@getmarrow/mcp 3.9.60 → 3.9.62

package/README.md

@@ -104,7 +104,27 @@ npx -y --package=@getmarrow/mcp@latest marrow-mcp ping
 
 Detection and notification are automatic. After explicit installer activation, the local controller may restore only Marrow-managed hooks/configuration. Package upgrades, owner policy, credentials, and unrelated configuration remain explicit and subject to the operator's normal change policy.
 
-## What's New in v3.9.60
+## What's New in v3.9.62
+
+v3.9.62 integrates four model-neutral reliability and capability contracts:
+
+- standalone `marrow_status` uses the bounded compact API contract and can return a fresh, owner-only last-known status projection without treating it as a live gate or authorization;
+- ordinary runtime responses expose typed `runtime_authorization` backed by the authoritative gate receipt and omit `decision_id` unless the server actually created a decision;
+- `spool-status` and `drain-spool` report the active credential namespace separately from isolated legacy debt, and a clear active namespace exits successfully without replaying, merging, editing, or deleting old-key files;
+- initialize, prompt, setup, and tool responses qualify coverage by `host_capability`: MCP tools are on demand, while native hooks, an owned SDK process, a governed runner, or a custom event adapter cover only the scope proved by observed Marrow receipts.
+
+The default surface remains six tools and the prompt remains named `marrow-always-on`. Host and model labels are display-only and never change auth, tenant, plan, policy, proof, schema, or API behavior.
+
+## Previous: v3.9.61
+
+v3.9.61 keeps an authoritative proof-pack rejection distinct from a control-path outage:
+
+- backend `MARROW_PROOF_PACK_INCOMPLETE` responses are reported as `validation` / `proof_required`, not infrastructure failures;
+- the exact missing proof fields and backend repair instruction remain visible to the agent;
+- live proof validation does not return a stale outage brief or unavailable authorization state;
+- proof enforcement remains fail-closed, and successful commit behavior is unchanged.
+
+## Previous: v3.9.60
 
 v3.9.60 restores the complete control-and-proof loop for ordinary MCP clients:
 
@@ -116,7 +136,7 @@ v3.9.60 restores the complete control-and-proof loop for ordinary MCP clients:
 - a plan-gated handoff is reported as unavailable for the current plan, not as an API or authentication outage;
 - the release canary runs with the customer's default client deadlines instead of silently overriding them.
 
-MCP-only hosts, including Grok today, receive Marrow's control instructions but cannot expose native always-on lifecycle hooks unless the host implements them. Marrow reports that capability boundary explicitly instead of claiming hook coverage it cannot observe.
+MCP-only hosts receive the same model-neutral control instructions and six-tool default surface, but MCP transport alone is on demand. A host or model label never changes that coverage contract. Marrow reports passive coverage only from observed lifecycle receipts, not from configuration detection.
 
 ## Previous: v3.9.59
 
@@ -129,7 +149,7 @@ v3.9.59 makes the six-tool control path reliable and honest across ordinary edge
 - a first-session outage returns a clearly labeled local safety brief, and infrastructure failures are never mislabeled as policy denials;
 - timeout errors return a concrete retry delay instead of an unresolved placeholder;
 - Cloudflare edge denials are separated from key-scope or Marrow policy rejections;
-- MCP initialization carries the always-on control/proof instructions even when a client does not request the optional prompt template;
+- MCP initialization carries the capability-qualified control/proof instructions even when a client does not request the optional prompt template;
 - update, launch, setup, spool, and ping commands use the unambiguous `npx --package ... marrow-mcp` form;
 - explicit spool drains tolerate slow edge delivery without extending passive hook latency.
 
@@ -251,6 +271,8 @@ With installed native hooks, protected tool calls follow this automatically. For
 4. Perform the action only when its gate allows it. For a hard external choke point, run the command through `npx @getmarrow/install run`; it verifies the signed action permit immediately before execution.
 5. Call `marrow_commit` with that `decision_id`, the outcome, gate receipt, and required proof.
 
