@jr2/orchestrator 0.6.0 → 0.7.0

package/docs/reference/decisions/0067-an-effect-is-an-actor-slot-and-runs-at-most-once-unless-marked-idempotent.md

@@ -2,15 +2,17 @@
 
 An Effect is work a Machine does outside itself. A Machine already runs Agents and Gates as actors (ADR-0049); work such
 as running the tests had no place of its own, so an author either asked an Agent to do it (and trusted its word) or
-wrote a raw xstate promise that a restart ran again. jr2 builds four kinds: `command`, run a program in the Workspace;
+wrote a raw xstate promise that a restart ran again. jr2 builds five kinds: `command`, run a program in the Workspace;
 `http`, call a URL — with a JSON or text body, or a Worktree file as its body; `push`, push a Worktree's branch to its
-Repo Slot's Binding; and `dispatch`, start a run of a registered Workflow, on this Orchestrator or another's
-([ADR-0071](0071-a-run-starts-a-run-through-a-dispatch-effect.md)). A fifth, `worktree()`, is a kit Effect on the
-`command` machinery that cuts a Worktree ([ADR-0075](0075-a-machine-cuts-a-worktree-and-the-workspace-only-clones.md)).
-An Effect that holds a secret runs in an Effector
-([ADR-0068](0068-an-effector-holds-an-effects-secrets-and-signs-its-wire.md)). A `command` whose env names a secret —
-the credentialed `command` — runs there too, its child confined (below). A `dispatch` with no target runs in the
-Orchestrator's own process, the one Effect that does: it starts the run through the run host and holds no secret.
+Repo Slot's Binding; `dispatch`, start a run of a registered Workflow, on this Orchestrator or another's
+([ADR-0071](0071-a-run-starts-a-run-through-a-dispatch-effect.md)); and `mcp`, call a tool of an MCP server, or read its
+resource or get its prompt
+([ADR-0079](0079-an-agent-holds-mcp-tools-a-machine-calls-them-as-an-effect-and-the-machine-is-the-approval.md)). Beside
+them, `worktree()` is a kit Effect on the `command` machinery that cuts a Worktree
+([ADR-0075](0075-a-machine-cuts-a-worktree-and-the-workspace-only-clones.md)). An Effect that holds a secret runs in an
+Effector ([ADR-0068](0068-an-effector-holds-an-effects-secrets-and-signs-its-wire.md)). A `command` whose env names a
+secret — the credentialed `command` — runs there too, its child confined (below). A `dispatch` with no target runs in
+the Orchestrator's own process, the one Effect that does: it starts the run through the run host and holds no secret.
 
