@getmarrow/mcp 3.9.72 → 3.9.74

package/README.md

@@ -66,7 +66,7 @@ Set the key through trusted secret storage:
 export MARROW_API_KEY=mrw_live_...
 ```
 
-For native pre-action enforcement, Marrow accepts the process environment or an owner-controlled `~/.marrow/env` file with owner-only permissions. Repository-local `.env` files are intentionally ignored for enforcement identity so project content cannot replace the account, agent, or API endpoint used to authorize a protected action.
+For Claude Code's cooperative pre-action hook, Marrow accepts the process environment or an owner-controlled `~/.marrow/env` file with owner-only permissions. Repository-local `.env` files are intentionally ignored so project content cannot replace the account, agent, or API endpoint used for guidance. The public hook callback is still a client self-report, not certified host provenance or an external enforcement boundary.
 
 Then configure the MCP server:
 
@@ -104,7 +104,11 @@ npx -y --package=@getmarrow/mcp@latest marrow-mcp ping
 
 Detection and notification are automatic. After explicit installer activation, the local controller may restore only Marrow-managed hooks/configuration. Package upgrades, owner policy, credentials, and unrelated configuration remain explicit and subject to the operator's normal change policy.
 
-## What's New in v3.9.72
+## What's New in v3.9.74
+
+v3.9.74 keeps one automatic operation bound to its original runtime authorization and decision across timeout and proof-required retries, then closes that exact decision once verified proof is supplied. One outer `marrow_auto` invocation normally completes think and commit in-band within its bounded eight-second client budget. The release canary allows that complete client budget plus bounded response overhead rather than cutting the operation off at five seconds.
+
+## Previous: v3.9.72
 
 v3.9.72 requires SDK `3.7.61` so MCP installations cannot resolve to an SDK that recursively intercepts its own Marrow control-plane traffic. The MCP tool contract is unchanged; this release aligns the tested package chain.
 
@@ -115,9 +119,10 @@ v3.9.71 makes the advertised Grok control loop true:
 - default tools include `marrow_think` so the official loop can create a `decision_id` without `MARROW_TOOL_PROFILE=full`;
 - process identity prefers `MARROW_KEY_<ROLE>` when it matches `MARROW_AGENT_ID`, so a leaked fleet env cannot 403 every status call;
 - Grok native hooks are installed under `~/.grok/hooks/marrow.json` and hook parsers accept Grok camelCase envelopes;
+- Grok hooks are advisory telemetry/context only. Consequential execution requires `npx @getmarrow/install run --agent <agent-id> -- -- <command>`;
 - idle spool nudge drains up to 40 current-namespace events so the queue does not sit as a nag;
 - if `risk_gate.enforced` is false, the gate is advisory — do not describe it as a live block;
-- `marrow_commit.decision_id` may come from `marrow_think`, `marrow_auto`, or `marrow_agent_runtime.runtime_authorization.id`.
+- `marrow_commit.decision_id` comes from `marrow_think`, `marrow_auto`, or an arbitration runtime that actually created a decision. A normal runtime authorization is a gate receipt, not a decision.
 
 ## Previous: v3.9.69
 
@@ -182,9 +187,9 @@ v3.9.62 integrates four model-neutral reliability and capability contracts:
 - standalone `marrow_status` uses the bounded compact API contract and can return a fresh, owner-only last-known status projection without treating it as a live gate or authorization;
 - ordinary runtime responses expose typed `runtime_authorization` backed by the authoritative gate receipt and omit `decision_id` unless the server actually created a decision;
 - `spool-status` and `drain-spool` report the active credential namespace separately from isolated legacy debt, and a clear active namespace exits successfully without replaying, merging, editing, or deleting old-key files;
-- initialize, prompt, setup, and tool responses qualify coverage by `host_capability`: MCP tools are on demand, while native hooks, an owned SDK process, a governed runner, or a custom event adapter cover only the scope proved by observed Marrow receipts.
+- initialize, prompt, setup, and tool responses qualify coverage by `host_capability`: MCP tools are on demand, while client-self-reported hook activity remains visible but never certifies coverage or control.
 
-The default surface is seven tools (runtime, think, commit, ask, status, auto, handoff status) and the prompt remains named `marrow-always-on`. Host and model labels are display-only and never change auth, tenant, plan, policy, proof, schema, or API behavior. Grok always-on coverage is native hooks plus MCP; it is verified only from observed receipts.
+The default surface is seven tools (runtime, think, commit, ask, status, auto, handoff status) and the prompt remains named `marrow-always-on`. Host and model labels are display-only and never change auth, tenant, plan, policy, proof, schema, or API behavior. Grok hook activity is advisory and client-self-reported; the governed wrapper is the consequential-action boundary.