+`marrow_agent_runtime` returns `runtime_authorization` with the authoritative gate receipt. Ordinary runtime checks do not create a decision, so they omit `decision_id`; call `marrow_think` (or use `marrow_auto`) when a decision must be created and closed. An arbitration runtime that actually creates a decision returns that server-created `decision_id`. This contract is identical across MCP-compatible hosts and SDK-owned runtimes.
+
 Example pre-action request:
 
 ```json
@@ -345,9 +367,21 @@ it does not run models, retain prompts, or infer a winner from labels.
 
 ## Passive Use
 
-`npx -y --package=@getmarrow/mcp@latest marrow-mcp setup` installs supported prompt, tool-result, and session-stop hooks so the agent can receive before-action context, record meaningful tool outcomes, and keep unfinished closure visible without the owner repeatedly prompting it to use Marrow.
+`npx -y --package=@getmarrow/mcp@latest marrow-mcp setup` configures supported prompt, pre-action, tool-result, and session-stop hooks. Configuration is not proof that the host invoked them. Marrow reports native passive coverage only after it observes the required prompt, pre-action, action-result, and session-end receipts.
+
+### Capability and coverage contract
+
+| Integration mode | Coverage Marrow can claim |
+| --- | --- |
+| MCP tools-only | On demand; covers only explicit MCP tool calls |
+| Verified native hooks | Passive only for the lifecycle stages backed by observed hook receipts |
+| `createPassiveRuntime().install()` | Only the owned Node process, and only while that runtime is installed and running |
+| Governed runner | Only the command launched through the wrapper |
+| Custom host | Requires a bounded event adapter; covers only the lifecycle events whose receipts Marrow observes |
+
+This contract is model-neutral. A model name, host header, config file, installed hook entry, or successful MCP handshake does not certify passive coverage. Only observed Marrow receipts do. An unknown MCP host therefore gets the generic `mcp-client` identity and the same on-demand tools, schemas, and API semantics as a named host.
 
-The hooks send compact classifications and lifecycle receipts. They do not need raw prompts, completions, command output, tool output, or credentials. A completed tool or session does not automatically become a successful business outcome; explicit success/failure closure is required.
+When invoked by a supported host, the configured hooks send compact classifications and lifecycle receipts. They do not need raw prompts, completions, command output, tool output, or credentials. A completed tool or session does not automatically become a successful business outcome; explicit success/failure closure is required.
 
 Transient lifecycle receipts use a bounded owner-only spool and are retried with stable event IDs. Operators can inspect and drain it without exposing event content:
 
@@ -356,7 +390,7 @@ npx -y --package=@getmarrow/mcp@latest marrow-mcp spool-status
 npx -y --package=@getmarrow/mcp@latest marrow-mcp drain-spool
 ```
 
-The output contains only state, exact pending/failed counts, oldest receipt timestamps, capacity, and an exact fix. Terminal validation/authentication failures and exhausted retries remain explicit durable failures rather than cycling indefinitely.
+The output contains only state, bounded pending/failed counts, oldest receipt timestamps, capacity, and an exact fix. A drain applies only to the active credential-and-agent namespace: isolated legacy namespace debt is reported separately and never changes a successful active-namespace drain into a failure. Legacy files are never replayed, merged, deleted, or attributed to the active identity. Restore the exact original identity to drain one, or preserve the selected file unchanged in a separate owner-only quarantine directory when that identity is unavailable. Terminal validation/authentication failures and exhausted retries in the active namespace remain explicit durable failures rather than cycling indefinitely.
 
 Check the installed runtime:
 

package/dist/cli.js

@@ -17,6 +17,7 @@ const hook_session_1 = require("./hook-session");
 const hook_pre_action_1 = require("./hook-pre-action");
 const env_1 = require("./env");
 const lifecycle_spool_1 = require("./lifecycle-spool");
+const spool_command_1 = require("./spool-command");
 const guidance_cache_1 = require("./guidance-cache");
 const request_reliability_1 = require("./request-reliability");
 const hook_contract_1 = require("./hook-contract");
@@ -24,6 +25,8 @@ const ping_state_1 = require("./ping-state");
 const control_path_state_1 = require("./control-path-state");
 const redact_1 = require("./redact");
 const runtime_contract_1 = require("./runtime-contract");
+const status_cache_1 = require("./status-cache");
+const host_capability_1 = require("./host-capability");
 // Parse CLI args
 function parseArgs() {
     const args = process.argv.slice(2);
@@ -127,17 +130,10 @@ async function runSpoolCommand(drain) {
     const status = drain
         ? await (0, lifecycle_spool_1.drainLifecycleSpool)({ apiKey, baseUrl, agentId: resolved.agentId || undefined })
         : (0, lifecycle_spool_1.lifecycleSpoolStatus)({ apiKey, agentId: resolved.agentId || undefined });
-    const namespaceAttention = status.other_namespaces.state === 'attention_required';
-    process.stdout.write(`${JSON.stringify({
-        ok: drain
-            ? status.state === 'clear' && !namespaceAttention
-            : status.state !== 'attention_required' && !namespaceAttention,
-        lifecycle_spool: status,
-    }, null, 2)}\n`);
-    if (status.state === 'attention_required' || namespaceAttention)
-        process.exitCode = 2;
-    else if (drain && status.state !== 'clear')
-        process.exitCode = 1;
+    const outcome = (0, spool_command_1.lifecycleSpoolCommandOutcome)(status, drain);
+    process.stdout.write(`${JSON.stringify(outcome.output, null, 2)}\n`);
+    if (outcome.exitCode !== 0)
+        process.exitCode = outcome.exitCode;
 }
 // ─── Setup command: inject Marrow instructions into CLAUDE.md ───
 function runSetup() {
@@ -148,10 +144,10 @@ function runSetup() {
     const marrowInstructions = `${MARROW_BLOCK_START}
 ## Marrow — Agent Control and Proof (auto-injected by @getmarrow/mcp setup)
 
