@ggui-ai/protocol-conformance 0.24.0 → 0.25.0

package/README.md

@@ -58,7 +58,7 @@ Each catalog ships its cases as raw JSON so a non-TypeScript implementer can gra
 - **`@ggui-ai/protocol-conformance/resolution-conformance`** — which bundle + style URLs the server MUST compute for a gadget descriptor's transport fields (`bundleHost` precedence, default host, loopback `http` scheme).
 - **`@ggui-ai/protocol-conformance/binding-conformance`** — which MCP tool-binding set a manifest resolves to (a declared `mcpTools` list wins entirely; blueprints without it derive bare tool-name entries from contract tool names) and which artifacts the registry `tool=` / `server=` search filters MUST match (SPEC §7.7.4.1).
 - **`@ggui-ai/protocol-conformance/props-schema-conformance`** — the schema-precise render arbiter (SPEC §2.3.2): the enforced-props-schema builder (drift), its RFC 8785 sha256 hash, the grammar-safe profile verdict, and returned-schema AUTHORITY (sample validity under the case's own `propsSchema`, including the 2026-08-19 out-of-vocabulary enum incident pinned as a permanent sample).
-- **`@ggui-ai/protocol-conformance/host-helper-conformance`** — grades a HOST-HELPER library (what mounts a ggui view and answers the MCP Apps bridge) through a JSON-RPC port the implementer supplies: a well-formed `ui/initialize` (H1), truthful capability advertisement (H2: an advertised `serverTools` answers `tools/call`, an advertised `serverResources` answers `resources/read`), honest and bounded refusals (H3/H4), and an unmodified `tools/call` relay (R1/R2), plus optional chrome (C1) and theme-coverage (T1) grades. The scorecard names a tier: `relaying`, `read-only` (a legal grade), or `nonconforming`. Runner: `runHostHelperConformance(port)`.
+- **`@ggui-ai/protocol-conformance/host-helper-conformance`** — grades a HOST-HELPER library (what mounts a ggui view and answers the MCP Apps bridge) through a JSON-RPC port the implementer supplies: a well-formed `ui/initialize` (H1), truthful capability advertisement (H2: an advertised `serverTools` answers `tools/call`, an advertised `serverResources` answers `resources/read`), honest and bounded refusals (H3/H4), and an unmodified `tools/call` relay (R1/R2), plus optional chrome (C1), theme-coverage (T1) and model-tool-set (M1 — the host's own visibility filter graded against `toolVisibleToModel`: withhold the app-only `ggui_runtime_*` tools, keep every model-visible one; ggui#1414) grades. The scorecard names a tier: `relaying`, `read-only` (a legal grade), or `nonconforming`. Runner: `runHostHelperConformance(port)`.
 - **`@ggui-ai/protocol-conformance/refusal-envelope-conformance`** — the tool result a server MUST project for a PRE-GENERATION refusal (SPEC §7.1's refused arm): an in-result `isError` (never a throw), `content[0].text` leading with the code, `structuredContent` carrying `{outcome: 'refused', refusal}` and nothing else, no `_meta` — and no envelope at all for a registered code whose surfaces exclude the render gate.
 - **`@ggui-ai/protocol-conformance/registry-completeness`** — the structural obligations a deployment's closed refusal-code registry MUST satisfy: `surfaces` non-empty, `code === key`, every `after-fix` entry naming who acts (`fixBy`), and `retry` inside the closed four-value set. Grades DATA rather than a function — the caller passes their registry.
 - **`@ggui-ai/protocol-conformance/transport-refusal-conformance`** — the JSON-RPC error a per-app MCP endpoint MUST answer with when it refuses a request for a typed reason (SPEC §7.1's endpoint-level refusal, ggui#825): HTTP 403 with `{ code: -32003, message: 'App not found', data: { refusal } }`, where `refusal` is the registry projection without the render-only fields (`code`, `message`, `fix`, `retry`) — and no envelope at all for a registered code whose surfaces exclude `mcp-endpoint` (an untyped authorization failure answers 403 with `-32007` and no `data`, by contract — ggui#836). Runner: `runTransportRefusalConformance(project)`; folded into `runConformance()` via `transportRefusalProjector`.

