@intentius/chant 0.72.2 → 0.72.4

package/src/cli/commands/init.ts

@@ -1,10 +1,10 @@
 import { existsSync, mkdirSync, writeFileSync, readdirSync, readFileSync } from "fs";
 import { join, resolve, dirname } from "path";
 import { fileURLToPath } from "url";
-import { homedir } from "os";
 import { createInterface } from "readline";
 import { formatSuccess, formatWarning } from "../format";
 import { loadPlugin } from "../plugins";
+import { MCP_CONFIG_FILENAME, detectPackageManager, generateMcpConfig, mcpConfigPath } from "../mcp-config";
 
 /** Read the current chant package version from our own package.json. */
 export function getChantVersion(): string {
@@ -29,7 +29,7 @@ export interface InitOptions {
   template?: string;
   /** Force init even in non-empty directory */
   force?: boolean;
-  /** Skip MCP config generation */
+  /** Skip writing the project's `.mcp.json` (`--skip-mcp`) */
   skipMcp?: boolean;
   /** Skip interactive install prompt */
   skipInstall?: boolean;
@@ -55,46 +55,6 @@ export interface InitResult {
   error?: string;
 }
 
-/**
- * Detect whether the user's project uses bun or npm.
- * Checks for lock files.
- */
-function detectPackageManager(dir?: string): "bun" | "npm" {
-  if (dir && (existsSync(join(dir, "bun.lockb")) || existsSync(join(dir, "bun.lock")))) return "bun";
-  return "npm";
-}
-
-/**
- * Detect the IDE environment for MCP config
- */
-function detectIdeEnvironment(): "claude-code" | "cursor" | "generic" {
-  // Check for Claude Code
-  if (existsSync(join(homedir(), ".claude"))) {
-    return "claude-code";
-  }
-
-  // Check for Cursor
-  if (existsSync(join(homedir(), ".cursor"))) {
-    return "cursor";
-  }
-
-  return "generic";
-}
-
-/**
- * Get MCP config directory based on IDE
- */
-function getMcpConfigDir(ide: "claude-code" | "cursor" | "generic"): string {
-  switch (ide) {
-    case "claude-code":
-      return join(homedir(), ".claude");
-    case "cursor":
-      return join(homedir(), ".cursor");
-    default:
-      return join(homedir(), ".config", "mcp");
-  }
-}
-
 /**
  * Generate package.json content
  */
@@ -224,22 +184,6 @@ export interface ChantConfig {
 `;
 }
 
-/**
- * Generate MCP config
- */
-function generateMcpConfig(pm: "bun" | "npm"): string {
-  const config = {
-    mcpServers: {
-      chant: {
-        command: pm === "bun" ? "bunx" : "npx",
-        args: ["chant", "serve", "mcp"],
-      },
-    },
-  };
-
-  return JSON.stringify(config, null, 2);
-}
-
 /**
  * Prompt user for install
  */
@@ -441,19 +385,16 @@ export async function initCommand(options: InitOptions): Promise<InitResult> {
     warnings,
   );
 
-  // Generate MCP config
+  // Generate the project's MCP config. It lands in the directory init was
+  // pointed at, like everything else init produces, and at the path
+  // `chant doctor` checks — see ../mcp-config.ts for why project scope, and
+  // chant #2383 for the three-way disagreement that came of writing it into
+  // the user's home directory instead.
   if (!options.skipMcp) {
-    const ide = detectIdeEnvironment();
-    const mcpDir = getMcpConfigDir(ide);
-
-    if (!existsSync(mcpDir)) {
-      mkdirSync(mcpDir, { recursive: true });
-    }
-
     writeIfNotExists(
-      join(mcpDir, "mcp.json"),
+      mcpConfigPath(targetDir),
       generateMcpConfig(detectPackageManager(targetDir)),
-      `~/.${ide === "generic" ? "config/mcp" : ide}/mcp.json`,
+      MCP_CONFIG_FILENAME,
       createdFiles,
       warnings,
     );

package/src/cli/commands/update.ts

@@ -4,6 +4,7 @@ import { createRequire } from "module";
 import { formatSuccess, formatWarning, formatError } from "../format";
 import { loadChantConfig } from "../../config";
 import { loadPlugins } from "../plugins";
+import { writeProjectMcpConfig } from "../mcp-config";
 
