@indexnetwork/protocol 6.15.0-rc.407.1 → 8.0.1-rc.417.1

package/dist/mcp/mcp.server.js

@@ -6,13 +6,15 @@
  */
 import { z } from 'zod';
 import { McpServer, fromJsonSchema } from '@modelcontextprotocol/server';
+import { McpResolvedIdentitySchema } from '../shared/schemas/mcp-auth.schema.js';
+import { CANONICAL_GUIDANCE_SUMMARY } from '../shared/agent/canonical-guidance.js';
 import { resolveChatContext } from '../shared/agent/tool.helpers.js';
 import { deriveAllowedNetworkIds, scopeFromNetworkId } from '../shared/agent/tool.scope.js';
-import { QuestionSchema } from '../shared/schemas/question.schema.js';
-import { dispatchElicitations } from './elicitation.dispatcher.js';
 import { createToolRegistry } from '../runtime/foreground/composition/tool.registry.js';
+import { bindOwnerApprovalProvenance } from '../opportunity/application/opportunity.owner-provenance.js';
 import { ToolRuntimeError, invokeToolRuntime, toolRuntimeErrorToResult } from '../shared/agent/tool.runtime.js';
 import { protocolLogger } from '../shared/observability/protocol.logger.js';
+import { buildMcpAuthorizationDenialEvent, McpCapabilityPolicy, ONBOARDING_ALLOWED, resolveMcpActivityCaller, resolveMcpCapabilitySubject } from './mcp.authorization-policy.js';
 const logger = protocolLogger('McpServer');
 const mcpToolMetadataCache = new Map();
 /**
@@ -21,8 +23,10 @@ const mcpToolMetadataCache = new Map();
  * the cached metadata set is automatically invalidated.
  */
 export function getMcpToolMetadataCacheKey(deps) {
+    // CONTACTS_ENABLED deliberately does NOT shape the MCP registry: contact and
+    // Gmail-import tools are omitted from the MCP surface entirely (IND-596), so
+    // the flag can never change the MCP tool set.
     return [
-        `contacts:${deps.contactsEnabled === true ? '1' : '0'}`,
         `chat:${deps.chatSession ? '1' : '0'}`,
         `agent:${deps.agentDatabase ? '1' : '0'}`,
         `negotiation:${deps.agentDispatcher ? '1' : '0'}`,
@@ -49,7 +53,7 @@ export function getCachedMcpToolMetadata(deps) {
     const cached = mcpToolMetadataCache.get(cacheKey);
     if (cached)
         return cached;
-    const registry = createToolRegistry(deps);
+    const registry = createToolRegistry(deps, { surface: 'mcp' });
     const metadata = Array.from(registry.values()).map((toolDef) => {
         const jsonSchema = zodToJsonSchema(toolDef.schema);
         return {
@@ -188,47 +192,6 @@ export function sanitizeMcpResult(text) {
         return { text, isError: false };
     }
 }
-/** Spec cap on the number of decision questions surfaced per turn. */
-const MAX_DECISION_QUESTIONS = 3;
-/**
- * Extracts decision questions from a parsed tool-result text, if present.
- * Validates each entry against `QuestionSchema` and drops malformed items;
- * caps the array at `MAX_DECISION_QUESTIONS` (defense-in-depth — Slice 2's
- * generator already caps at 3, but we don't trust the cast here).
- *
- * Returns null when the text isn't JSON, has no `data.questions`, or
- * contains zero valid questions after validation.
- */
-export function extractDecisionQuestions(text) {
-    let parsed;
-    try {
-        parsed = JSON.parse(text);
-    }
-    catch {
-        return null;
-    }
-    const rawQs = parsed?.data?.questions;
-    if (!Array.isArray(rawQs) || rawQs.length === 0)
-        return null;
-    const valid = [];
-    for (const raw of rawQs) {
-        const result = QuestionSchema.safeParse(raw);
-        if (result.success)
-            valid.push(result.data);
-        if (valid.length === MAX_DECISION_QUESTIONS)
-            break;
-    }
-    return valid.length > 0 ? valid : null;
-}
-/**
- * Renders the JSON-envelope text block appended to the tool result content
- * when decision questions are present. The leading sentinel string lets the
- * LLM client recognize and surface the questions in prose for clients
- * without elicitation support.