package/dist/host-helper-conformance/index.d.ts

@@ -60,10 +60,20 @@
  *   reference validate is `@ggui-ai/design`'s `validateThemeCoverage`
  *   bound to the shipped `consumed-tokens.manifest.json` tokens.
  *
+ * - `M1-model-tool-set` — OPTIONAL like T1, graded when the host supplies
+ *   the filter it uses to derive the MODEL's tool list from a served
+ *   `tools/list` (ggui#1414): the result must withhold every tool whose
+ *   `_meta.ui.visibility` lacks `'model'` (ggui's six `ggui_runtime_*`
+ *   app-only tools) and keep every other tool. SEP-1865 assigns this door
+ *   to the host, and the server cannot observe a violation — a
+ *   view-issued and a model-issued call are indistinguishable on the wire
+ *   — so the kit is where a host proves it. Absent ⇒ `skip`.
+ *
  * A helper that refuses the relay honestly is graded **tier
  * `read-only`** — a LEGAL grade, with the R cases skipped, never
  * failed. `nonconforming` means a dishonesty case failed.
  */
+import { type McpAppsToolVisibility } from '@ggui-ai/protocol/integrations/mcp-apps';
 /** Minimal JSON-RPC request the driver sends through the port. */
 export interface JsonRpcRequest {
     readonly jsonrpc: '2.0';
@@ -144,6 +154,41 @@ export interface ThemeCoverageOptions {
     readonly registration: unknown;
     readonly validate: (registration: unknown) => ThemeCoverageValidationResult;
 }
+/**
+ * A tool as a host sees it on a served `tools/list` — the two fields the
+ * visibility door reads. Nothing else on a tool declaration decides who may
+ * call it.
+ */
+export interface ServedToolDeclaration {
+    readonly name: string;
+    readonly _meta?: {
+        readonly ui?: {
+            readonly visibility?: readonly McpAppsToolVisibility[];
+        };
+    };
+}
+/** The M1 grade's input: the host's own model-facing filter. */
+export interface ModelToolSetOptions {
+    /**
+     * The function the host uses to derive the MODEL's tool list from a
+     * served `tools/list` (names only). The kit feeds
+     * {@link MODEL_TOOL_SET_FIXTURE} and grades the result against
+     * `toolVisibleToModel`.
+     */
+    readonly offeredToModel: (served: readonly ServedToolDeclaration[]) => readonly string[];
+}
+/**
+ * A served-equivalent shape the M1 grade feeds a host's filter (ggui#1414):
+ * agent tools as ggui declares them — `ggui_render` and `ggui_update` stamp
+ * `visibility: ['model']`, the others carry no marker (the spec's default)
+ * — and ggui's six app-only `ggui_runtime_*` tools. The list is static and
+ * the names are the protocol's own, so it grades the FILTER a host applies,
+ * never the host's live `tools/list`: a host that filters by name rather
+ * than by visibility passes only as long as this list matches what its
+ * server lists, which is why the grade wants the filter and the SPEC
+ * points at the predicate.
+ */
+export declare const MODEL_TOOL_SET_FIXTURE: readonly ServedToolDeclaration[];
 export interface HostHelperConformanceOptions {
     /**
      * How long a refusal may take before it counts as a hang (H4 /
@@ -153,7 +198,8 @@ export interface HostHelperConformanceOptions {
     readonly refusalTimeoutMs?: number;
     /**
      * Chrome audit for the C-grades. Absent ⇒ C cases report `skip`
-     * (self-certification pending) — the tier is decided by H/R alone.
+     * (self-certification pending) — the tier is decided by H/R and by
+     * whichever optional grades (C1, T1, M1) were supplied.
      */
     readonly chromeAudit?: ChromeAudit;
     /**
@@ -162,6 +208,12 @@ export interface HostHelperConformanceOptions {
      * unthemed helper surface has no coverage obligation.
      */
     readonly themeCoverage?: ThemeCoverageOptions;
+    /**
+     * The host's model-facing tool filter for the M1 grade (ggui#1414).
+     * Absent ⇒ M1 reports `skip` — the door is still the host's obligation;
+     * it is just not graded here.
+     */
+    readonly modelToolSet?: ModelToolSetOptions;
 }
 export type HostHelperCaseOutcome = 'pass' | 'fail' | 'skip' | 'warn';
 export interface HostHelperCaseResult {