 /**
  * Update command options
@@ -178,6 +179,14 @@ export async function updateCommand(options: UpdateOptions): Promise<UpdateResul
     warnings.push("Could not load plugins for skill installation");
   }
 
+  // Restore the project's MCP registration if it went missing. This is what
+  // makes the doctor's `mcp-config` remediation runnable: `chant init`
+  // refuses a non-empty directory without --force, so an already scaffolded
+  // project needs some other command to put the file back, and this is the
+  // same command the doctor's skills check already points at (chant #2383).
+  const writtenMcp = writeProjectMcpConfig(projectDir);
+  if (writtenMcp) synced.push(writtenMcp);
+
   return {
     success: true,
     synced,

package/src/cli/handlers/init.ts

@@ -19,6 +19,7 @@ export async function runInit(ctx: CommandContext): Promise<number> {
     template: args.template,
     skill: args.skill,
     force: args.force,
+    skipMcp: args.skipMcp,
     skipInstall: true,
   });
   await printInitResult(result, { skipInstall: false, cwd: args.path });

package/src/cli/handlers/operator.ts

@@ -29,6 +29,9 @@ import { readConvergeLedger, type ConvergeTickRecord } from "../../lifecycle/con
 import { readRunLedger } from "../../lifecycle/run-ledger";
 import type { OpRunRecord } from "../../op/runtime";
 import type { GateResolutionRecord, PendingGateRecord } from "../../lifecycle/gate-ledger";
+import {
+  currentGateOrigin, isModelAuthored, sameOriginRefusal, UNATTESTED_APPROVER, type GateOrigin,
+} from "../../lifecycle/gate-origin";
 import {
   appendGateResolution, appendPendingGate, readGateResolutions, readGateLedger,
   latestResolutionSince, latestPendingGate, isPendingGateExpired,
@@ -694,6 +697,7 @@ export async function runApprove(ctx: CommandContext): Promise<number> {
     note: ctx.args.note,
     url: ctx.args.url,
     plan: ctx.args.plan,
+    allowSameOrigin: ctx.args.allowSameOrigin,
   });
   if (!outcome.ok) return 1;
 
@@ -708,6 +712,21 @@ export async function runApprove(ctx: CommandContext): Promise<number> {
 
 /** What a caller supplies alongside the op and gate names. */
 export interface GateApprovalOptions {
+  /**
+   * The channel this resolution arrived on (chant#2384). Defaults to the
+   * process's own — `"cli"` unless an entry point declared otherwise — and is
+   * a parameter only so a caller that knows better can say so.
+   */
+  origin?: GateOrigin;
+  /**
+   * Record a resolution that the same-origin rule would refuse (chant#2384).
+   *
+   * There is a legitimate case: a single operator driving an agent, who wants
+   * the model's run resolved from the same session and accepts what that
+   * means. The override exists so that is a deliberate act with a trace on the
+   * record, rather than the default.
+   */
+  allowSameOrigin?: boolean;
   /** `--actor`/`--approver`; falls back to the CI or shell identity. */
   actor?: string;
   /** `--note` — free-text prose. */
@@ -815,7 +834,33 @@ export async function recordGateApproval(
     planDigest = standing.planDigest;
   }
 
