@honua/mcp-server 0.1.10-beta.0 → 0.1.11-beta.0

package/dist/src/release/zero-to-map.js

@@ -9,7 +9,6 @@ import { publicHttps } from "./zero-to-map-provision.js";
  */
 import { createHash } from "node:crypto";
 import { inflateSync } from "node:zlib";
-import { ADMIN_MCP_EXCLUDED_OPERATIONS, ADMIN_MCP_EXCLUDED_OPERATION_COUNT, ADMIN_MCP_EXCLUSION_ROSTER_SHA256, ADMIN_MCP_PUBLISHED_TOOL_NAMES, MCP_DEFAULT_STATIC_TOOL_COUNT, MCP_DEFAULT_TOTAL_TOOL_COUNT, } from "@honua/sdk-js/control-plane";
 export const ZERO_TO_MAP_PLAN_SCHEMA = "honua.zero-to-map.plan/v1";
 export const ZERO_TO_MAP_RECEIPT_SCHEMA = "honua.zero-to-map.receipt/v1";
 export const ZERO_TO_MAP_CONSOLE_RECEIPT_SCHEMA = "honua.zero-to-map.console-receipt/v1";
@@ -18,63 +17,31 @@ export const ZERO_TO_MAP_CATALOG_RECEIPT_SCHEMA = "honua.zero-to-map.catalog/v1"
 /**
  * Stages in the release journey: install, admin, style, geoprocessing, studio,
  * proposal, console, artifact. `style` proves a canonical style applied to a
- * *published* layer reaches rendered pixels - the Studio-draft styling in the
- * `studio` stage never leaves a draft and so never proved that.
+ * *published* layer reaches rendered pixels. `console` fetches the share URLs
+ * the same admin publish returned; it does not import a second-principal receipt.
  */
 export const ZERO_TO_MAP_STAGE_COUNT = 8;
-/** Identifier of the always-required default roster. */
-export const ZERO_TO_MAP_BASE_PROFILE_ID = "base";
 /**
- * Additive profiles the zero-to-map journey requires, in receipt order.
- *
- * `analysis` contributes six members; only `honua_buffer_features` - the
- * MCP-native dataset Buffer verb the journey actually executes - is confirmed
- * by an in-repo artifact. `esri-gp` contributes exactly the three tools named
- * by `release/zero-to-map/contracts/esri-gp-mcp.v1.json`.
+ * Receipt id for the closed operator roster: the MCP tools this journey calls,
+ * not a 432/441 catalog total and not the `analysis` or `esri-gp` profiles.
  */
-export const ZERO_TO_MAP_ADDITIVE_PROFILES = [
-    {
-        id: "analysis",
-        memberCount: 6,
-        confirmedMembers: ["honua_buffer_features"],
-        namePrefixes: [],
-    },
-    {
-        id: "esri-gp",
-        memberCount: 3,
-        confirmedMembers: ["honua_esri_gp_describe_task", "honua_esri_gp_execute_task", "honua_esri_gp_list_tasks"],
-        namePrefixes: ["honua_esri_gp_"],
-    },
-];
+export const ZERO_TO_MAP_CLOSED_ROSTER_ID = "operator";
 /**
  * The reserved `tools/list` view name that opts a request back out of any
  * server-configured or session-negotiated workflow view and returns the
  * complete paginated catalog (honua-server#3428).
  *
- * The candidate server may publish a bounded workflow view - today `setup` - and
- * may make one the profile default through the configuration key named by
- * {@link ZERO_TO_MAP_WORKFLOW_VIEW_CONFIG_KEY}. Selecting a view can only
- * *narrow* discovery, so a host that configures a default view would serve the
- * roster preflight a short catalog and the preflight would blame a missing
- * server profile for what is actually a discovery setting. The preflight
- * therefore always selects this escape hatch explicitly rather than relying on
- * the candidate having no default configured.
+ * The candidate may publish a bounded workflow view and may make one the
+ * default through {@link ZERO_TO_MAP_WORKFLOW_VIEW_CONFIG_KEY}. Selecting a
+ * view can only *narrow* discovery, so a host that configures a default view
+ * would hide tools the journey calls. The preflight always selects this escape
+ * hatch explicitly rather than relying on the candidate having no default.
  */
 export const ZERO_TO_MAP_FULL_CATALOG_VIEW = "full";
 /** Configuration key whose value would narrow the candidate's default `tools/list`. */
 export const ZERO_TO_MAP_WORKFLOW_VIEW_CONFIG_KEY = "Mcp:WorkflowViews:DefaultView";
 /** Environment-variable spelling of {@link ZERO_TO_MAP_WORKFLOW_VIEW_CONFIG_KEY}. */
 export const ZERO_TO_MAP_WORKFLOW_VIEW_ENV_KEY = "Mcp__WorkflowViews__DefaultView";
-/** Profiles the candidate must advertise before the journey is executable. */
-export const ZERO_TO_MAP_REQUIRED_PROFILES = [
-    ZERO_TO_MAP_BASE_PROFILE_ID,
-    ...ZERO_TO_MAP_ADDITIVE_PROFILES.map((profile) => profile.id),
-];
-/** Tools the base roster contributes: 47 static + 385 published Admin projections. */