 ## Decision
 
@@ -19,18 +21,20 @@ Orchestrator's own process, the one Effect that does: it starts the run through
   exits, its input persists with the snapshot, a `src` typo is a compile error, and `.provide()` is the unit-test seam.
   The slot carries its parts as plain data — kind, placement, timeout; a `command`'s argv and the secrets its env names;
   an `http` Effect's method, fixed host, the names of the secrets it names and whether its body is a Worktree file; a
-  `push`'s `pin`, `sign`, `squash`, `force` and `slot`; a cut's `expect` — which `jr2 up` prints and the Machine doc
-  carries, read without running anything. A packaged Machine may leave an `http` url (whatever its body) or a
-  `command`'s argv Open (`open` in its place), and the name of one secret its auth, a header or a command's env names
-  (`secret(open)`; never in a url), for the composer to bind once with
-  `customize(machine, { effects: { <slot>: { url } | { argv } | { secret } } })` — one object with both keys for an
-  Effect with two Open parts ([ADR-0054](0054-the-kit-ships-machines-and-a-shipped-machine-leaves-its-parts-open.md));
-  the slot then carries the Effect built again with the bound parts, and an Effect still Open runs nothing: its state's
-  `onError`. An Effect written inline (`invoke: { src: http({...}) }`) is refused at build and at load, with the slot
-  form in the message: xstate gives it a generated key that moves when a state is renamed, so the ledger, the report and
-  the Machine doc would name it by a number, and `customize()` — `provide`, keyed on `actors` — could not reach it. The
-  same rule holds for `agent()` and `workspace()` (ADR-0049): a Part is a key of `actors`, and every Effect kind is one
-  (the brand `isEffect` reads).
+  `push`'s `pin`, `sign`, `squash`, `force` and `slot`; an `mcp` Effect's operation, server and tool; a cut's `expect` —
+  which `jr2 up` prints and the Machine doc carries, read without running anything. A packaged Machine may leave an
+  `http` url (whatever its body), a `command`'s argv, or an `mcp` Effect's server or tool Open (`open` in its place),
+  and the name of one secret its auth, a header or a command's env names (`secret(open)`; never in a url), for the
+  composer to bind once with
+  `customize(machine, { effects: { <slot>: { url } | { argv } | { secret } | { server } | { tool } } })` — one object
+  with both keys for an Effect with two Open parts
+  ([ADR-0054](0054-the-kit-ships-machines-and-a-shipped-machine-leaves-its-parts-open.md)); the slot then carries the
+  Effect built again with the bound parts, and an Effect still Open runs nothing: its state's `onError`. An Effect
+  written inline (`invoke: { src: http({...}) }`) is refused at build and at load, with the slot form in the message:
+  xstate gives it a generated key that moves when a state is renamed, so the ledger, the report and the Machine doc
+  would name it by a number, and `customize()` — `provide`, keyed on `actors` — could not reach it. The same rule holds
+  for `agent()` and `workspace()` (ADR-0049): a Part is a key of `actors`, and every Effect kind is one (the brand
+  `isEffect` reads).
 - **Between a pick and its work: `fromPick`, `paramsOf`, `answer`.** All optional; a plain mapper is legal.
   `fromPick(def, fill)` is the `input` of a state a pick enters: the pick's params flow into the Effect's input by name,
   `fill` returns only what the Machine adds, and the sum is checked against the Effect's input type — the security
@@ -79,9 +83,10 @@ Orchestrator's own process, the one Effect that does: it starts the run through
   `http` whose body is a Worktree file, are placed in that Sandbox Effector — the command runs there with its child
   confined (below). A `dispatch` with no target runs in the Orchestrator's own process, the fourth Placement,
   `orchestrator`, and the one Effect that has it; with a target it runs in the Instance Effector
-  ([ADR-0071](0071-a-run-starts-a-run-through-a-dispatch-effect.md)). There is no `placement:` key and no kind per
-  placement: naming a secret places a command, the body places an `http`, and the target places a `dispatch` — one name
-  per thing, so there is no `upload` kind beside it (ADR-0068).
+  ([ADR-0071](0071-a-run-starts-a-run-through-a-dispatch-effect.md)). An `mcp` Effect runs in the Instance Effector,
+  because in v1 it calls a remote server only. There is no `placement:` key and no kind per placement: naming a secret
+  places a command, the body places an `http`, and the target places a `dispatch` — one name per thing, so there is no
+  `upload` kind beside it (ADR-0068).
 - **A `command` that names no secret runs in the Harness container of its Workspace's Sandbox**, as a confined child of
   the Harness process ([ADR-0076](0076-an-agents-control-credential-lives-only-where-no-workspace-code-runs.md)): the
   Agent's user, the Sandbox Image's tools, the same confined env and Stand-ins as the Agent's `bash` (ADR-0059), and no
@@ -100,17 +105,18 @@ Orchestrator's own process, the one Effect that does: it starts the run through
 - **Every outcome is output**: `exited | timeout | killed | unknown` for a `command` (`killed` with the signal that
   ended it; a stopped credentialed command's is `exited` with the stop's signal, D1);
   `response | unreachable | refused | unknown` for an `http` Effect; `pushed | rejected | diverged | unknown` for a
-  `push`. A command not found is `exited` 127, and a bad Worktree adds no outcome: a `command` settles `exited` 127 with
-  the reason in its tail, and an `http` file body settles `refused`. Every union here is open: `worktree()`, `push`,
-  `command` and `http` each hold a stand-in member, so that no author can write an exhaustive check and a later outcome
-  is no break. A start over the bytes an Effector reads (ADR-0068) is sent nowhere and settles as its kind's own outcome
-  — an `http` `refused`, a `push` `rejected` at stage `start` (nothing pushed), a credentialed `command` `exited` 127
-  with the reason in its tail, the Effector's own form for a command that could not start — since an Agent's param (a
-  squash message, an argv part) can reach the bound; a path segment that is `.`, `..` or empty, and a file body's path
-  that is a symlink, leaves the Worktree, is absolute, is a FIFO or has more than one link, are `refused` with nothing
-  sent — an Agent's param can cause each. `onError` is only a jr2 or config defect: no Workspace, a `command` with no
-  `worktree` under Repo Slots, an argv slot with no value, an input that misses the definition's schema, no Effector to
-  send to, an Open part nobody bound.
+  `push`; `returned | refused | unreachable | input-required | unknown` for an `mcp` Effect. A command not found is
+  `exited` 127, and a bad Worktree adds no outcome: a `command` settles `exited` 127 with the reason in its tail, and an
+  `http` file body settles `refused`. Every union here is open: `worktree()`, `push`, `command` and `http` each hold a
+  stand-in member, so that no author can write an exhaustive check and a later outcome is no break; the `mcp` union
+  holds one too. A start over the bytes an Effector reads (ADR-0068) is sent nowhere and settles as its kind's own
+  outcome — an `http` `refused`, a `push` `rejected` at stage `start` (nothing pushed), a credentialed `command`
+  `exited` 127 with the reason in its tail, the Effector's own form for a command that could not start — since an
+  Agent's param (a squash message, an argv part) can reach the bound; a path segment that is `.`, `..` or empty, and a
+  file body's path that is a symlink, leaves the Worktree, is absolute, is a FIFO or has more than one link, are
+  `refused` with nothing sent — an Agent's param can cause each. `onError` is only a jr2 or config defect: no Workspace,
+  a `command` with no `worktree` under Repo Slots, an argv slot with no value, an input that misses the definition's
+  schema, no Effector to send to, an Open part nobody bound.
 - **An `http` Effect is a definition plus one function.**
   `http({ method, url, headers?, auth?, input?, request?, body?, timeout?, maxBody?, idempotent? })`. The url's scheme
   and host are literal — a secret, named with `secret("name")`, may sit only in its path, through the `text` template,
@@ -134,6 +140,40 @@ Orchestrator's own process, the one Effect that does: it starts the run through
   refused when the Machine loads ("write one of them", as for `auth` beside an `authorization` header). With neither it
   is `application/octet-stream`. A later body form (a multipart file and fields) is one more body on `http`, never a
   kind.
+- **An `mcp` Effect has the shape of `http`, with a server and a tool in place of a url.**
+  `mcp.call(server, tool, { input?, timeout?, maxBody?, idempotent? })`,
+  `mcp.read(server, uri, { timeout?, maxBody?, idempotent? })` and
+  `mcp.prompt(server, name, { input?, timeout?, maxBody?, idempotent? })`
+  ([ADR-0079](0079-an-agent-holds-mcp-tools-a-machine-calls-them-as-an-effect-and-the-machine-is-the-approval.md)).
