@eir-labs/coltrane 0.6.2 → 0.7.3

package/dist/src/server.js

@@ -9,11 +9,12 @@ import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprot
 import { MCP_TOOLS, requiresApproval, AGENT_STATUS_ORDER, STANDARD_STATUS_ORDER, SKILL_STATUS_ORDER, checkPromotion, PromotionError, } from "./mcp.js";
 import { loadRegistry, domainTypeDefect } from "./registry.js";
 import { resolveGenome } from "./loader.js";
-import { SkillSchema, AgentSchema, StandardSchema, DomainTypeSchema } from "./genome_schema.js";
+import { SkillSchema, AgentSchema, StandardSchema, DomainTypeSchema, ChartSchema, VenueSchema, venueDefect } from "./genome_schema.js";
+import { composeChart, runChart, chartHash, chartEntrySeedTypes, dispatchTarget, } from "./chart.js";
 import { runSkillFixtures, executeSkill, loadFixtures } from "./skill_subprocess.js";
 import { evolveSkill } from "./skills.js";
 import { sealAgentDefinition, sealDefinition, sealSkillPackage, recordIdentity } from "./genome_writer.js";
-import { createOutputStore, defaultOutputsPersistDir } from "./outputs.js";
+import { createOutputStore, defaultOutputsPersistDir, } from "./outputs.js";
 import { createOutputMirror, defaultMirrorDir, outputPreview, mirrorStorageRef } from "./output_mirror.js";
 import { FileLedger, LedgerError, LEDGER_SCHEMA_VERSION, defaultLedgerPath, } from "./ledger.js";
 import { sealDrill } from "./seal_drill.js";
@@ -465,39 +466,30 @@ async function runImpl(slug, args, deps, approval) {
                 if (!["upstream", "downstream", "both"].includes(direction)) {
                     return { ok: false, requires_approval: approval, error: `unrecognized direction "${direction}" — use "upstream", "downstream" or "both"` };
                 }
-                const upstream = direction === "downstream"
-                    ? []
-                    : deps.outputs.trace(id, maxDepth !== undefined ? { max_depth: maxDepth } : undefined);
-                // Forward walk: a node's children are the outputs naming it in their input_refs.
-                const downstream = [];
-                if (direction !== "upstream") {
-                    const all = deps.outputs.all();
-                    const seen = new Set([id]);
-                    let frontier = [id];
-                    for (let depth = 0; frontier.length && (maxDepth === undefined || depth < maxDepth); depth++) {
-                        const next = [];
-                        for (const o of all) {
-                            if (seen.has(o.id))
-                                continue;
-                            if (o.input_refs.some((r) => frontier.includes(r))) {
-                                seen.add(o.id);
-                                downstream.push(o);
-                                next.push(o.id);
-                            }
-                        }
-                        frontier = next;
-                    }
-                }
-                const nodes = direction === "upstream" ? upstream
-                    : direction === "downstream" ? downstream
-                        : [...upstream, ...downstream.filter((d) => !upstream.some((u) => u.id === d.id))];
+                // The WALK — every direction of it — belongs to the store, which is the one owner of the
+                // performance-family crossing rule and of the labels that make a crossing visible. This
+                // handler used to hand-roll the forward walk over `all()`, which gave downstream a
+                // different scope than upstream (none at all) and no labels either.
+                const nodes = deps.outputs.trace(id, {
+                    ...(maxDepth !== undefined ? { max_depth: maxDepth } : {}),
+                    direction: direction,
+                });
+                // A hole is reported as itself: named on its own key AND left in the graph, never dropped
+                // from either. It is deliberately kept OUT of the two classifications, which read fields
+                // an absent record does not have — a hole carries no `input_refs`, so the root-signal test
+                // ("nothing upstream of it") would have called every unresolvable reference a root signal,
+                // which is the opposite of what is known about it: nothing at all.
+                const missing = nodes.filter((n) => n.missing === true);
+                const held = nodes.filter((n) => n.missing !== true);
+                const all = deps.outputs.all();
                 return {
                     ok: true, requires_approval: approval,
                     data: {
                         graph: { nodes }, direction,
-                        root_signals: nodes.filter((o) => o.input_refs.length === 0),
+                        root_signals: held.filter((o) => o.input_refs.length === 0),
                         // The other end of the chain: outputs nothing else was derived from.
-                        terminal_outputs: nodes.filter((o) => !deps.outputs.all().some((x) => x.input_refs.includes(o.id))),
+                        terminal_outputs: held.filter((o) => !all.some((x) => x.input_refs.includes(o.id))),
+                        missing,
                     },
                 };
             }
@@ -558,10 +550,45 @@ async function runImpl(slug, args, deps, approval) {
                 if (!deps.standards || !deps.invoke) {
                     return { ok: false, not_implemented: true, requires_approval: approval, error: "gig_dispatch needs standards + invoke wired into the server" };
                 }
-                const slug2 = String(args["standard_slug"] ?? "");
-                const standard = deps.standards.get(slug2);
-                if (!standard)
-                    return { ok: false, requires_approval: approval, error: `unknown standard "${slug2}"` };
+                // ── which performance? ───────────────────────────────────────────────────────────────
+                // EXACTLY ONE of standard_slug / chart_slug. A single-standard dispatch IS the degenerate
+                // one-movement chart, so naming both names two performances and naming neither names none;
+                // the refinement lives in one place (dispatchTarget) and is shared with the CLI.
+                const target = dispatchTarget({
+                    standard_slug: args["standard_slug"] === undefined || args["standard_slug"] === null ? undefined : String(args["standard_slug"]),
+                    chart_slug: args["chart_slug"] === undefined || args["chart_slug"] === null ? undefined : String(args["chart_slug"]),
+                });
+                if (!target.ok)
+                    return { ok: false, requires_approval: approval, error: target.error };
+                const chartDef = target.kind === "chart" ? deps.charts?.get(target.slug) : undefined;
+                if (target.kind === "chart" && !chartDef) {
+                    return {
+                        ok: false, requires_approval: approval,
+                        error: deps.charts
+                            ? `unknown chart "${target.slug}"`
+                            : `unknown chart "${target.slug}": this server has no charts map (bootstrap from a genome with charts/)`,
+                    };
+                }
+                const slug2 = target.slug;
+                // The standards this dispatch will actually run: one, or one per movement. Every preflight
+                // below is stated ONCE over this list, so a chart cannot route around a gate a standard
+                // dispatch has to pass.