package/dist/host-helper-conformance/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/host-helper-conformance/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEG;AAIH,kEAAkE;AAClE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,qEAAqE;AACrE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CACtE;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;CAChE;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,WAAW;IAC1B,oEAAoE;IACpE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,4DAA4D;IAC5D,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClD;AAED;;;;;GAKG;AACH,MAAM,WAAW,6BAA6B;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,8CAA8C;IAC9C,QAAQ,CAAC,SAAS,EAAE;QAClB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;QAClC,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;KAClC,CAAC;IACF,0DAA0D;IAC1D,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,oEAAoE;IACpE,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE,OAAO,KAAK,6BAA6B,CAAC;CAC7E;AAED,MAAM,WAAW,4BAA4B;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,oBAAoB,CAAC;CAC/C;AAED,MAAM,MAAM,qBAAqB,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAEtE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,WAAW,GAAG,eAAe,CAAC;AAExE,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,OAAO,EAAE,yBAAyB,CAAC;IAC5C,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAChD,0EAA0E;IAC1E,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAmID;;;GAGG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,cAAc,EACpB,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,2BAA2B,CAAC,CAmUtC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/host-helper-conformance/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0EG;AAEH,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,yCAAyC,CAAC;AAGjD,kEAAkE;AAClE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,qEAAqE;AACrE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CACtE;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;CAChE;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,WAAW;IAC1B,oEAAoE;IACpE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,4DAA4D;IAC5D,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClD;AAED;;;;;GAKG;AACH,MAAM,WAAW,6BAA6B;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,8CAA8C;IAC9C,QAAQ,CAAC,SAAS,EAAE;QAClB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;QAClC,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;KAClC,CAAC;IACF,0DAA0D;IAC1D,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,oEAAoE;IACpE,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE,OAAO,KAAK,6BAA6B,CAAC;CAC7E;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE;QACf,QAAQ,CAAC,EAAE,CAAC,EAAE;YAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAA;SAAE,CAAC;KAC1E,CAAC;CACH;AAED,gEAAgE;AAChE,MAAM,WAAW,mBAAmB;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,EAAE,CACvB,MAAM,EAAE,SAAS,qBAAqB,EAAE,KACrC,SAAS,MAAM,EAAE,CAAC;CACxB;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAAS,qBAAqB,EAYlE,CAAC;AAEF,MAAM,WAAW,4BAA4B;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,oBAAoB,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;CAC7C;AAED,MAAM,MAAM,qBAAqB,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAEtE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,WAAW,GAAG,eAAe,CAAC;AAExE,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,OAAO,EAAE,yBAAyB,CAAC;IAC5C,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAChD,0EAA0E;IAC1E,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAkID;;;GAGG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,cAAc,EACpB,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,2BAA2B,CAAC,CAiXtC"}