- */
-export function renderQuestionsEnvelope(questions) {
-    return `Decision questions (structured): ${JSON.stringify({ questions })}`;
-}
 /**
  * Promotes a network-scoped agent's bound network into the resolved tool
  * context as the implicit chat scope. Every tool derives its focused network
@@ -261,37 +224,7 @@ export const applyNetworkScopeToContext = (context, networkScopeId) => {
     context.scopedMembershipRole = isOwner ? 'owner' : 'member';
     context.isOwner = isOwner;
 };
-/**
- * Tools allowed during onboarding — everything else is gated until
- * complete_onboarding is called.  Includes the agent-gate-exempt tools
- * (register_agent, read_docs, scrape_url) because they are informational /
- * registration primitives needed at every lifecycle stage.
- */
-export const ONBOARDING_ALLOWED = new Set([
-    'register_agent',
-    'read_docs',
-    'scrape_url',
-    'record_onboarding_privacy_consent',
-    // Canonical *_user_context / *_enrichment_run names (IND-371)
-    'preview_user_context',
-    'get_enrichment_run',
-    'cancel_enrichment_run',
-    'confirm_user_context',
-    'create_user_context',
-    'read_user_contexts',
-    // Deprecated aliases retained so mid-migration clients can still onboard (IND-373 removes them)
-    'preview_user_profile',
-    'get_profile_run',
-    'cancel_profile_run',
-    'confirm_user_profile',
-    'create_user_profile',
-    'read_user_profiles',
-    'complete_onboarding',
-    'import_gmail_contacts',
-    'read_networks',
-    'create_network_membership',
-    'create_intent',
-]);
+export { ONBOARDING_ALLOWED } from './mcp.authorization-policy.js';
 /**
  * Builds the onboarding gate message for MCP callers.  Condensed from the
  * chat orchestrator's 8-step flow (chat.prompt.ts buildOnboarding) into a
@@ -316,7 +249,7 @@ export function buildMcpOnboardingMessage(ctx) {
         `5. Present the profile draft and ask "Does that look right?" On approval/correction, call confirm_user_context(...).\n` +
         `${communityStep}\n` +
         `6. Ask what the user is looking for and call create_intent(description="...", autoApprove=true) so the first signal is persisted.\n` +
-        `7. Call complete_onboarding() to finish setup. Gmail/contact import and discovery are optional after onboarding, never mandatory.`);
+        `7. Call complete_onboarding() to finish setup. Discovery is optional after onboarding, never mandatory.`);
 }
 /**
  * Creates an MCP server with all protocol tools registered.
@@ -343,8 +276,6 @@ function createMcpTraceEmitter(toolName, ctx) {
                 return `${toolName}: ${event.name} agent started`;
             if (event.type === 'agent_end')
                 return `${toolName}: ${event.name} agent finished${event.durationMs != null ? ` in ${event.durationMs}ms` : ''}`;
-            if (event.type === 'opportunity_draft_ready')
-                return `${toolName}: opportunity draft ready`;
             return `${toolName}: progress`;
         })();
         const notification = {
@@ -360,61 +291,19 @@ function createMcpTraceEmitter(toolName, ctx) {
     };
 }
 export const MCP_INSTRUCTIONS = `
-Index Network is a private, intent-driven discovery protocol. You help users find the right people and help the right people find them, via Index Network MCP tools.
-
-# Voice
-Calm, direct, analytical, concise. Preferred vocabulary: opportunity, overlap, signal, pattern, emerging, relevant, adjacency.
-
-# Banned vocabulary
-NEVER use "search" in any form. Use "looking up" for indexed data, "find" / "look for" for discovery, "check" for verification, "discover" for exploration. Banned: leverage, unlock, optimize, scale, disrupt, revolutionary, AI-powered, maximize value, act fast, networking, match.
-
-# Entity model
-- User — has one Profile, many Memberships, many Intents.
-- Profile — identity (bio, skills, interests, location).
-- Index — community with title, prompt (purpose), join policy. Has Members.
-- Membership — User↔Index junction. \`isPersonal: true\` marks the user's personal network (contacts).
-- Intent — what a user is looking for (signal). Description, summary, embedding.
-- IntentIndex — Intent↔Index junction (auto-assigned).
-- Opportunity — discovered connection between users. Roles, status, reasoning.
+${CANONICAL_GUIDANCE_SUMMARY}
 
-# Output rules
-- NEVER expose internal IDs, UUIDs, field names, or tool names — EXCEPT when an ID is actionable for the user (e.g. a \`conversationId\` they need to open a chat). Surface such IDs verbatim when the tool returns them.
-- NEVER use internal vocabulary — say "signal" not "intent", "community" not "index".