+  `server` is a name of the `mcp` block of `jr2.config.ts`, so the server's url and its secret are the config's and
+  never a param; the secret is the Effect's Effect secret, placed in the Instance Effector (ADR-0068). `server` can be
+  Open for each of the three; `tool` for `mcp.call`; a read's `uri` and a prompt's `name` are the author's. `jr2 up`
+  refuses an `mcp` Effect whose server the `mcp` block does not declare, or whose server is a stdio server, and prints
+  the `mcp` block entry that declares a remote server, and the `customize()` line for an Open server. `input` is the
+  schema of the tool's arguments (a prompt's arguments are strings), and the invoke's input is the arguments, which
+  `fromPick` fills from a pick's params: an Agent's param reaches the arguments only. An Effect's `timeout` replaces its
+  server's `timeout` for that Effect; with none, the server's applies (60 seconds by default). The outcomes:
+  `returned { isError, text, structured?, truncated? }` — the server answered the call, `isError` being the tool's own,
+  `structured` its `structuredContent`, typed `unknown`, and `truncated` set when the Effector cut `text` or dropped
+  `structured` at the bound (ADR-0068), and a reason keeps at most 1 KiB of a server's error message; `refused` — the
+  request did not run: the server answered a 3xx or a 4xx status (a 401 or a 403 included) at any step, the handshake
+  too, refused the handshake, or answered the request with the JSON-RPC error `-32700`, `-32600`, `-32601` or `-32602`
+  (a request it could not read, an unknown method, an unknown tool, bad arguments), or answered a read with `-32002`
+  (the resource does not exist); or the Effector sent nothing because the server or its secret is not in its
+  `effector.json`, the second fence behind the `jr2 up` refusal; `unreachable` — nothing of the request was sent: the
+  name did not resolve, or the connection, TLS or the handshake failed otherwise (a 5xx, the timeout, an answer that is
+  not MCP's, a handshake that names an MCP revision the client does not speak); `input-required` — the server asked for
+  input, which jr2 does not give, so the Machine routes it: the error `-32042` (URL elicitation required), after which
+  the tool did not run, or an `elicitation/create` request, which the client declared no capability for and which comes
+  while the tool runs, so the tool may have begun; jr2 does not send the request again, and a Machine that invokes the
+  Effect again after a Gate can run a part of the tool two times; `unknown` — the request was sent and no answer came
+  (the timeout, a reset, a stream that ended first and that the server did not give again from its last event id), or
+  the server answered with a 5xx or with another JSON-RPC error, after which the tool may have acted. `idempotent` is
+  the author's mark alone; the server's `idempotentHint` is ignored. `mcp.read` and `mcp.prompt` settle the same
+  outcomes, and their `returned` is `{ text, structured?, truncated? }`: for a read, `text` joins the text of the
+  resource's contents and `structured` is the `contents` list, with a blob given only as its `mimeType` and size; for a
+  prompt, `text` joins the text of the prompt's messages and `structured` is the `messages` list. An `output:` schema
+  for `structured` is Later.
 - **A credentialed `command`: `command(argv, { env: { NAME: secret("x") | secret("x").path }, pin? })`.** Naming a
   secret is what places it: it runs in the Sandbox Effector of the Workspace whose body invokes it, with no `placement:`
   key — and so does an env that names `secret(open)`, whose name the composer binds (ADR-0054). Its child runs as the
@@ -321,26 +361,26 @@ Orchestrator's own process, the one Effect that does: it starts the run through
   with only that commit — never the Agent's tip now — because its run is a function of the commit and its credential,
   what the intent row records; with no commit recorded it settles `unknown`. A credentialed command follows the push's
   rule: its intent row names its Sandbox and, once the first answer names it, the pinned commit, and one the Effector
-  lost is sent again with only that commit, since its run is a function of (commit, argv, secrets). An `http` intent row
-  names its placement — the Instance Effector, or the Sandbox of a file-body `http` — and no replica: the Effect asks
-  every replica of that Effector for its id and follows the one that holds it; when none does, it is sent again only
-  when the author marked it `idempotent`, and any other settles `unknown`. Retry is the author's choice — a route back
-  into the state, or `idempotent` for a call that carries its own idempotency key or only reads. No row is dropped: each
-  settled or aborted row keeps the Effect's id, kind and outcome for the run's life, the record of what the run's
-  Effects did. A settled row's output tail is dropped once the save that carries its transition is on disk; the full
-  stream is on the feed. An `http` response's body and headers are its tail: the row keeps the outcome, the status, the
-  content type and the size, and the settled line on the feed carries the whole response. A `push` row keeps its Repo
-  Slot, its branch, its published commit, its source, its `squashed` and its sync's answer whole — every later push of
-  its Workspace and (slot, branch) sends them as one of its pairs, and the newest push's sync, when it did not finish,
-  runs again — and drops git's words; it drops its bundle once its sync answered `synced`, `already` or `skipped`, and
-  keeps it while the sync is `busy` or `not-synced` only as long as it is the newest push of its (slot, branch) that
-  published, because the sync that runs again moves the branch from it and only the newest push's sync runs again. Once
-  a newer push of that key published, the older row's bundle goes at the next save: one bundle per (slot, branch) at
-  most. A cut's `ready` row keeps its Repo Slot, its path and its branch whole, because a later Effect reads them. So an
-  Effect in a loop grows the ledger by one short row per pass, never by its tails. One exception, bounded by one pick:
-  while a pick is outstanding, its hold keeps the `chain` whole, tails included, because an `answer` action may read it
-  after a restore; a loop below the Agent's state then grows the hold by one tail per pass. The hold drops its chain
-  when the pick is answered.
+  lost is sent again with only that commit, since its run is a function of (commit, argv, secrets). An `http` or `mcp`
+  intent row names its placement — the Instance Effector, or the Sandbox of a file-body `http` — and no replica: the
+  Effect asks every replica of that Effector for its id and follows the one that holds it; when none does, it is sent
+  again only when the author marked it `idempotent`, and any other settles `unknown`. Retry is the author's choice — a
+  route back into the state, or `idempotent` for a call that carries its own idempotency key or only reads. No row is
+  dropped: each settled or aborted row keeps the Effect's id, kind and outcome for the run's life, the record of what
+  the run's Effects did. A settled row's output tail is dropped once the save that carries its transition is on disk;
+  the full stream is on the feed. An `http` response's body and headers are its tail: the row keeps the outcome, the
+  status, the content type and the size, and the settled line on the feed carries the whole response. A `push` row keeps
+  its Repo Slot, its branch, its published commit, its source, its `squashed` and its sync's answer whole — every later
+  push of its Workspace and (slot, branch) sends them as one of its pairs, and the newest push's sync, when it did not
+  finish, runs again — and drops git's words; it drops its bundle once its sync answered `synced`, `already` or
+  `skipped`, and keeps it while the sync is `busy` or `not-synced` only as long as it is the newest push of its (slot,
+  branch) that published, because the sync that runs again moves the branch from it and only the newest push's sync runs
+  again. Once a newer push of that key published, the older row's bundle goes at the next save: one bundle per (slot,
+  branch) at most. A cut's `ready` row keeps its Repo Slot, its path and its branch whole, because a later Effect reads
+  them. So an Effect in a loop grows the ledger by one short row per pass, never by its tails. One exception, bounded by
+  one pick: while a pick is outstanding, its hold keeps the `chain` whole, tails included, because an `answer` action
+  may read it after a restore; a loop below the Agent's state then grows the hold by one tail per pass. The hold drops
+  its chain when the pick is answered.
 - **A start is sent once where it may have arrived.** A Harness runs one id once only within its own process; a
   restarted Harness knows no id. So the Orchestrator sends a start again only when it certainly never left (the
   connection was refused, the name did not resolve). Any other failure — a reset, a 5xx, no answer — may follow a start

