(server, { corpusStore } = {}) {
 
   server.registerTool('command-show', {
     title: 'Show AIWG CLI Command Definition',
-    description: 'Fetch the full spec/help text for a specific `aiwg` CLI command.',
+    description: 'Return the AIWG metadata card with governing rules, outline, resources, and drill-in guidance. Use body/section for authored content.',
     inputSchema: {
+      ...showDrillInSchema,
       name: z.string().describe('Command name (e.g. "use", "discover", "ralph")'),
     },
     annotations: { readOnlyHint: true },
-  }, async ({ name }) => {
+  }, async ({ name, ...drillIn }) => {
     try {
-      const { stdout, code, stderr } = await runAiwgCli(['show', 'command', name, '--json']);
+      const { stdout, code, stderr } = await runAiwgCli(['show', 'command', name, '--json', ...showDrillInArgs(drillIn)]);
       if (code !== 0) return mcpError(`command-show failed: ${stderr}`);
       return mcpJson(stdout);
     } catch (err) {
@@ -166,7 +190,7 @@ export function registerDiscoveryTools(server, { corpusStore } = {}) {
     description: 'Enumerate AIWG enforcement rules (e.g. skill-discovery, no-attribution, anti-laziness, citation-policy). Top-7 CRITICAL/HIGH rules are inlined into Hermes AGENTS.md priming (skill-discovery added #1347); this tool reaches the rest.',
     inputSchema: {
       filter: z.string().optional().describe('Substring filter on rule name'),
-      limit: z.number().int().min(1).max(200).default(50),
+      limit: integer().min(1).max(200).default(50),
     },
     annotations: { readOnlyHint: true },
   }, async ({ filter, limit }) => {
@@ -182,14 +206,15 @@ export function registerDiscoveryTools(server, { corpusStore } = {}) {
 
   server.registerTool('rule-show', {
     title: 'Show AIWG Rule',
-    description: 'Fetch the full body of a specific AIWG rule by name.',
+    description: 'Return the AIWG metadata card with governing rules, outline, resources, and drill-in guidance. Use body/section for authored content.',
     inputSchema: {
+      ...showDrillInSchema,
       name: z.string().describe('Rule name (e.g. "no-attribution", "anti-laziness")'),
     },
     annotations: { readOnlyHint: true },
-  }, async ({ name }) => {
+  }, async ({ name, ...drillIn }) => {
     try {
-      const { stdout, code, stderr } = await runAiwgCli(['show', 'rule', name, '--json']);
+      const { stdout, code, stderr } = await runAiwgCli(['show', 'rule', name, '--json', ...showDrillInArgs(drillIn)]);
       if (code !== 0) return mcpError(`rule-show failed: ${stderr}`);
       return mcpJson(stdout);
     } catch (err) {
@@ -202,15 +227,15 @@ export function registerDiscoveryTools(server, { corpusStore } = {}) {
   // ============================================================
   server.registerTool('agent-show', {
     title: 'Show AIWG Agent Definition',
-    description: 'Fetch the full agent definition (system prompt + frontmatter) by name.',
+    description: 'Return the AIWG metadata card with governing rules, outline, resources, and drill-in guidance. Use body/section for authored content.',
     inputSchema: {
-      bound_rule_bodies: z.boolean().optional().describe('Include full bound rule bodies'),
+      ...showDrillInSchema,
       name: z.string().describe('Agent name (e.g. "test-engineer", "security-auditor")'),
     },
     annotations: { readOnlyHint: true },
-  }, async ({ name, bound_rule_bodies }) => {
+  }, async ({ name, ...drillIn }) => {
     try {
-      const { stdout, code, stderr } = await runAiwgCli(['show', 'agent', name, '--json', ...(bound_rule_bodies ? ['--bound-rule-bodies'] : [])]);
+      const { stdout, code, stderr } = await runAiwgCli(['show', 'agent', name, '--json', ...showDrillInArgs(drillIn)]);
       if (code !== 0) return mcpError(`agent-show failed: ${stderr}`);
       return mcpJson(stdout);
     } catch (err) {