-You have Marrow MCP connected. Use it on EVERY session automatically:
+Use Marrow according to the capability evidence returned by the MCP server:
 
-1. **Passive by default:** Marrow hooks record compact lifecycle receipts and inject relevant policy, warnings, lessons, and risky-work decision briefs into your prompt context.
-2. **Before risky actions:** Respect the returned \`allow\`, \`warn\`, \`review_required\`, or \`block\` decision and its proof contract. Call \`marrow_agent_runtime\` explicitly when the passive hook cannot cover the action.
+1. **MCP baseline is on demand:** MCP transport exposes tools; it does not provide passive hooks. Call Marrow tools explicitly unless observed receipts verify another capability mode.
+2. **Before risky actions:** Respect the returned \`allow\`, \`warn\`, \`review_required\`, or \`block\` decision and its proof contract. Call \`marrow_agent_runtime\` explicitly when verified passive coverage cannot cover the action.
 3. **After meaningful work:** Record the real success or failure with \`marrow_commit\` or \`marrow_auto\`. A tool exit or session end is not proof that the business outcome succeeded.
 4. **Unfinished work:** Leave pending outcomes visible. Do not invent success to clear a closure item.
 5. **To explain an intervention:** Use \`marrow_decision_trace\`, then relay its \`intervention_receipt\` in one factual sentence when Marrow blocked, warned, or required review. Stay quiet for routine low-risk work.
@@ -160,6 +156,8 @@ You have Marrow MCP connected. Use it on EVERY session automatically:
 
 Do not skip the gate or outcome. Marrow's value comes from controlling the action before execution and preserving evidence afterward.
 