-  const resolvedBy = opts.actor ?? process.env.GITHUB_ACTOR ?? process.env.GITLAB_USER_LOGIN ?? process.env.USER ?? "unknown";
+  // chant#2384 — the gate's whole value is that its two halves have different
+  // authors. At a shell they do: a person runs, reads the plan, and approves.
+  // On MCP and ACP the person's only act was launching the server, and every
+  // call after is the model's, so a gate reached over one of those channels and
+  // resolved over the same one has no second party in it. Refused by default,
+  // the way #2300 refuses a plan nobody approved.
+  const origin = opts.origin ?? currentGateOrigin();
+  const standingForOrigin = latestPendingGate((await readGateLedger(opName)).pending, gate);
+  const refusal = sameOriginRefusal(standingForOrigin?.origin, origin);
+  if (refusal && !opts.allowSameOrigin) {
+    console.error(formatError({
+      message: `Gate "${gate}" on "${opName}" cannot be resolved from here: ${refusal}`,
+      hint:
+        `Approve it from a channel the run did not come from — \`chant approve ${opName} ${gate}\` ` +
+        `at a shell is the usual one. If resolving from the same channel genuinely is the intent, ` +
+        `pass --allow-same-origin, which records that it was deliberate.`,
+    }));
+    return { ok: false };
+  }
+
+  const resolvedBy = opts.actor
+    ?? (isModelAuthored(origin)
+      // A channel that cannot attest to a name does not get to write one down.
+      // "unattested" reads as what it is; a name the model chose would read in
+      // the ledger exactly like a name a person gave.
+      ? UNATTESTED_APPROVER
+      : process.env.GITHUB_ACTOR ?? process.env.GITLAB_USER_LOGIN ?? process.env.USER ?? "unknown");
 
   const { record } = await appendGateResolution({
     op: opName,
@@ -825,6 +870,8 @@ export async function recordGateApproval(
     ...(opts.note ? { note: opts.note } : {}),
     ...(url ? { url } : {}),
     ...(planDigest !== undefined ? { planDigest } : {}),
+    origin,
+    ...(refusal && opts.allowSameOrigin ? { sameOriginOverride: true } : {}),
   });
   const pushed = await reportedPush(
     `The resolution is recorded locally on ${LIFECYCLE_BRANCH}. Until it reaches the remote, ` +

package/src/cli/main.ts

@@ -91,6 +91,7 @@ const BOOLEAN_FLAGS = new Set([
   "--check-snapshot",
   "--fail-on-drift",
   "--durable-requests",
+  "--skip-mcp",
 ]);
 
 /**
@@ -132,6 +133,7 @@ export function parseArgs(args: string[]): ParsedArgs {
     useComposites: false,
     reportFile: undefined,
     skill: undefined,
+    skipMcp: undefined,
     src: undefined,
     env: undefined,
   };
@@ -252,6 +254,8 @@ export function parseArgs(args: string[]): ParsedArgs {
       result.useComposites = true;
     } else if (arg === "--skill") {
       result.skill = args[++i];
+    } else if (arg === "--skip-mcp") {
+      result.skipMcp = true;
     } else if (arg === "--src") {
       result.src = args[++i];
     } else if (arg === "--env") {
@@ -411,6 +415,10 @@ export function parseArgs(args: string[]): ParsedArgs {
       result.note = args[++i];
     } else if (arg === "--expire") {
       result.expire = true;
+    } else if (arg === "--allow-same-origin") {
+      // chant#2384 — record a resolution the same-origin rule would refuse,
+      // deliberately. Flagged on the record, not just accepted quietly.
+      result.allowSameOrigin = true;
     } else if (arg === "--plan") {
       result.plan = args[++i];
     } else if (arg === "--url") {
@@ -687,6 +695,7 @@ Options:
                         \`environments\` when declared.
   -t, --template <name> Init template (e.g. node-pipeline, docker-build)
   --skill <name>        Init: install only this skill from the lexicon
+  --skip-mcp            Init: scaffold without writing the project's .mcp.json
   --fix                 Auto-fix fixable issues (lint command)
   --force               Force overwrite existing files (import command)
   -w, --watch           Watch for changes and rebuild/re-lint (build, lint)