+                const targetStandards = [];
+                if (chartDef) {
+                    for (const m of chartDef.movements) {
+                        const s = deps.standards.get(m.standard_slug);
+                        // A dead standard name is composeChart's R2 and is reported with the rule named below;
+                        // the preflights simply have nothing to check for that movement.
+                        if (s)
+                            targetStandards.push(s);
+                    }
+                }
+                else {
+                    const standard = deps.standards.get(slug2);
+                    if (!standard)
+                        return { ok: false, requires_approval: approval, error: `unknown standard "${slug2}"` };
+                    targetStandards.push(standard);
+                }
                 // #203, the READ side. Preserving `status` through the loader was only half of it: the
                 // symptom recorded on the issue — "a retired standard stays dispatchable and nothing
                 // says otherwise" — survived the field being kept, because nothing consulted it. A
@@ -574,29 +601,38 @@ async function runImpl(slug, args, deps, approval) {
                 //
                 // deprecated ALLOWS and warns; retired REFUSES. Were both refused, `deprecated` would
                 // be a spelling of `retired` and there would be no way to say the softer thing.
-                const stdStatus = standard.status;
-                if (stdStatus === "retired") {
-                    return {
-                        ok: false, requires_approval: approval,
-                        error: `standard "${slug2}" is retired and cannot be dispatched. ` +
-                            `Promote it back to active (standard_promote) if it should run again.`,
-                    };
+                //
+                // Swept over EVERY standard this dispatch will run, so a chart cannot smuggle a retired
+                // movement past a gate a direct dispatch of the same standard would fail.
+                const warnings = [];
+                for (const s of targetStandards) {
+                    const stdStatus = s.status;
+                    if (stdStatus === "retired") {
+                        return {
+                            ok: false, requires_approval: approval,
+                            error: `standard "${s.slug}" is retired and cannot be dispatched. ` +
+                                `Promote it back to active (standard_promote) if it should run again.`,
+                        };
+                    }
+                    if (stdStatus === "deprecated") {
+                        warnings.push(`standard "${s.slug}" is deprecated — it still runs, but should not be built on.`);
+                    }
                 }
-                const warnings = stdStatus === "deprecated"
-                    ? [`standard "${slug2}" is deprecated — it still runs, but should not be built on.`]
-                    : [];
                 // WU-0008 preflight: run the same sealDrill used by standard_simulate BEFORE spending
                 // on any chair. A structurally-unsealable standard is refused here (pennies) instead of
                 // after a chair runs and aborts. Gate is placed once, above the wait/async split, so a
-                // single check covers both runGig call-sites below.
-                const drill = sealDrill({ phases: standard.phases.map((p) => ({ name: p.name, chairs: p.chairs.map((c) => ({ role: c.role, output_contract: c.output_contract })) })) }, deps.registry);
-                if (!drill.ok) {
-                    return {
-                        ok: false, requires_approval: approval,
-                        error: `standard "${slug2}" cannot seal: ` +
-                            drill.failures.map((f) => `${f.phase}/${f.role} → ${f.domain_type} (${f.errors.join("; ")})`).join(", "),
-                        data: { seal_drill: drill },
-                    };
+                // single check covers both runGig call-sites below — and over every movement's standard,
+                // because a chart that cannot seal at movement three is refused before movement one.
+                for (const s of targetStandards) {
+                    const drill = sealDrill({ phases: s.phases.map((p) => ({ name: p.name, chairs: p.chairs.map((c) => ({ role: c.role, output_contract: c.output_contract })) })) }, deps.registry);
+                    if (!drill.ok) {
+                        return {
+                            ok: false, requires_approval: approval,
+                            error: `standard "${s.slug}" cannot seal: ` +
+                                drill.failures.map((f) => `${f.phase}/${f.role} → ${f.domain_type} (${f.errors.join("; ")})`).join(", "),
+                            data: { seal_drill: drill },
+                        };
+                    }
                 }
                 // Optional budget arg — when present, runtime enforces per-gig cost-budget
                 // and raises BudgetExhausted on depletion (PR for T10 gap, see runtime.ts).
@@ -642,6 +678,22 @@ async function runImpl(slug, args, deps, approval) {
                     ...(resumeArg !== undefined ? { resume_from: resumeArg } : {}),
                     ...(reuseOn && deps.reuse ? { reuse: deps.reuse } : {}),
                 };
+                // ── the human seat's door ────────────────────────────────────────────────────────
+                // A chair marked `human: true` parks the run until its incumbent's verdict arrives
+                // here, keyed by role. The typical shape is the SECOND call on one gig: dispatch,
+                // park, then re-dispatch with `resume_gig_id` + the approval, which restores the
+                // chairs already paid for and seals the verdict under `approved_by`.
+                const approvalsArg = args["approvals"];
+                const approvals = approvalsArg && typeof approvalsArg === "object" && !Array.isArray(approvalsArg)
+                    ? approvalsArg
+                    : undefined;
+                const approvedBy = typeof args["approved_by"] === "string" && args["approved_by"].trim() !== ""
+                    ? args["approved_by"]
+                    : undefined;
+                const humanWiring = {
+                    ...(approvals ? { approvals } : {}),
+                    ...(approvedBy !== undefined ? { approved_by: approvedBy } : {}),
+                };
                 /** What a run skipped, and why — echoed on every reply so a saving is never silent. */
                 const savings = (res) => ({
                     ...(res.skipped ? { skipped: res.skipped } : {}),
@@ -649,20 +701,198 @@ async function runImpl(slug, args, deps, approval) {
                     ...(res.reuse ? { reuse: res.reuse } : {}),
                     ...(res.checkpoint_error ? { checkpoint_error: res.checkpoint_error } : {}),
                 });
+                const wait = args["wait"] === true;
+                // ── the chart path ────────────────────────────────────────────────────────────────────
+                // A chart is COMPOSED here, not at load, because the last rule needs a fact the genome does
+                // not hold: which types the dispatch payload carries. Everything else composeChart checks it
+                // already checked at load; this pass is the one that can hold R7 to the real payload, so a
+                // performance whose first movement was never seeded is refused before it spawns anything.