+Capability boundaries: verified native hooks cover only their observed lifecycle; \`createPassiveRuntime().install()\` covers only its owned Node process while installed; a governed runner covers only its wrapped command; and a custom host needs a bounded event adapter. A model name, host label, or installed configuration is not proof of coverage. Only observed Marrow receipts certify it.
+
 For one-shot logging: \`marrow_auto({ action: "did X", outcome: "result Y", success: true })\` — one call, done.
 ${MARROW_BLOCK_END}`;
     let dir = process.cwd();
@@ -203,37 +201,37 @@ ${MARROW_BLOCK_END}`;
     }
     const hookInstall = (0, hook_1.installPostToolUseHook)(process.cwd());
     if (hookInstall.installed) {
-        process.stdout.write('Installed PostToolUse hook — your agent\'s tool calls now auto-log to Marrow.\n');
+        process.stdout.write('Configured PostToolUse hook. Coverage remains unverified until Marrow observes action-result receipts.\n');
     }
     else {
-        process.stdout.write('PostToolUse hook already installed — agent tool calls auto-log to Marrow.\n');
+        process.stdout.write('PostToolUse hook configuration is present. Coverage remains unverified until Marrow observes action-result receipts.\n');
     }
     const contextHookInstall = (0, hook_context_1.installUserPromptSubmitHook)(process.cwd());
     if (contextHookInstall.installed) {
-        process.stdout.write('Installed UserPromptSubmit hook — Marrow will inject relevant context and passive decision briefs into your prompts automatically.\n');
+        process.stdout.write('Configured UserPromptSubmit hook. Passive prompt coverage remains unverified until Marrow observes prompt receipts.\n');
     }
     else {
-        process.stdout.write('UserPromptSubmit hook already installed — Marrow context and passive decision briefs are injected on matching prompts.\n');
+        process.stdout.write('UserPromptSubmit hook configuration is present. Passive prompt coverage remains unverified until Marrow observes prompt receipts.\n');
     }
     const preActionHookInstall = (0, hook_pre_action_1.installPreActionHook)(process.cwd());
     if (preActionHookInstall.installed) {
-        process.stdout.write('Installed PreToolUse hook — Marrow now checks each matched action before execution.\n');
+        process.stdout.write('Configured PreToolUse hook. Pre-action coverage remains unverified until Marrow observes pre-action receipts.\n');
     }
     else {
-        process.stdout.write('PreToolUse hook already installed — matched actions are checked before execution.\n');
+        process.stdout.write('PreToolUse hook configuration is present. Pre-action coverage remains unverified until Marrow observes pre-action receipts.\n');
     }
     const sessionHookInstall = (0, hook_session_1.installSessionEndHook)(process.cwd());
     if (sessionHookInstall.installed) {
-        process.stdout.write('Installed Stop hook — unfinished outcomes remain visible for reconciliation.\n');
+        process.stdout.write('Configured Stop hook. Session-end coverage remains unverified until Marrow observes session-end receipts.\n');
     }
     else {
-        process.stdout.write('Stop hook already installed — unfinished outcomes remain visible for reconciliation.\n');
+        process.stdout.write('Stop hook configuration is present. Session-end coverage remains unverified until Marrow observes session-end receipts.\n');
     }
     process.stdout.write(`Hook settings: ${hookInstall.settingsPath}\n`);
     process.stdout.write('Set MARROW_AUTO_HOOK=false to disable passive hooks.\n');
     process.stdout.write('Set MARROW_PASSIVE_BRIEF=false to disable automatic decision briefs, or MARROW_PASSIVE_BRIEF=always to brief every prompt.\n');
     process.stdout.write('Set MARROW_HOOK_DEBUG=true for write-side hook diagnostics, or MARROW_CONTEXT_HOOK_DEBUG=true for prompt-context diagnostics.\n');
-    process.stdout.write('Your agent will now use Marrow automatically — both writing decisions AND reading past intelligence — in every session.\n');
+    process.stdout.write('Setup completed. MCP tools remain on demand; passive coverage is reported only after Marrow observes the required hook receipts.\n');
     process.exit(0);
 }
 const cliArgs = parseArgs();
@@ -447,16 +445,21 @@ if (process.argv[2] !== 'keys') {
         }
         function toolFailure(toolName, failure) {
             const result = (0, request_reliability_1.structuredRequestFailure)(failure);
-            const infrastructureFailure = !['authentication_required', 'permission_denied'].includes(failure.code);
+            const proofValidation = failure.code === 'proof_required';
+            const infrastructureFailure = !proofValidation && !['authentication_required', 'permission_denied'].includes(failure.code);
             const supportsStale = ['marrow_agent_runtime', 'marrow_orient', 'marrow_ask', 'marrow_handoff_status', 'marrow_runtime_status', 'marrow_status'].includes(toolName || '');
             const spool = (0, lifecycle_spool_1.lifecycleSpoolStatus)({ apiKey: API_KEY, agentId: FLEET_AGENT_ID });
-            result.failure_kind = infrastructureFailure ? 'infrastructure' : 'authorization';
+            result.failure_kind = proofValidation ? 'validation' : infrastructureFailure ? 'infrastructure' : 'authorization';
             result.control_path = (0, control_path_state_1.controlPathStats)(toolName || 'marrow_control');
             result.lifecycle_spool = {
                 ...spool,
                 drain_command: 'npx -y --package=@getmarrow/mcp@latest marrow-mcp drain-spool',
             };
             result.host_capability = mcpHostCapability();
+            if (proofValidation) {
+                result.proof_required = true;
+                result.exact_next_action = failure.exactFix;
+            }
             if (infrastructureFailure && supportsStale) {
                 let cached = null;
                 try {
@@ -484,22 +487,9 @@ if (process.argv[2] !== 'keys') {
             return result;
         }
         function mcpHostCapability() {
-            const raw = String(process.env.MARROW_CLIENT || process.env.MARROW_HARNESS || '').trim().toLowerCase();
-            const host = ['grok', 'claude-code', 'codex', 'cursor', 'windsurf', 'gemini', 'kimi', 'qwen', 'deepseek']
-                .includes(raw) ? raw : 'mcp-client';
-            return {
-                transport: 'mcp_stdio',
-                host,
-                tools_available: true,
-                tool_invocation: 'on_demand',
-                passive_hooks: {
-                    provided_by_mcp_transport: false,
-                    external_host_hook_state: 'unverified',
-                    observed_by_this_process: false,
-                },
-                always_on_state: 'host_dependent',
-                exact_next_action: 'Use the Marrow MCP tools on demand. Claim passive coverage only when the host separately configures trusted hooks and Marrow receives their lifecycle receipts.',
-            };
+            return (0, host_capability_1.resolveHostCapability)({
+                hostLabel: process.env.MARROW_CLIENT || process.env.MARROW_HARNESS || process.env.MARROW_AGENT_CLIENT,
+            });
         }
         function clientOperationalPayload(toolName, value) {
             const payload = value && typeof value === 'object' && !Array.isArray(value)
