@getmarrow/mcp 3.9.83 → 3.9.84

package/README.md

@@ -124,15 +124,21 @@ npx -y --package=@getmarrow/mcp@latest marrow-mcp ping
 
 Detection and notification are automatic. After explicit installer activation, the local controller may restore only Marrow-managed hooks/configuration. Package upgrades, owner policy, credentials, and unrelated configuration remain explicit and subject to the operator's normal change policy.
 
-## What's New in v3.9.83
+## Pending write recovery
 
-v3.9.83 confirms pending automatic writes by replaying the same authenticated operation and request, with one retry owner and a four-second attempt ceiling inside the unchanged eight-second total budget. Numeric and date-based server retry delays are preserved. Conflicting receipts never confirm closure, and unavailable or unverified results remain pending.
+A direct `marrow_think` can receive a durable pending response before the backend can safely expose a decision ID. The client recognizes the explicit `agent_write_reconciliation.v1` think contract and the corresponding current legacy pending shapes. It retries the identical authenticated request with the original idempotency key, agent and session, at most three reconciliation rounds with the existing one-second wait between rounds. Each round retains up to two transport attempts for retryable failures, so one invocation can send up to six HTTP requests, all with the same key and body. It never creates a placeholder decision or starts an automatic operation to recover a direct think call. Unknown states, conflicting keys and unsafe responses fail closed; exhaustion returns a retryable structured `pending_receipt` with `committed:false`, the original `idempotency_key`, and `request_hash`. To resume manually, pass both fields to `marrow_think` with the same arguments, credentials, agent and session. The hash binds that exact canonical request and scope; drift is rejected before sending. No prompt, credential, or raw scope is included in the receipt. Caller keys must be privacy-safe opaque identifiers.
 
-Post-action commit lookup now preserves the original general/empty-surface defaults and optional explicit target. It remains observation-only. Receipt expiry uses an explicit normal runtime request for the original scope, followed by a separate verified commit; it does not extend the old receipt or grant retrospective permission. Transient lifecycle delivery retries preserve the queued event and its stable identity across restart within bounded scheduling and attempt limits. Queued, server-accepted, and committed remain separate facts.
+A saved `observed_unverified` outcome is terminal observation evidence, not a committed outcome. Receipt expiry cannot retroactively authorize completed work. Preserve the original decision, receipt, proof and key; an already authorized durable checkpoint may finish through its existing exact recovery path. Do not repeat the action merely to obtain a fresh receipt.
+
+## What's New in v3.9.84
+
+v3.9.84 adds bounded direct-think recovery without inventing a decision ID, and an exact scoped pending receipt for manual continuation. Saved unverified observations remain terminal untrusted evidence. It also preserves confirmation of pending automatic writes by replaying the same authenticated operation and request, with one retry owner and a four-second attempt ceiling inside the unchanged eight-second total budget. Numeric and date-based server retry delays are preserved. Conflicting receipts never confirm closure, and unavailable or unverified results remain pending.
+
+Post-action commit lookup now preserves the original general/empty-surface defaults and optional explicit target. It remains observation-only. Receipt expiry retains unverified observation evidence unless an existing historically authorized checkpoint supports exact recovery; it does not extend the old receipt or grant retrospective permission. Transient lifecycle delivery retries preserve the queued event and its stable identity across restart within bounded scheduling and attempt limits. Queued, server-accepted, and committed remain separate facts.
 
 Before upgrading, finish existing pending auto operations with their current verified client. Older auto requests omitted supplied surfaces from think; correcting nonempty surfaces can therefore expose an idempotency conflict for that old operation. Do not reinterpret the conflict, open a replacement operation, use a silent legacy fallback, or automatically downgrade. Omitted/empty surface operations preserve their original canonical scope. This is a scope-correctness change, not a promise that every pending old-client operation can resume across an upgrade.
 
-Default primary guidance uses runtime followed by commit and exposes exactly 17 tools. Auto remains available in explicitly selected core/full profiles. SDK `3.7.62` and installer `0.1.56` are unchanged; install MCP `3.9.83`, reload the host, review hook trust, and verify before claiming the updated client is active.
+Default primary guidance uses runtime followed by commit and exposes exactly 17 tools. Auto remains available in explicitly selected core/full profiles. SDK `3.7.62` and installer `0.1.56` are unchanged; install MCP `3.9.84`, reload the host, review hook trust, and verify before claiming the updated client is active.
 