+                if (chartDef) {
+                    const composed = composeChart({
+                        chart: chartDef,
+                        standards: deps.standards,
+                        ...(deps.agents ? { agents: deps.agents } : {}),
+                        ...(deps.venues ? { venues: deps.venues } : {}),
+                        payload_types: Object.keys(gigInput),
+                    });
+                    if (!composed.ok) {
+                        return {
+                            ok: false, requires_approval: approval,
+                            error: `chart "${slug2}" cannot be performed: ` + composed.violations.map((v) => `${v.rule}: ${v.detail}`).join(" | "),
+                            data: { validation_result: { valid: false, violations: composed.violations } },
+                        };
+                    }
+                    const plan = composed;
+                    const chartDeps = {
+                        outputs: deps.outputs, ledger: deps.ledger, invoke: deps.invoke,
+                        model_version: deps.model_version, skills: deps.skills, skill_dirs: deps.skill_dirs, evals: deps.evals, budget,
+                        ...(depth ? { depth } : {}), ...reuseWiring, ...humanWiring,
+                    };
+                    /** The ARRANGEMENT's manifest. A chart has no single genome_hash or run_fingerprint — it
+                     *  has a chart_hash and one run per movement — so the reply says what a chart run is
+                     *  rather than reshaping it into a standard run's fields. */
+                    const chartManifest = (res) => ({
+                        chart_slug: res.chart_slug, chart_hash: res.chart_hash,
+                        movements: res.movements.map((m) => ({
+                            movement_id: m.movement_id, standard_slug: m.standard_slug, gig_id: m.gig_id,
+                            status: m.status, output_count: m.outputs.length, spent_usd: m.spent_usd,
+                            ...(m.result ? { genome_hash: m.result.genome_hash, run_fingerprint: m.result.run_fingerprint } : {}),
+                        })),
+                        output_count: res.movements.reduce((n, m) => n + m.outputs.length, 0),
+                        spent_usd: res.spent_usd,
+                        ...(res.budget ? { budget: res.budget } : {}),
+                        ...(res.gates_approved ? { gates_approved: res.gates_approved } : {}),
+                        ...(res.resumed ? { resumed: res.resumed } : {}),
+                    });
+                    if (wait) {
+                        try {
+                            const res = await runChart(plan, gigInput, chartDeps);
+                            return {
+                                ok: true, requires_approval: approval,
+                                data: {
+                                    gig_id: res.gig_id, status: res.status,
+                                    ...(res.awaiting ? { awaiting: res.awaiting } : {}),
+                                    ...(depth ? { depth } : {}),
+                                    warnings, manifest: chartManifest(res),
+                                },
+                            };
+                        }
+                        catch (e) {
+                            if (e instanceof ResumeRefused) {
+                                return { ok: false, requires_approval: approval, error: e.message,
+                                    data: { resume_refused: true, gig_id: e.gig_id, drift: e.drift } };
+                            }
+                            if (e instanceof BudgetExhausted) {
+                                const partial = partialGigUsage(e);
+                                return { ok: false, requires_approval: approval, error: e.message,
+                                    data: { budget_exhausted: true, agent_slug: e.agent_slug, balance: e.balance, cost: e.cost, budget_state: e.state,
+                                        ...(partial ? { usage: partial } : {}) } };
+                            }
+                            throw e;
+                        }
+                    }
+                    // Async, the default. Same live-state row an async standard dispatch registers, so
+                    // gig_monitor and gig_abort reach a performance exactly as they reach a run: the row
+                    // names the standard the performance OPENS with, and `chart_slug` names the arrangement.
+                    const chartGigId = resumeArg ?? randomUUID();
+                    const chartRuns = deps.gig_runs ?? (deps.gig_runs = new Map());
+                    const priorChartState = chartRuns.get(chartGigId);
+                    const chartState = newGigRun(chartGigId, plan.movements[0].standard.slug, plan.movements.reduce((n, m) => n + m.standard.phases.length, 0), new Date().toISOString());
+                    chartState.chart_slug = plan.chart.slug;
+                    const chartController = new AbortController();
+                    chartState.controller = chartController;
+                    chartRuns.set(chartGigId, chartState);
+                    pruneGigRuns(chartRuns);
+                    const chartLogDir = deps.gig_log_base ? join(deps.gig_log_base, "gigs", chartGigId) : undefined;
+                    const onChartProgress = (ev) => {
+                        applyGigProgress(chartState, ev);
+                        if (chartLogDir && ev.type === "agent_event") {
+                            try {
+                                mkdirSync(chartLogDir, { recursive: true });
+                                appendFileSync(join(chartLogDir, `${ev.role}.jsonl`), JSON.stringify(ev.event) + "\n");
+                            }
+                            catch { /* best-effort */ }
+                        }
+                        const line = gigEventLogLine(chartGigId, ev);
+                        if (line) {
+                            try {
+                                process.stderr.write(line + "\n");
+                            }
+                            catch { /* best-effort */ }
+                        }
+                    };
+                    const chartPromise = runChart(plan, gigInput, {
+                        ...chartDeps, gig_id: chartGigId, onProgress: onChartProgress, signal: chartController.signal,
+                    });
+                    let chartRefusal;
+                    if (resumeArg !== undefined) {
+                        void chartPromise.catch((e) => { if (e instanceof ResumeRefused)
+                            chartRefusal = e; });
+                    }
+                    void chartPromise
+                        .then((res) => {
+                        chartState.status = res.status === "complete" ? "complete" : "awaiting_approval";
+                        // An arrangement-level GATE has no phase — its position is the movement it gates — so
+                        // the movement_id fills the slot a within-movement park fills with its phase name.