 
 ## Previous: v3.9.61
 
@@ -200,14 +205,14 @@ v3.9.61 keeps an authoritative proof-pack rejection distinct from a control-path
 v3.9.60 restores the complete control-and-proof loop for ordinary MCP clients:
 
 - cached guidance no longer cuts live status, ask, runtime, or handoff reads down to an impossible 500 ms deadline;
-- `marrow_auto` waits for the bounded think-and-commit path and reports the live decision and proof result in-band;
+- `marrow_auto` normally waits for the bounded think-and-commit path and reports the live decision and proof result in-band; if the client deadline is reached, the returned operation ID continues that same decision;
 - `marrow_commit` now shares the same abort and deadline contract as the other control calls;
 - transient retries use a one-second delay so a slow edge path is not immediately hit again;
 - spool status surfaces backlogs under older credential namespaces without replaying them across an unverified tenant boundary;
 - a plan-gated handoff is reported as unavailable for the current plan, not as an API or authentication outage;
 - the release canary runs with the customer's default client deadlines instead of silently overriding them.
 
-MCP-only hosts receive the same model-neutral control instructions and six-tool default surface, but MCP transport alone is on demand. A host or model label never changes that coverage contract. Marrow reports passive coverage only from observed lifecycle receipts, not from configuration detection.
+The current package gives MCP-only hosts the same model-neutral control instructions and seven-tool default surface, but MCP transport alone remains on demand. A host or model label never changes that coverage contract. Public lifecycle callbacks and hook activity are client-self-reported and cannot verify or certify passive coverage; independent authority is required. Codex, Grok, Gemini, and similar CLI harnesses must use `npx @getmarrow/install run --agent <agent-id> -- -- <command>` for consequential commands.
 
 ## Previous: v3.9.59
 
@@ -286,7 +291,7 @@ It preserves the signed action-permit and update controls introduced in v3.9.52.
 
 ## Previous: v3.9.52
 
-v3.9.52 combines operator-controlled client update notices with signed, action-bound permit verification in native hooks. Official MCP requests identify the installed package version, and passive context renders a request-specific server advisory with exact update and verification commands:
+v3.9.52 combines operator-controlled client update notices with signed, action-bound permit verification in the cooperative Claude Code hook path. That permit flow does not authenticate hook provenance or certify always-on coverage. Official MCP requests identify the installed package version, and passive context renders a request-specific server advisory with exact update and verification commands:
 
 - update availability or unrecognized version metadata appears during normal authenticated runtime/status activity;
 - messaging clearly states that hosted Marrow services are already current and that no local change was applied;
@@ -294,7 +299,7 @@ v3.9.52 combines operator-controlled client update notices with signed, action-b
 - unknown versions do not imply a vulnerability, while server-designated security requirements remain distinct;
 - existing MCP tools and older server responses remain compatible when no advisory is returned.
 
-The native `PreToolUse` hook verifies the permit before protected work can execute. It obtains the runtime gate, records the exact governed decision, requests a permit bound to that gate, decision, target, and canonical action surfaces, and consumes it immediately before returning control to the harness:
+The Claude Code `PreToolUse` hook cooperatively verifies the permit before returning control to that harness. It obtains the runtime gate, records the exact governed decision, requests a permit bound to that gate, decision, target, and canonical action surfaces, and consumes it before returning. The callback itself remains client-self-reported and is not a certified external choke point:
 
 - protected deploy, publish, merge, migration, credential, and production actions fail closed on timeout or permit failure;
 - the permit is bound to the authenticated account, key, agent, session, action, target, canonical action surfaces, decision, and runtime gate;
@@ -303,13 +308,13 @@ The native `PreToolUse` hook verifies the permit before protected work can execu
 - the bounded hook timeout prevents a control-plane wait from hanging the agent indefinitely;
 - low-risk work retains passive/advisory behavior unless account policy requires stronger enforcement.
 
-It preserves the verifiable native-hook coverage introduced in v3.9.50:
+It preserves native-hook activity diagnostics introduced in v3.9.50, with the current trust boundary applied:
 
-- agents and owners can distinguish “MCP configured” from “pre-action, result, and session hooks actually observed”;
+- agents and owners can distinguish “MCP configured” from client-reported pre-action, result, and session activity without treating either as certification;
 - `PreToolUse` requests the Marrow runtime gate before matched actions and maps `block` to deny and `review_required` to operator review;
 - matching `PreToolUse` and result hooks share Claude Code's tool-use correlation while the session shares one workflow identity;
-- generic integration events cannot claim native-hook coverage unless the native adapter supplies that evidence;
-- retries preserve correlation and capability evidence in the owner-only durable spool;
+- generic integration events and public hook entrypoints cannot claim certified native-hook coverage;
+- retries preserve correlation and explicitly `client_self_reported` activity in the owner-only durable spool;
 - configuration drift can be diagnosed without sending configuration contents;
 - missing outcome closure remains visible rather than treating tool or session exit as business success;
 - existing MCP tools and lifecycle inputs remain compatible.