package/docs/reference/decisions/0068-an-effector-holds-an-effects-secrets-and-signs-its-wire.md

@@ -9,6 +9,15 @@ only asks. Its Role reads no Secret either: it may create and patch one, never g
 
 ## Decision
 
+- **What an Effector is for.** It holds the secrets that the Orchestrator must not hold, and it makes every call that
+  jr2 makes to the outside for a Machine or a Hook: every `http` and `mcp` Effect runs in an Effector
+  ([ADR-0067](0067-an-effect-is-an-actor-slot-and-runs-at-most-once-unless-marked-idempotent.md)), and the
+  Orchestrator's one call out of the Instance is the fetch of a JWT issuer's public keys (and of its discovery document,
+  which names where the keys are), which spends no secret
+  ([ADR-0078](0078-a-caller-comes-from-one-authenticator-seam-and-acts-within-its-scopes.md)). It serves two clients: a
+  Machine's Effects, in both placements, and the Orchestrator's Hook door, in the Instance Effector only, which uses two
+  operations: the `mac` check and one `http` call (below). It knows no Hook kind and no service. The reason above holds
+  for both clients, and a Hook's secret adds one: it can forge a delivery that answers a Gate.
 - **One static Go binary, `effector`.** A top-level Go module, `effector/`, beside `operator/`: the same toolchain and
   lint, `make test` and `make lint`, the standard library only. Go because the Effector is the trust boundary, and the
   safe file opener (`os.Root`, `openat2`) is Go's. It is configured by its env, which names where its own mount holds
@@ -48,25 +57,46 @@ only asks. Its Role reads no Secret either: it may create and patch one, never g
   (`the remote could not be reached: ssh: …`), with both in the detail: git's own words for an ssh failure name no
   cause.
 
-- **Two placements, one binary.** The Instance Effector runs `http` with no Worktree file, and `dispatch` toward another
-  Orchestrator ([ADR-0071](0071-a-run-starts-a-run-through-a-dispatch-effect.md)), the other Orchestrator's Instance
-  token being an Effect secret it holds. A Sandbox Effector — the binary with `JR2_EFFECTOR_WORK` set, a read-only view
-  of the Agent's `/work` — runs an `http` whose body is a Worktree file, `push` and a credentialed `command` (ADR-0067);
-  the Instance Effector refuses the last two, and a file body, as a defect, and a Sandbox Effector refuses a `dispatch`.
-  Under Repo Slots each of the three needs a cut's settled row in the run's ledger, because a path alone does not name
-  the target of a credential: the Orchestrator reads the row before it starts the Effect, and with no row it sends
-  nothing and settles the kind's own outcome
-  ([ADR-0075](0075-a-machine-cuts-a-worktree-and-the-workspace-only-clones.md)). Its env names where its mount holds the
-  rest: `JR2_EFFECTOR_REPOS` (the node's Repo caches, read-only), `JR2_EFFECTOR_GIT` (the push credentials: one
-  directory per `git.credentials` entry the Sandbox's pushes spend, the entry's own Secret as the operator projects it —
-  `entry.json`, what the entry is; `identity` and `known_hosts` for an ssh key; `password` for a token; `sign.identity`
-  or `sign.private.asc` for the signing key; see the Sandbox Effector's objects below), `JR2_EFFECTOR_SCRATCH` (its own
-  writable scratch). What jr2 guarantees is stated per kind: for `push` and a file body, git never takes config or hooks
-  from the Agent's repository and no program the Agent's files name runs — the clean-repository procedure of ADR-0067
-  and the opener below. jr2's own programs (`git`, `ssh`, `ssh-keygen`, `gpg`, `gpg-agent`) run by an absolute path
-  found in one fixed PATH, `/usr/local/bin:/usr/bin:/bin`, never by the PATH the image set: an image that puts a
-  directory of its own first does not choose which `git` runs. For a credentialed `command` the Agent's files are the
-  author's choice to run, and the claims are the next bullet's.
+- **Two placements, one binary.** The Instance Effector runs `http` with no Worktree file, `mcp`
+  ([ADR-0079](0079-an-agent-holds-mcp-tools-a-machine-calls-them-as-an-effect-and-the-machine-is-the-approval.md)), and
+  `dispatch` toward another Orchestrator ([ADR-0071](0071-a-run-starts-a-run-through-a-dispatch-effect.md)), the other
+  Orchestrator's Caller token being an Effect secret it holds. It also serves the Hook door (below). A Sandbox Effector
+  — the binary with `JR2_EFFECTOR_WORK` set, a read-only view of the Agent's `/work` — runs an `http` whose body is a
+  Worktree file, `push` and a credentialed `command` (ADR-0067); the Instance Effector refuses the last two, and a file
+  body, as a defect, and a Sandbox Effector refuses a `dispatch` and an `mcp` Effect. Under Repo Slots each of the three
+  needs a cut's settled row in the run's ledger, because a path alone does not name the target of a credential: the
+  Orchestrator reads the row before it starts the Effect, and with no row it sends nothing and settles the kind's own
+  outcome ([ADR-0075](0075-a-machine-cuts-a-worktree-and-the-workspace-only-clones.md)). Its env names where its mount
+  holds the rest: `JR2_EFFECTOR_REPOS` (the node's Repo caches, read-only), `JR2_EFFECTOR_GIT` (the push credentials:
+  one directory per `git.credentials` entry the Sandbox's pushes spend, the entry's own Secret as the operator projects
+  it — `entry.json`, what the entry is; `identity` and `known_hosts` for an ssh key; `password` for a token;
+  `sign.identity` or `sign.private.asc` for the signing key; see the Sandbox Effector's objects below),