-- NEVER dump raw JSON. Synthesize in natural language.
-- Surface top 1–3 relevant points unless asked for the full list.
-- Prefer first names; use full names only to disambiguate.
-- Translate statuses: draft/latent → "draft", pending → "awaiting review/response", accepted → "accepted opportunity". Agent acceptance is not "connected".
-- NEVER fabricate data. If you don't have it, call the appropriate tool.
+# Voice & Output Rules
+Calm, analytical, concise. Say "signal" not "intent", "community" not "index". Never use "search" — use "discover" or "find". Banned: leverage, optimize, unlock, scale, disrupt, AI-powered, act fast.
 
-# Tool guidance
-Each tool's description contains its own usage rules (when to call, when NOT to call, required prerequisites, post-call follow-ups). Read the description of every tool you call — that is where the per-tool workflow patterns live.
+NEVER dump raw JSON or expose IDs (except actionable ones like conversationId). Synthesize in natural language; surface top 1–3 points unless asked for full list. Fabricate nothing.
 
-# Authentication
-Pass your API key in the \`x-api-key\` request header (not \`Authorization: Bearer\`).
+# Authentication & Opportunity Lifecycle
+API key in \`x-api-key\` header. Opportunities: draft → pending → accepted/rejected. Agent acceptance ≠ owner approval. Only call update_opportunity with accepted after explicit user confirmation.
 
-# Opportunity lifecycle
-Opportunities move through: draft → pending → accepted (or rejected).
+# Tool Guidance
+Read each tool's description for usage rules (when, prerequisites, follow-ups). Tools contain workflow patterns.
 
-- **draft** (you created it, not yet sent): offer to send it; confirm before calling update_opportunity with pending.
-- **pending, you sent it**: waiting for the other side — nothing to do.
-- **pending, you received it**: the other person is waiting for your response. Surface it to the user and ask if they want to start a chat. Only call update_opportunity with accepted after explicit user confirmation.
-- **accepted**: an owner accepted. Status alone never proves an H2H thread; mention one only when this result returns H2H evidence.
-
-A **completed** negotiation means only that agents concluded. Agent \`accept\` may leave a \`pending\` match awaiting owner review; it is not owner acceptance or an H2H thread. Keep rejected, stalled, draft, expired, and pending distinct.
-
-Never accept a received opportunity without explicit user approval in the current conversation.
-
-# Decision questions after discovery
-
-After \`discover_opportunities\`, the tool result may include a second text block starting with \`Decision questions (structured): ...\`. This means the discovery engine ran negotiations but needs human input to sharpen the next turn — e.g. clarify timing, role, stage, or location.
-
-**When this block is present:**
-1. Parse the \`questions\` array from the JSON after the sentinel.
-2. Each question has \`title\` (decision domain, ≤12 chars), \`prompt\` (ends in \`?\`), \`options\` (2–4 items, each with \`label\` and \`description\`), and \`multiSelect\`. The safest option is labeled \`... (Recommended)\`.
-3. Present each question in natural language: ask the \`prompt\`, list options as \`**{label}** — {description}\`. Never expose the JSON or technical field names.
-4. Wait for the user's answer, then fold it into the next \`discover_opportunities(searchQuery=...)\` call.
-
-**Elicitation-capable clients** (those that declared \`elicitation\` support in \`initialize\`): the server dispatches \`elicitation/create\` requests directly — answers are written back to the chat session automatically. You will not see the envelope as a follow-up task in that case.
 `.trim();
 /**
  * Extracts a Bearer token from an HTTP Authorization header.
@@ -449,11 +338,136 @@ export function parseClientSurface(raw) {
     }
     return 'web';
 }
-export function createMcpServer(deps, authResolver, scopedDepsFactory) {
-    // Tools exempt from the agent-registration gate — available before registration is complete.
-    const AGENT_GATE_EXEMPT = new Set(['register_agent', 'read_docs', 'scrape_url']);
+export function createMcpServer(deps, authResolver, scopedDepsFactory, policyOptions = {}, authorizationObserver) {
     const server = new McpServer({ name: 'index-network', version: '1.0.0' }, { instructions: MCP_INSTRUCTIONS });
     const toolMetadata = getCachedMcpToolMetadata(deps);
+    const capabilityPolicy = new McpCapabilityPolicy(policyOptions);
+    // Fail-closed authorization observability: emit a safe, secret-free denial
+    // event at the host boundary. Never let an observer failure change the
+    // decision or surface a credential — the denial stands regardless.
