@getmarrow/mcp 3.9.80 → 3.9.82

package/README.md

@@ -116,7 +116,17 @@ npx -y --package=@getmarrow/mcp@latest marrow-mcp ping
 
 Detection and notification are automatic. After explicit installer activation, the local controller may restore only Marrow-managed hooks/configuration. Package upgrades, owner policy, credentials, and unrelated configuration remain explicit and subject to the operator's normal change policy.
 
-## What's New in v3.9.80
+## What's New in v3.9.82
+
+v3.9.82 batches client reliability fixes for `marrow_auto`. Continuations honor the server's finite retry delay within the existing eight-second core budget; when the delay cannot fit, the same operation remains pending with retry guidance. Gated auto reuses the server-created decision after checking its canonical scope, and ordinary owner approval can resume that decision when the backend explicitly declares the supported proof contract. The installed bytes of v3.9.81 cannot provide these client changes; update MCP for this behavior. SDK and installer versions are unchanged.
+
+Auto now durably queues its lifecycle receipt before responding and starts the existing bounded background delivery afterward. A queued receipt is not server acceptance, while `live_delivery.committed` separately reports confirmed governed closure. New numeric response timings distinguish core work, durable enqueue, and response construction. The canary preserves these measurements and distinguishes pending completion, owner approval, and missing proof from malformed responses or transport failures; an uncommitted canary still fails. These changes do not promise fixed latency or eliminate outages.
+
+### Previous release: v3.9.81
+
+v3.9.81 adds bounded structured failure evidence to the authenticated eleven-tool control-path canary. Failed runs identify the observed stage, tool, error class, timing, and completed checks without retaining credentials, customer payloads, or arbitrary error text. Protocol and write failures observed after the final response or during shutdown now fail closed; the canary's own bounded cleanup remains compatible with a successful run. The eleven live-tool requirements, client deadlines, package identity checks, and retry limits are unchanged.
+
+### Previous release: v3.9.80
 
 v3.9.80 is a reliability patch for direct `marrow_think` and `marrow_commit` calls. Each invocation now carries one stable bounded idempotency key. Only the backend's documented pending-persistence states are reconciled, using the byte-identical request and key after a fixed one-second delay for at most three total attempts. A 202 response is never reported as successful completion; unknown, malformed, correlation-drifted, or exhausted pending responses fail closed with a structured error. Explicit caller-supplied idempotency keys remain unchanged, and durable `observed_unverified` outcomes retain their terminal, non-authorizing semantics.
 
@@ -379,15 +389,21 @@ Configured hooks can provide cooperative telemetry and context, but they are not
 
 1. Call `marrow_agent_runtime` or `marrow_decision_brief`.
 2. Stop when the returned decision is `block` or `review_required`; otherwise follow its prior lesson and proof contract.
-3. Call `marrow_think` or `marrow_auto` to record intent and obtain the `decision_id` that will be closed. Keep `marrow_agent_runtime.runtime_authorization.id` separate as the gate receipt for consequential work.
+3. Reuse a server-created runtime `decision_id` when the completion contract identifies it. Call `marrow_think` or `marrow_auto` when decision creation is still required. Keep `marrow_agent_runtime.runtime_authorization.id` separate as the gate receipt for consequential work.
 4. Perform the action only when its gate allows it. Codex, Grok, and Gemini use configured native hooks only after restart and host hook review. The governed wrapper remains an explicit bounded fallback: `npx @getmarrow/install run --agent <agent-id> -- -- <command>`.
 5. Call `marrow_commit` with that `decision_id`, the outcome, gate receipt, and required proof.
 
-`marrow_agent_runtime` returns `runtime_authorization` with the authoritative gate receipt. Ordinary runtime checks do not create a decision, so they omit `decision_id`; call `marrow_think` (or use `marrow_auto`) when a decision must be created and closed. An arbitration runtime that actually creates a decision returns that server-created `decision_id`. This contract is identical across MCP-compatible hosts and SDK-owned runtimes.
+`marrow_agent_runtime` returns `runtime_authorization` with the authoritative gate receipt. An ordinary or arbitrated runtime that creates a decision also returns its server-created `decision_id`; follow `completion_contract.decision_creation_required` and preserve the returned scope. When decision creation is required, call `marrow_think` or use `marrow_auto`. Auto requests the existing expanded runtime response to check receipt identity, decision, action, agent, session, and expiry before reusing that decision; it does not obtain a second authorization fetch.
 