@@ -330,20 +335,22 @@ It preserves `marrow_arbitrate` from v3.9.49, the session-orientation hardening
 
 Existing MCP tools and stable context API names remain compatible. Authentication, policy, proof, and validation failures are surfaced rather than retried as network failures.
 
-Coverage percentages are produced only when Marrow has exact observed receipts. An installed config without observed hooks is shown as warming up or degraded, with `npx @getmarrow/install --repair` as the bounded repair path.
+Client hook activity alone never produces certified coverage percentages. An installed config or API-key-authenticated callback is shown as client-self-reported activity; certification requires an independent authority not supplied by the public MCP hook entrypoints.
 
 ## Governed Action Flow
 
-With installed native hooks, protected tool calls follow this automatically. For explicit/custom MCP flows before deploys, merges, publishes, migrations, credential changes, financial operations, or customer-impacting work:
+Configured hooks can provide cooperative telemetry and context, but they are not a certified execution boundary. Before deploys, merges, publishes, migrations, credential changes, financial operations, or customer-impacting work:
 
 1. Call `marrow_agent_runtime` or `marrow_decision_brief`.
 2. Stop when the returned decision is `block` or `review_required`; otherwise follow its prior lesson and proof contract.
-3. Call `marrow_think` or `marrow_auto` to record intent and obtain the `decision_id` that will be closed. `marrow_agent_runtime.runtime_authorization.id` is also accepted.
-4. Perform the action only when its gate allows it. For a hard external choke point, run the command through `npx @getmarrow/install run`; it verifies the signed action permit immediately before execution.
+3. Call `marrow_think` or `marrow_auto` to record intent and obtain the `decision_id` that will be closed. Keep `marrow_agent_runtime.runtime_authorization.id` separate as the gate receipt for consequential work.
+4. Perform the action only when its gate allows it. For Codex, Grok, Gemini, and similar CLI harnesses, use the governed wrapper: `npx @getmarrow/install run --agent <agent-id> -- -- <command>`.
 5. Call `marrow_commit` with that `decision_id`, the outcome, gate receipt, and required proof.
 
 `marrow_agent_runtime` returns `runtime_authorization` with the authoritative gate receipt. Ordinary runtime checks do not create a decision, so they omit `decision_id`; call `marrow_think` (or use `marrow_auto`) when a decision must be created and closed. An arbitration runtime that actually creates a decision returns that server-created `decision_id`. This contract is identical across MCP-compatible hosts and SDK-owned runtimes.
 
+`marrow_auto` returns an `operation_id`, phase, and resumable state. If a client deadline is reached before closure, retry with the same `operation_id`; Marrow reuses the same tenant-scoped runtime authorization, think decision, and commit idempotency keys instead of opening another decision. When the phase is `proof_required`, add the requested proof and retry with that same operation ID and unchanged action/context/surfaces. Proof is validated and bound at commit; changing the tenant or action scope is rejected. A closed response reports `phase: "closed"`, `committed: true`, and `resumable: false`.
+
 Example pre-action request:
 
 ```json
@@ -438,22 +445,26 @@ it does not run models, retain prompts, or infer a winner from labels.
 
 ## Passive Use
 
-`npx -y --package=@getmarrow/mcp@latest marrow-mcp setup` configures supported prompt, pre-action, tool-result, and session-stop hooks. Configuration is not proof that the host invoked them. Marrow reports native passive coverage only after it observes the required prompt, pre-action, action-result, and session-end receipts.
+`npx -y --package=@getmarrow/mcp@latest marrow-mcp setup` configures supported prompt, pre-action, tool-result, and session-stop hooks. Configuration, public hook argv, and API-key-authenticated callbacks are client self-reports. They preserve raw lifecycle activity but do not prove that the host invoked a hook or certify passive control.