package/dist/src/mcp/tools/orchestration.mjs

@@ -9,6 +9,8 @@
  */
 
 import { z } from 'zod';
+import { integer } from '../../schema/zod-validation.mjs';
+import { showDrillInSchema, showDrillInArgs } from './discovery.mjs';
 import { parse as parseYaml } from 'yaml';
 import fs from 'node:fs/promises';
 import path from 'node:path';
@@ -157,28 +159,23 @@ export function registerFlowToolset(server) {
 
   server.registerTool('flow-show', {
     title: 'Show AIWG Flow',
-    description: 'Fetch a declarative Flow playbook by name, including parsed step summary and the wrapper skill path when present.',
+    description: 'Return the same metadata card as aiwg show flow, with optional body, section, rules, and resource drill-ins.',
     inputSchema: {
+      ...showDrillInSchema,
       name: z.string().describe('Flow name or playbook file name (e.g. flow-release)'),
-      bound_rule_bodies: z.boolean().optional().describe('Include full bound rule bodies'),
       framework: z.string().optional().describe('Optional framework disambiguator'),
     },
     annotations: { readOnlyHint: true, openWorldHint: false },
-  }, async ({ name, framework, bound_rule_bodies }) => {
+  }, async ({ name, framework, ...drillIn }) => {
     try {
-      const flow = await findFlow(name, framework);
-      if (!flow) return mcpError(`flow-show: flow not found: ${name}`);
-      flow.wrapper_skill.exists = await pathExists(flow.wrapper_skill.path);
+      const flow = framework ? await findFlow(name, framework) : null;
+      if (framework && !flow) return mcpError(`flow-show: flow not found: ${name}`);
       const { stdout, stderr, code } = await runAiwgCli([
-        'show', 'flow', flow.path, '--json',
-        ...(bound_rule_bodies ? ['--bound-rule-bodies'] : []),
+        'show', 'flow', flow?.path ?? name, '--json',
+        ...showDrillInArgs(drillIn),
       ]);
-      if (code !== 0) return mcpError(`flow-show binding lookup failed: ${stderr}`);
-      const shown = JSON.parse(stdout);
-      return mcpJson({ ...flow, ...(shown.bound_rules ? { bound_rules: shown.bound_rules,
-        ...(shown.required_rule_checks ? { required_rule_checks: shown.required_rule_checks } : {}),
-        ...(shown.rule_stats ? { rule_stats: shown.rule_stats } : {}),
-        ...(shown.rule_check_obligation ? { rule_check_obligation: shown.rule_check_obligation } : {}) } : {}) });
+      if (code !== 0) return mcpError(`flow-show lookup failed: ${stderr}`);
+      return mcpJson(stdout);
     } catch (err) {
       return mcpError(`flow-show: ${err.message}`);
     }
@@ -191,7 +188,7 @@ export function registerFlowToolset(server) {
       name: z.string().describe('Flow name (e.g. flow-release)'),
       framework: z.string().optional().describe('Optional framework disambiguator'),
       project_dir: z.string().optional().describe('Project directory where the Flow should operate'),
-      args: z.array(z.string()).default([]).describe('Operator arguments to pass conceptually to the wrapper skill'),
+      args: z.array(z.string()).prefault([]).describe('Operator arguments to pass conceptually to the wrapper skill'),
       confirmed: z.boolean().default(false).describe('Required because Flows can run shell commands and write artifacts'),
     },
     annotations: { destructiveHint: true, openWorldHint: true },
@@ -246,15 +243,16 @@ export function registerMissionToolset(server) {
       session_id: z.string().describe('Existing Mission Control session id from mc-start / mc-list'),
       objective: z.string().describe('Mission objective'),
       completion: z.string().describe('Measurable completion criterion'),
-      max_iterations: z.number().int().positive().max(Number.MAX_SAFE_INTEGER).optional().describe('Ralph iteration cap'),