+                        if (res.awaiting)
+                            chartState.awaiting = { phase: res.awaiting.phase ?? res.awaiting.movement_id, role: res.awaiting.chair };
+                        chartState.finished_at = new Date().toISOString();
+                        // The arrangement's identity in the slot the run's identity occupies — the same
+                        // substitution `run_fingerprint` makes for a chart (src/chart.ts), so a monitor reading
+                        // this field gets the hash that actually identifies what ran.
+                        chartState.genome_hash = res.chart_hash;
+                        chartState.outputs_count = res.movements.reduce((n, m) => n + m.outputs.length, 0);
+                        // A budget_exhausted performance settled without completing and without parking. It
+                        // is not `complete` and there is no person to wait for, so it reads as failed with
+                        // the boundary it stopped at named — the same posture a depleted run has.
+                        if (res.status === "budget_exhausted") {
+                            chartState.status = "failed";
+                            chartState.error = `budget envelope exhausted at movement "${res.budget?.exhausted_at_movement ?? "?"}" (spent $${res.spent_usd} of $${res.budget?.total_usd ?? "?"})`;
+                        }
+                    })
+                        .catch((e) => {
+                        chartState.finished_at = new Date().toISOString();
+                        if (e instanceof GigAborted) {
+                            chartState.status = "aborted";
+                            chartState.abort_reason = e.reason;
+                            chartState.outputs_count = e.outputs.length;
+                            if (e.usage)
+                                chartState.usage = e.usage;
+                            return;
+                        }
+                        chartState.status = "failed";
+                        chartState.error = e instanceof Error ? e.message : String(e);
+                        const partial = partialGigUsage(e);
+                        if (partial)
+                            chartState.usage = partial;
+                        const bs = partialBudgetState(e);
+                        if (bs)
+                            chartState.budget_state = bs;
+                        onChartProgress({ type: "gig_failed", error: chartState.error });
+                    })
+                        .finally(() => { chartState.controller = undefined; });
+                    if (resumeArg !== undefined) {
+                        await Promise.resolve(); // one turn — see the ordering note on the standard path below
+                        if (chartRefusal) {
+                            if (priorChartState)
+                                chartRuns.set(chartGigId, priorChartState);
+                            else
+                                chartRuns.delete(chartGigId);
+                            return { ok: false, requires_approval: approval, error: chartRefusal.message,
+                                data: { resume_refused: true, gig_id: chartRefusal.gig_id, drift: chartRefusal.drift } };
+                        }
+                    }
+                    return {
+                        ok: true, requires_approval: approval,
+                        data: {
+                            gig_id: chartGigId, status: "running", chart_slug: plan.chart.slug, chart_hash: plan.chart_hash,
+                            ...(depth ? { depth } : {}), warnings, ...(chartLogDir ? { log_dir: chartLogDir } : {}),
+                            ...(resumeArg !== undefined ? { resumed_from: resumeArg } : {}),
+                            ...(reuseOn ? { reuse: true } : {}),
+                        },
+                    };
+                }
+                // ── the single-standard path ──────────────────────────────────────────────────────────
+                // Reached only when the target is a standard: the chart branch above always returns, and an
+                // unresolvable standard slug returned before the preflights. So there is exactly one here.
+                const standard = targetStandards[0];
                 // Synchronous mode (opt-in via wait:true) — block, return the manifest. The
                 // deterministic test path and any caller that wants the answer in one call.
-                const wait = args["wait"] === true;
                 if (wait) {
                     try {
                         const res = await runGig(standard, gigInput, {
                             outputs: deps.outputs, ledger: deps.ledger, invoke: deps.invoke,
                             model_version: deps.model_version, skills: deps.skills, skill_dirs: deps.skill_dirs, evals: deps.evals, budget,
-                            ...(depth ? { depth } : {}), ...reuseWiring,
+                            ...(depth ? { depth } : {}), ...reuseWiring, ...humanWiring,
                         });
                         return {
                             ok: true, requires_approval: approval,
                             data: {
                                 gig_id: res.gig_id,
+                                // The run's own verdict on itself. A parked gig reported as nothing at all read
+                                // as a completed one to every caller of the synchronous path.
+                                status: res.status,
+                                ...(res.awaiting ? { awaiting: res.awaiting } : {}),
                                 ...(depth ? { depth } : {}),
                                 warnings,
                                 manifest: {
@@ -738,7 +968,7 @@ async function runImpl(slug, args, deps, approval) {
                 const runPromise = runGig(standard, gigInput, {
                     outputs: deps.outputs, ledger: deps.ledger, invoke: deps.invoke,
                     model_version: deps.model_version, skills: deps.skills, skill_dirs: deps.skill_dirs, evals: deps.evals, budget,
-                    gig_id: gigId, onProgress, signal: controller.signal, ...(depth ? { depth } : {}), ...reuseWiring,
+                    gig_id: gigId, onProgress, signal: controller.signal, ...(depth ? { depth } : {}), ...reuseWiring, ...humanWiring,
                 });
                 // A REFUSED resume must be answered in THIS reply, not discovered later by polling. The
                 // gate throws in runGig's SYNCHRONOUS phase — before its first `await`, which is exactly
@@ -754,7 +984,12 @@ async function runImpl(slug, args, deps, approval) {
                 }
                 void runPromise
                     .then((res) => {
-                    state.status = "complete";
+                    // A run that PARKED at a human chair settled without completing. Recording it as
+                    // `complete` erased the park from gig_monitor — the only surface an async caller
+                    // has — so the operator saw a finished gig with a chair that never sealed.