-export const ZERO_TO_MAP_BASE_PROFILE_TOOL_COUNT = MCP_DEFAULT_STATIC_TOOL_COUNT + ADMIN_MCP_PUBLISHED_TOOL_NAMES.length;
-/** Derived candidate total. Never hardcode this; it follows from the enabled profiles. */
-export const ZERO_TO_MAP_EXPECTED_TOTAL_TOOL_COUNT = ZERO_TO_MAP_BASE_PROFILE_TOOL_COUNT +
-    ZERO_TO_MAP_ADDITIVE_PROFILES.reduce((total, profile) => total + profile.memberCount, 0);
 const STUDIO_GENERATION_MUTATION_TOOLS = new Set([
     "honua_studio_add_control",
     "honua_studio_add_layer",
@@ -840,24 +807,69 @@ function summarizeNames(names, limit = 10) {
         ? `${sorted.slice(0, limit).join(", ")}, ... (+${sorted.length - limit})`
         : sorted.join(", ");
 }
+/**
+ * Distinct MCP tools the plan calls, sorted. This is the closed operator roster.
+ * A server may advertise more; the preflight does not require a catalog total.
+ */
+export function zeroToMapClosedRoster(plan) {
+    return [...new Set(requiredMcpToolUses(plan).map((use) => use.tool))].sort();
+}
+/**
+ * Turn a share URL into an absolute request URL.
+ *
+ * Admin publication returns `StudioPublishedRoutes.BuildActiveUrl`, a
+ * root-relative `/api/v1/studio/published/...` path. Live mode resolves that
+ * path against the MCP endpoint origin. Absolute HTTPS is accepted as-is.
+ * HTTP is accepted only for a loopback origin, which is the local-install proof.
+ */
+export function resolvePublishedShareUrl(url, mcpUrl) {
+    if (url.includes("${"))
+        throw new Error("published share URL was not resolved");
+    const absolute = url.startsWith("/") ? joinSharePath(url, mcpUrl) : url;
+    let requested;
+    try {
+        requested = new URL(absolute);
+    }
+    catch {
+        throw new Error("published share URL must be HTTPS, or HTTP on a loopback origin");
+    }
+    if (requested.username || requested.password || requested.search || requested.hash) {
+        throw new Error("published share URL must not embed credentials, query, or fragment");
+    }
+    const loopback = requested.hostname === "localhost" || requested.hostname === "127.0.0.1" || requested.hostname === "::1";
+    if (requested.protocol === "https:" || (requested.protocol === "http:" && loopback))
+        return requested.toString();
+    throw new Error("published share URL must be HTTPS, or HTTP on a loopback origin");
+}
+function joinSharePath(path, mcpUrl) {
+    if (!mcpUrl)
+        throw new Error("a root-relative share URL requires the MCP endpoint origin");
+    let endpoint;
+    try {
+        endpoint = new URL(mcpUrl);
+    }
+    catch {
+        throw new Error("a root-relative share URL requires the MCP endpoint origin");
+    }
+    return `${endpoint.origin}${path}`;
+}
 /**
  * Preflight the advertised MCP catalog before the first live mutation.
  *
- * The base roster, the audited exclusions and each enabled server profile are
- * verified independently, and the expected total is *derived* from those
- * rosters rather than written down. A previous revision required the catalog
- * to equal the 432-tool default roster while the journey simultaneously
- * required analysis and Esri GP tools, so no candidate configuration could
- * pass. Findings are reported per cause (missing / unexpected / duplicate /
- * excluded / truncated / drifted) and name the journey stage and action that
- * needs the tool.
+ * The closed roster is the set of tools this journey calls. The preflight does
+ * not require a 432- or 441-tool catalog, and it does not require the
+ * `analysis` or `esri-gp` profiles. A missing member names the stage and
+ * action that needs it. Extra advertised tools are not a failure: the server
+ * may publish more than this journey uses. Input-schema drift on a planned
+ * call still blocks before that call is sent.
  */
 async function assertMcpCatalog(plan, adapter) {
     const requiredUses = requiredMcpToolUses(plan);
-    // Explicitly opt out of any server-configured or session-negotiated workflow
-    // view. A candidate with `Mcp:WorkflowViews:DefaultView` set would otherwise
-    // serve a deliberately narrowed catalog and every roster finding below would
-    // name a missing server profile for what is really a discovery setting.
+    const closedRoster = zeroToMapClosedRoster(plan);
+    // Opt out of any server-configured or session-negotiated workflow view. A
+    // candidate with `Mcp:WorkflowViews:DefaultView` set would otherwise hide
+    // tools this journey calls, and the finding would look like a missing tool