@@ -570,6 +560,23 @@ if (process.argv[2] !== 'keys') {
             }
             catch { /* owner-only cache is best effort */ }
         }
+        function storeLastKnownStatus(status, source) {
+            try {
+                (0, status_cache_1.writeStatusCache)({
+                    apiKey: API_KEY,
+                    baseUrl: BASE_URL,
+                    agentId: FLEET_AGENT_ID,
+                    status,
+                    source,
+                });
+            }
+            catch { /* owner-only cache is best effort */ }
+        }
+        function refreshStatusInBackground() {
+            void (0, index_1.marrowStatus)(API_KEY, BASE_URL, SESSION_ID, FLEET_AGENT_ID)
+                .then((status) => storeLastKnownStatus(status, 'status'))
+                .catch(() => undefined);
+        }
         // [FIX #6 & #7] Safe JSON response helper for memory API functions
         async function safeMemoryResponse(res) {
             if (!res.ok) {
@@ -815,7 +822,7 @@ if (process.argv[2] !== 'keys') {
                             type: 'object',
                             description: 'Optional required proof pack for gated work: summary, checks, outcome, blockers, commits_prs_shas, rollback_target, handoff_result_file, deployment_and_smoke.',
                         },
-                        gate_receipt_id: { type: 'string', description: 'Receipt id from marrow_agent_runtime.gate_receipt.id for risky work.' },
+                        gate_receipt_id: { type: 'string', description: 'Canonical receipt id from marrow_agent_runtime.runtime_authorization.id for risky work.' },
                         arbitration_receipt_id: { type: 'string', description: 'Required for arbitrated work: use marrow_arbitrate.arbitration.receipt_id from the same runtime response.' },
                         owner_approval_receipt_id: { type: 'string', description: 'Single-use owner approval receipt issued by authenticated dashboard review for review_required arbitration.' },
                         action: { type: 'string', description: 'Optional original action. If provided and gate_receipt_id is omitted, MCP can fetch a matching runtime gate receipt before commit.' },
@@ -1228,6 +1235,8 @@ if (process.argv[2] !== 'keys') {
                 name: 'marrow_agent_runtime',
                 description: 'One-call agent-native Marrow loop. Returns passive status, decision brief, risk gate, relevant lessons, ' +
                     'template suggestion, required proof pack, before-you-act instruction, and exact next action. ' +
+                    'Its runtime_authorization is the authoritative gate receipt; it returns decision_id only when runtime actually creates a decision. ' +
+                    'Use marrow_auto or marrow_think to create the decision_id required for outcome closure. ' +
                     'Use this before meaningful work when you want Marrow to guide the whole action in one call.',
                 inputSchema: {
                     type: 'object',
@@ -1682,13 +1691,15 @@ if (process.argv[2] !== 'keys') {
             try {
                 if (method === 'initialize') {
                     initialized = true;
+                    const hostCapability = mcpHostCapability();
                     success(id, {
                         protocolVersion: '2024-11-05',
                         capabilities: { tools: {}, prompts: {} },
                         serverInfo: { name: 'marrow', version: hook_contract_1.MCP_ADAPTER_VERSION },
                         ...(AUTO_ENROLL ? {
-                            instructions: 'Use marrow_agent_runtime before consequential actions, obey fresh allow/warn/review_required/block results, use marrow_ask for relevant prior lessons, and close meaningful outcomes with marrow_commit. Infrastructure failures are not policy denials; continue only low-risk reversible work from the returned outage-safe brief, and require a fresh gate for high-risk work. MCP tools are on demand; do not claim passive or prompt-injection coverage unless the host separately configured trusted hooks and Marrow observed their receipts.',
+                            instructions: `Use marrow_agent_runtime before consequential actions, obey fresh allow/warn/review_required/block results, use marrow_ask for relevant prior lessons, and close meaningful outcomes with marrow_commit. Infrastructure failures are not policy denials; continue only low-risk reversible work from the returned outage-safe brief, and require a fresh gate for high-risk work. ${(0, host_capability_1.hostCapabilityInstructions)(hostCapability)}`,
                         } : {}),
+                        _meta: { host_capability: hostCapability },
                     });
                     // Auto-enroll: emit enrollment notification on connection
                     if (AUTO_ENROLL) {
@@ -1700,9 +1711,10 @@ if (process.argv[2] !== 'keys') {
                                 logger: 'marrow',
                                 data: {
                                     type: 'auto_enroll',
-                                    message: 'Marrow auto-enroll active. Call marrow_orient FIRST, then marrow_think before acting, marrow_commit after. Or use marrow_auto / marrow_run for one-call logging.',
+                                    message: `Marrow operating contract available. MCP tools are on demand. ${hostCapability.exact_next_action}`,
                                     agentId: FLEET_AGENT_ID,
                                     client_update: (0, request_reliability_1.localClientUpdate)(),
+                                    host_capability: hostCapability,
                                 },
                             },
                         });
@@ -1715,8 +1727,9 @@ if (process.argv[2] !== 'keys') {
                             prompts: [
                                 {
                                     name: 'marrow-always-on',
-                                    description: 'Always-on Marrow control and proof loop. Applies before-action guidance, records compact lifecycle receipts, and keeps unfinished outcomes visible.',
+                                    description: 'Marrow control and proof contract, qualified by verified host capability and observed lifecycle receipts.',
                                     arguments: [],
+                                    _meta: { host_capability: mcpHostCapability() },
                                 },
                             ],
                         });
@@ -1732,8 +1745,10 @@ if (process.argv[2] !== 'keys') {
                         error(id, -32602, 'Unknown prompt');
                         return;
                     }
+                    const hostCapability = mcpHostCapability();
                     success(id, {
-                        description: 'Always-on Marrow control and proof loop — automatic, zero-config',
+                        description: 'Marrow control and proof contract — coverage is capability-qualified and receipt-verified',
+                        _meta: { host_capability: hostCapability },
                         messages: [
                             {
                                 role: 'user',
@@ -1741,14 +1756,16 @@ if (process.argv[2] !== 'keys') {
                                     type: 'text',
                                     text: `You have Marrow — the agent control and proof layer around this workflow.
 