+                    state.status = res.status === "awaiting_approval" ? "awaiting_approval" : "complete";
+                    if (res.awaiting)
+                        state.awaiting = res.awaiting;
                     state.finished_at = new Date().toISOString();
                     state.run_fingerprint = res.run_fingerprint;
                     state.genome_hash = res.genome_hash;
@@ -841,7 +1076,13 @@ async function runImpl(slug, args, deps, approval) {
                         ok: true, requires_approval: approval,
                         data: {
                             status: live.status,
+                            // Who the run is waiting ON. `awaiting_approval` with no chair named leaves the
+                            // operator to guess which seat is theirs to sit in.
+                            ...(live.awaiting ? { awaiting: live.awaiting } : {}),
                             standard_slug: live.standard_slug,
+                            // Present iff this run is a performance of a chart. Absent means one standard, which
+                            // is what every caller has always been looking at.
+                            ...(live.chart_slug ? { chart_slug: live.chart_slug } : {}),
                             current_phase: live.current_phase ?? null,
                             phases_total: live.phases_total,
                             phases_complete: live.phases_seen.length,
@@ -970,6 +1211,105 @@ async function runImpl(slug, args, deps, approval) {
                     throw e;
                 }
             }
+            case "chart_define": {
+                // The arrangement, authored through the genome's mouth. Every field is read explicitly from
+                // the schema's own key set — the surface is generated from ChartSchema, so a field added
+                // there must be threaded here or the drift guard reds.
+                if (!deps.standards) {
+                    return { ok: false, not_implemented: true, requires_approval: approval, error: "chart_define needs a standards map (bootstrap from a genome) — a chart's movements name standards, and a chart composed against nothing is a chart of dead names" };
+                }
+                const cSlug = String(args["slug"] ?? "");
+                const chartInputDef = {
+                    slug: cSlug,
+                    movements: args["movements"] ?? [],
+                    ...(args["edges"] !== undefined ? { edges: args["edges"] } : {}),
+                    ...(args["approval_gates"] !== undefined ? { approval_gates: args["approval_gates"] } : {}),
+                    ...(args["budget_envelope"] !== undefined ? { budget_envelope: args["budget_envelope"] } : {}),
+                    ...(args["venue"] !== undefined ? { venue: args["venue"] } : {}),
+                };
+                const shape = ChartSchema.safeParse(chartInputDef);
+                const composed = composeChart({
+                    chart: chartInputDef,
+                    standards: deps.standards,
+                    ...(deps.agents ? { agents: deps.agents } : {}),
+                    ...(deps.venues ? { venues: deps.venues } : {}),
+                    // Authoring time knows no payload, so a boundary movement's declared gig contract stands
+                    // in for it — the same rule the loader applies, and dispatch re-checks against the real
+                    // payload. (An unparseable chart has no movements to read; composeChart reports R0.)
+                    payload_types: shape.success ? chartEntrySeedTypes(shape.data, deps.standards) : [],
+                });
+                if (!composed.ok) {
+                    const why = composed.violations.map((v) => `${v.rule}: ${v.detail}`).join(" | ");
+                    return {
+                        ok: false, requires_approval: approval, error: `chart "${cSlug}" was refused: ${why}`,
+                        data: { validation_result: { valid: false, violations: composed.violations } },
+                    };
+                }
+                // Write-through to the LIVE map so gig_dispatch can perform it in the same session.
+                deps.charts?.set(cSlug, composed.chart);
+                const chartFile = { ...composed.chart };
+                const sealedChart = sealDefinition("chart_define", cSlug, chartFile, deps.ledger, deps.genome_dir, "charts");
+                return {
+                    ok: true, requires_approval: approval,
+                    data: {
+                        chart_id: composed.chart.slug, chart_hash: composed.chart_hash,
+                        movements: composed.order, edges_classified: composed.edges_classified,
+                        content_hash: sealedChart.content_hash, dependency_hash: sealedChart.dependency_hash,
+                        effective_hash: sealedChart.effective_hash,
+                        validation_result: { valid: true },
+                    },
+                };
+            }
+            case "venue_define": {
+                // The room. BOTH gates, in the loader's order: the single Zod source for the shape, then
+                // venueDefect for the cross-field rules — so a venue authored here cannot slip past a check
+                // a venue read off disk would hit.
+                const vSlug = String(args["slug"] ?? "");
+                const venueInputDef = {
+                    slug: vSlug,
+                    institution_slug: args["institution_slug"],
+                    ...(args["description"] !== undefined ? { description: args["description"] } : {}),
+                    ...(args["flavor"] !== undefined ? { flavor: args["flavor"] } : {}),
+                    // Pass through only what was stated. The schema owns the defaults — including that an
+                    // unstated `equipment` is the EMPTY room — so this handler cannot disagree with the loader
+                    // about what a bare venue means.
+                    ...(args["equipment"] !== undefined ? { equipment: args["equipment"] } : {}),
+                    ...(args["doors"] !== undefined ? { doors: args["doors"] } : {}),
+                    ...(args["installs"] !== undefined ? { installs: args["installs"] } : {}),
+                    ...(args["credential_surface"] !== undefined ? { credential_surface: args["credential_surface"] } : {}),
+                    ...(args["lifecycle"] !== undefined ? { lifecycle: args["lifecycle"] } : {}),
+                    ...(args["responsible_chair"] !== undefined ? { responsible_chair: args["responsible_chair"] } : {}),
+                };
+                const parsedVenue = VenueSchema.safeParse(venueInputDef);
+                if (!parsedVenue.success) {
+                    const why = parsedVenue.error.issues.map((i) => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ");
+                    return {
+                        ok: false, requires_approval: approval, error: `venue "${vSlug}" was refused: ${why}`,
+                        data: { validation_result: { valid: false, error: why } },
+                    };
+                }
+                const vDefect = venueDefect(parsedVenue.data);
+                if (vDefect) {
+                    return {
+                        ok: false, requires_approval: approval, error: vDefect,
+                        data: { validation_result: { valid: false, error: vDefect } },
+                    };
+                }
+                deps.venues?.set(vSlug, parsedVenue.data);
+                const sealedVenue = sealDefinition("venue_define", vSlug, parsedVenue.data, deps.ledger, deps.genome_dir, "venues");
+                return {
+                    ok: true, requires_approval: approval,
+                    data: {
+                        venue_id: parsedVenue.data.slug,
+                        // What a room actually permits, echoed back: an author who meant "read-only tools" and
+                        // typed nothing has built the EMPTY room, and the count is where they see it.