+  `JR2_EFFECTOR_SCRATCH` (its own writable scratch). What jr2 guarantees is stated per kind: for `push` and a file body,
+  git never takes config or hooks from the Agent's repository and no program the Agent's files name runs — the
+  clean-repository procedure of ADR-0067 and the opener below. jr2's own programs (`git`, `ssh`, `ssh-keygen`, `gpg`,
+  `gpg-agent`) run by an absolute path found in one fixed PATH, `/usr/local/bin:/usr/bin:/bin`, never by the PATH the
+  image set: an image that puts a directory of its own first does not choose which `git` runs. For a credentialed
+  `command` the Agent's files are the author's choice to run, and the claims are the next bullet's.
+- **The Instance Effector serves the Hook door with two operations, and the Orchestrator never holds a Hook's secret.**
+  A Hook with a `mac` verifier
+  ([ADR-0078](0078-a-caller-comes-from-one-authenticator-seam-and-acts-within-its-scopes.md)) names its secret as an
+  Effect names one, and the secret is placed in the Instance Effector alone.
+  - **The `mac` check.** The Orchestrator sends, on the signed wire (below), the bytes to check, the signature, the
+    secret's name and the algorithm. The Hook's kind gives the bytes, and the door makes every check that needs no
+    secret itself, so the Effector reads no header and no timestamp. The Effector computes an HMAC over the bytes with
+    that secret, compares it with the signature in constant time, and answers only "match" or "no match". It returns no
+    secret and no digest of one.
+  - **One `http` call**: a Hook kind's follow-up, such as the reply to a Slack click, which the door posts to the
+    click's `response_url` ([ADR-0011](0011-workflow-defined-events.md)). It is the `http` kind on the same wire, with
+    no secret, to a host that the Hook's kind declares, which `jr2 up` writes into `effector.json` for each Hook of that
+    kind, and it is sent once. It has no slot, no ledger row and no run.
+
+  `jr2 up` converges the Instance Effector when a Hook has a `mac` verifier or its kind declares a follow-up host, as it
+  does when an Effect is placed there. The `token` and `ed25519` verifiers run in the Orchestrator: a digest and a
+  public key cannot sign anything, so they need no Effector, but a follow-up of their kind goes through it. The check is
+  `POST /mac`, beside the Effects' routes and never an Effect: it has no id, starts nothing and is answered at once, and
+  a secret the Effector does not hold is a defect (400), as an Effect's is. A Sandbox Effector does not serve the route.
+
 - **A credentialed `command`'s child is confined with Landlock.** The child runs as the Effector's own uid in the
   Effector's container, where the placement key, every placed secret and the push and signing keys are files that uid
   can read, and its program is often the Agent's code (`npm run deploy`, `make`, `./scripts/release.sh`, a tool's
@@ -204,8 +234,9 @@ only asks. Its Role reads no Secret either: it may create and patch one, never g
   `effector/internal/wire` and zod schemas in `@jr2/orchestrator`, the one definition each TypeScript type is inferred
   from. Go decodes with unknown fields disallowed. The golden fixtures in `effector/testdata/wire/` keep the two equal:
   one JSON file per request shape (`request.*`), per answer and outcome (`response.*`), per shape its decoder must
-  refuse (`reject.*`), and the two signatures (`signature.*`). Go decodes each request and encodes each response; the
-  TypeScript tests read the same files by a relative path, encode the requests and decode the responses.
+  refuse (`reject.*`), the two signatures (`signature.*`), and the `mac` check's request, answers and refusals
+  (`mac.*`). Go decodes each request and encodes each response; the TypeScript tests read the same files by a relative
+  path, encode the requests and decode the responses.
 - **Signed requests and signed answers, and no bearer.** The key is the placement's,
   `HMAC(signing key, "effector:" + placement)`, as ADR-0058 derives the Harness bearer: the Orchestrator stores nothing.
   The Effector reads it from a file in its own mount. A request carries `X-Jr2-Time` (Unix milliseconds), `X-Jr2-Nonce`,
@@ -283,7 +314,7 @@ only asks. Its Role reads no Secret either: it may create and patch one, never g
     `truncated` past it. A body that is not text is never returned: its size and type are.
   - `unreachable`: nothing was sent — the name did not resolve, the connection or TLS failed.
   - `refused`: the Effector refused it and sent nothing — a path segment that is `.`, `..` or empty (an Agent's param
-    can cause it, so it is output, not a fault), or a host and secrets that no Effect placed there names. The
+    can cause it, so it is output, not a fault), or a host and secrets that no Effect or Hook placed there names. The
     Orchestrator settles an `http` start longer than 4 MiB `refused` the same way, before it sends anything, and a file
     body with no cut's row (ADR-0075); a `push` and a `command` have no `refused`.
   - `unknown`: the connection was made and no answer came (the timeout, a reset): the host may have acted.
@@ -294,28 +325,45 @@ only asks. Its Role reads no Secret either: it may create and patch one, never g
   ``Its answer: the output of `<slot>`: <the output's JSON>.``, already scrubbed. An `answer` action shapes it instead
   ([ADR-0067](0067-an-effect-is-an-actor-slot-and-runs-at-most-once-unless-marked-idempotent.md)).
 