-## Passive operating contract
+## Capability-qualified operating contract
+
+${(0, host_capability_1.hostCapabilityInstructions)(hostCapability)}
 
-Installed hooks handle supported lifecycle capture automatically:
-- UserPromptSubmit requests relevant policy, warnings, lessons, and a decision brief before risky work.
-- PostToolUse records compact tool success or failure receipts.
-- Stop keeps unfinished outcomes visible instead of silently treating session exit as success.
+When verified by observed receipts, native hooks can cover these bounded lifecycle stages:
+- UserPromptSubmit can request relevant policy, warnings, lessons, and a decision brief before risky work.
+- PostToolUse can record compact tool success or failure receipts.
+- Stop can keep unfinished outcomes visible instead of silently treating session exit as success.
 
-Hooks never make a blocked action safe. Before a consequential action, respect the returned allow, warn, review_required, or block decision and its required proof. Call marrow_agent_runtime explicitly when the passive hook cannot cover the action.
+Hooks never make a blocked action safe. Before a consequential action, respect the returned allow, warn, review_required, or block decision and its required proof. Call marrow_agent_runtime explicitly when verified passive coverage cannot cover the action.
 
 When runtime/status returns a client_update notice, tell the operator and use its exact update and verification commands only when local change policy permits. Never silently change packages or configuration.
 