package/src/cli/mcp/docs-parity.test.ts

@@ -0,0 +1,133 @@
+import { describe, test, expect } from "vitest";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { join } from "node:path";
+import { McpServer, SUPPORTED_PROTOCOL_VERSIONS } from "./server";
+import type { ToolDefinition, ResourceDefinition } from "./types";
+
+/**
+ * The MCP docs say what this server offers; this test says they are right.
+ *
+ * `docs/src/content/docs/cli/mcp.mdx` is a hand-written list of tools,
+ * resources, methods and protocol revisions, and the server is the thing that
+ * actually registers them. Nothing connected the two, so the page fell two
+ * revisions behind twice over (#2385): it advertised six tools while the
+ * constructor registered thirteen, left `lifecycle-snapshot` and
+ * `lifecycle-diff` undocumented anywhere, omitted `server/discover` (#1194)
+ * and `chant://knowledge` (#1867), and claimed protocol version 2024-11-05
+ * long after #1194 made 2026-07-28 the preferred one.
+ *
+ * Each claim here is read back against the running server rather than against
+ * source text: the tool and resource lists come from a real `McpServer`
+ * answering `tools/list` and `resources/list`, which is what a client sees.
+ * The dispatch methods are the exception and are read out of `server.ts` by
+ * regex, because a switch statement has no listing API; that regex fails
+ * loudly if the switch is ever restructured.
+ *
+ * Same shape as `scripts/fold-depth-bound-claims.test.ts` (#2367) and
+ * `scripts/lexicon-count-claims.test.ts` (#2316): a doc claim pinned to
+ * ground truth, with a message that says what to edit.
+ */
+
+const repoRoot = fileURLToPath(new URL("../../../../../", import.meta.url));
+const MCP_DOC = join("docs", "src", "content", "docs", "cli", "mcp.mdx");
+const GUIDE_DOC = join("docs", "src", "content", "docs", "guide", "agent-integration.mdx");
+const SERVER_SRC = join("packages", "core", "src", "cli", "mcp", "server.ts");
+
+const mcpDoc = readFileSync(join(repoRoot, MCP_DOC), "utf8");
+const guideDoc = readFileSync(join(repoRoot, GUIDE_DOC), "utf8");
+const serverSrc = readFileSync(join(repoRoot, SERVER_SRC), "utf8");
+
+/** What a client is told when it asks, built from a server with no plugins loaded. */
+async function servedListing(method: "tools/list" | "resources/list"): Promise<string[]> {
+  const response = await new McpServer().handleRequest({ jsonrpc: "2.0", id: 1, method });
+  const result = response.result as { tools?: ToolDefinition[]; resources?: ResourceDefinition[] };
+  const names = result.tools?.map((t) => t.name) ?? result.resources?.map((r) => r.uri);
+  if (!names || names.length === 0) {
+    throw new Error(`mcp docs parity: ${method} returned nothing to compare the docs against`);
+  }
+  return names;
+}
+
+/** The lines of one `##`/`###` section, up to the next heading at any level. */
+function section(doc: string, heading: string, label: string): string {
+  const start = doc.indexOf(heading);
+  if (start < 0) throw new Error(`mcp docs parity: no "${heading}" heading in ${label} — was it renamed? Update this test to match.`);
+  const rest = doc.slice(start + heading.length);
+  const end = rest.search(/\n#{1,4} /);
+  return end < 0 ? rest : rest.slice(0, end);
+}
+
+/** Every `` | `thing` | `` first column of a markdown table in `text`. */
+function firstColumnCells(text: string): string[] {
+  return [...text.matchAll(/^\| `([^`]+)` \|/gm)].map((m) => m[1]);
+}
+
+function sorted(values: readonly string[]): string[] {
+  return [...values].sort();
+}
+
+describe("the MCP docs describe the server that ships (#2385)", () => {