+    const observeDenial = (input) => {
+        if (!authorizationObserver)
+            return;
+        try {
+            authorizationObserver.onCapabilityDenied(buildMcpAuthorizationDenialEvent(input));
+        }
+        catch (err) {
+            logger.debug('MCP authorization observer threw — ignoring', {
+                toolName: input.toolName,
+                error: err instanceof Error ? err.message : String(err),
+            });
+        }
+    };
+    // Both snapshots are scoped to this MCP server/connection. Permission and
+    // onboarding changes therefore apply only after the caller reconnects or
+    // refreshes its session. They are never shared with the static tool metadata
+    // cache, so a different server/principal cannot inherit decisions.
+    let authenticatedRequest;
+    let resolvedRequest;
+    const extractAuthInput = (httpReq) => ({
+        bearerToken: extractBearerToken(httpReq),
+        apiKey: httpReq.headers.get('x-api-key') ?? undefined,
+        clientSurface: parseClientSurface(httpReq.headers.get('x-index-surface')),
+        telegramHandle: httpReq.headers.get('x-index-telegram-handle') ?? undefined,
+        telegramUsername: httpReq.headers.get('x-index-telegram-username') ?? undefined,
+    });
+    const getAuthenticatedRequest = (httpReq) => {
+        if (authenticatedRequest)
+            return authenticatedRequest;
+        authenticatedRequest = (async () => {
+            const identity = McpResolvedIdentitySchema.parse(await authResolver.resolveIdentity(extractAuthInput(httpReq)));
+            const agentRecord = identity.agentId
+                ? await deps.agentDatabase?.getAgentWithRelations(identity.agentId) ?? null
+                : null;
+            const agent = agentRecord
+                ? {
+                    id: agentRecord.id,
+                    ownerId: agentRecord.ownerId,
+                    type: agentRecord.type,
+                    status: agentRecord.status,
+                    permissions: agentRecord.permissions.map((permission) => ({
+                        agentId: permission.agentId,
+                        userId: permission.userId,
+                        scope: permission.scope,
+                        scopeId: permission.scopeId,
+                        actions: [...permission.actions],
+                    })),
+                }
+                : null;
+            return {
+                identity,
+                agent,
+                // Onboarding can only reduce access, so this snapshot is sufficient to
+                // reject forged/hidden calls before resolving chat context.
+                preliminarySubject: resolveMcpCapabilitySubject({
+                    identity,
+                    isOnboarding: false,
+                    agent,
+                }),
+            };
+        })();
+        return authenticatedRequest;
+    };
+    const getResolvedRequest = (httpReq) => {
+        if (resolvedRequest)
+            return resolvedRequest;
+        resolvedRequest = (async () => {
+            const authenticated = await getAuthenticatedRequest(httpReq);
+            const context = await resolveChatContext({
+                database: deps.database,
+                userId: authenticated.identity.userId,
+                contactsEnabled: deps.contactsEnabled,
+            });
+            context.isMcp = true;
+            if (authenticated.identity.agentId) {
+                context.agentId = authenticated.identity.agentId;
+            }
+            // Trusted provenance seam (IND-593): only the server-resolved session
+            // identity — never a caller-supplied field — marks a direct MCP owner
+            // interaction for the opportunity owner-approval boundary. The
+            // capability-local extension deliberately keeps this field out of the
+            // shared helper's negotiation/question cycle.
+            bindOwnerApprovalProvenance(context, {
+                surface: 'mcp',
+                sessionAuthenticated: authenticated.identity.isSessionAuth === true,
+            });
+            if (authenticated.identity.clientSurface) {
+                context.clientSurface = authenticated.identity.clientSurface;
+            }
+            applyNetworkScopeToContext(context, authenticated.identity.networkScopeId);
+            const subject = resolveMcpCapabilitySubject({
+                identity: authenticated.identity,
+                isOnboarding: context.isOnboarding,
+                agent: authenticated.agent,
+            });
+            // Bind the typed resolved caller context so tools with
+            // permission-projected output (read_activity_summary) can apply the
+            // centralized projection without re-deriving principal state.