 
 ### Capability and coverage contract
 
 | Integration mode | Coverage Marrow can claim |
 | --- | --- |
 | MCP tools-only | On demand; covers only explicit MCP tool calls |
-| Verified native hooks | Passive only for the lifecycle stages backed by observed hook receipts |
+| Configured native hooks | Cooperative telemetry/context only; activity is client-self-reported and coverage remains unverified |
 | `createPassiveRuntime().install()` | Only the owned Node process, and only while that runtime is installed and running |
 | Governed runner | Only the command launched through the wrapper |
 | Custom host | Requires a bounded event adapter; covers only the lifecycle events whose receipts Marrow observes |
 
-This contract is model-neutral. A model name, host header, config file, installed hook entry, or successful MCP handshake does not certify passive coverage. Only observed Marrow receipts do. An unknown MCP host therefore gets the generic `mcp-client` identity and the same on-demand tools, schemas, and API semantics as a named host.
+This contract is model-neutral. A model name, host header, API key, public hook entrypoint, config file, installed hook entry, successful MCP handshake, or client-self-reported lifecycle callback does not certify passive coverage or enforcement. An unknown MCP host therefore gets the generic `mcp-client` identity and the same on-demand tools, schemas, and API semantics as a named host.
 
 When invoked by a supported host, the configured hooks send compact classifications and lifecycle receipts. They do not need raw prompts, completions, command output, tool output, or credentials. A completed tool or session does not automatically become a successful business outcome; explicit success/failure closure is required.
 
+Setup installs distinct Claude Code and Grok hook entrypoints. The public entrypoint supplies only a client-reported display label; it is not host provenance. Hook event JSON cannot select the lifecycle harness or agent. Agent identity comes only from owner configuration when present, otherwise the request omits it so the authenticated service can derive the credential-bound identity. Every hook lifecycle event is marked `source: client_self_reported` and omits `capability_level: native_hooks`, adapter certification, configuration fingerprints, expected hooks, and observed-hook certification fields. Legacy, unknown, and custom entrypoints stay generic.
+
+Claude Code hooks may cooperatively request guidance and apply the harness permission response, but that does not certify always-on control. Grok hooks are advisory telemetry/context only: `grok-pre-action-hook` never issues, verifies, or consumes an action permit and never claims enforcement. Codex, Grok, Gemini, and similar CLI harnesses must run consequential commands through `npx @getmarrow/install run --agent <agent-id> -- -- <command>`. Unknown and custom hosts remain on demand unless they provide a bounded event adapter, whose activity is still not certification without an independent authority.
+
 Transient lifecycle receipts use a bounded owner-only spool and are retried with stable event IDs. Operators can inspect and drain it without exposing event content:
 
 ```bash

package/dist/cli.js

@@ -25,7 +25,6 @@ const hook_contract_2 = require("./hook-contract");
 const ping_state_1 = require("./ping-state");
 const control_path_state_1 = require("./control-path-state");
 const redact_1 = require("./redact");
-const runtime_contract_1 = require("./runtime-contract");
 const status_cache_1 = require("./status-cache");
 const habit_loop_copy_1 = require("./habit-loop-copy");
 const host_capability_1 = require("./host-capability");
@@ -41,16 +40,16 @@ function parseArgs() {
         if (args[i] === 'setup' || args[i] === '--setup') {
             result.setup = true;
         }
-        if (args[i] === 'hook' || args[i] === '--hook') {
+        if (['hook', '--hook', 'claude-hook', 'grok-hook'].includes(args[i])) {
             result.hook = true;
         }
-        if (args[i] === 'context-hook' || args[i] === '--context-hook') {
+        if (['context-hook', '--context-hook', 'claude-context-hook', 'grok-context-hook'].includes(args[i])) {
             result.contextHook = true;
         }
-        if (args[i] === 'pre-action-hook' || args[i] === '--pre-action-hook') {
+        if (['pre-action-hook', '--pre-action-hook', 'claude-pre-action-hook', 'grok-pre-action-hook'].includes(args[i])) {
             result.preActionHook = true;
         }
-        if (args[i] === 'session-hook' || args[i] === '--session-hook') {
+        if (['session-hook', '--session-hook', 'claude-session-hook', 'grok-session-hook'].includes(args[i])) {
             result.sessionHook = true;
         }
         if (args[i] === 'spool-status' || args[i] === '--spool-status') {
@@ -163,7 +162,7 @@ function runSetup() {
 
 Use Marrow according to the capability evidence returned by the MCP server:
 
-1. **MCP baseline is on demand:** MCP transport exposes tools; it does not provide passive hooks. Call Marrow tools explicitly unless observed receipts verify another capability mode.
+1. **MCP baseline is on demand:** MCP transport exposes tools; it does not provide passive hooks. Public hook callbacks and local configuration are client-self-reported activity, not certified coverage.