package/dist/host-helper-conformance/index.js

@@ -60,11 +60,45 @@
  *   reference validate is `@ggui-ai/design`'s `validateThemeCoverage`
  *   bound to the shipped `consumed-tokens.manifest.json` tokens.
  *
+ * - `M1-model-tool-set` — OPTIONAL like T1, graded when the host supplies
+ *   the filter it uses to derive the MODEL's tool list from a served
+ *   `tools/list` (ggui#1414): the result must withhold every tool whose
+ *   `_meta.ui.visibility` lacks `'model'` (ggui's six `ggui_runtime_*`
+ *   app-only tools) and keep every other tool. SEP-1865 assigns this door
+ *   to the host, and the server cannot observe a violation — a
+ *   view-issued and a model-issued call are indistinguishable on the wire
+ *   — so the kit is where a host proves it. Absent ⇒ `skip`.
+ *
  * A helper that refuses the relay honestly is graded **tier
  * `read-only`** — a LEGAL grade, with the R cases skipped, never
  * failed. `nonconforming` means a dishonesty case failed.
  */
+import { toolVisibleToModel, } from '@ggui-ai/protocol/integrations/mcp-apps';
 import { renderLocatorUri } from '../resource-read-conformance/index.js';
+/**
+ * A served-equivalent shape the M1 grade feeds a host's filter (ggui#1414):
+ * agent tools as ggui declares them — `ggui_render` and `ggui_update` stamp
+ * `visibility: ['model']`, the others carry no marker (the spec's default)
+ * — and ggui's six app-only `ggui_runtime_*` tools. The list is static and
+ * the names are the protocol's own, so it grades the FILTER a host applies,
+ * never the host's live `tools/list`: a host that filters by name rather
+ * than by visibility passes only as long as this list matches what its
+ * server lists, which is why the grade wants the filter and the SPEC
+ * points at the predicate.
+ */
+export const MODEL_TOOL_SET_FIXTURE = [
+    { name: 'ggui_handshake' },
+    { name: 'ggui_render', _meta: { ui: { visibility: ['model'] } } },
+    { name: 'ggui_update', _meta: { ui: { visibility: ['model'] } } },
+    { name: 'ggui_consume' },
+    { name: 'ggui_amend' },
+    { name: 'ggui_runtime_submit_action', _meta: { ui: { visibility: ['app'] } } },
+    { name: 'ggui_runtime_pull', _meta: { ui: { visibility: ['app'] } } },
+    { name: 'ggui_runtime_sync_context', _meta: { ui: { visibility: ['app'] } } },
+    { name: 'ggui_runtime_refresh_ws_token', _meta: { ui: { visibility: ['app'] } } },
+    { name: 'ggui_runtime_telemetry', _meta: { ui: { visibility: ['app'] } } },
+    { name: 'ggui_runtime_declare_tool_catalog', _meta: { ui: { visibility: ['app'] } } },
+];
 const METHOD_NOT_SUPPORTED = -32601;
 const DEFAULT_REFUSAL_TIMEOUT_MS = 2_000;
 /** A method no ggui helper answers — the honest-refusal probe. */
@@ -72,8 +106,7 @@ const UNSUPPORTED_PROBE_METHOD = 'ggui-conformance/unsupported-probe';
 /**
  * The `resources/read` probe's URI: a well-formed render locator naming
  * a render that does not exist, built with the kit's own locator grammar
- * (one owner, `resource-read-conformance`; the kit never compiles against
- * live protocol types). It is a locator on purpose, so a helper that
+ * (one owner, `resource-read-conformance`; the kit compiles against the protocol's published integrations only where a predicate IS the contract (`toolVisibleToModel`), never against live wire types). It is a locator on purpose, so a helper that
  * forwards only `ui://ggui/render/` reads still forwards it; a relaying
  * helper then hands back the server's own classification of the miss,
  * which is an answer (ggui#1304).
@@ -438,6 +471,46 @@ export async function runHostHelperConformance(port, options = {}) {
             });
         }
     }
+    // ── M1: the model's tool set withholds app-only tools ─────────────
+    if (options.modelToolSet === undefined) {
+        cases.push({
+            id: 'M1-model-tool-set',
+            outcome: 'skip',
+            detail: 'no model-facing filter supplied — the visibility door is still the host\'s obligation (SEP-1865), just not graded here (supply modelToolSet to grade)',
+        });
+    }
+    else {
+        const offered = new Set(options.modelToolSet.offeredToModel(MODEL_TOOL_SET_FIXTURE));
+        const leaked = MODEL_TOOL_SET_FIXTURE.filter((t) => !toolVisibleToModel(t._meta?.ui?.visibility) && offered.has(t.name)).map((t) => t.name);
+        const withheld = MODEL_TOOL_SET_FIXTURE.filter((t) => toolVisibleToModel(t._meta?.ui?.visibility) && !offered.has(t.name)).map((t) => t.name);
+        const served = new Set(MODEL_TOOL_SET_FIXTURE.map((t) => t.name));
+        const unknown = [...offered].filter((name) => !served.has(name));
+        if (leaked.length === 0 && withheld.length === 0 && unknown.length === 0) {
+            cases.push({
+                id: 'M1-model-tool-set',
+                outcome: 'pass',
+                detail: `the model's tool set withholds every app-only tool and keeps every model-visible one (${offered.size} offered)`,
+            });
+        }
+        else {
+            const parts = [
+                leaked.length > 0
+                    ? `app-only tools offered to the model (${leaked.length}): ${leaked.join(', ')} — a model holding the app credential can call them`
+                    : undefined,
+                withheld.length > 0
+                    ? `model-visible tools withheld (${withheld.length}): ${withheld.join(', ')} — the agent cannot run the loop without them`
+                    : undefined,
+                unknown.length > 0
+                    ? `names offered that the server never listed (${unknown.length}): ${unknown.join(', ')} — the list is not derived from tools/list`
+                    : undefined,
+            ].filter((part) => part !== undefined);
+            cases.push({
+                id: 'M1-model-tool-set',
+                outcome: 'fail',
+                detail: parts.join('; '),
+            });
+        }
+    }
     const failures = cases
         .filter((c) => c.outcome === 'fail')
         .map((c) => c.id);