+                        tool_count: parsedVenue.data.equipment.tools.length,
+                        content_hash: sealedVenue.content_hash, dependency_hash: sealedVenue.dependency_hash,
+                        effective_hash: sealedVenue.effective_hash,
+                        validation_result: { valid: true },
+                    },
+                };
+            }
             case "agent_validate_pipeline": {
                 if (Array.isArray(args["primitives"])) {
                     try {
@@ -1212,6 +1552,13 @@ async function runImpl(slug, args, deps, approval) {
                 // mutate deps.agents in place so the next reload sees the new baseline.
                 const agentsBefore = new Map(deps.agents ?? []);
                 const agentsDiff = syncMap(deps.agents, fresh.agents, agentsBefore);
+                // charts + venues — same in-place sync. A reload that refreshed standards and left the
+                // arrangements over them stale would leave gig_dispatch performing a chart the genome no
+                // longer describes, which is the class of drift genome_reload exists to close.
+                const chartsBefore = new Map(deps.charts ?? []);
+                const chartsDiff = syncMap(deps.charts, fresh.charts, chartsBefore);
+                const venuesBefore = new Map(deps.venues ?? []);
+                const venuesDiff = syncMap(deps.venues, fresh.venues, venuesBefore);
                 // typesBefore is captured for symmetry; not currently surfaced beyond typeDiff.
                 void typesBefore;
                 return {
@@ -1225,6 +1572,8 @@ async function runImpl(slug, args, deps, approval) {
                                 skills: skillsDiff.added,
                                 evals: evalsDiff.added,
                                 agents: agentsDiff.added,
+                                charts: chartsDiff.added,
+                                venues: venuesDiff.added,
                             },
                             modified: {
                                 domain_types: typeDiff.modified,
@@ -1232,6 +1581,8 @@ async function runImpl(slug, args, deps, approval) {
                                 skills: skillsDiff.modified,
                                 evals: evalsDiff.modified,
                                 agents: agentsDiff.modified,
+                                charts: chartsDiff.modified,
+                                venues: venuesDiff.modified,
                             },
                             removed: {
                                 domain_types: typeDiff.removed,
@@ -1239,6 +1590,8 @@ async function runImpl(slug, args, deps, approval) {
                                 skills: skillsDiff.removed,
                                 evals: evalsDiff.removed,
                                 agents: agentsDiff.removed,
+                                charts: chartsDiff.removed,
+                                venues: venuesDiff.removed,
                             },
                         },
                         load_errors: deps.load_errors,
@@ -1486,6 +1839,24 @@ async function runImpl(slug, args, deps, approval) {
                     data: { status, aborted, cancellable: aborted, cleanup_result: { reason } },
                 };
             }
+            case "gig_approve": {
+                // Approval is a MEMBER act whose authority lives in the STORE (the coltrane_gig_approve RPC
+                // is member-JWT-only; an agent token is refused there — the enforcement belongs store-side,
+                // not here). The HOSTED surface routes this to deps.approveGig (see callSurfaceTool);
+                // reaching this switch is a NON-hosted call, which has no store-backed run to approve — a
+                // local run takes its human verdicts through gig_dispatch's `approvals` argument instead.
+                const gigId = String(args["gig_id"] ?? "");
+                const role = String(args["role"] ?? "");
+                const verdict = args["verdict"];
+                if (!gigId || !role || verdict === undefined) {
+                    return { ok: false, requires_approval: approval, error: "gig_approve requires gig_id, role, and verdict (the Judgment the human seat seals)" };
+                }
+                return {
+                    ok: false, not_implemented: true, requires_approval: approval,
+                    error: `gig_approve is the hosted member seam — approve gig "${gigId}" role "${role}" over a store-backed ` +
+                        "surface (wire deps.approveGig). A local run takes its human verdicts through gig_dispatch's `approvals` argument.",
+                };
+            }
             case "agent_define": {
                 // Build the def by the SCHEMA's own field list (genome_schema.ts AgentSchema): copy exactly
                 // the fields the schema declares from args. This handler was one of the restatements that
@@ -1594,12 +1965,20 @@ async function runImpl(slug, args, deps, approval) {
                 const evolveSlug = typeof args["slug"] === "string" ? args["slug"] : undefined;
                 const changes = (args["changes"] && typeof args["changes"] === "object")
                     ? args["changes"] : undefined;
-                if (evolveSlug && changes && deps.genome_dir) {
-                    const agentPath = join(deps.genome_dir, "agents", `${evolveSlug}.json`);
-                    if (!existsSync(agentPath)) {
+                if (evolveSlug && changes && (deps.genome_dir || deps.agents?.has(evolveSlug))) {
+                    // The base definition: the genome file when a working tree exists, else the loaded
+                    // agents map (a hosted surface has no filesystem — the STORE genome is the base,
+                    // and the seam above persists the merged definition back through the store).
+                    let currentDef;
+                    if (deps.genome_dir && existsSync(join(deps.genome_dir, "agents", `${evolveSlug}.json`))) {
+                        currentDef = JSON.parse(readFileSync(join(deps.genome_dir, "agents", `${evolveSlug}.json`), "utf-8"));
+                    }
+                    else if (deps.agents?.has(evolveSlug)) {
+                        currentDef = deps.agents.get(evolveSlug);
+                    }
+                    else {
                         return { ok: false, requires_approval: approval, error: `agent_evolve: unknown agent "${evolveSlug}" (no agents/${evolveSlug}.json)` };
                     }
-                    const currentDef = JSON.parse(readFileSync(agentPath, "utf-8"));
                     const nextDef = { ...currentDef, ...changes };
                     // The agent must still be a legal composition on its own…
                     try {
@@ -1656,9 +2035,12 @@ async function runImpl(slug, args, deps, approval) {
                                 agentsArr[i] = sealed.agent;
                         }
                     }
+                    // next_def is the seam's persistence source on a hosted surface (the store
+                    // upsert writes the MERGED definition, not the raw evolve args).
