@getmarrow/mcp 3.9.77 → 3.9.79

package/README.md

@@ -116,7 +116,15 @@ npx -y --package=@getmarrow/mcp@latest marrow-mcp ping
 
 Detection and notification are automatic. After explicit installer activation, the local controller may restore only Marrow-managed hooks/configuration. Package upgrades, owner policy, credentials, and unrelated configuration remain explicit and subject to the operator's normal change policy.
 
-## What's New in v3.9.77
+## What's New in v3.9.79
+
+v3.9.79 aligns `marrow_replay_compare` with the production replay contract. Its public MCP schema now exposes two exclusive modes: fetch an existing comparison with `comparison_id`, or create one with `source_decision_id`, `baseline.decision_id`, and `candidate.decision_id`. Empty, incomplete, mixed-mode, blank-ID, unsafe-ID, same-decision, and undeclared content-bearing fields fail locally before any request, while comparison fetches and valid distinct-decision comparisons keep their existing behavior. Outbound baseline and candidate references contain only validated decision IDs and optional privacy-safe identifier labels. Replay comparison still uses only already-recorded durable evidence and never runs a model or replays customer content. This release requires SDK `^3.7.62`, keeping the active MCP dependency floor aligned with the current SDK release.
+
+## Previous: v3.9.78
+
+v3.9.78 separates durable post-action observation from action authorization. For outcome closure only, `marrow_commit` sends the existing `decision_id` to runtime and can use the backend's exact `outcome_observation_only` response to submit the already-completed result without forwarding its non-durable correlation ID as receipt evidence. That response never permits an action: it has `allow: false`, `durable: false`, and no authorization. The accepted result remains `committed: false`, `outcome_state: "observed_unverified"`, `authorization_granted: false`, and `trusted_learning_applied: false`; it is terminal delivery and is not retried from the local queue. Trusted promotion requires an explicit new commit attempt with the backend-required authorization and proof for the exact observed payload. Missing, malformed, conflicting, or cross-scope runtime truth still fails closed, and privacy-unsafe `instruction_ref` values such as dates and long numeric IDs now fail locally before any network call.
+
+## Previous: v3.9.77
 
 v3.9.77 makes `primary` the ordinary MCP profile when `MARROW_TOOL_PROFILE` is unset. The default surface now matches the 17 documented Primary MCP Tools, while explicit `core` preserves the seven-tool control loop and explicit `full` preserves the complete catalog. Invalid values fail with an exact bounded repair instead of broadening visibility. Status responses report the effective profile, visible names/count, and fresh backend-projected entitlement states when provided; local visibility and cached evidence never authorize access. The exact-version 11-tool control-path canary remains pinned to `full`.
 
@@ -373,6 +381,8 @@ Configured hooks can provide cooperative telemetry and context, but they are not
 
 `marrow_agent_runtime` returns `runtime_authorization` with the authoritative gate receipt. Ordinary runtime checks do not create a decision, so they omit `decision_id`; call `marrow_think` (or use `marrow_auto`) when a decision must be created and closed. An arbitration runtime that actually creates a decision returns that server-created `decision_id`. This contract is identical across MCP-compatible hosts and SDK-owned runtimes.
 
+A `review_required`, `block`, or `outcome_observation_only` result never permits the action. If the action already occurred and its real result must be preserved, `marrow_commit` can ask runtime to bind observation delivery to the existing decision, action, session, and agent. The exact backend `outcome_observation_only` correlation is non-durable and non-authorizing, so MCP never sends it as a gate, arbitration, or owner-approval receipt. An accepted observation reports `committed: false`, `outcome_state: "observed_unverified"`, `authorization_granted: false`, and `trusted_learning_applied: false`, plus the backend's `exact_next_action`. This is durable delivery, so do not retry or spool the same observation. To promote it into trusted learning, obtain the named authorization and proof, then make an explicit new commit attempt using the exact observed payload. Never synthesize a decision, receipt, approval, or authorization.
+
 `marrow_auto` returns an `operation_id`, phase, and resumable state. If a client deadline is reached before closure, retry with the same `operation_id`; Marrow reuses the same tenant-scoped runtime authorization, decision, and commit idempotency keys instead of opening another decision. When the phase is `proof_required`, add the requested proof and retry with that same operation ID and unchanged action/context/surfaces. An arbitrated runtime binds the operation directly to the arbitration response's server-created `decision_id`; `marrow_auto` does not open a separate decision. When an arbitrated result returns `owner_approval_required`, do not retry proof: approve that exact arbitration decision in an authenticated Marrow dashboard, then call `marrow_auto` once with the same operation ID, `arbitration_receipt_id`, and server-issued `owner_approval_receipt_id`. A non-arbitrated `review_required` result is terminal for that operation because the backend cannot issue a compatible dashboard receipt; start a new supported `marrow_arbitrate` review instead. Chat or proof text is never an approval receipt. Proof and receipts are validated and bound at commit; changing the tenant or action scope is rejected. A closed response reports `phase: "closed"`, `committed: true`, and `resumable: false`.
 