 ### Previous release: v3.9.82
 
@@ -146,7 +152,7 @@ v3.9.81 adds bounded structured failure evidence to the authenticated eleven-too
 
 ### Previous release: v3.9.80
 
-v3.9.80 is a reliability patch for direct `marrow_think` and `marrow_commit` calls. Each invocation now carries one stable bounded idempotency key. Only the backend's documented pending-persistence states are reconciled, using the byte-identical request and key after a fixed one-second delay for at most three total attempts. A 202 response is never reported as successful completion; unknown, malformed, correlation-drifted, or exhausted pending responses fail closed with a structured error. Explicit caller-supplied idempotency keys remain unchanged, and durable `observed_unverified` outcomes retain their terminal, non-authorizing semantics.
+v3.9.80 is a reliability patch for direct `marrow_think` and `marrow_commit` calls. Each invocation now carries one stable bounded idempotency key. Only the backend's documented pending-persistence states are reconciled, using the byte-identical request and key after a fixed one-second delay for at most three reconciliation rounds. The existing transport layer permits up to two attempts per round, for up to six HTTP requests with the same key and body. A 202 response is never reported as successful completion; unknown, malformed, correlation-drifted, or exhausted pending responses fail closed with a structured error. Explicit caller-supplied idempotency keys remain unchanged, and durable `observed_unverified` outcomes retain their terminal, non-authorizing semantics.
 
 ### Previous release: v3.9.79
 

package/dist/cli.js

@@ -177,7 +177,7 @@ Capability boundaries: configured native hooks provide cooperative client-report
 
 With MARROW_TOOL_PROFILE unset, use the 17-tool primary runtime → commit flow. Reuse runtime.decision_id when its completion_contract identifies a created decision; keep runtime.runtime_authorization.id separate as gate_receipt_id. Use marrow_think only when decision creation is required. Explicit core/full profiles also expose marrow_auto: continue a pending response only after retry_after_ms with the same operation_id and unchanged scope, outcome, proof, and receipts. Only committed:true confirms closure; queued lifecycle delivery is separate.
 
-For an expired receipt on a still-open decision, explicitly request normal runtime with the original scope and a fresh request key, verify the returned decision_id, and follow the current proof/approval contract. Post-action auto_gate is observation-only and cannot renew permission. Fresh receipts never retrospectively authorize earlier work.
+For an expired receipt, preserve the original decision, proof and idempotency key. Only an existing historically authorized checkpoint can support exact recovery. Otherwise an accepted observed_unverified result is terminal untrusted evidence: do not repeat the action, create a new decision, or renew permission retrospectively. Only committed:true confirms trusted learning.
 
 After authorized setup via \`npx -y --package=@getmarrow/mcp@latest marrow-mcp setup\`, reload the host, review/enable hook trust, then run \`npx -y @getmarrow/install@latest doctor --self-test\`. Configuration alone does not prove runtime coverage; empty savings remain zero until observed usage exists.
 ${MARROW_BLOCK_END}`;
@@ -828,6 +828,8 @@ if (process.argv[2] !== 'keys') {
                 inputSchema: {
                     type: 'object',
                     properties: {
+                        idempotency_key: { type: 'string', description: 'Original privacy-safe pending receipt key when resuming the identical think request.' },
+                        request_hash: { type: 'string', description: 'Pending receipt request_hash; validates unchanged arguments, credentials, agent and session before resuming.' },
                         action: { type: 'string', description: 'What the agent is about to do' },
                         type: {
                             type: 'string',
@@ -2088,7 +2090,7 @@ Marrow is not a replacement agent or a standalone memory app. Context and prior
                             human_directed: args.human_directed,
                             instruction_ref: args.instruction_ref,
                             source_meta: args.source_meta,
-                        }, SESSION_ID, FLEET_AGENT_ID);
+                        }, SESSION_ID, FLEET_AGENT_ID, undefined, { idempotencyKey: args.idempotency_key, requestHash: args.request_hash });
                         // Refresh orient warnings every 5th think call
                         thinkCallCount++;
                         if (thinkCallCount % 5 === 0) {