+            context.mcpCaller = resolveMcpActivityCaller(subject);
+            return {
+                ...authenticated,
+                context,
+                subject,
+            };
+        })();
+        return resolvedRequest;
+    };
+    const capabilityDeniedResult = (decision, context) => {
+        const message = decision.reason === 'onboarding_required' && context
+            ? buildMcpOnboardingMessage(context)
+            : 'This capability is not available to the authenticated principal. Reconnect or refresh the session after an administrator changes permissions.';
+        return {
+            content: [{
+                    type: 'text',
+                    text: JSON.stringify({
+                        error: 'Capability not authorized',
+                        code: 'MCP_CAPABILITY_DENIED',
+                        message,
+                    }),
+                }],
+            isError: true,
+        };
+    };
     for (const toolDef of toolMetadata) {
         const toolName = toolDef.name;
         server.registerTool(toolName, {
@@ -472,16 +486,33 @@ export function createMcpServer(deps, authResolver, scopedDepsFactory) {
                         isError: true,
                     };
                 }
-                // Extract transport-neutral auth input DTO from the HTTP request
-                const mcpAuthInput = {
-                    bearerToken: extractBearerToken(httpReq),
-                    apiKey: httpReq.headers.get('x-api-key') ?? undefined,
-                    clientSurface: parseClientSurface(httpReq.headers.get('x-index-surface')),
-                    telegramHandle: httpReq.headers.get('x-index-telegram-handle') ?? undefined,
-                    telegramUsername: httpReq.headers.get('x-index-telegram-username') ?? undefined,
-                };
-                // Resolve authenticated identity from the auth input DTO
-                const { userId, agentId, isSessionAuth, networkScopeId, clientSurface } = await authResolver.resolveIdentity(mcpAuthInput);
+                // Resolve the request-local auth/agent snapshot, then repeat the exact
+                // tools/list policy decision before chat context, scoped DB, registry,
+                // or handler work. This is the forged-call fail-closed boundary.
+                const authenticated = await getAuthenticatedRequest(httpReq);
+                const preliminaryDecision = capabilityPolicy.authorize(authenticated.preliminarySubject, toolName);
+                if (!preliminaryDecision.allowed) {
+                    observeDenial({
+                        phase: 'tools/call',
+                        toolName,
+                        subject: authenticated.preliminarySubject,
+                        decision: preliminaryDecision,
+                    });
+                    return capabilityDeniedResult(preliminaryDecision);
+                }
+                const resolved = await getResolvedRequest(httpReq);
+                const decision = capabilityPolicy.authorize(resolved.subject, toolName);
+                if (!decision.allowed) {
+                    observeDenial({
+                        phase: 'tools/call',
+                        toolName,
+                        subject: resolved.subject,
+                        decision,
+                    });
+                    return capabilityDeniedResult(decision, resolved.context);
+                }
+                const { identity, context } = resolved;
+                const { userId, agentId } = identity;
                 reportUserId = userId;
                 // Per-principal MCP throttle. Runs BEFORE any DB work so a throttled
                 // call short-circuits cheaply. The /mcp transport bypasses the
@@ -513,10 +544,7 @@ export function createMcpServer(deps, authResolver, scopedDepsFactory) {
                                     type: 'text',
                                     text: JSON.stringify({
                                         error: 'Rate limit exceeded',
-                                        message: `Too many ${toolName} calls in a short period. Wait ${retryAfterSec}s before retrying.` +
-                                            (toolName === 'discover_opportunities'
-                                                ? ` If a discovery run is in progress, poll get_discovery_run instead of calling discover_opportunities again.`
-                                                : ''),
+                                        message: `Too many ${toolName} calls in a short period. Wait ${retryAfterSec}s before retrying.`,
                                         retryAfterSec,
                                     }),
                                 }],
@@ -524,54 +552,7 @@ export function createMcpServer(deps, authResolver, scopedDepsFactory) {
                         };
                     }
                 }
-                // Resolve chat context for the user (mark as MCP — no interactive UI available)
-                const context = await resolveChatContext({ database: deps.database, userId, contactsEnabled: deps.contactsEnabled });
                 reportContext = context;
-                context.isMcp = true;
-                if (agentId) {
-                    context.agentId = agentId;
-                }
-                if (clientSurface) {
-                    context.clientSurface = clientSurface;
-                }
-                // Network-scoped agents inherit their bound network as the implicit chat
-                // scope. Tools consume the scope envelope and derive any concrete
-                // allowed network IDs from it plus the user's memberships.
-                applyNetworkScopeToContext(context, networkScopeId);
-                // Gate: API-key callers (background agents) must register before using most tools.
-                // OAuth/JWT session callers (human MCP clients such as Claude Code) are exempt —
-                // their identity is already established via the auth flow and they have no agent entity.