 2. **Before risky actions:** Respect the returned \`allow\`, \`warn\`, \`review_required\`, or \`block\` decision and its proof contract. Call \`marrow_agent_runtime\` explicitly when verified passive coverage cannot cover the action.
 3. **After meaningful work:** Record the real success or failure with \`marrow_commit\` or \`marrow_auto\`. A tool exit or session end is not proof that the business outcome succeeded.
 4. **Unfinished work:** Leave pending outcomes visible. Do not invent success to clear a closure item.
@@ -173,9 +172,9 @@ Use Marrow according to the capability evidence returned by the MCP server:
 
 Do not skip the gate or outcome. Marrow's value comes from controlling the action before execution and preserving evidence afterward.
 
-Capability boundaries: verified native hooks cover only their observed lifecycle; \`createPassiveRuntime().install()\` covers only its owned Node process while installed; a governed runner covers only its wrapped command; and a custom host needs a bounded event adapter. A model name, host label, or installed configuration is not proof of coverage. Only observed Marrow receipts certify it.
+Capability boundaries: configured native hooks provide cooperative telemetry or context only; \`createPassiveRuntime().install()\` covers only its owned Node process while installed; a governed wrapper covers only its wrapped command; and a custom host needs a bounded event adapter. A model name, host label, API key, public hook entrypoint, installed configuration, or client-self-reported callback is not proof of coverage or enforcement. For Codex, Grok, Gemini, and similar CLI harnesses, run consequential commands through \`npx @getmarrow/install run --agent <agent-id> -- -- <command>\`.
 
-For one-shot logging: \`marrow_auto({ action: "did X", outcome: "result Y", success: true })\` — one call, done.
+For bounded outcome capture: \`marrow_auto({ action: "did X", outcome: "result Y", success: true })\`. One outer invocation normally completes think and commit in-band within its bounded client budget. If the host or network deadline is reached, retry with the returned \`operation_id\`; Marrow continues the same operation and never opens a second decision.
 ${MARROW_BLOCK_END}`;
     let dir = process.cwd();
     let claudeMdPath = null;
@@ -218,44 +217,44 @@ ${MARROW_BLOCK_END}`;
     }
     const hookInstall = (0, hook_1.installPostToolUseHook)(process.cwd());
     if (hookInstall.installed) {
-        process.stdout.write('Configured PostToolUse hook. Coverage remains unverified until Marrow observes action-result receipts.\n');
+        process.stdout.write('Configured PostToolUse hook. Activity is client-self-reported and does not certify action-result coverage.\n');
     }
     else {
-        process.stdout.write('PostToolUse hook configuration is present. Coverage remains unverified until Marrow observes action-result receipts.\n');
+        process.stdout.write('PostToolUse hook configuration is present. Activity is client-self-reported and does not certify action-result coverage.\n');
     }
     const contextHookInstall = (0, hook_context_1.installUserPromptSubmitHook)(process.cwd());
     if (contextHookInstall.installed) {
-        process.stdout.write('Configured UserPromptSubmit hook. Passive prompt coverage remains unverified until Marrow observes prompt receipts.\n');
+        process.stdout.write('Configured UserPromptSubmit hook. Activity is client-self-reported and does not certify passive prompt coverage.\n');
     }
     else {
-        process.stdout.write('UserPromptSubmit hook configuration is present. Passive prompt coverage remains unverified until Marrow observes prompt receipts.\n');
+        process.stdout.write('UserPromptSubmit hook configuration is present. Activity is client-self-reported and does not certify passive prompt coverage.\n');
     }
     const preActionHookInstall = (0, hook_pre_action_1.installPreActionHook)(process.cwd());
     if (preActionHookInstall.installed) {
-        process.stdout.write('Configured PreToolUse hook. Pre-action coverage remains unverified until Marrow observes pre-action receipts.\n');
+        process.stdout.write('Configured PreToolUse hook. Activity is client-self-reported and does not certify pre-action control.\n');
     }
     else {
-        process.stdout.write('PreToolUse hook configuration is present. Pre-action coverage remains unverified until Marrow observes pre-action receipts.\n');
+        process.stdout.write('PreToolUse hook configuration is present. Activity is client-self-reported and does not certify pre-action control.\n');
     }
     const sessionHookInstall = (0, hook_session_1.installSessionEndHook)(process.cwd());
     if (sessionHookInstall.installed) {
-        process.stdout.write('Configured Stop hook. Session-end coverage remains unverified until Marrow observes session-end receipts.\n');
+        process.stdout.write('Configured Stop hook. Activity is client-self-reported and does not certify session-end coverage.\n');
     }
     else {
-        process.stdout.write('Stop hook configuration is present. Session-end coverage remains unverified until Marrow observes session-end receipts.\n');
+        process.stdout.write('Stop hook configuration is present. Activity is client-self-reported and does not certify session-end coverage.\n');
     }