-      max_total_tokens: z.number().int().positive().max(Number.MAX_SAFE_INTEGER).optional().describe('Hard cumulative token ceiling'),
-      max_output_tokens: z.number().int().positive().max(Number.MAX_SAFE_INTEGER).optional().describe('Hard cumulative output-token ceiling'),
-      max_tool_calls: z.number().int().positive().max(Number.MAX_SAFE_INTEGER).optional().describe('Hard cumulative tool-call ceiling'),
+      max_iterations: integer().positive().max(Number.MAX_SAFE_INTEGER).optional().describe('Ralph iteration cap'),
+      max_total_tokens: integer().positive().max(Number.MAX_SAFE_INTEGER).optional().describe('Hard cumulative token ceiling'),
+      max_output_tokens: integer().positive().max(Number.MAX_SAFE_INTEGER).optional().describe('Hard cumulative output-token ceiling'),
+      max_tool_calls: integer().positive().max(Number.MAX_SAFE_INTEGER).optional().describe('Hard cumulative tool-call ceiling'),
       max_total_cost: z.number().positive().finite().optional().describe('Hard cumulative provider-reported spend ceiling'),
       max_wall_clock_minutes: z.number().positive().finite().optional().describe('Hard cumulative runtime ceiling'),
-      exploration_quota: z.number().int().positive().max(Number.MAX_SAFE_INTEGER).optional().describe('Require structural variant after this many flat cycles (off unless declared; no default K)'),
+      exploration_quota: integer().positive().max(Number.MAX_SAFE_INTEGER).optional().describe('Require structural variant after this many flat cycles (off unless declared; no default K)'),
       budget_stop_policy: z.enum(['completion-wins', 'budget-wins']).optional().describe('Stop semantics when the completing iteration crosses a ceiling (default: completion-wins)'),
       project_dir: z.string().optional().describe('Project directory for CLI dispatch'),
+      worker_dispatch: z.string().optional().describe('Absolute prepared managed worker dispatch JSON path inside the project'),
       confirmed: z.boolean().default(false).describe('Required for durable/long-running mission dispatch'),
     },
     annotations: { destructiveHint: true, openWorldHint: true },
@@ -270,6 +268,7 @@ export function registerMissionToolset(server) {
     max_wall_clock_minutes,
     exploration_quota,
     budget_stop_policy,
+    worker_dispatch,
     project_dir,
     confirmed,
   }) => {
@@ -289,6 +288,7 @@ export function registerMissionToolset(server) {
       if (max_wall_clock_minutes) cliArgs.push('--max-wall-clock-minutes', String(max_wall_clock_minutes));
       if (exploration_quota) cliArgs.push('--exploration-quota', String(exploration_quota));
       if (budget_stop_policy) cliArgs.push('--budget-stop-policy', budget_stop_policy);
+      if (worker_dispatch) cliArgs.push('--worker-dispatch', worker_dispatch);
       const { stdout, stderr, code } = await runAiwgCli(
         cliArgs,
         { cwd: project_dir, timeoutMs: 30_000 },
@@ -335,7 +335,7 @@ export function registerWorkerResolveTool(server) {
   server.registerTool('worker-resolve', {
     title: 'Resolve Worker Invocation',
     description: 'Resolve a nonlaunching qualified worker plan without Mission or MC state.',
-    inputSchema: z.object({
+    inputSchema: z.strictObject({
       role: z.enum(['efficiency', 'coding', 'reasoning']),
       task: z.string().min(1),
       group: z.string().min(1).regex(/^[a-z][a-z0-9-]{0,62}$/),
@@ -345,7 +345,7 @@ export function registerWorkerResolveTool(server) {
       transport: z.enum(['shell', 'mcp']).default('shell'),
       format: z.enum(['shell', 'json']).optional(),
       project_dir: z.string().min(1).optional(),
-    }).strict(),
+    }),
     annotations: { readOnlyHint: true, destructiveHint: false, openWorldHint: false },
   }, async input => {
     try {