+    // rather than a discovery setting.
     const catalog = await adapter.listTools({ view: ZERO_TO_MAP_FULL_CATALOG_VIEW });
     const names = catalog.map((tool) => tool.name);
     const findings = [];
@@ -865,123 +877,22 @@ async function assertMcpCatalog(plan, adapter) {
     if (duplicateNames.length > 0) {
         findings.push(`duplicate: the catalog advertises ${summarizeNames(duplicateNames)} more than once`);
     }
-    // --- base profile: the 385 published Admin projections ---------------------
-    const advertisedAdmin = names.filter((name) => name.startsWith("honua_admin_"));
-    const advertisedAdminSet = new Set(advertisedAdmin);
-    const expectedAdmin = new Set(ADMIN_MCP_PUBLISHED_TOOL_NAMES);
-    const missingAdmin = [...expectedAdmin].filter((name) => !advertisedAdminSet.has(name)).sort();
-    const unexpectedAdmin = [...advertisedAdminSet].filter((name) => !expectedAdmin.has(name)).sort();
-    if (missingAdmin.length > 0) {
-        findings.push(`missing: ${missingAdmin.length} of the ${expectedAdmin.size} published Admin projections are absent ` +
-            `(${summarizeNames(missingAdmin)})`);
-    }
-    if (unexpectedAdmin.length > 0) {
-        findings.push(`unexpected: the catalog advertises unpublished Admin tools ${summarizeNames(unexpectedAdmin)}`);
-    }
-    // --- base profile: the 11 audited secret/session exclusions ----------------
-    const excludedToolNames = ADMIN_MCP_EXCLUDED_OPERATIONS.map((operation) => operation.toolName);
-    if (excludedToolNames.length !== ADMIN_MCP_EXCLUDED_OPERATION_COUNT) {
-        findings.push(`excluded: the generated exclusion roster carries ${excludedToolNames.length} operations; the audited ` +
-            `contract requires ${ADMIN_MCP_EXCLUDED_OPERATION_COUNT}`);
-    }
-    const advertisedExclusions = excludedToolNames.filter((name) => advertisedAdminSet.has(name)).sort();
-    if (advertisedExclusions.length > 0) {
-        findings.push(`excluded: the catalog advertises audited secret/session operations ${summarizeNames(advertisedExclusions)}`);
-    }
-    // --- additive profiles, verified independently -----------------------------
-    const nonAdminNames = names.filter((name) => !name.startsWith("honua_admin_"));
-    const namedProfiles = ZERO_TO_MAP_ADDITIVE_PROFILES.filter((profile) => profile.namePrefixes.length > 0);
-    const fallbackProfile = ZERO_TO_MAP_ADDITIVE_PROFILES.find((profile) => profile.namePrefixes.length === 0);
-    const claimed = new Set();
-    const profileReceipts = [];
-    for (const profile of namedProfiles) {
-        const members = nonAdminNames.filter((name) => profile.namePrefixes.some((prefix) => name.startsWith(prefix)));
-        for (const member of members)
-            claimed.add(member);
-        const memberSet = new Set(members);
-        const missingMembers = profile.confirmedMembers.filter((name) => !memberSet.has(name)).sort();
-        const unexpectedMembers = [...memberSet].filter((name) => !profile.confirmedMembers.includes(name)).sort();
-        if (missingMembers.length > 0) {
-            findings.push(`missing: the ${profile.id} profile is not advertised - ${missingMembers
-                .map((tool) => {
-                const use = requiredUses.find((candidate) => candidate.tool === tool);
-                return use ? describeToolUse(use) : tool;
-            })
-                .join(", ")}. Enable the ${profile.id} server profile on the candidate and rerun.`);
-        }
-        if (unexpectedMembers.length > 0) {
-            findings.push(`unexpected: the ${profile.id} profile advertises ${summarizeNames(unexpectedMembers)}, which the checked-in profile contract does not declare`);
-        }
-        if (members.length !== profile.memberCount) {
-            findings.push(`${members.length < profile.memberCount ? "missing" : "unexpected"}: the ${profile.id} profile advertises ` +
-                `${members.length} members; the profile contract declares ${profile.memberCount}`);
-        }
-        profileReceipts.push({
-            id: profile.id,
-            expectedMembers: profile.memberCount,
-            advertisedMembers: members.length,
-            confirmedMembers: [...profile.confirmedMembers].sort(),
-            nameResolvedMembers: [...members].sort(),
-            rosterSha256: rosterDigest(members),
-        });
-    }