 A `review_required`, `block`, or `outcome_observation_only` result never permits the action. If the action already occurred and its real result must be preserved, `marrow_commit` can ask runtime to bind observation delivery to the existing decision, action, session, and agent. The exact backend `outcome_observation_only` correlation is non-durable and non-authorizing, so MCP never sends it as a gate, arbitration, or owner-approval receipt. An accepted observation reports `committed: false`, `outcome_state: "observed_unverified"`, `authorization_granted: false`, and `trusted_learning_applied: false`, plus the backend's `exact_next_action`. This is durable delivery, so do not retry or spool the same observation. To promote it into trusted learning, obtain the named authorization and proof, then make an explicit new commit attempt using the exact observed payload. Never synthesize a decision, receipt, approval, or authorization.
 
-`marrow_auto` returns an `operation_id`, phase, and resumable state. If a client deadline is reached before closure, retry with the same `operation_id`; Marrow reuses the same tenant-scoped runtime authorization, decision, and commit idempotency keys instead of opening another decision. When the phase is `proof_required`, add the requested proof and retry with that same operation ID and unchanged action/context/surfaces. An arbitrated runtime binds the operation directly to the arbitration response's server-created `decision_id`; `marrow_auto` does not open a separate decision. When an arbitrated result returns `owner_approval_required`, do not retry proof: approve that exact arbitration decision in an authenticated Marrow dashboard, then call `marrow_auto` once with the same operation ID, `arbitration_receipt_id`, and server-issued `owner_approval_receipt_id`. A non-arbitrated `review_required` result is terminal for that operation because the backend cannot issue a compatible dashboard receipt; start a new supported `marrow_arbitrate` review instead. Chat or proof text is never an approval receipt. Proof and receipts are validated and bound at commit; changing the tenant or action scope is rejected. A closed response reports `phase: "closed"`, `committed: true`, and `resumable: false`.
+`marrow_auto` returns an `operation_id`, phase, and resumable state. For a resumable pending phase, respect `retry_after_ms` and use the same operation ID and unchanged scope; auto never shortens the requested finite delay to fit its core budget. When the phase is `proof_required`, supply the requested measured evidence before retrying that operation. Stable phase idempotency keys preserve the original decision and outcome across retries; the backend remains authoritative for acceptance and conflicts.
+
+For an ordinary gate, continue only when the server declares `completion_contract.owner_approval.mode: "ordinary_non_arbitrated"`. Auto waits in `owner_approval_required` until the caller actually obtains explicit owner approval for the exact work and supplies `proof.owner_approval = { approved_by: "owner", reference: "approved-release-bundle" }` together with required measured proof. Then call auto once with the same operation ID and original decision/receipt scope. The object records actual approval; it is not permission to infer approval from action text, a model response, or `human_directed`. Unknown ordinary completion contracts remain stopped without automatically starting arbitration. The backend checks receipt ownership, scope, expiry, and proof before confirming closure.
+
+For arbitration, the ordinary proof marker is not accepted. Approve the exact arbitration decision in the authenticated Marrow dashboard, then call auto with the same operation ID, `arbitration_receipt_id`, and server-issued `owner_approval_receipt_id`. Proof or chat text cannot substitute for this dashboard receipt. A CLI closed response reports `phase: "closed"`, `live_delivery.committed: true`, and `resumable: false`; the library result uses `committed: true`. Neither an ordinary marker nor an outcome record changes a stopped action into an allowed action.
+
+The CLI's lifecycle `receipt.queued: true` means its stable event is stored locally for later bounded delivery; `receipt.accepted: false` must not be read as server acceptance. Process exit can interrupt the background nudge, leaving the event for a later run. `phase_timings_ms.total` measures core auto phases. `response_timings_ms` contains numeric `core`, `durable_enqueue`, and `full_response`; the last ends at response construction and excludes subsequent stdout drain and host processing. Canary `latency_ms` independently measures the MCP round trip, while `attempts` and `retry_wait_ms` describe measured outer tool retries, not internal database or network calls.
 
 Example pre-action request:
 