package/dist/n1-compat-conformance/cases/release-13-render-result.json

@@ -0,0 +1,25 @@
+{
+    "name": "release-13-render-result",
+    "description": "A ggui_render result as ggui tag 13 (5903985f2, serving prod) emitted it on a cold generation — captured verbatim from dev serving that tag (`ggui-protocol-5903985f2f46`, 2026-09-27T04:36Z) on a fixture app: `outcome: rendered`, the six identity fields, and the cache marker, WITHOUT `effort`. Today's renderOutputSchema MUST accept it: `effort` (#1459) is optional, so a consumer holding this release's result keeps parsing (VERSION-POLICY §3.6).",
+    "release": {
+        "label": "ggui tag 13",
+        "sha": "5903985f2"
+    },
+    "wire": "render-result",
+    "payload": {
+        "outcome": "rendered",
+        "sessionId": "render_63607d1b-afbf-405b-aa0d-43e1c27fc474",
+        "resourceUri": "ui://ggui/render/render_63607d1b-afbf-405b-aa0d-43e1c27fc474/9a679f0634bac356",
+        "action": "create",
+        "contractHash": "9a679f0634bac356",
+        "blueprintId": "bp_62c8adae-6405-4093-8a35-15f827a6f703",
+        "variantKey": "44136fa355b3678a",
+        "cache": {
+            "hit": false,
+            "llmCallsAvoided": 0,
+            "kind": "cold",
+            "reason": "cold: generated fresh — no saved interface fit this render"
+        }
+    },
+    "expect": "accepted"
+}