package/dist/src/mcp/tools/subsystems.mjs

@@ -15,6 +15,7 @@
  */
 
 import { z } from 'zod';
+import { integer } from '../../schema/zod-validation.mjs';
 import { runAiwgCli, mcpError, mcpJson } from '../helpers.mjs';
 import { registerFlowToolset, registerMissionToolset } from './orchestration.mjs';
 import { registerWorkerInvokeToolset, WORKERS_TOOLSET_NAME } from './worker-invoke.mjs';
@@ -187,7 +188,7 @@ function registerActivityLogToolset(server) {
     inputSchema: {
       since: z.string().optional().describe('Filter by date YYYY-MM-DD'),
       operation: z.string().optional().describe('Filter by operation token (e.g. "create", "deploy")'),
-      limit: z.number().int().min(1).max(1000).default(100),
+      limit: integer().min(1).max(1000).default(100),
     },
     readOnly: true,
     buildArgs: ({ since, operation, limit }) => {
@@ -256,7 +257,7 @@ function registerIndexToolset(server) {
     inputSchema: {
       keyword: z.string().optional().describe('Keyword query'),
       type: z.string().optional().describe('Artifact type filter'),
-      limit: z.number().int().min(1).max(500).default(50),
+      limit: integer().min(1).max(500).default(50),
     },
     readOnly: true,
     buildArgs: ({ keyword, type, limit }) => {
@@ -310,7 +311,7 @@ function registerRalphToolset(server) {
     inputSchema: {
       task: z.string().describe('Task description'),
       completion: z.string().describe('Measurable completion criteria (verification command)'),
-      max_cycles: z.number().int().min(1).max(500).default(20),
+      max_cycles: integer().min(1).max(500).default(20),
       confirmed: z.boolean().default(false).describe('Required (Ralph is long-running)'),
     },
     annotations: { destructiveHint: true },
@@ -415,13 +416,13 @@ function registerMcToolset(server) {
       session_id: z.string().describe('Session id'),
       objective: z.string().describe('Mission objective'),
       completion: z.string().optional().describe('Completion criteria'),
-      max_iterations: z.number().int().positive().max(Number.MAX_SAFE_INTEGER).optional().describe('Ralph iteration cap'),
-      max_total_tokens: z.number().int().positive().max(Number.MAX_SAFE_INTEGER).optional().describe('Hard cumulative token ceiling'),
-      max_output_tokens: z.number().int().positive().max(Number.MAX_SAFE_INTEGER).optional().describe('Hard cumulative output-token ceiling'),
-      max_tool_calls: z.number().int().positive().max(Number.MAX_SAFE_INTEGER).optional().describe('Hard cumulative tool-call ceiling'),
+      max_iterations: integer().positive().max(Number.MAX_SAFE_INTEGER).optional().describe('Ralph iteration cap'),
+      max_total_tokens: integer().positive().max(Number.MAX_SAFE_INTEGER).optional().describe('Hard cumulative token ceiling'),
+      max_output_tokens: integer().positive().max(Number.MAX_SAFE_INTEGER).optional().describe('Hard cumulative output-token ceiling'),
+      max_tool_calls: integer().positive().max(Number.MAX_SAFE_INTEGER).optional().describe('Hard cumulative tool-call ceiling'),
       max_total_cost: z.number().positive().finite().optional().describe('Hard cumulative provider-reported spend ceiling'),
       max_wall_clock_minutes: z.number().positive().finite().optional().describe('Hard cumulative runtime ceiling'),
-      exploration_quota: z.number().int().positive().max(Number.MAX_SAFE_INTEGER).optional().describe('Require structural variant after this many flat cycles (off unless declared; no default K)'),
+      exploration_quota: integer().positive().max(Number.MAX_SAFE_INTEGER).optional().describe('Require structural variant after this many flat cycles (off unless declared; no default K)'),
       budget_stop_policy: z.enum(['completion-wins', 'budget-wins']).optional().describe('Stop semantics when the completing iteration crosses a ceiling (default: completion-wins)'),
     },
     buildArgs: ({