@@ -1797,7 +1814,7 @@ Marrow is not a replacement agent or a standalone memory app. Context and prior
                                 `2. Use marrow_agent_runtime when a risky action needs an explicit gate.\n` +
                                 `3. Close meaningful work with marrow_commit; a tool exit alone is not outcome proof.\n` +
                                 `4. Use marrow_decision_trace to explain the prior failure, lesson, gate, proof, workflow, and outcome path.\n\n` +
-                                `Installed hooks cover supported passive lifecycle events. Leave unknown outcomes pending instead of inventing success.\n`;
+                                `${(0, host_capability_1.hostCapabilityInstructions)(mcpHostCapability())}\n\nLeave unknown outcomes pending instead of inventing success.\n`;
                             const orientText = JSON.stringify(result, null, 2);
                             success(id, {
                                 content: [{ type: 'text', text: enrollmentText + orientText }],
@@ -1964,7 +1981,12 @@ Marrow is not a replacement agent or a standalone memory app. Context and prior
                             }, SESSION_ID, FLEET_AGENT_ID, signal), { highRisk: true, toolName: 'marrow_auto.runtime' });
                             storeRuntimeGuidance(runtimeGate);
                         }
-                        const proofCanClose = !highRisk || (0, runtime_contract_1.highRiskRuntimeCanClose)(runtimeGate, suppliedProof, args.gate_receipt_id);
+                        const canonicalRuntimeReceiptId = (0, runtime_contract_1.runtimeAuthorizationReceiptId)(runtimeGate);
+                        const suppliedRuntimeReceiptId = typeof args.gate_receipt_id === 'string'
+                            ? args.gate_receipt_id
+                            : canonicalRuntimeReceiptId;
+                        const proofCanClose = !highRisk
+                            || (0, runtime_contract_1.highRiskRuntimeCanClose)(runtimeGate, suppliedProof, suppliedRuntimeReceiptId);
                         const acceptedSuccess = proofCanClose ? outcomeSuccess : undefined;
                         const delivery = () => (0, index_1.marrowAuto)(API_KEY, BASE_URL, {
                             action,
@@ -1972,9 +1994,10 @@ Marrow is not a replacement agent or a standalone memory app. Context and prior
                             success: acceptedSuccess,
                             type,
                             proof: suppliedProof,
-                            gate_receipt_id: typeof args.gate_receipt_id === 'string'
-                                ? args.gate_receipt_id
-                                : runtimeGate?.gate_receipt?.id,
+                            gate_receipt_id: suppliedRuntimeReceiptId || undefined,
+                            // Low-risk one-shot capture does not need a policy gate. Consequential
+                            // work already obtained and validated canonical runtime authorization.
+                            auto_gate: highRisk,
                         }, SESSION_ID, FLEET_AGENT_ID, 8_000);
                         let delivered = null;
                         let deliveryFailure = null;
@@ -2055,7 +2078,20 @@ Marrow is not a replacement agent or a standalone memory app. Context and prior
                         return;
                     }
                     if (toolName === 'marrow_status') {
+                        let cached = null;
+                        try {
+                            cached = (0, status_cache_1.readStatusCache)({ apiKey: API_KEY, baseUrl: BASE_URL, agentId: FLEET_AGENT_ID });
+                        }
+                        catch { /* owner-only cache is best effort */ }
+                        if (cached) {
+                            const startedAt = Date.now();
+                            refreshStatusInBackground();
+                            (0, control_path_state_1.recordControlPathSample)('marrow_status', Date.now() - startedAt, true);
+                            toolSuccess(id, clientOperationalPayload('marrow_status', (0, status_cache_1.cachedStatusPayload)(cached)));
+                            return;
+                        }
                         const result = await withControlDeadline((signal) => (0, index_1.marrowStatus)(API_KEY, BASE_URL, SESSION_ID, FLEET_AGENT_ID, signal), { cacheAware: false, toolName: 'marrow_status' });
+                        storeLastKnownStatus(result, 'status');
                         toolSuccess(id, clientOperationalPayload('marrow_status', result));
                         return;
                     }
@@ -2252,6 +2288,7 @@ Marrow is not a replacement agent or a standalone memory app. Context and prior
                         };
                         const result = await withControlDeadline((signal) => (0, index_1.marrowAgentRuntime)(API_KEY, BASE_URL, runtimeInput, SESSION_ID, FLEET_AGENT_ID, signal), { highRisk: isHighRiskAction(runtimeInput.action, runtimeInput.type), toolName: 'marrow_agent_runtime' });
                         storeRuntimeGuidance(result);
+                        storeLastKnownStatus(result.status, 'runtime');
                         toolSuccess(id, clientOperationalPayload('marrow_agent_runtime', result));
                         return;
                     }