+  test("cli/mcp.mdx documents exactly the tools the server registers", async () => {
+    const registered = await servedListing("tools/list");
+    // Every core tool gets its own `### \`name\`` heading. The `#### ` heading
+    // under op-approve and the un-backticked "### Plugin Tools" are not tools.
+    const documented = [...mcpDoc.matchAll(/^### `([^`]+)`$/gm)].map((m) => m[1]);
+    expect(documented.length, `${MCP_DOC}: found no "### \`tool-name\`" headings — was the Tools section reformatted?`).toBeGreaterThan(0);
+    expect(
+      sorted(documented),
+      `${MCP_DOC} and the McpServer constructor disagree about the core tools. ` +
+        `Registered: ${sorted(registered).join(", ")}. Documented: ${sorted(documented).join(", ")}. ` +
+        `Give every registered tool a "### \`name\`" section on that page, and delete the sections for tools that no longer exist.`,
+    ).toEqual(sorted(registered));
+  });
+
+  test("guide/agent-integration.mdx lists exactly the tools the server registers", async () => {
+    const registered = await servedListing("tools/list");
+    const listed = firstColumnCells(section(guideDoc, "### Available Tools", GUIDE_DOC));
+    expect(
+      sorted(listed),
+      `${GUIDE_DOC}'s "Available Tools" table and the McpServer constructor disagree. ` +
+        `Registered: ${sorted(registered).join(", ")}. Listed: ${sorted(listed).join(", ")}. ` +
+        `Add or remove rows so the table matches; the parameter detail lives on the cli/mcp reference page.`,
+    ).toEqual(sorted(registered));
+  });
+
+  test("cli/mcp.mdx documents exactly the resources the server serves", async () => {
+    const served = await servedListing("resources/list");
+    // Rows of the Resources table: `| `chant://...` | `mime` | description |`.
+    const documented = [...mcpDoc.matchAll(/^\| `(chant:\/\/[^`]+)` \| `[^`]+` \|/gm)].map((m) => m[1]);
+    expect(
+      sorted(documented),
+      `${MCP_DOC}'s Resources table and the server's resources/list disagree. ` +
+        `Served: ${sorted(served).join(", ")}. Documented: ${sorted(documented).join(", ")}. ` +
+        `A URI the server reads but never lists (chant://examples/{name}) belongs in prose under the table, not in it.`,
+    ).toEqual(sorted(served));
+  });
+
+  test("cli/mcp.mdx states the protocol revisions the server negotiates, preferred first", () => {
+    const documented = [...mcpDoc.matchAll(/^\| `(\d{4}-\d{2}-\d{2})` \|/gm)].map((m) => m[1]);
+    expect(
+      documented,
+      `${MCP_DOC} claims protocol revisions ${documented.join(", ") || "(none found)"}, but server.ts ` +
+        `negotiates ${SUPPORTED_PROTOCOL_VERSIONS.join(", ")}. The first row is the preferred revision, ` +
+        `the one a client that names no version gets back.`,
+    ).toEqual([...SUPPORTED_PROTOCOL_VERSIONS]);
+  });
+
+  test("cli/mcp.mdx lists exactly the JSON-RPC methods dispatch answers", () => {
+    const dispatched = [...serverSrc.matchAll(/^      case "([^"]+)":$/gm)].map((m) => m[1]);
+    if (dispatched.length === 0) {
+      throw new Error(
+        `mcp docs parity: no \`case "method":\` labels found in ${SERVER_SRC} — the dispatch switch was ` +
+          `restructured, so this test can no longer read the method list out of it. Update the test to match.`,
+      );
+    }
+    const documented = firstColumnCells(section(mcpDoc, "### Supported Methods", MCP_DOC));
+    expect(
+      sorted(documented),
+      `${MCP_DOC}'s "Supported Methods" table and the dispatch switch in ${SERVER_SRC} disagree. ` +
+        `Dispatched: ${sorted(dispatched).join(", ")}. Documented: ${sorted(documented).join(", ")}.`,
+    ).toEqual(sorted(dispatched));
+  });
+});