+                    deps.agents?.set(evolveSlug, sealed.agent);
                     return {
                         ok: true, requires_approval: approval,
-                        data: { new_version, evolved: sealed.agent, content_hash: sealed.content_hash, effective_hash: sealed.effective_hash, cascade_check: { agents_affected: [], standards_affected } },
+                        data: { new_version, evolved: sealed.agent, next_def: nextDef, content_hash: sealed.content_hash, effective_hash: sealed.effective_hash, cascade_check: { agents_affected: [], standards_affected } },
                     };
                 }
                 return { ok: true, requires_approval: approval, data: { new_version, cascade_check: { agents_affected: [], standards_affected: [] } } };
@@ -1720,6 +2102,25 @@ async function runImpl(slug, args, deps, approval) {
             // production status, and never RUN, TESTED, LISTED or REVISED through the engine. The
             // fixture gate on promotion made that gap sharper — you could be refused for failing
             // fixtures with no way to run them and see why.
+            // ── the org context switch — set once, inherited by every member write ─────────────
+            case "org_use": {
+                const orgSlug = String(args["org_slug"] ?? "");
+                if (!orgSlug)
+                    return { ok: false, requires_approval: approval, error: "org_use requires org_slug" };
+                if (!deps.orgUse) {
+                    return {
+                        ok: false, requires_approval: approval,
+                        error: "org context is a store concept — a file genome has one implicit org (this working tree). On a hosted surface the host wires deps.orgUse to the store's coltrane_org_use RPC.",
+                    };
+                }
+                try {
+                    const set = await deps.orgUse(orgSlug);
+                    return { ok: true, requires_approval: approval, data: { org_slug: set, set: true } };
+                }
+                catch (e) {
+                    return { ok: false, requires_approval: approval, error: e instanceof Error ? e.message : String(e) };
+                }
+            }
             // ── discoverability parity — a dispatcher must be able to FIND a slug over MCP ──────
             // (tests/genome_browse_parity.test.ts). Backed by the deps maps, so the same handler
             // serves a working-tree load and a hosted store load identically; no filesystem.
@@ -1742,6 +2143,103 @@ async function runImpl(slug, args, deps, approval) {
                     .sort((a, b) => (a.slug < b.slug ? -1 : 1));
                 return { ok: true, requires_approval: approval, data: { standards, count: standards.length } };
             }
+            case "standard_inspect": {
+                // The single-record read, mirroring skill_inspect: browse lists shallow rows; this returns
+                // ONE standard's full shape. Same failure postures as the browse handlers — no standards
+                // map is "needs a standards map", an unknown slug is an honest error, never a silent null.
+                if (!deps.standards)
+                    return { ok: false, not_implemented: true, requires_approval: approval, error: "standard_inspect needs a standards map (bootstrap from a genome)" };
+                const target = String(args["slug"] ?? "");
+                if (!target)
+                    return { ok: false, requires_approval: approval, error: "standard_inspect requires slug" };
+                const std = deps.standards.get(target);
+                if (!std)
+                    return { ok: false, requires_approval: approval, error: `unknown standard "${target}"` };
+                return {
+                    ok: true, requires_approval: approval,
+                    data: {
+                        slug: std.slug, domain: std.domain, status: std.status ?? "active",
+                        phases: std.phases.map((p) => ({
+                            name: p.name,
+                            chairs: p.chairs.map((c) => ({
+                                role: c.role,
+                                agent_slug: c.agent_slug ?? null,
+                                skill_slug: c.skill_slug ?? null,
+                                human: c.human ?? false,
+                                input_contract: c.input_contract ?? [],
+                                output_contract: c.output_contract ?? [],
+                            })),
+                        })),
+                        input_types: std.input_types ?? [], output_types: std.output_types ?? [],
+                        eval_slugs: std.eval_slugs ?? [], description: std.description ?? null,
+                    },
+                };
+            }
+            case "chart_browse": {
+                if (!deps.charts)
+                    return { ok: false, not_implemented: true, requires_approval: approval, error: "chart_browse needs a charts map (bootstrap from a genome)" };
+                let clist = [...deps.charts.values()];
+                if (args["venue"])
+                    clist = clist.filter((c) => c.venue === args["venue"]);
+                if (args["standard_slug"])
+                    clist = clist.filter((c) => c.movements.some((m) => m.standard_slug === args["standard_slug"]));
+                const charts = clist
+                    .map((c) => {
+                    // The arrangement's identity, when it is computable. chartHash folds each movement's
+                    // standard PROJECTION, so a chart naming a standard this server does not hold has no
+                    // hash to report — and reporting null is the honest answer, not a fabricated prefix.
+                    const resolvedMovements = [];
+                    for (const m of c.movements) {
+                        const s = deps.standards?.get(m.standard_slug);
+                        if (s)
+                            resolvedMovements.push({ movement_id: m.movement_id, standard: s, runtime_fills: m.runtime_fills, seatings: m.seatings });
+                    }
+                    const complete = resolvedMovements.length === c.movements.length;
+                    return {
+                        slug: c.slug,
+                        standard_slugs: c.movements.map((m) => m.standard_slug),
+                        movement_ids: c.movements.map((m) => m.movement_id),
+                        movement_count: c.movements.length,
+                        edge_count: c.edges.length,
+                        gate_count: c.approval_gates.length,
+                        venue: c.venue ?? null,
+                        budget_usd: c.budget_envelope?.total_usd ?? null,
+                        // A PREFIX: enough to tell two arrangements apart in a listing, not the identity
+                        // itself (which a caller reads off the define call or the ledger).