 Example pre-action request:

package/dist/cli.js

@@ -841,7 +841,7 @@ if (process.argv[2] !== 'keys') {
                             description: 'Optional provenance source. Defaults to agent_autonomous for MCP calls.',
                         },
                         human_directed: { type: 'boolean', description: 'True only when the action is directly requested by the owner/user.' },
-                        instruction_ref: { type: 'string', description: 'Optional opaque non-PII instruction reference.' },
+                        instruction_ref: { type: 'string', description: 'Optional privacy-safe opaque reference. Dates, long digit runs, provider IDs, addresses, and domains are rejected locally; valid values are preserved exactly.' },
                         source_meta: { type: 'object', description: 'Optional provenance metadata. PII and raw provider IDs are rejected by the API.' },
                     },
                     required: ['action'],
@@ -852,7 +852,8 @@ if (process.argv[2] !== 'keys') {
                 description: 'Close a recorded action with success/failure, a specific outcome, and required proof. ' +
                     'decision_id comes from marrow_think, marrow_auto, or an arbitration runtime that actually created a decision. ' +
                     'Use the gate receipt from marrow_agent_runtime for consequential work. ' +
-                    'Outcome closure is required for accountable fleet learning.',
+                    'The exact non-authorizing outcome_observation_only runtime correlation may submit an observed_unverified result, but is never sent as receipt evidence and never authorizes action or trusted learning. ' +
+                    'Only committed:true closes trusted outcome learning.',
                 inputSchema: {
                     type: 'object',
                     properties: {
@@ -870,7 +871,7 @@ if (process.argv[2] !== 'keys') {
                         action: { type: 'string', description: 'Optional original action. If provided and gate_receipt_id is omitted, MCP can fetch a matching runtime gate receipt before commit.' },
                         type: { type: 'string', description: 'Optional original action type for auto gate lookup, e.g. deploy, publish, merge, handoff, implementation.' },
                         surfaces: { type: 'array', items: { type: 'string' }, description: 'Optional surfaces for auto gate receipt, e.g. github, cloudflare, npm, production.' },
-                        auto_gate: { type: 'boolean', description: 'If true/default and action is provided, call marrow_agent_runtime to obtain gate_receipt_id before commit.' },
+                        auto_gate: { type: 'boolean', description: 'If true/default and action is provided, fetch runtime truth bound to this existing decision. Authorizing receipts preserve normal closure; exact outcome_observation_only correlation can submit only an observed_unverified result and is omitted from receipt evidence.' },
                         model_usage: { type: 'object', description: 'Optional compact token/cost/latency counts. Do not include raw prompts or completions.' },
                     },
                     required: ['decision_id', 'success', 'outcome'],
@@ -1397,10 +1398,17 @@ if (process.argv[2] !== 'keys') {
                     'This does not run a model or replay customer content; it returns complete or insufficient_evidence.',
                 inputSchema: {
                     type: 'object',
+                    additionalProperties: false,
                     properties: {
-                        comparison_id: { type: 'string', description: 'Fetch a prior replay comparison by id.' },
-                        source_decision_id: { type: 'string', description: 'Original task decision used to bind the comparison.' },
-                        workspace_binding_id: { type: 'string', description: 'Optional privacy-safe workspace binding from runtime.' },
+                        comparison_id: { type: 'string', minLength: 1, description: 'Fetch a prior replay comparison by id.' },
+                        source_decision_id: {
+                            type: 'string', minLength: 1, maxLength: 128, pattern: '^[A-Za-z0-9._:-]{1,128}$',
+                            description: 'Original task decision used to bind the comparison.',
+                        },
+                        workspace_binding_id: {
+                            type: 'string', minLength: 34, maxLength: 34, pattern: '^workspace_[a-f0-9]{24}$',
+                            description: 'Optional privacy-safe workspace binding from runtime.',
+                        },
                         constraints: {
                             type: 'object',
                             additionalProperties: false,
@@ -1418,16 +1426,43 @@ if (process.argv[2] !== 'keys') {
                         },
                         baseline: {
                             type: 'object',
-                            properties: { label: { type: 'string' }, decision_id: { type: 'string' } },
+                            additionalProperties: false,
+                            maxProperties: 2,
+                            properties: {
+                                label: { type: 'string', minLength: 1, maxLength: 80, pattern: '^[A-Za-z0-9._:-]{1,80}$' },
+                                decision_id: { type: 'string', minLength: 1, maxLength: 128, pattern: '^[A-Za-z0-9._:-]{1,128}$' },
+                            },
                             required: ['decision_id'],
                         },
                         candidate: {
                             type: 'object',
-                            properties: { label: { type: 'string' }, decision_id: { type: 'string' } },
+                            additionalProperties: false,
+                            maxProperties: 2,
+                            properties: {
+                                label: { type: 'string', minLength: 1, maxLength: 80, pattern: '^[A-Za-z0-9._:-]{1,80}$' },
+                                decision_id: { type: 'string', minLength: 1, maxLength: 128, pattern: '^[A-Za-z0-9._:-]{1,128}$' },
+                            },
                             required: ['decision_id'],
                         },
                     },
-                    required: [],
+                    oneOf: [
+                        {
+                            required: ['comparison_id'],
+                            not: {
+                                anyOf: [
+                                    { required: ['source_decision_id'] },
+                                    { required: ['workspace_binding_id'] },
+                                    { required: ['constraints'] },
+                                    { required: ['baseline'] },
+                                    { required: ['candidate'] },
+                                ],
+                            },
+                        },
+                        {
+                            required: ['source_decision_id', 'baseline', 'candidate'],
+                            not: { required: ['comparison_id'] },
+                        },
+                    ],
                 },
             },
             {