package/src/cli/mcp/op-approve-origin.test.ts

@@ -0,0 +1,70 @@
+import { describe, test, expect, afterEach } from "vitest";
+import { createOpApproveTool } from "./op-tools";
+import { McpServer } from "./server";
+import { readFileSync } from "node:fs";
+import { resetGateOrigin, currentGateOrigin } from "../../lifecycle/gate-origin";
+
+/**
+ * chant#2384 — the MCP surface cannot both produce a gate and resolve it.
+ *
+ * `op-run` executes the Op in-process and returns the gate it stopped on;
+ * `op-approve` then wrote the resolution with the approver taken from the
+ * request. So the agent that produced a pending gate resolved it under any
+ * name it liked, and #2300's plan binding did not close it: the digest comes
+ * off the standing pending fact, which is the plan the same caller produced one
+ * tool call earlier. The approval was for the right plan and meant nothing.
+ *
+ * These assert the two halves of the fix that are visible without a ledger: the
+ * tool no longer offers a name it cannot verify, and constructing the server
+ * declares the channel. The rule itself is exercised in
+ * `../../lifecycle/gate-origin.test.ts`.
+ */
+describe("op-approve on the MCP channel (chant#2384)", () => {
+  afterEach(() => resetGateOrigin());
+
+  test("the tool no longer accepts a free-text approver", () => {
+    const schema = createOpApproveTool().definition.inputSchema as {
+      properties: Record<string, unknown>;
+      required: string[];
+    };
+
+    // The hole, stated as a test: `approver` was free text on a channel that
+    // cannot verify one, and the ledger recorded it indistinguishably from a
+    // name a person gave. Recording "unattested" is more honest than recording
+    // a name the model chose.
+    expect(Object.keys(schema.properties)).not.toContain("approver");
+
+    // The rest of the tool is unchanged — this narrows one field, it does not
+    // remove the tool. The narrower alternative in the issue was to drop
+    // op-approve entirely; this keeps it useful for the cross-channel case.
+    expect(Object.keys(schema.properties).sort()).toEqual(["gate", "name", "note", "runtime", "url"]);
+    expect(schema.required.sort()).toEqual(["gate", "name"]);
+  });
+
+  test("the description tells the caller where an approval has to come from", () => {
+    // A model reads this string and nothing else. If it does not say that the
+    // gate must be approved elsewhere, the model's only signal is a refusal it
+    // cannot act on.
+    const description = createOpApproveTool().definition.description;
+    expect(description).toMatch(/refuses a gate this same channel reached/i);
+    expect(description).toContain("chant approve");
+    expect(description).toMatch(/unattested/i);
+  });
+
+  test("merely constructing a server does not change what the process is", () => {
+    // Deliberate: the channel is declared in `start()`, not the constructor.
+    // Building a server object in a test must not make every later gate fact in
+    // that worker read as model-authored — which is exactly the contamination
+    // the first version of this caused.
+    new McpServer();
+    expect(currentGateOrigin()).toBe("cli");
+  });
+
+  test("op-approve names its own channel, so it holds even on a server that never started", () => {
+    // The ambient value covers the pending fact written during `op-run`. The
+    // resolution does not rely on it: the tool passes `origin: "mcp"` outright,
+    // so the rule holds regardless of what the process thinks it is.
+    const source = readFileSync(new URL("./op-tools.ts", import.meta.url), "utf8");
+    expect(source).toContain('origin: "mcp"');
+  });
+});

package/src/cli/mcp/op-tools.ts

@@ -181,13 +181,18 @@ export function createOpApproveTool(): ToolRegistration {
     definition: {
       name: "op-approve",
       description:
-        "Record a gate's resolution on the gate ledger and wake the runtime hosting the gated run. The rename of op-signal: a gate is resolved by recording the fact, not by sending a message.",
+        "Record a gate's resolution on the gate ledger and wake the runtime hosting the gated run. " +
+        "Refuses a gate this same channel reached: a run started with op-run must be approved from " +
+        "somewhere else, normally `chant approve <op> <gate>` at a shell. The approver is recorded as " +
+        "unattested, because this channel cannot verify a name.",
       inputSchema: {
         type: "object",
         properties: {
           name: { type: "string", description: "Op name (e.g. alb-deploy)" },
           gate: { type: "string", description: "Gate name (e.g. gate-dns-delegation)" },
-          approver: { type: "string", description: "Who approved; defaults to the CI or shell identity" },
+          // chant#2384 — no `approver`. It was free text on a channel that
+          // cannot verify one, so the model named itself whatever it liked and
+          // the ledger recorded it indistinguishably from a name a person gave.
           note: { type: "string", description: "Free-text context recorded on the resolution" },
           url: { type: "string", description: "Absolute http/https URL this resolution happened at" },
           runtime: RUNTIME_PARAM,
@@ -202,11 +207,19 @@ export function createOpApproveTool(): ToolRegistration {
 