-                if (!isSessionAuth && !context.agentId && !AGENT_GATE_EXEMPT.has(toolName)) {
-                    return {
-                        content: [{
-                                type: 'text',
-                                text: JSON.stringify({
-                                    error: 'Agent not registered',
-                                    message: 'You must register as an agent before using Index tools. ' +
-                                        'Call register_agent with your agent name to establish an identity. ' +
-                                        'The tools register_agent, read_docs, and scrape_url are available without registration.',
-                                }),
-                            }],
-                        isError: true,
-                    };
-                }
-                // Gate: non-onboarded users can only use onboarding-related tools.
-                // Mirrors the chat orchestrator's ONBOARDING MODE — the MCP client must
-                // walk the user through profile creation, Gmail connect, intent capture,
-                // and complete_onboarding() before full tool access is granted.
-                if (context.isOnboarding && !ONBOARDING_ALLOWED.has(toolName)) {
-                    const onboardingSteps = buildMcpOnboardingMessage(context);
-                    return {
-                        content: [{
-                                type: 'text',
-                                text: JSON.stringify({
-                                    error: 'Onboarding required',
-                                    message: onboardingSteps,
-                                }),
-                            }],
-                        isError: true,
-                    };
-                }
                 // Build per-request scoped databases via injected factory.
                 // Network-scoped agents are clamped to their bound network plus the user's
                 // personal network — they cannot reach other networks even when the user is
@@ -589,8 +570,9 @@ export function createMcpServer(deps, authResolver, scopedDepsFactory) {
                 reportDeps = requestDeps;
                 // Re-create registry with per-request deps for scoped database access.
                 // Do not use cached registration metadata handlers here: tool handlers
-                // close over userDb/systemDb when the registry is created.
-                const requestRegistry = createToolRegistry(requestDeps);
+                // close over userDb/systemDb when the registry is created. The MCP
+                // surface profile keeps the tools/call lookup identical to tools/list.
+                const requestRegistry = createToolRegistry(requestDeps, { surface: 'mcp' });
                 const requestTool = requestRegistry.get(toolName);
                 if (!requestTool) {
                     return {
@@ -619,39 +601,6 @@ export function createMcpServer(deps, authResolver, scopedDepsFactory) {
                     traceEmitter: createMcpTraceEmitter(toolName, ctx),
                 });
                 const { text: sanitizedText, isError: toolIsError } = sanitizeMcpResult(result);
-                // Slice 5: decision questions post-processing for discover_opportunities only.
-                if (toolName === "discover_opportunities" && !toolIsError) {
-                    const questions = extractDecisionQuestions(sanitizedText);
-                    if (questions) {
-                        const envelopeBlock = {
-                            type: "text",
-                            text: renderQuestionsEnvelope(questions),
-                        };
-                        const supportsElicitation = !!server.server.getClientCapabilities()?.elicitation;
-                        // Capture into a local const so TS preserves the narrowing
-                        // inside the callback below. Optional chains don't survive
-                        // across closure boundaries under strict mode.
-                        const elicitInput = ctx.mcpReq?.elicitInput;
-                        if (supportsElicitation && elicitInput) {
-                            // Sequential — never parallel (day-one rule). We await the loop
-                            // before returning the tool result so test harnesses can observe
-                            // the dispatched calls deterministically.
-                            await dispatchElicitations({
-                                userId,
-                                questions,
-                                elicitInput: (params) => elicitInput(params),
-                                chatMessageWriter: deps.chatMessageWriter,
-                            });
-                        }
-                        return {
-                            content: [
-                                { type: "text", text: sanitizedText },
-                                envelopeBlock,
-                            ],
-                            ...(toolIsError ? { isError: true } : {}),
-                        };
-                    }
-                }
                 return {
                     content: [{ type: 'text', text: sanitizedText }],
                     ...(toolIsError ? { isError: true } : {}),
@@ -685,6 +634,31 @@ export function createMcpServer(deps, authResolver, scopedDepsFactory) {
             }
         });
     }
+    // McpServer's default tools/list handler exposes every registered tool.
+    // Replace it with a principal-aware inventory built from the same static
+    // metadata and the same policy used above for tools/call.