+                        chart_hash: complete ? chartHash({ movements: resolvedMovements, chart: c }).slice(0, 12) : null,
+                    };
+                })
+                    .sort((a, b) => (a.slug < b.slug ? -1 : 1));
+                return { ok: true, requires_approval: approval, data: { charts, count: charts.length } };
+            }
+            case "venue_browse": {
+                if (!deps.venues)
+                    return { ok: false, not_implemented: true, requires_approval: approval, error: "venue_browse needs a venues map (bootstrap from a genome)" };
+                let vlist = [...deps.venues.values()];
+                if (args["institution_slug"])
+                    vlist = vlist.filter((v) => v.institution_slug === args["institution_slug"]);
+                if (args["flavor"])
+                    vlist = vlist.filter((v) => v.flavor === args["flavor"]);
+                const venues = vlist
+                    .map((v) => ({
+                    slug: v.slug, institution_slug: v.institution_slug, flavor: v.flavor ?? null,
+                    // COUNTS, not contents: the numbers are what a seating decision turns on ("does this
+                    // room hold anything at all", "can anything leave"), and the full lists are one
+                    // venue_define / file read away.
+                    tool_count: v.equipment.tools.length,
+                    tools: v.equipment.tools,
+                    ingress_count: v.doors?.ingress.length ?? 0,
+                    egress_count: v.doors?.egress.length ?? 0,
+                    install_count: v.installs.length,
+                    credential_surface: v.credential_surface,
+                    lifecycle: v.lifecycle.policy,
+                    rebuild_cadence: v.lifecycle.rebuild_cadence ?? null,
+                    responsible_chair: v.responsible_chair ?? null,
+                    description: v.description ?? null,
+                }))
+                    .sort((a, b) => (a.slug < b.slug ? -1 : 1));
+                return { ok: true, requires_approval: approval, data: { venues, count: venues.length } };
+            }
             case "agent_browse": {
                 if (!deps.agents)
                     return { ok: false, not_implemented: true, requires_approval: approval, error: "agent_browse needs an agents map (bootstrap from a genome)" };
@@ -2308,9 +2806,17 @@ const HOSTED_BLOCKED = {
 // single source the handlers copy from), so the store payload can't drift from the schema.
 const HOSTED_UPSERT = {
     agent_define: { cls: "agent", keys: Object.keys(AgentSchema.shape) },
+    agent_evolve: { cls: "agent", keys: Object.keys(AgentSchema.shape) },
     standard_compose: { cls: "standard", keys: Object.keys(StandardSchema.shape) },
     type_register: { cls: "domain_type", keys: Object.keys(DomainTypeSchema.shape) },
     skill_define: { cls: "skill", keys: Object.keys(SkillSchema.shape) },
+    // The chart and the venue ride the same port. The store side is NOT built — coltrane_genome_upsert
+    // has no branch for either class — so a hosted chart_define reaches the RPC and is refused there,
+    // with the store's own message, and the mutation fails loudly. That is the right failure: the
+    // class travels the port it is supposed to travel, and the missing half announces itself instead
+    // of the engine quietly declining to try. (Store-side work: two tables + two upsert branches.)
+    chart_define: { cls: "chart", keys: Object.keys(ChartSchema.shape) },
+    venue_define: { cls: "venue", keys: Object.keys(VenueSchema.shape) },
 };
 async function callSurfaceTool(slug, args, deps) {
     if (deps.hosted) {
@@ -2337,6 +2843,27 @@ async function callSurfaceTool(slug, args, deps) {
                     "for the drain worker.",
             };
         }
+        if (slug === "gig_approve") {
+            // Approval is a MEMBER act. The tool is a pure pass-through to the store's member-JWT-only
+            // coltrane_gig_approve RPC — an AGENT token is refused THERE, which is where that
+            // enforcement belongs, not in the engine. With the seam wired it approves; without it, typed.
+            if (deps.approveGig) {
+                try {
+                    const data = await deps.approveGig(args);
+                    return { ok: true, data };
+                }
+                catch (e) {
+                    return { ok: false, error: e instanceof Error ? e.message : String(e) };
+                }
+            }
+            return {
+                ok: false,
+                hosted_unsupported: true,
+                error: "hosted approval goes through the member RPC (coltrane_gig_approve) — a member act the store " +
+                    "authorizes, never the engine. Wire deps.approveGig (parallel to deps.queueGig) to approve the " +
+                    "parked gig over the wire.",
+            };
+        }
     }
     const result = await dispatchTool(slug, args, deps);
     // Hosted persistence: without a genome_dir the handlers compute + validate + seal identity
@@ -2345,10 +2872,17 @@ async function callSurfaceTool(slug, args, deps) {
     // request's memory must not report success.
     const up = HOSTED_UPSERT[slug];
     if (deps.hosted && deps.store && result.ok && up) {
+        // No org rides the call: the caller set a working org ONCE (org_use) and the store's
+        // resolver supplies it — explicit-per-call disambiguators are exactly the bookkeeping
+        // the surface must not push onto agents.
+        // agent_evolve persists the MERGED definition the handler computed, not the raw args.
+        const source = slug === "agent_evolve" && result.data && typeof result.data === "object" && result.data["next_def"]
+            ? result.data["next_def"]
+            : args;
         const payload = {};
         for (const k of up.keys)
-            if (args[k] !== undefined)
-                payload[k] = args[k];
+            if (source[k] !== undefined)
+                payload[k] = source[k];
         try {
             await deps.store.upsert(up.cls, payload);
         }
@@ -2477,6 +3011,8 @@ export function bootstrapServerDeps(genomeRoot) {
         // — as tests/dispatch_tool_resolution.test.ts does with no root — leaves no trace.
         ledger: new FileLedger(defaultLedgerPath(root)),
         standards: genome.standards, // ← gig_dispatch can now resolve file-defined standards
+        charts: genome.charts, // ← gig_dispatch resolves a chart_slug; chart_browse lists them
+        venues: genome.venues, // ← the ceiling a chart's venue imposes has to resolve to something
         invoke: makeClaudeInvoker({
             registry,
             model: process.env["COLTRANE_MODEL"],