     const grokHookInstall = (0, hook_contract_1.installGrokNativeHooks)();
     if (grokHookInstall.installed) {
-        process.stdout.write(`Configured Grok native hooks at ${grokHookInstall.settingsPath}. Coverage remains unverified until Marrow observes Grok lifecycle receipts.\n`);
+        process.stdout.write(`Configured Grok advisory hooks at ${grokHookInstall.settingsPath}. Their activity is client-self-reported and never certifies coverage or enforcement; consequential commands require npx @getmarrow/install run --agent <agent-id> -- -- <command>.\n`);
     }
     else {
-        process.stdout.write(`Grok native hook configuration is present at ${grokHookInstall.settingsPath}. Coverage remains unverified until Marrow observes Grok lifecycle receipts.\n`);
+        process.stdout.write(`Grok advisory hook configuration is present at ${grokHookInstall.settingsPath}. Its activity is client-self-reported and never certifies coverage or enforcement; consequential commands require npx @getmarrow/install run --agent <agent-id> -- -- <command>.\n`);
     }
     process.stdout.write(`Hook settings: ${hookInstall.settingsPath}\n`);
     process.stdout.write('Set MARROW_AUTO_HOOK=false to disable passive hooks.\n');
     process.stdout.write('Set MARROW_PASSIVE_BRIEF=false to disable automatic decision briefs, or MARROW_PASSIVE_BRIEF=always to brief every prompt.\n');
     process.stdout.write('Set MARROW_HOOK_DEBUG=true for write-side hook diagnostics, or MARROW_CONTEXT_HOOK_DEBUG=true for prompt-context diagnostics.\n');
-    process.stdout.write('Setup completed. MCP tools remain on demand; passive coverage is reported only after Marrow observes the required hook receipts.\n');
+    process.stdout.write('Setup completed. MCP tools remain on demand; configured hook activity is client-self-reported and does not certify passive coverage or enforcement.\n');
     process.exit(0);
 }
 const cliArgs = parseArgs();
@@ -848,13 +847,13 @@ if (process.argv[2] !== 'keys') {
             {
                 name: 'marrow_commit',
                 description: 'Close a recorded action with success/failure, a specific outcome, and required proof. ' +
-                    'decision_id may come from marrow_think, marrow_auto, or marrow_agent_runtime.runtime_authorization.id. ' +
+                    'decision_id comes from marrow_think, marrow_auto, or an arbitration runtime that actually created a decision. ' +
                     'Use the gate receipt from marrow_agent_runtime for consequential work. ' +
                     'Outcome closure is required for accountable fleet learning.',
                 inputSchema: {
                     type: 'object',
                     properties: {
-                        decision_id: { type: 'string', description: 'decision_id from marrow_think, marrow_auto, or marrow_agent_runtime.runtime_authorization.id' },
+                        decision_id: { type: 'string', description: 'decision_id from marrow_think, marrow_auto, or an arbitration runtime that created a decision' },
                         success: { type: 'boolean', description: 'Did the action succeed?' },
                         outcome: { type: 'string', description: 'What happened — be specific, this trains the hive' },
                         caused_by: { type: 'string', description: 'Optional: what caused this action' },
@@ -903,7 +902,7 @@ if (process.argv[2] !== 'keys') {
             },
             {
                 name: 'marrow_run',
-                description: 'One-call governed outcome capture. Records intent, obtains a gate for risky work, and closes only with an explicit measured result.',
+                description: 'Governed outcome capture. Records intent, obtains a gate for risky work, and closes only with an explicit measured result.',
                 inputSchema: {
                     type: 'object',
                     properties: {
@@ -923,7 +922,7 @@ if (process.argv[2] !== 'keys') {
             },
             {
                 name: 'marrow_auto',
-                description: 'Durably capture low-risk activity without blocking. Outcomes remain pending unless success is explicit; risky completion still requires a fresh gate and measured proof.',
+                description: 'Durably capture low-risk activity. One outer invocation normally completes in-band within the bounded client budget; a deadline continuation reuses the same operation_id and never opens a second decision. Outcomes remain pending unless success is explicit; risky completion still requires a fresh gate and measured proof.',
                 inputSchema: {
                     type: 'object',
                     properties: {
@@ -937,6 +936,10 @@ if (process.argv[2] !== 'keys') {
                         },
                         proof: { type: 'object', description: 'Measured completion evidence for gated work.' },
                         gate_receipt_id: { type: 'string', description: 'Fresh receipt returned by marrow_agent_runtime.' },
+                        operation_id: {
+                            type: 'string',
+                            description: 'Opaque 8-80 character resume token. Reuse it only with the original tenant, action, context, and surfaces; proof may be added after proof_required.',
+                        },
                     },
                     required: ['action'],