       const runtime = await runtimeFor(params.runtime);
       const outcome = await recordGateApproval(name, gate, {
-        actor: params.approver as string | undefined,
         note: params.note as string | undefined,
         url: params.url as string | undefined,
+        // Named rather than left to the ambient value, so this tool states its
+        // own channel even if it is ever registered on a server that did not.
+        origin: "mcp",
       });
-      if (!outcome.ok) throw new Error(`Gate "${gate}" on "${name}" was not recorded`);
+      if (!outcome.ok) {
+        throw new Error(
+          `Gate "${gate}" on "${name}" was not recorded. If the gate was reached over MCP, it cannot ` +
+            `also be resolved over MCP — approve it from another channel, normally ` +
+            `\`chant approve ${name} ${gate}\` at a shell.`,
+        );
+      }
 
       if (runtime.resolveGate) await runtime.resolveGate(name, gate, outcome.record);
 
@@ -214,6 +227,7 @@ export function createOpApproveTool(): ToolRegistration {
         op: name,
         gate,
         resolvedBy: outcome.record.resolvedBy,
+        origin: outcome.record.origin,
         timestamp: outcome.record.timestamp,
         runtimeNotified: Boolean(runtime.resolveGate),
       };

package/src/cli/mcp/server.ts

@@ -9,6 +9,7 @@ import { searchTool, createSearchHandler } from "./tools/search";
 import type { LexiconPlugin } from "../../lexicon";
 import type { McpRequest, McpResponse, McpRequestMeta, ToolDefinition, ToolHandler, ResourceDefinition } from "./types";
 import { createSnapshotTool, createDiffTool } from "./lifecycle-tools";
+import { setGateOrigin } from "../../lifecycle/gate-origin";
 import { createOpListTool, createOpRunTool, createOpStatusTool, createOpApproveTool, createOpReportTool } from "./op-tools";
 import { buildResourcesList, handleResourcesRead } from "./resource-handlers";
 
@@ -16,8 +17,12 @@ import { buildResourcesList, handleResourcesRead } from "./resource-handlers";
  * Protocol versions this server understands, newest first. `initialize` and
  * `server/discover` both negotiate against this list rather than assuming
  * the client's revision (#1194).
+ *
+ * Exported because `docs-parity.test.ts` reads it: `cli/mcp.mdx` states these
+ * revisions in prose, and stating them twice is how the page came to claim
+ * 2024-11-05 for two releases after this list moved past it (#2385).
  */
-const SUPPORTED_PROTOCOL_VERSIONS = ["2026-07-28", "2024-11-05"] as const;
+export const SUPPORTED_PROTOCOL_VERSIONS = ["2026-07-28", "2024-11-05"] as const;
 const LATEST_PROTOCOL_VERSION = SUPPORTED_PROTOCOL_VERSIONS[0];
 
 /**
@@ -302,6 +307,16 @@ export class McpServer {
    * Start the MCP server on stdio
    */
   async start(): Promise<void> {
+    // chant#2384 — declared here rather than in the constructor, because this
+    // is where the PROCESS becomes an MCP server. Constructing the object does
+    // not change what the process is, and a test that builds one should not
+    // silently make every later gate fact in that worker read as model-authored.
+    //
+    // From here on a person's only act was launching this; every call is the
+    // model's. So every gate fact written records the channel it came through,
+    // and a gate reached here cannot also be resolved here.
+    setGateOrigin("mcp");
+
     const rl = createInterface({
       input: process.stdin,
       output: process.stdout,