package/dist/n1-compat-conformance/index.d.ts

@@ -1,5 +1,5 @@
 /** The protocol-owned wires the catalog can grade. */
-export declare const N1_COMPAT_WIRES: readonly ["app-theme", "app-theme-read", "app-theme-carry", "render-meta", "generation-profile", "ops-generate-blueprint", "handshake-suggestion"];
+export declare const N1_COMPAT_WIRES: readonly ["app-theme", "app-theme-read", "app-theme-carry", "render-meta", "generation-profile", "ops-generate-blueprint", "handshake-suggestion", "render-result"];
 /** `backward`: the previous release's payload against today's parser. `forward`: a later release's payload against today's READ door. */
 export declare const N1_COMPAT_DIRECTIONS: readonly ["backward", "forward"];
 export type N1CompatDirection = (typeof N1_COMPAT_DIRECTIONS)[number];

package/dist/n1-compat-conformance/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/n1-compat-conformance/index.ts"],"names":[],"mappings":"AA+BA,sDAAsD;AACtD,eAAO,MAAM,eAAe,oJAAqJ,CAAC;AAElL,yIAAyI;AACzI,eAAO,MAAM,oBAAoB,kCAAmC,CAAC;AACrE,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AACtE,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5D,MAAM,WAAW,eAAe;IAC9B,mFAAmF;IACnF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,iKAAiK;IACjK,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,6EAA6E;IAC7E,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,0CAA0C;IAC1C,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,4FAA4F;IAC5F,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,gGAAgG;IAChG,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;CAC7B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAgDD,eAAO,MAAM,eAAe,EAAE,SAAS,YAAY,EAShC,CAAC;AAoGpB,4DAA4D;AAC5D,wBAAgB,sBAAsB,IAAI,SAAS,cAAc,EAAE,CAkBlE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/n1-compat-conformance/index.ts"],"names":[],"mappings":"AAgCA,sDAAsD;AACtD,eAAO,MAAM,eAAe,qKAAsK,CAAC;AAEnM,yIAAyI;AACzI,eAAO,MAAM,oBAAoB,kCAAmC,CAAC;AACrE,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AACtE,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5D,MAAM,WAAW,eAAe;IAC9B,mFAAmF;IACnF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,iKAAiK;IACjK,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,6EAA6E;IAC7E,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,0CAA0C;IAC1C,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,4FAA4F;IAC5F,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,gGAAgG;IAChG,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;CAC7B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAgDD,eAAO,MAAM,eAAe,EAAE,SAAS,YAAY,EAUhC,CAAC;AA6GpB,4DAA4D;AAC5D,wBAAgB,sBAAsB,IAAI,SAAS,cAAc,EAAE,CAoBlE"}