+- **The `mcp` kind.** The Effector holds a small MCP client of its own: Go, the standard library only, Streamable HTTP,
+  protocol `2025-11-25`
+  ([ADR-0079](0079-an-agent-holds-mcp-tools-a-machine-calls-them-as-an-effect-and-the-machine-is-the-approval.md)). Each
+  Effect is one session: the handshake, one request (`tools/call`, `resources/read` or `prompts/get`), and a DELETE of
+  the session, so a replica keeps no session between Effects and the replica rules of `http` hold unchanged. The start
+  names the server and nothing else of it: the server's url, the name of its secret and its `timeout` are in
+  `effector.json`, which `jr2 up` writes from the `mcp` block, and the secret goes as `Authorization: Bearer <value>`.
+  The client declares no capability, so a server that asks for input gets none: the Effect settles `input-required`. An
+  answer is read as JSON, or as an event stream until the message that answers the request. A result's `text` and its
+  `structured` are each bounded to the start's `maxBody`, 64 KiB by default as for an `http` body; past it the Effector
+  cuts the text (a `structured` past the bound is dropped, not cut into JSON that does not parse) and sets `truncated`.
+  Every string of the output is scrubbed, as an `http` body is. A redirect is not followed. The outcomes and their
+  meaning are ADR-0067's.
 - **The host is fixed, in the Effector.** The Effector's config (`effector.json`, written by `jr2 up` from the Effects'
   plain data) lists each scheme, host and port an Effect placed there names, with the secrets that Effect names — the
-  host its definition fixes, or for a url the package left Open, the one the composer's `customize()` bound
+  host its definition fixes, the host of an `mcp` Effect's server url in `jr2.config.ts`, or for a url the package left
+  Open, the one the composer's `customize()` bound
   ([ADR-0054](0054-the-kit-ships-machines-and-a-shipped-machine-leaves-its-parts-open.md)); `jr2 up` refuses a Machine
-  whose Open url nothing bound, so no fence entry is ever a guess. A request to another target, or with another secret,
-  is `refused`. A redirect is the response and is never followed: it would send the request, and its `Authorization`, to
-  a host the definition did not fix. No proxy is read from the environment. The trust is the system roots and the
-  instance's `caBundle` ([ADR-0020](0020-private-ca-trust-is-a-named-concept.md)).
+  whose Open url nothing bound, so no fence entry is ever a guess. Each Hook adds the hosts that its kind declares for a
+  follow-up (the `slack` kind: `https://hooks.slack.com`), with no secret (above). A request to another target, or with
+  another secret, is `refused`. A redirect is the response and is never followed: it would send the request, and its
+  `Authorization`, to a host the definition did not fix. No proxy is read from the environment. The trust is the system
+  roots and the instance's `caBundle` ([ADR-0020](0020-private-ca-trust-is-a-named-concept.md)).
 - **One list of secrets; placement is read, never declared, and naming is placement on both sides.** The top-level
   `secrets` list replaces `harness.heldSecrets`; its entry is ADR-0059's
   (`{ name, value | valueFrom.secretKeyRef, hosts?, headers?, paths? }`). A pod gets the secrets something in it names:
-  a Workspace's pod the Held secrets its `workspace()` lists under `secrets: [...]` and the model keys its Agents'
-  providers read; the Instance Harness the model keys of its `"none"` Agents only; an Effector what its Effects name
-  with `secret("name")` (an `http` Effect: the Instance Effector; an `http` whose body is a Worktree file: the Sandbox
-  Effector of the Workspace whose body invokes it; a credentialed command: that Sandbox Effector), and the name a
-  composer binds to an Effect's `secret(open)` with `customize()` (ADR-0054) is placed the same way, in that Effect's
-  Effector alone, once bound — `jr2 up` refuses an Open secret nothing bound. `hosts`, `headers` and `paths` are a Held
-  secret's binding, never its placement (ADR-0059). One derivation (`secretPlacementsOf`) places both kinds, and the
-  held manifest, the Custodian config and the held values' Secret of each Harness pod come from it. Both is both, and
-  `jr2 up` reports it per pod. An entry nothing names goes nowhere, and `jr2 up` warns:
-  `secrets[i] (<name>) is named by nothing; goes nowhere`. There is no `placement:` key: naming is the placement.
-  `jr2 up` prints one line per secret with its placements, and one per pod with what it holds
+  a Workspace's pod the Held secrets its `workspace()` lists under `secrets: [...]`, the model keys its Agents'
+  providers read and the secrets of the MCP servers its Agents name; the Instance Harness the model keys and the MCP
+  server secrets of its `"none"` Agents only; an Effector what its Effects name with `secret("name")` (an `http` Effect:
+  the Instance Effector; an `mcp` Effect, which names its server's secret through the server: the Instance Effector; an
+  `http` whose body is a Worktree file: the Sandbox Effector of the Workspace whose body invokes it; a credentialed
+  command: that Sandbox Effector), and the name a composer binds to an Effect's `secret(open)` with `customize()`
+  (ADR-0054) is placed the same way, in that Effect's Effector alone, once bound — `jr2 up` refuses an Open secret
+  nothing bound. A Hook with a `mac` verifier places its secret in the Instance Effector the same way. `hosts`,
+  `headers` and `paths` are a Held secret's binding, never its placement (ADR-0059). One derivation
+  (`secretPlacementsOf`) places both kinds, and the held manifest, the Custodian config and the held values' Secret of
+  each Harness pod come from it. Both is both, and `jr2 up` reports it per pod. An entry nothing names goes nowhere, and
+  `jr2 up` warns: `secrets[i] (<name>) is named by nothing; goes nowhere`. There is no `placement:` key: naming is the
+  placement. `jr2 up` prints one line per secret with its placements, and one per pod with what it holds
   (`Workspace of workflow "coding": Custodian holds ANTHROPIC_API_KEY (provider), JIRA_TOKEN`,
   `the Instance Effector: holds jira`,
   `Workspace of workflow "coding": Sandbox Effector (image the Sandbox Image) holds aws; pushes Repo Slot "app" with git.credentials "*"`
@@ -330,9 +378,10 @@ only asks. Its Role reads no Secret either: it may create and patch one, never g
   short value, for a Secret edited after the converge. A secret reaches only the pods where something names it: a
   literal is written into the placement's own Secret, and a `valueFrom` is projected from the user's Secret by
   reference, never copied. `git.credentials` stays its own list: a fence keyed by url prefix, not a named value.
-- **The Instance Effector's objects.** `jr2 up` converges them when a registered Machine places an Effect there, and
-  deletes them otherwise; it reports either (`instance effector: converging (<workflow>/<slot>; secrets …; grace …)` or
-  `instance effector: none`). All four are named `jr2-instance-effector`:
+- **The Instance Effector's objects.** `jr2 up` converges them when a registered Machine places an Effect there or a
+  Hook has a `mac` verifier or a kind that declares a follow-up host, and deletes them otherwise; it reports either
+  (`instance effector: converging (<workflow>/<slot> or hook <name>; secrets …; grace …)` or `instance effector: none`).
+  All four are named `jr2-instance-effector`:
   - A **Deployment**, one replica, rolling with surge and no gap, so a rollout runs the old pod beside the new one: the
     `jr2-harness` image, command `/opt/jr2/bin/effector`, non-root, no privilege escalation, every capability dropped, a
     read-only root filesystem, an emptyDir scratch as `$HOME`, no ServiceAccount token, the control tier's PriorityClass
@@ -347,12 +396,13 @@ only asks. Its Role reads no Secret either: it may create and patch one, never g
   - A **NetworkPolicy** of `jr2-sandbox-ingress`'s form ([ADR-0058](0058-a-harness-answers-the-orchestrator-alone.md)):
     ingress from this Instance's Orchestrator only. Egress stays open: the pod calls the hosts its Effects name, and
     holds no Custodian.
-  - The **Secret**: each literal Effect secret placed there, `effector.json` (the targets), and the placement's key,
-    `effectorKey(signing key, "instance")`, which `jr2 up` derives from the kept signing key. "Nothing stored" means
-    nothing stored by the Orchestrator: the Kubernetes Secret is the store, as for every credential. The secrets are
-    files under `/run/jr2/secrets`, mode 0400; the kubelet makes them readable by the pod's `fsGroup`, and the pod has
-    one container. `harness.env` and `harness.envFrom` may not name this Secret, nor a Workspace's `jr2-effector-<pod>`,
-    a Sandbox's `<sandbox>-effector`, or a `git.credentials` entry's `jr2-git-*` (ADR-0059's R13).
+  - The **Secret**: each literal Effect secret placed there, `effector.json` (the targets, and the MCP servers that its
+    `mcp` Effects name), and the placement's key, `effectorKey(signing key, "instance")`, which `jr2 up` derives from
+    the kept signing key. "Nothing stored" means nothing stored by the Orchestrator: the Kubernetes Secret is the store,
+    as for every credential. The secrets are files under `/run/jr2/secrets`, mode 0400; the kubelet makes them readable
+    by the pod's `fsGroup`, and the pod has one container. `harness.env` and `harness.envFrom` may not name this Secret,
+    nor a Workspace's `jr2-effector-<pod>`, a Sandbox's `<sandbox>-effector`, or a `git.credentials` entry's `jr2-git-*`
+    (ADR-0059's R13).
 - **A Workspace's Sandbox Effector's objects** (ADR-0059). `jr2 up` reads, for each `workspace()`, the Effects placed
   there below it, down to the next `workspace()` — every `push`, `http` whose body is a Worktree file and credentialed
   `command`, from their plain data, statically — and writes two objects for a Workspace with one, none for one without.
@@ -403,6 +453,10 @@ only asks. Its Role reads no Secret either: it may create and patch one, never g
 - **A StatefulSet for the Instance Effector**, as the Instance Harness is. Rejected: a one-replica StatefulSet deletes
   the old pod before it creates the new one, so a rollout would cut an Effect in flight; the Effector keeps nothing a
   stable name or volume would hold.
+- **Check a Hook's `mac` in the Orchestrator.** Rejected: the Orchestrator runs every Machine's code, and an HMAC secret
+  in its process can sign a forged delivery. The check costs one call on the signed wire for each delivery.
+- **A verifier container of its own** for the Hook door. Rejected: it would be the same binary, with the same secret
+  mount and the same signed wire, so a second pod adds a Deployment, a key and a NetworkPolicy and closes nothing.
 - **A `placement:` key on a secret.** Rejected: naming a secret in an Effect is what places it, and a key would be a
   second statement that can disagree with the first.
 