                 },
@@ -1768,7 +1771,7 @@ if (process.argv[2] !== 'keys') {
                             prompts: [
                                 {
                                     name: 'marrow-always-on',
-                                    description: 'Marrow control and proof contract, qualified by verified host capability and observed lifecycle receipts.',
+                                    description: 'Marrow control and proof contract. MCP tools are on demand; host activity is client-self-reported and coverage remains unverified without independent authority.',
                                     arguments: [],
                                     _meta: { host_capability: mcpHostCapability() },
                                 },
@@ -1788,7 +1791,7 @@ if (process.argv[2] !== 'keys') {
                     }
                     const hostCapability = mcpHostCapability();
                     success(id, {
-                        description: 'Marrow control and proof contract — coverage is capability-qualified and receipt-verified',
+                        description: 'Marrow control and proof contract — MCP tools are on demand, host activity is client-self-reported, and coverage is unverified without independent authority',
                         _meta: { host_capability: hostCapability },
                         messages: [
                             {
@@ -1801,12 +1804,12 @@ if (process.argv[2] !== 'keys') {
 
 ${(0, host_capability_1.hostCapabilityInstructions)(hostCapability)}
 
-When verified by observed receipts, native hooks can cover these bounded lifecycle stages:
+Configured native hooks can cooperatively report or inject context for these bounded lifecycle stages, but their callbacks are client-self-reported activity and do not certify control:
 - UserPromptSubmit can request relevant policy, warnings, lessons, and a decision brief before risky work.
 - PostToolUse can record compact tool success or failure receipts.
 - Stop can keep unfinished outcomes visible instead of silently treating session exit as success.
 
-Hooks never make a blocked action safe. Before a consequential action, respect the returned allow, warn, review_required, or block decision and its required proof. Call marrow_agent_runtime explicitly when verified passive coverage cannot cover the action.
+Hooks never make a blocked action safe and are not an external execution choke point. Before a consequential action, respect the returned allow, warn, review_required, or block decision and its required proof. For Codex, Grok, Gemini, and similar CLI harnesses, use npx @getmarrow/install run --agent <agent-id> -- -- <command>.
 
 When runtime/status returns a client_update notice, tell the operator and use its exact update and verification commands only when local change policy permits. Never silently change packages or configuration.
 
@@ -2010,35 +2013,20 @@ Marrow is not a replacement agent or a standalone memory app. Context and prior
                         const suppliedProof = args.proof && typeof args.proof === 'object' && !Array.isArray(args.proof)
                             ? (0, redact_1.redactSensitiveValue)(args.proof)
                             : undefined;
-                        let runtimeGate = null;
-                        if (highRisk) {
-                            runtimeGate = await withControlDeadline((signal) => (0, index_1.marrowAgentRuntime)(API_KEY, BASE_URL, {
-                                action: (0, redact_1.redactSensitiveText)(action),
-                                type,
-                                agent_id: FLEET_AGENT_ID,
-                                session_id: SESSION_ID,
-                                proof: suppliedProof,
-                                context: { source: 'mcp_auto_risk_upgrade' },
-                            }, SESSION_ID, FLEET_AGENT_ID, signal), { highRisk: true, toolName: 'marrow_auto.runtime' });
-                            storeRuntimeGuidance(runtimeGate);
-                        }
-                        const canonicalRuntimeReceiptId = (0, runtime_contract_1.runtimeAuthorizationReceiptId)(runtimeGate);
                         const suppliedRuntimeReceiptId = typeof args.gate_receipt_id === 'string'
                             ? args.gate_receipt_id
-                            : canonicalRuntimeReceiptId;
-                        const proofCanClose = !highRisk
-                            || (0, runtime_contract_1.highRiskRuntimeCanClose)(runtimeGate, suppliedProof, suppliedRuntimeReceiptId);
-                        const acceptedSuccess = proofCanClose ? outcomeSuccess : undefined;
+                            : undefined;
                         const delivery = () => (0, index_1.marrowAuto)(API_KEY, BASE_URL, {
                             action,
                             outcome,
-                            success: acceptedSuccess,
+                            success: outcomeSuccess,
                             type,
                             proof: suppliedProof,
                             gate_receipt_id: suppliedRuntimeReceiptId || undefined,
                             // Low-risk one-shot capture does not need a policy gate. Consequential
-                            // work already obtained and validated canonical runtime authorization.