package/dist/n1-compat-conformance/index.js

@@ -14,18 +14,19 @@
  * Pure-function catalog: no transport, no adopter input — graded on every
  * `runConformance()` and by the kit's own unit lane.
  */
-import { appGenerationProfileSchema, appThemeGetResponseSchema, appThemeSchema, handshakeSuggestionSchema, opsGenerateBlueprintInputSchema, parseAppThemeAtReadDoor } from '@ggui-ai/protocol';
+import { appGenerationProfileSchema, appThemeGetResponseSchema, appThemeSchema, handshakeSuggestionSchema, opsGenerateBlueprintInputSchema, parseAppThemeAtReadDoor, renderOutputSchema } from '@ggui-ai/protocol';
 import { MCP_APP_AI_GGUI_RENDER_META_KEY, parseMcpAppAiGguiRenderMeta, } from '@ggui-ai/protocol/integrations/mcp-apps';
 import release2AppThemeV2 from './cases/release-2-app-theme-v2.json' with { type: 'json' };
 import release2RenderMeta from './cases/release-2-render-meta.json' with { type: 'json' };
 import release2GenerationProfile from './cases/release-2-generation-profile.json' with { type: 'json' };
 import release2OpsGenerateBlueprint from './cases/release-2-ops-generate-blueprint.json' with { type: 'json' };
 import release91HandshakeSuggestion from './cases/release-9-1-handshake-suggestion.json' with { type: 'json' };
+import release13RenderResult from './cases/release-13-render-result.json' with { type: 'json' };
 import forwardAppThemeUnknownMember from './cases/forward-app-theme-unknown-member.json' with { type: 'json' };
 import forwardAppThemeCarryUnknownMember from './cases/forward-app-theme-carry-unknown-member.json' with { type: 'json' };
 import forwardRenderMetaUnknownMember from './cases/forward-render-meta-unknown-member.json' with { type: 'json' };
 /** The protocol-owned wires the catalog can grade. */
-export const N1_COMPAT_WIRES = ['app-theme', 'app-theme-read', 'app-theme-carry', 'render-meta', 'generation-profile', 'ops-generate-blueprint', 'handshake-suggestion'];
+export const N1_COMPAT_WIRES = ['app-theme', 'app-theme-read', 'app-theme-carry', 'render-meta', 'generation-profile', 'ops-generate-blueprint', 'handshake-suggestion', 'render-result'];
 /** `backward`: the previous release's payload against today's parser. `forward`: a later release's payload against today's READ door. */
 export const N1_COMPAT_DIRECTIONS = ['backward', 'forward'];
 function isN1CompatWire(v) {
@@ -82,6 +83,7 @@ export const N1_COMPAT_CASES = [
     release2GenerationProfile,
     release2OpsGenerateBlueprint,
     release91HandshakeSuggestion,
+    release13RenderResult,
     forwardAppThemeUnknownMember,
     forwardAppThemeCarryUnknownMember,
     forwardRenderMetaUnknownMember,
@@ -186,6 +188,14 @@ function gradeHandshakeSuggestion(payload) {
         ? { pass: true, detail: 'handshakeSuggestionSchema: accepted' }
         : { pass: false, detail: `handshakeSuggestionSchema refused the previous release's suggestion: ${r.error.issues.map((i) => i.message).join('; ')}` };
 }
+// ggui#1459 — the render result the served release emits must keep parsing when
+// the result gains an optional member (`effort`).
+function gradeRenderResult(payload) {
+    const r = renderOutputSchema.safeParse(payload);
+    return r.success
+        ? { pass: true, detail: 'renderOutputSchema: accepted' }
+        : { pass: false, detail: `renderOutputSchema refused the previous release's render result: ${r.error.issues.map((i) => i.message).join('; ')}` };
+}
 /** Grade every N−1 case against the protocol as shipped. */
 export function runN1CompatConformance() {
     return N1_COMPAT_CASES.map((c) => {
@@ -201,7 +211,9 @@ export function runN1CompatConformance() {
                             ? gradeGenerationProfile(c.payload)
                             : c.wire === 'handshake-suggestion'
                                 ? gradeHandshakeSuggestion(c.payload)
-                                : gradeOpsGenerateBlueprint(c.payload);
+                                : c.wire === 'render-result'
+                                    ? gradeRenderResult(c.payload)
+                                    : gradeOpsGenerateBlueprint(c.payload);
         return { name: c.name, direction: c.direction, pass: graded.pass, detail: `${c.release.label} (${c.release.sha}) → ${graded.detail}` };
     });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ggui-ai/protocol-conformance",
-  "version": "0.24.0",
+  "version": "0.25.0",
   "description": "Conformance test kit for the ggui protocol. Drives a behavioral fixture catalog against a live implementation over WebSocket, a resources/read catalog against a live MCP server, and nine pure-function catalogs (schema, registration, resolution, binding, props-schema, host-helper, refusal-envelope, registry-completeness, transport-refusal) for the gadget, tool-binding, schema-precise-render, host-helper and pre-generation-refusal obligations, reporting a scorecard-style pass / fail / skip. MCP builders adopt this kit to prove their implementation is protocol-conformant.",
   "license": "Apache-2.0",
   "keywords": [
@@ -104,7 +104,7 @@
   },
   "dependencies": {
     "ws": "^8.20.1",
-    "@ggui-ai/protocol": "0.24.0"
+    "@ggui-ai/protocol": "0.25.0"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",