package/docs/reference/decisions/0069-the-orchestrator-is-a-kit-image-and-an-instance-publishes-its-assembly.md

@@ -71,15 +71,16 @@ resolve a Workflow's name only to the new Machine. The grill of 2026-10-18 split
   an image cost: cluster write access. The token lives in the Instance's Secret beside the Instance token, `jr2 up`
   reads it through the kube API alone, and no env var and no `--url` path can supply it, so an ingress-exposed Instance
   exposes no publish door. The Instance token keeps its meaning
-  ([ADR-0032](0032-the-console-unlocks-with-the-instance-token.md)): start runs, answer Gates, read. `GET /assembly`,
+  ([ADR-0032](0032-the-console-unlocks-with-a-callers-credential.md)): start runs, answer Gates, read. `GET /assembly`,
   public like `GET /workflows`: the current hash and Kit version, the Assemblies held with the runs that hold them, and,
   when deployed, the digest of each ConfigMap the process reads through a mount (`jr2-images`, `jr2-held`), so a
-  publisher can see what the process reads. `jr2 status` prints it; `/healthz` prints the current hash where it printed
-  the content hash. A repeat publish of the current hash answers `200 { unchanged: true }` before the body is read;
-  `--force` sends the PUT anyway and gets the same answer, because the hash names bytes the Orchestrator already holds.
-  Rejected: an OCI artifact the Orchestrator pulls, which needs the registry that dropping docker removed; a ConfigMap,
-  at 1 MiB; a git ref the Orchestrator clones, when [ADR-0048](0048-the-orchestrator-boots-without-its-repos.md) just
-  took cloning out of the Orchestrator.
+  publisher can see what the process reads, and each standing Workflow's state and count of held items
+  ([ADR-0017](0017-pool-over-a-source-port.md)). `jr2 status` prints it; `/healthz` prints the current hash where it
+  printed the content hash. A repeat publish of the current hash answers `200 { unchanged: true }` before the body is
+  read; `--force` sends the PUT anyway and gets the same answer, because the hash names bytes the Orchestrator already
+  holds. Rejected: an OCI artifact the Orchestrator pulls, which needs the registry that dropping docker removed; a
+  ConfigMap, at 1 MiB; a git ref the Orchestrator clones, when
+  [ADR-0048](0048-the-orchestrator-boots-without-its-repos.md) just took cloning out of the Orchestrator.
 - **The walk runs twice, with different duties.** On the host, `jr2 up` keeps the typecheck
   ([ADR-0050](0050-what-code-names-config-declares-what-the-cli-names-discovery-finds.md)) and every duty that needs the
   host or the cluster: it loads the Instance folder with the same `loadWorkflows` and `partsOf` the Orchestrator runs,
@@ -121,8 +122,22 @@ resolve a Workflow's name only to the new Machine. The grill of 2026-10-18 split
   Effector manifests, the held-secret Secrets, and the roots of the image sweep. A held run that still needs one the
   current Assembly dropped fails at that provision, naming the held Assembly; so a publish strands no run whose Machine
   it changed, and a publish that drops a Sandbox Image context a parked run has not yet provisioned is the one edit that
-  still can. The Console draws a run on the current Machine; a held run's `assembly` is in its status, and a Console
-  that marks or draws held runs is a later decision. So a publish strands nothing: the "editing a workflow strands its
+  still can. A held run's `assembly` is in its status and in its `GET /runs` summary. The Console marks a run whose
+  Assembly is not the current one, "older Assembly · <hash>", and draws it on the run's own Machine, not on the current
+  Machine, from `GET /workflows/:name/runs/:runId/machine`; so the lit states are always states of the run's own Machine
+  ([ADR-0032](0032-the-console-unlocks-with-a-callers-credential.md)). For a live run the route reads the Machine from
+  the Assembly that the run holds. An ended run holds no Assembly, so the run's terminal write keeps its Machine, as
+  structure with the Charts that it bound last compiled in, in a table of its own in `state.db`, once for each distinct
+  doc: the key is a digest of the kept doc. The Machine digest of
+  [ADR-0030](0030-a-snapshot-names-the-machine-it-was-written-under.md) is not the key, because it hashes only what a
+  restore needs, and two Machines that differ in a guard, a description or an Effect's command would share one copy. The
+  Console draws every ended run from the route, because the status of an ended run binds no Chart. The run's row holds
+  only the key, so a thousand runs of one Workflow on one Assembly keep one copy, and the terminal write adds a row only
+  for a doc that the table does not have. The route serves that copy for as long as the row is kept
+  ([ADR-0065](0065-a-persist-survives-a-crash-and-history-is-kept-for-a-set-time.md)), and the run sweep deletes a doc
+  that no kept row names. So the collection rule above does not change for history: an ended run needs no Assembly to be
+  drawn. A `drifted` run has no Machine to keep, because its Assembly could not load: the Console shows no graph for it,
+  and shows its drift reason in place of the graph. So a publish strands nothing: the "editing a workflow strands its
   parked runs" consequence of [ADR-0030](0030-a-snapshot-names-the-machine-it-was-written-under.md) is retired, and
   drift is what it always meant, "I can no longer read what I saved": an Assembly that cannot load after a Kit version
   bump, or a volume that lost it. Such a run is `drifted` with a reason naming the Assembly hash and the import error;
@@ -154,6 +169,14 @@ resolve a Workflow's name only to the new Machine. The grill of 2026-10-18 split
   The agent path is data: [ADR-0070](0070-a-machine-lends-its-parts-to-a-chart.md).
 - **Semver-compatible Assemblies.** Rejected above; one line to loosen later.
 - **Keep only the current Assembly and report the runs a publish will strand.** Rejected above.
+- **Hold each Assembly that a kept run names, to draw an ended run.** Rejected: an ended run needs only its Machine's
+  structure, not the code of the Assembly, and a hold for each kept row would keep every Assembly for `runs.retain` and
+  grow the volume with each publish. The run's structure is kept instead.
+- **Keep the Machine in each ended run's row.** Rejected: every run of a Workflow on one Assembly would store the same
+  structure again, the space guard never frees rows, and the copy would add work to the synchronous terminal write. One
+  copy for each distinct structure, named by the row, costs neither.
+- **Draw no graph for an ended run whose Assembly is gone.** Rejected: the graph of a failed run is what a person reads
+  first, and the copy in the row is small.
 