-    // The fallback profile's members are not separable from the base static
-    // surface by name (the server has not published an `analysis` roster yet:
-    // honua-server#3363). It is therefore verified by its confirmed members plus
-    // its declared size, and the base static count is derived from the residue.
-    const residue = nonAdminNames.filter((name) => !claimed.has(name));
-    const fallbackMembers = fallbackProfile ? residue.length - MCP_DEFAULT_STATIC_TOOL_COUNT : 0;
-    const baseStaticTools = residue.length - fallbackMembers;
-    if (fallbackProfile) {
-        const residueSet = new Set(residue);
-        const missingMembers = fallbackProfile.confirmedMembers.filter((name) => !residueSet.has(name)).sort();
-        if (missingMembers.length > 0) {
-            findings.push(`missing: the ${fallbackProfile.id} profile is not advertised - ${missingMembers
-                .map((tool) => {
-                const use = requiredUses.find((candidate) => candidate.tool === tool);
-                return use ? describeToolUse(use) : tool;
-            })
-                .join(", ")}. Enable the ${fallbackProfile.id} server profile on the candidate and rerun.`);
-        }
-        if (fallbackMembers !== fallbackProfile.memberCount) {
-            findings.push(`${fallbackMembers < fallbackProfile.memberCount ? "missing" : "unexpected"}: the non-Admin surface ` +
-                `advertises ${residue.length} tools; the base static roster (${MCP_DEFAULT_STATIC_TOOL_COUNT}) plus the ` +
-                `${fallbackProfile.id} profile (${fallbackProfile.memberCount}) derive ` +
-                `${MCP_DEFAULT_STATIC_TOOL_COUNT + fallbackProfile.memberCount}`);
-        }
-        profileReceipts.push({
-            id: fallbackProfile.id,
-            expectedMembers: fallbackProfile.memberCount,
-            advertisedMembers: Math.max(fallbackMembers, 0),
-            confirmedMembers: [...fallbackProfile.confirmedMembers].sort(),
-            nameResolvedMembers: [...fallbackProfile.confirmedMembers].filter((name) => residueSet.has(name)).sort(),
-            rosterSha256: rosterDigest(residue),
-        });
-    }
-    // --- derived totals --------------------------------------------------------
-    if (ZERO_TO_MAP_BASE_PROFILE_TOOL_COUNT !== MCP_DEFAULT_TOTAL_TOOL_COUNT) {
-        findings.push(`unexpected: the generated base roster derives ${MCP_DEFAULT_STATIC_TOOL_COUNT} static + ${expectedAdmin.size} ` +
-            `Admin = ${ZERO_TO_MAP_BASE_PROFILE_TOOL_COUNT} tools, but the default roster constant is ` +
-            `${MCP_DEFAULT_TOTAL_TOOL_COUNT}`);
-    }
-    const expectedTotal = ZERO_TO_MAP_EXPECTED_TOTAL_TOOL_COUNT;
-    if (names.length !== expectedTotal) {
-        const shortfall = expectedTotal - names.length;
-        findings.push(shortfall > 0 && duplicateNames.length === 0 && unexpectedAdmin.length === 0
-            ? `truncated: the catalog returned ${names.length} of ${expectedTotal} tools (${shortfall} short). Every tools/list page must be drained before the roster is judged; a short read is a pagination fault, not a roster decision. This preflight already selects view="${ZERO_TO_MAP_FULL_CATALOG_VIEW}", so a candidate workflow view configured through ${ZERO_TO_MAP_WORKFLOW_VIEW_CONFIG_KEY} (${ZERO_TO_MAP_WORKFLOW_VIEW_ENV_KEY}) is not the cause.`
-            : `unexpected: the catalog advertises ${names.length} tools; the enabled profiles ` +
-                `(${ZERO_TO_MAP_REQUIRED_PROFILES.join(" + ")}) derive ${expectedTotal}`);
+    const advertised = new Map(catalog.map((tool) => [tool.name, tool]));
+    const missing = closedRoster.filter((tool) => !advertised.has(tool));
+    if (missing.length > 0) {
+        const described = missing
+            .map((tool) => requiredUses
+            .filter((use) => use.tool === tool)
+            .map(describeToolUse)
+            .join(", "))
+            .join("; ");
+        findings.push(`missing: the ${ZERO_TO_MAP_CLOSED_ROSTER_ID} roster is not advertised - ${described}. ` +
+            `This preflight already selects view="${ZERO_TO_MAP_FULL_CATALOG_VIEW}", so a candidate workflow view ` +
+            `configured through ${ZERO_TO_MAP_WORKFLOW_VIEW_CONFIG_KEY} (${ZERO_TO_MAP_WORKFLOW_VIEW_ENV_KEY}) is not the cause.`);
     }
     if (findings.length > 0) {
-        throw new JourneyBlockedError(`MCP catalog preflight failed for profiles ${ZERO_TO_MAP_REQUIRED_PROFILES.join(" + ")}: ${findings.join("; ")}`, "mcp-catalog-incomplete");