+    server.server.setRequestHandler('tools/list', async (_request, ctx) => {
+        const httpReq = ctx.http?.req;
+        if (!httpReq) {
+            throw new Error('No HTTP request available in MCP context');
+        }
+        const resolved = await getResolvedRequest(httpReq);
+        const visibleNames = new Set(capabilityPolicy.visibleToolNames(resolved.subject, toolMetadata.map((tool) => tool.name)));
+        return {
+            tools: toolMetadata
+                .filter((tool) => visibleNames.has(tool.name))
+                .map((tool) => ({
+                name: tool.name,
+                description: tool.description,
+                // `jsonSchema` is the zod-derived JSON Schema for the tool's object
+                // input, so it always has `type: 'object'`. The SDK describes the same
+                // value with two different types — `JsonSchemaType` (json-schema-typed,
+                // used by `fromJsonSchema`) and the wire-level `Tool['inputSchema']` —
+                // which are structurally incompatible, so bridge them at this boundary.
+                inputSchema: tool.jsonSchema,
+            })),
+        };
+    });
     logger.verbose('MCP server created', { toolCount: toolMetadata.length });
     return server;
 }

package/dist/negotiation/application/negotiation.agent.js

@@ -4,6 +4,7 @@ import { SystemNegotiationTurnSchema, FinalNegotiationTurnSchema } from "../doma
 import { turnSchemaFor, fallbackActionFor } from "../domain/negotiation.protocol.js";
 import { renderNegotiatorMemorySection } from "../domain/negotiation.memory.js";
 import { renderBargainingShiftSection } from "../domain/negotiation.deadlock.js";
+import { configuredNegotiatorStance, stanceActionRules, stanceJobFraming, stanceQuerySatisfiedRule } from "../domain/negotiation.stance.contracts.js";
 import { attributedDialogueIsEmpty, renderAttributedPriorDialogue } from "../negotiation.attribution.js";
 import { protocolLogger } from "../../shared/observability/protocol.logger.js";
 const agentLog = protocolLogger("IndexNegotiator");
@@ -14,7 +15,7 @@ const SYSTEM_PROMPT = `You are the Index Negotiator, an AI agent acting on behal
 Your user's role in this connection: {role}
 Network context: {networkContext}
 
-Your job: Evaluate whether this connection genuinely serves {userName}'s interests given their role. Argue their case honestly — acknowledge weaknesses, but advocate for genuine fit.
+Your job: Evaluate whether this connection genuinely serves {userName}'s interests given their role. {stanceFraming}
 
 Rules:
 {actionRules}
@@ -28,13 +29,27 @@ const V1_ACTION_RULES = `- On the FIRST turn: Propose the connection case. Expla
   - "counter" if you have specific objections but see potential
   - "accept" if the match genuinely benefits {userName}
   - "reject" if the match does not serve {userName}'s needs`;
-/** v2 initiator seat: reaching stance — accept is structurally unavailable. */
+/**
+ * v2 initiator seat: reaching stance — accept is structurally unavailable.
+ *
+ * The closing rule (IND-570) is the initiator-only decision link between
+ * clarification and walking away: this seat is the one that can end a match it
+ * started, so once information arriving through EITHER clarification channel —
+ * the counterparty's answer to a `question`, or the acting user's own answers /
+ * private consultation surfaced between sessions — disqualifies the match, the
+ * seat should `withdraw` instead of countering indefinitely. It is worded
+ * channel-neutrally (it never names the `ask_user` action) so it renders
+ * correctly whether or not the caller granted `canAskUser`; the answer context
+ * it refers to is injected independently of that grant. It must never reach
+ * `V2_COUNTERPARTY_RULES` (that seat has no `withdraw`) or `V1_ACTION_RULES`.
+ */
 const V2_INITIATOR_RULES = `- You hold the INITIATING seat: your user's side surfaced this match and you are reaching out. Only the counterparty may accept — "accept" is NOT available to you.
 - On the FIRST turn: Make the outreach case. Explain why the connection would benefit both parties. Set action to "outreach".
 - On SUBSEQUENT turns: Evaluate the counterparty's arguments. Either:
   - "counter" if you have specific objections but see potential
   - "question" if you need a specific clarification from the counterparty
-  - "withdraw" if the match does not serve {userName}'s needs`;
+  - "withdraw" if the match does not serve {userName}'s needs
+- WITHDRAW ON DISQUALIFYING INFORMATION: clarification exists to resolve uncertainty, so act on what it returns. When something you have learned since reaching out — the counterparty's answer to one of your questions, or {userName}'s own answers or private consultation provided between sessions — reveals a reason this match no longer serves {userName}, choose "withdraw" rather than countering or questioning again. Once a disqualifying reason is on the table, do not keep negotiating the match.`;
 /**
  * v2 client-consult pause rule (P3.2). Appended to either seat's rules only
  * when the caller granted `canAskUser` — the action never appears in the
@@ -96,6 +111,11 @@ export class IndexNegotiator {
         // Deadlock→bargaining stance (IND-428): v2 only — defense in depth on top
         // of the graph-side gating, mirroring the canAskUser guard above.