package/dist/cli.js

@@ -850,14 +850,14 @@ if (process.argv[2] !== 'keys') {
             {
                 name: 'marrow_commit',
                 description: 'Close a recorded action with success/failure, a specific outcome, and required proof. ' +
-                    'decision_id comes from marrow_think, marrow_auto, or an arbitration runtime that actually created a decision. ' +
+                    'decision_id comes from marrow_think, marrow_auto, or a runtime that actually created a decision. ' +
                     'Use the gate receipt from marrow_agent_runtime for consequential work. ' +
                     'The exact non-authorizing outcome_observation_only runtime correlation may submit an observed_unverified result, but is never sent as receipt evidence and never authorizes action or trusted learning. ' +
                     'Only committed:true closes trusted outcome learning.',
                 inputSchema: {
                     type: 'object',
                     properties: {
-                        decision_id: { type: 'string', description: 'decision_id from marrow_think, marrow_auto, or an arbitration runtime that created a decision' },
+                        decision_id: { type: 'string', description: 'decision_id from marrow_think, marrow_auto, or a runtime that created a decision' },
                         success: { type: 'boolean', description: 'Did the action succeed?' },
                         outcome: { type: 'string', description: 'What happened — be specific, this trains the hive' },
                         caused_by: { type: 'string', description: 'Optional: what caused this action' },
@@ -926,7 +926,7 @@ if (process.argv[2] !== 'keys') {
             },
             {
                 name: 'marrow_auto',
-                description: 'Durably capture low-risk activity. One outer invocation normally completes in-band within the bounded client budget; a deadline continuation reuses the same operation_id and never opens a second decision. Outcomes remain pending unless success is explicit; risky completion still requires a fresh gate and measured proof.',
+                description: 'Durably capture activity with bounded core completion. Respect retry_after_ms and reuse operation_id for pending continuation. Server-declared ordinary approval requires actual owner approval supplied in proof; arbitration requires its dashboard receipt. Lifecycle receipt queued is separate from server acceptance. Risky completion requires a fresh gate and measured proof.',
                 inputSchema: {
                     type: 'object',
                     properties: {
@@ -1285,7 +1285,7 @@ if (process.argv[2] !== 'keys') {
                 description: 'One-call agent-native Marrow loop. Returns passive status, decision brief, risk gate, relevant lessons, ' +
                     'template suggestion, required proof pack, before-you-act instruction, and exact next action. ' +
                     'Its runtime_authorization is the authoritative gate receipt; it returns decision_id only when runtime actually creates a decision. ' +
-                    'Use marrow_auto or marrow_think to create the decision_id required for outcome closure. ' +
+                    'Reuse its server-created decision_id for outcome closure; use marrow_auto or marrow_think only when the completion contract requires decision creation. ' +
                     'Use this before meaningful work when you want Marrow to guide the whole action in one call.',
                 inputSchema: {
                     type: 'object',
@@ -1920,6 +1920,7 @@ if (process.argv[2] !== 'keys') {
         // Request handler
         async function handleRequest(req) {
             const { id, method, params } = req;
+            const responseStartedAt = performance.now();
             // [FIX #15] Enforce initialize-first per MCP spec
             if (!initialized && method !== 'initialize') {
                 error(id, -32002, 'Server not initialized. Send initialize first.');
@@ -2234,19 +2235,22 @@ Marrow is not a replacement agent or a standalone memory app. Context and prior
                         }, SESSION_ID, FLEET_AGENT_ID, 8_000);
                         let delivered = null;
                         let deliveryFailure = null;
+                        const coreStartedAt = performance.now();
                         try {
                             delivered = await delivery();
                         }
                         catch (err) {
                             deliveryFailure = (0, request_reliability_1.structuredRequestFailure)(err);
                         }
+                        const coreDurationMs = Math.floor(performance.now() - coreStartedAt);
                         const runtimeGate = delivered?.runtime_gate || null;
                         if (runtimeGate)
                             storeRuntimeGuidance(runtimeGate);
+                        const enqueueStartedAt = performance.now();
                         const receipt = await (0, lifecycle_spool_1.recordLifecycleEvent)({
                             apiKey: API_KEY,
                             baseUrl: BASE_URL,
-                            deferDelivery: false,
+                            deferDelivery: true,
                             event: {
                                 ...(delivered?.operation_id ? {
                                     event_id: `auto_${delivered.committed ? 'closed' : 'pending'}_${delivered.operation_id}`,
@@ -2268,6 +2272,7 @@ Marrow is not a replacement agent or a standalone memory app. Context and prior
                                 source: 'client_self_reported',
                             },
                         });
+                        const enqueueDurationMs = Math.floor(performance.now() - enqueueStartedAt);
                         const response = {
                             action,
                             outcome: outcome || 'pending',
@@ -2317,9 +2322,19 @@ Marrow is not a replacement agent or a standalone memory app. Context and prior
                             client_update: (0, request_reliability_1.localClientUpdate)(),
                             ...(runtimeGate ? { runtime_gate: runtimeGate } : {}),
                         };
+                        // Measure through response construction; stdout/host consumption occurs
+                        // after this snapshot and is not represented as server phase latency.
+                        response.response_timings_ms = {
+                            core: coreDurationMs,
+                            durable_enqueue: enqueueDurationMs,
+                            full_response: Math.floor(performance.now() - responseStartedAt),
+                        };
                         success(id, {
                             content: [{ type: 'text', text: JSON.stringify(response, null, 2) }],
                         });
+                        // The existing bounded owner handles rejection and preserves queued
+                        // receipts across exit/restart. Network work never holds this response.
+                        void (0, lifecycle_spool_1.nudgeLifecycleSpool)({ apiKey: API_KEY, baseUrl: BASE_URL, agentId: FLEET_AGENT_ID });
                         return;
                     }
                     if (toolName === 'marrow_ask') {