-    }
-    // --- every tool the plan actually calls ------------------------------------
-    const advertised = new Map(catalog.map((tool) => [tool.name, tool]));
-    const missingRequired = [...new Set(requiredUses.map((use) => use.tool))].filter((tool) => !advertised.has(tool));
-    if (missingRequired.length > 0) {
-        throw new JourneyBlockedError(`MCP catalog is missing required tools: ${missingRequired.join(", ")}`, "mcp-catalog-incomplete");
+        throw new JourneyBlockedError(`MCP catalog preflight failed for the ${ZERO_TO_MAP_CLOSED_ROSTER_ID} roster: ${findings.join("; ")}`, "mcp-catalog-incomplete");
     }
-    // --- input-schema drift on every planned call ------------------------------
     for (const stage of plan.stages) {
         for (const action of stage.actions) {
             if (action.kind !== "mcp")
@@ -1003,20 +914,33 @@ async function assertMcpCatalog(plan, adapter) {
             }
         }
     }
+    const adminNames = names.filter((name) => name.startsWith("honua_admin_"));
+    const staticNames = names.filter((name) => !name.startsWith("honua_admin_"));
+    const closedAdmin = closedRoster.filter((name) => name.startsWith("honua_admin_"));
+    const closedStatic = closedRoster.filter((name) => !name.startsWith("honua_admin_"));
     return {
         schemaVersion: ZERO_TO_MAP_CATALOG_RECEIPT_SCHEMA,
-        activeProfiles: [...ZERO_TO_MAP_REQUIRED_PROFILES],
+        activeProfiles: [ZERO_TO_MAP_CLOSED_ROSTER_ID],
         requestedView: ZERO_TO_MAP_FULL_CATALOG_VIEW,
-        expectedTotalTools: expectedTotal,
+        expectedTotalTools: closedRoster.length,
         advertisedTotalTools: names.length,
-        baseStaticTools,
-        baseAdminTools: advertisedAdmin.length,
-        auditedExclusions: excludedToolNames.length,
-        profiles: profileReceipts,
+        baseStaticTools: closedStatic.length,
+        baseAdminTools: closedAdmin.length,
+        auditedExclusions: 0,
+        profiles: [
+            {
+                id: ZERO_TO_MAP_CLOSED_ROSTER_ID,
+                expectedMembers: closedRoster.length,
+                advertisedMembers: closedRoster.length,
+                confirmedMembers: closedRoster,
+                nameResolvedMembers: closedRoster,
+                rosterSha256: rosterDigest(closedRoster),
+            },
+        ],
         catalogSha256: rosterDigest(names),
-        adminRosterSha256: rosterDigest(advertisedAdmin),
-        staticRosterSha256: rosterDigest(residue),
-        exclusionRosterSha256: ADMIN_MCP_EXCLUSION_ROSTER_SHA256,
+        adminRosterSha256: rosterDigest(adminNames),
+        staticRosterSha256: rosterDigest(staticNames),
+        exclusionRosterSha256: rosterDigest([]),
     };
 }
 function duplicateValues(values) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@honua/mcp-server",
-  "version": "0.1.10-beta.0",
+  "version": "0.1.11-beta.0",
   "description": "Platform-free MCP server for geospatial services: expose discovery, query, and analysis over any public ArcGIS/Esri FeatureServer or OGC API endpoint to any MCP client, with no platform lock-in",
   "license": "Apache-2.0",
   "author": "Honua",
@@ -56,6 +56,7 @@
     "test:certification": "npm run build --silent && vitest run test/certification && node dist/src/certification/cli.js",
     "test:certification:admin": "vitest run test/proxy.test.ts test/certification/admin-parity.test.ts",
     "certify:admin-parity": "npm run build --silent && node dist/src/certification/admin-parity.js",
+    "certify:setup-parity": "npm run build --silent && node dist/src/certification/setup-parity.js",
     "test:certification:artifact": "npm run build --silent && node dist/src/certification/cli.js --artifact-only",
     "test:certification:standalone": "npm run build --silent && node dist/src/certification/cli.js --target standalone",
     "test:certification:standalone-ogc": "npm run build --silent && node dist/src/certification/cli.js --target standalone-ogc",
@@ -88,7 +89,7 @@
     "qs": "^6.16.0"
   },
   "peerDependencies": {
-    "@honua/sdk-js": "^0.1.10-beta.0"
+    "@honua/sdk-js": "^0.1.11-beta.0"
   },
   "devDependencies": {
     "@biomejs/biome": "1.9.4",
@@ -102,6 +103,7 @@
     "dist/src",
     "release/zero-to-map",
     "certification/geospatial-mcp-schemas",
+    "certification/setup-parity.md",
     "README.md",
     "LICENSE"
   ],