+                            // work obtains exactly one canonical runtime authorization inside auto.
                             auto_gate: highRisk,
+                            operation_id: typeof args.operation_id === 'string' ? args.operation_id : undefined,
                         }, SESSION_ID, FLEET_AGENT_ID, 8_000);
                         let delivered = null;
                         let deliveryFailure = null;
@@ -2048,27 +2036,32 @@ Marrow is not a replacement agent or a standalone memory app. Context and prior
                         catch (err) {
                             deliveryFailure = (0, request_reliability_1.structuredRequestFailure)(err);
                         }
+                        const runtimeGate = delivered?.runtime_gate || null;
+                        if (runtimeGate)
+                            storeRuntimeGuidance(runtimeGate);
                         const receipt = await (0, lifecycle_spool_1.recordLifecycleEvent)({
                             apiKey: API_KEY,
                             baseUrl: BASE_URL,
                             deferDelivery: false,
                             event: {
+                                ...(delivered?.operation_id ? {
+                                    event_id: `auto_${delivered.committed ? 'closed' : 'pending'}_${delivered.operation_id}`,
+                                } : {}),
                                 event_type: delivered?.committed
                                     ? 'outcome_committed'
-                                    : !highRisk && acceptedSuccess === false
+                                    : !highRisk && outcomeSuccess === false
                                         ? 'tool_failed'
-                                        : !highRisk && acceptedSuccess === true
+                                        : !highRisk && outcomeSuccess === true
                                             ? 'tool_completed'
                                             : 'goal_started',
                                 harness: process.env.MARROW_CLIENT || process.env.MARROW_HARNESS || 'mcp',
                                 agent_id: FLEET_AGENT_ID,
                                 session_id: SESSION_ID,
-                                decision_id: delivered?.decision_id,
+                                decision_id: delivered?.decision_id || undefined,
                                 action,
                                 outcome_state: delivered?.committed ? 'closed' : 'pending',
-                                success: delivered?.committed ? acceptedSuccess : highRisk ? undefined : acceptedSuccess,
-                                adapter_version: hook_contract_2.MCP_ADAPTER_VERSION,
-                                capability_level: 'mcp',
+                                success: delivered?.committed ? outcomeSuccess : highRisk ? undefined : outcomeSuccess,
+                                source: 'client_self_reported',
                             },
                         });
                         const response = {
@@ -2077,20 +2070,34 @@ Marrow is not a replacement agent or a standalone memory app. Context and prior
                             warnings: cachedOrientWarnings.map(formatWarningActionably),
                             logging: delivered?.committed
                                 ? 'governed_commit_confirmed'
-                                : delivered
-                                    ? 'intent_confirmed'
-                                    : 'durably_queued',
+                                : delivered?.resumable
+                                    ? 'resume_required'
+                                    : delivered
+                                        ? 'intent_confirmed'
+                                        : 'durably_queued',
                             receipt,
                             completion_state: delivered?.committed
                                 ? 'closed_with_proof'
-                                : !proofCanClose
+                                : delivered?.phase === 'proof_required'
                                     ? 'pending_required_proof'
-                                    : outcomeSuccess === undefined
+                                    : delivered?.phase === 'decision_created' || outcomeSuccess === undefined
                                         ? 'pending_evidence'
                                         : 'delivery_pending',
                             decision_id: delivered?.decision_id || null,
+                            operation_id: delivered?.operation_id || (typeof args.operation_id === 'string' ? args.operation_id : null),
+                            phase: delivered?.phase || null,
+                            resumable: delivered?.resumable || false,
+                            retry_after_ms: delivered?.retry_after_ms ?? null,
+                            phase_timings_ms: delivered?.phase_timings_ms || null,
+                            exact_next_action: delivered?.committed
+                                ? 'The governed outcome is closed. Reuse this decision_id only for read-only trace inspection.'
+                                : delivered?.phase === 'proof_required'
+                                    ? 'Attach the required measured proof and retry marrow_auto with this same operation_id and unchanged action, context, and surfaces.'
+                                    : delivered?.resumable
+                                        ? 'Retry marrow_auto with this same operation_id. Do not start a new auto operation.'
+                                        : 'Close this decision after the real outcome is known.',
                             live_delivery: {
-                                accepted: Boolean(delivered),
+                                accepted: Boolean(delivered?.decision_id),
                                 committed: Boolean(delivered?.committed),
                                 ...(deliveryFailure ? { failure: deliveryFailure } : {}),
                             },