         const bargainingActive = input.bargaining != null && version === "v2";
+        // Negotiator stance (IND-611). Resolved from the environment once per turn
+        // via the domain contract, exactly like `configuredScreenMode()`. Under the
+        // `advocate` default every stance fragment below is the legacy string, so
+        // the rendered prompt is byte-identical to the pre-IND-611 build.
+        const stance = configuredNegotiatorStance();
         const schema = turnSchemaFor(version, seat, isFinalTurn, {
             system: SystemNegotiationTurnSchema,
             final: FinalNegotiationTurnSchema,
@@ -106,7 +126,7 @@ export class IndexNegotiator {
         const networkContext = input.indexContext.prompt || "General discovery";
         const actionRules = (version === "v2"
             ? (seat === "initiator" ? V2_INITIATOR_RULES : V2_COUNTERPARTY_RULES)
-            : V1_ACTION_RULES) + (canAskUser ? ASK_USER_RULE : "");
+            : V1_ACTION_RULES) + stanceActionRules(stance) + (canAskUser ? ASK_USER_RULE : "");
         const finalTurnInstruction = input.isFinalTurn
             ? (version === "v2"
                 ? (seat === "initiator"
@@ -123,10 +143,13 @@ export class IndexNegotiator {
 QUERY PRIORITY RULE: This search query is the PRIMARY criterion for this negotiation. Before evaluating intents or profile overlap, first answer: does ${otherName} satisfy the search query "${input.discoveryQuery}"?
 - If the query is a role or identity term (e.g. "samurai", "investors", "designers"): check whether ${otherName} IS that thing based on their profile. Subject-matter adjacency does not count (drawing samurai ≠ being a samurai, raising funding ≠ being an investor).
 - If ${otherName} does NOT satisfy the query: REJECT the match. Background intents cannot rescue a query mismatch.
-- If ${otherName} DOES satisfy the query: PROPOSE or ACCEPT the connection and evaluate fit normally using intents and profile data.`
+${stanceQuerySatisfiedRule(stance, otherName, userName)}`
             : '';
         const systemPrompt = SYSTEM_PROMPT
             .replace("{actionRules}", actionRules)
+            // Stance framing is substituted BEFORE the global {userName} replace so
+            // its own {userName} placeholders resolve in the same pass.
+            .replace("{stanceFraming}", stanceJobFraming(stance))
             .replace(/{userName}/g, userName)
             .replace("{discoveryContext}", discoveryContext)
             .replace("{discoveryQueryContext}", discoveryQueryContext)
@@ -138,6 +161,7 @@ QUERY PRIORITY RULE: This search query is the PRIMARY criterion for this negotia
             userName,
             canAskUser,
             consecutiveNonConvergent: input.bargaining?.consecutiveNonConvergent ?? 0,
+            stance,
         }))
             .replace("{negotiatorMemory}", renderNegotiatorMemorySection(input.memory ?? []));
         const formatTurnLine = (t, i) => {

package/dist/negotiation/application/negotiation.graph.d.ts

@@ -619,10 +619,8 @@ export interface NegotiationResult {
 }
 /**
  * Per-candidate resolution hook — fires as each negotiation settles, before
- * Promise.all aggregates. Used by the orchestrator branch to progressively
- * stream `opportunity_draft_ready` events as each candidate resolves, rather
- * than emitting all at once after the full fan-out completes. Awaited so the
- * caller can run async work (DB update, event emit) before the next settle.
+ * Promise.all aggregates. Awaited so the caller can run async work before the
+ * next settle.
  *
  * `turns` and `outcome` are passed through from the underlying negotiation
  * graph so consumers can build per-candidate decision-question inputs without
@@ -650,7 +648,6 @@ export declare function negotiateCandidates(negotiationGraph: NegotiationGraphLi
     indexContextOverrides?: Map<string, string>;
     timeoutMs?: number;
     onCandidateResolved?: OnNegotiationResolved;
-    trigger?: "orchestrator" | "ambient";
     /**
      * Initiator seat for every candidate session in this fan-out (v2 stamp).
      * Passed through to the negotiation graph, which may still override it by