package/release/zero-to-map/README.md

@@ -1,15 +1,25 @@
 # Zero-to-map 2026.1 release journey
 
+The September 9 release decision on #1401 narrows first-cut qualification.
+This older journey still exercises the broader Admin/analysis and multi-family
+Studio integration. Its roster is not the bounded 2026.1 setup gate. Use the
+[pinned setup catalog check](../../certification/setup-parity.md) for that
+gate's HTTP/stdio discovery evidence; retain separate install and style/render
+execution receipts. Full Admin MCP and broader analysis qualification remain
+outside the bounded first-cut dependency chain.
+
 This bundle is the executable contract for `honua-release#123` D9.3: install
-Honua, configure and publish deterministic data with AI-accessible admin tools,
-run Buffer through the AI-facing Esri MCP tool, the SDK's Esri GPServer
-compatibility path, and the MCP-native analysis verb, compose distinct map,
-app, and dashboard packages in Studio, save each as an immutable version, read
-that exact version, reopen it as a new draft, record three publication intents,
-and save three new intent-bearing versions. It then stops at the human Console
-gate before verifying the three approved public URLs. Both MCP
-jobs are polled through `honua://jobs/{id}` and joined to their
-`honua://jobs/{id}/results` packages; a queued submission alone cannot pass.
+Honua, configure and publish deterministic data with the closed admin roster,
+buffer the published parcels with `honua_validate_plan` then
+`honua_execute_plan` (`analytics.buffer-aggregate`), prove `geometry.buffer`
+through the SDK GPServer runner, compose distinct map, app, and dashboard
+packages in Studio, save each as an immutable version, and publish that saved
+version. An admin `honua_studio_propose_publication` returns `shareUrl` with
+`humanConfirmationRequired: false`. The same session fetches each share URL and
+requires HTTP 200. It does not import a Console receipt and it does not require
+a second principal. The buffer job is polled through `honua://jobs/{jobId}` to
+terminal success, and `artifacts[].artifactId` is read from
+`honua://jobs/{jobId}/results`; a queued submission alone cannot pass.
 
 The driver reuses `honua admin install` and `honua-mcp-proxy`. It does not ship
 a second installer, admin client, or MCP transport. The installer is the
@@ -49,17 +59,21 @@ Prerequisites:
 
 - Node.js 20.19 or newer and Docker with Compose
 - the 2026.1 `honua` CLI work from `honua-sdk-js#1370-#1373`
-- a server build exposing the complete default 432-tool roster (47 static plus
-  385 `honua_admin_*` tools), with all eleven secret/session Admin operations
-  absent, **and** the `analysis` and `esri-gp` server profiles enabled so the
-  three `honua_esri_gp_*` tools and `honua_buffer_features` are advertised
-  (441 tools in total), plus the Studio lifecycle tools including
-  `honua_studio_save_version`, `honua_studio_get_version`, and
-  `honua_studio_reopen_version`
-- the `geoprocessing/Buffer` GPServer task seeded by the deployment
+- one admin credential. The journey does not require a second principal
+- a server build that advertises the closed operator roster this journey calls:
+  `honua_admin_connections_create`, `honua_admin_connections_test`,
+  `honua_admin_import_upload_url`, `honua_admin_layer_publish`,
+  `honua_admin_services_access_policy_set`, `honua_admin_server_status`,
+  `honua_admin_api_key_list`, `honua_admin_api_key_effective_permissions`,
+  `honua_validate_plan`, `honua_execute_plan`, and the Studio lifecycle tools
+  including `honua_studio_save_version`, `honua_studio_get_version`,
+  `honua_studio_reopen_version`, and `honua_studio_propose_publication`.
+  It does not require a 432- or 441-tool catalog, and it does not require the
+  `analysis` or `esri-gp` profiles. `honua_esri_gp_*` and `honua_buffer_features`
+  are not called
+- the `geoprocessing/Buffer` GPServer task seeded for the separate
+  `geometry.buffer` proof. That task takes WKB and has no `layerId`
 - these fixtures available to the server at an HTTP(S) base URL
-- a writable checkpoint path; the first pass emits the exact resolved Console
-  receipt request after all pre-approval work completes
 
 Serve the checked-in fixtures from a URL reachable by the Honua container, for
 example with an existing static-file server. Then run:
@@ -97,26 +111,13 @@ compose file it generates, so add both to the `honua` service's environment (or
 start an equivalent server yourself) before running with `--execute`. If you
 pass a different `--var dbSecretReference=env:<NAME>`, permit `<NAME>` instead.
 
-The first pass exits `2` with `external-receipt-missing`. It has already run
-stages 1-5 exactly once. Give the checkpoint's resolved
-`consoleReceiptRequest` to the Console producer, carry
-`checkpoint.integrity.digest` outside that file, and resume with the same
-command plus:
-
-```sh
-  --checkpoint-digest <checkpoint.integrity.digest> \
-  --console-receipt ./console-approval.json
-```
-
-The resume atomically claims the checkpoint before any adapter work. A second
-or concurrent claimant fails closed. The checkpoint is bound to the exact plan
-bytes, SDK source SHA (`HONUA_SOURCE_REVISION`), target, MCP endpoint,
-candidate/release, and (for AWS) provisioning receipt; it contains only
-allowlisted captures/evidence, including the non-secret deterministic
-`serviceName` identity and access-credential ID/grants/reference digest required
-by external producers, and never the database password, admin key, token, or
-authorization material. A successful resume
-marks it consumed and binds the final receipt hash.
+The live run does not pause for a Console receipt. An admin publish returns
+`shareUrl` (`/api/v1/studio/published` plus the route) with
+`humanConfirmationRequired: false`, and the journey fetches that URL. A
+root-relative share path is resolved against the MCP endpoint origin. HTTP is
+accepted only for a loopback origin; any other share URL must be HTTPS and must
+not embed credentials. One admin credential performs configuration, publication,
+and the fetch.
 
 For a deployment already provisioned by the DevOps ECS producer, use
 `--target aws-ecs --provision-receipt <pre-teardown-binding.json>`. The binding
@@ -126,27 +127,14 @@ the real image/digest, Terraform, readiness, and a secret-free access receipt
 whose reference digest is verified against the producer's Secrets Manager ARN;
 it does not invoke or pretend to invoke the Docker installer.
 
-The catalog is checked in full before the first MCP call. Missing tools or
-input-schema drift block the run without sending that call.
-
-The preflight verifies each enabled server profile independently and *derives*
-the expected total from them; it never compares the catalog against a single
-hardcoded number:
-
-| Profile | Members | Verified by |
-| --- | --- | --- |
-| `base` | 47 static + 385 `honua_admin_*` = 432 | the generated Admin contract, plus the 11 audited secret/session exclusions proven absent |
-| `analysis` | 6 | `honua_buffer_features` by name; the rest by declared size (the server has not published an `analysis` roster - honua-server#3363) |
-| `esri-gp` | 3 | exactly `honua_esri_gp_list_tasks`, `honua_esri_gp_describe_task`, `honua_esri_gp_execute_task` from `contracts/esri-gp-mcp.v1.json` |
-
-The enabled candidate therefore advertises 432 + 6 + 3 = 441 tools. A missing,
-unexpected, duplicate, excluded, truncated, or schema-drifted member fails with
-its own labelled finding naming the journey stage and action that needs the
-tool; a short catalog is reported as a pagination fault rather than a roster
-decision. The pagination safety ceiling in `listAllTools` is deliberately
-separate from every roster number, so reading a larger profile-enabled catalog
-is never mistaken for a hostile server. Default-profile certification
-(`certifyAdminCatalogParity`) continues to require exactly 432.
+The catalog is checked before the first MCP call. The preflight selects
+`tools/list` view `full` and asserts the closed roster: every tool this journey
+calls, by name, with the stage and action that needs it. It does not require
+432 or 441 tools and it does not require the `analysis` or `esri-gp` profiles.
+Extra advertised tools are not a failure. A duplicate name or an input schema
+that rejects a planned argument blocks the run without sending that call.
+Default-profile certification (`certifyAdminCatalogParity`) is a separate gate
+and is not this journey's roster.
 
 The connection is
 created with `secretReference` + `secretType`; raw database credentials never
@@ -164,30 +152,20 @@ The Studio version tools are also preflighted before the first server mutation.
 Map, app, and dashboard each exercise layer, style, view, widget, and control
 mutations before validation; family-specific shortcuts or embedded lookalikes
 cannot satisfy the release roster.
-The journey does not treat `honua_studio_get_draft` as reopen evidence: every
-family must capture its `itemId`, immutable `versionId`, `contentHash`, and the
-new draft whose `baseVersionId` points back to that exact version. After the
-proposal increments that reopened draft's generation, the journey saves a new
-immutable publication version. Console must create and publish the request for
-that new version, never the earlier pre-intent version.
-
-The Console receipt is accepted only when it is `passed` and binds this
-journey/release contract to the exact connection, service, layers, three GP job
-identities, result packages/artifacts, map/app/dashboard draft and immutable
-version identities, all three reopened drafts and intent-bearing publication
-versions, all three Console request/publication/status/public-URL identities,
-execution operations, audit correlations, routes, candidate, and release. Each
-audit operation must equal its family's execution operation, each proposal ID
-must equal its publication request ID, and the app public URL must equal the
-top-level share URL. The Studio proposal actions reject any pre-approval
-publication ID or public URL and must report both `recorded=true` and
-`humanConfirmationRequired=true`. Agent execution never claims the human
-publication step. Stage 7 independently requires identity-preserving HTTPS
-HTTP 200 responses for map, app, and dashboard URLs.
+The journey does not treat `honua_studio_get_draft` as reopen evidence. Save
+captures read `/structuredContent/version/versionId`,
+`/structuredContent/version/contentHash`, and `versionNumber` under `version`.
+`honua_studio_get_version` still returns top-level `versionId` and `contentHash`.
+Publication runs after that save. `honua_studio_propose_publication` takes
+`itemId`, `versionId`, `contentHash`, `route`, `visibility`, and `note`. It does
+not take `draftId`, `generation`, or `embed`. For this admin journey the result
+has `humanConfirmationRequired: false` and a `shareUrl`. The journey fetches
+each share URL and requires HTTP 200. It does not forbid `shareUrl` and it does
+not wait for a second principal.
 
 ## Evidence status
 
 The fixtures, plan, contracts, and simulated end-to-end tests are deterministic.
-They are not a live release recording. Until all deployment dependencies are
-available and an operator supplies a matching Console receipt, the honest
-candidate result is `blocked`/`skipped`, not passed.
+They are not a live release recording. Contract mode stays `blocked` and does
+not start Docker. A live pass is the same admin session reaching HTTP 200 on
+the three share URLs.

package/release/zero-to-map/configs/claude-code.mcp.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "honua": {
       "command": "npx",
-      "args": ["-y", "--package", "@honua/mcp-server@0.1.9-beta.0", "honua-mcp-proxy"],
+      "args": ["-y", "--package", "@honua/mcp-server@0.1.10-beta.0", "honua-mcp-proxy"],
       "env": {
         "HONUA_MCP_REMOTE_URL": "http://localhost:8080/mcp"
       }

package/release/zero-to-map/configs/claude-desktop.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "honua": {
       "command": "npx",
-      "args": ["-y", "--package", "@honua/mcp-server@0.1.9-beta.0", "honua-mcp-proxy"],
+      "args": ["-y", "--package", "@honua/mcp-server@0.1.10-beta.0", "honua-mcp-proxy"],
       "env": {
         "HONUA_MCP_REMOTE_URL": "http://localhost:8080/mcp"
       }

package/release/zero-to-map/configs/cursor.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "honua": {
       "command": "npx",
-      "args": ["-y", "--package", "@honua/mcp-server@0.1.9-beta.0", "honua-mcp-proxy"],
+      "args": ["-y", "--package", "@honua/mcp-server@0.1.10-beta.0", "honua-mcp-proxy"],
       "env": {
         "HONUA_MCP_REMOTE_URL": "http://localhost:8080/mcp"
       }