 ## Consequences
 

package/docs/reference/decisions/0070-a-machine-lends-its-parts-to-a-chart.md

@@ -49,16 +49,21 @@ their own maintainers, and the escapes shipped in systems that used them were in
   answer into the run), so the Open body lends it whole, `lends.gate: true`, and a body that does not has no `gate` in
   its grammar and refuses one at the door; a lent Gate's ids sit below the body's own actor path, so a Chart cannot take
   the name of its wrapper's Gate. (Measured: with `gate` offered beside one lent Agent, three of five missed second
-  Charts reached for it as a worker.) And it mints its own Agents, because an Agent is five plain fields
+  Charts reached for it as a worker.) And it mints its own Agents, because an Agent is plain fields
   ([ADR-0049](0049-a-machine-carries-its-parts-and-composes-by-invoke.md)) and the Harness runs whatever definition
-  rides the Turn. A minted Agent's model must be one the Open body allows and the Assembly placed a key for;
-  `workspace: "none"` needs the Instance Harness the Assembly converged. Both are door refusals, never a 401 mid-run. It
-  borrows, by slot name only, every Effect (the url, argv and secret were bound once by the author and the Chart fills
-  only its input slots), every Repo and image, every secret, every child Machine, and every guard, action or delay
-  beyond the generic set. Lending is attenuated by construction; an author who lends
-  `command(["sh", "-c", arg("script")])` has lent a shell, and that is theirs to choose. A lent name may not be dotted,
-  `gate`, `fail`, a generic action's name or an integer, because those are the kit's; the Gate itself is lent as
-  `gate: true`, and the Part that fails the run as `fail: true`
+  rides the Turn. A minted Agent names no MCP server: the Chart grammar refuses `mcp`, because an MCP server with its
+  secret is reach, and MCP tools reach a Chart only through a lent Agent
+  ([ADR-0079](0079-an-agent-holds-mcp-tools-a-machine-calls-them-as-an-effect-and-the-machine-is-the-approval.md)). A
+  minted Agent's model must be one the Open body allows and the Assembly placed a key for; `workspace: "none"` needs the
+  Instance Harness the Assembly converged. Both are door refusals, never a 401 mid-run. It borrows, by slot name only,
+  every Effect (the url, argv, MCP server and tool, and secret were bound once by the author and the Chart fills only
+  its input slots), every Repo and image, every secret, every child Machine, and every guard, action or delay beyond the
+  generic set. Lending is attenuated by construction; an author who lends `command(["sh", "-c", arg("script")])` has
+  lent a shell, and that is theirs to choose. A lent name may not be dotted, `gate`, `fail`, a generic action's name or
+  an integer, because those are the kit's; the Gate itself is lent as `gate: true`, and a Gate slot that hears a Hook
+  ([ADR-0011](0011-workflow-defined-events.md)) is lent by its slot name in `lends.gates`, as an Effect is in
+  `lends.effects`; the door refuses a lent Gate slot whose `delivers` names an event that is not in the Chart's
+  Vocabulary. The Part that fails the run is lent as `fail: true`
   ([ADR-0073](0073-a-machine-fails-a-run-with-fail-and-an-uncaught-failure-ends-it-failed.md)), because the Machine
   decides which ends a Chart can choose. The guards `jr2.failure`, which tells a Failure from a defect on an `onError`,
   and `jr2.ready`, which says that a cut settled `ready`
@@ -172,10 +177,9 @@ their own maintainers, and the escapes shipped in systems that used them were in
   token, not the publish token, because a Chart is data and cannot reach the process, which is the whole point of this
   decision; it lives on the Orchestrator's volume at `.jr2/charts/<wrapper>/<name>.chart.json` beside the Assemblies,
   written durably, and survives restarts. A live run holds its Chart through the text in its own snapshot, so a `DELETE`
-  while a run is live answers at once and the run goes on. It lists in `jr2 runs` and the Console with its origin shown:
-  `jr2 runs` keeps its result, the live runs, and prints the listing beside it as activity, with `--workflows` to make
-  the listing the result ([ADR-0009](0009-cli-and-instance-interface.md)); there is no verb for `PUT` or `DELETE`, an
-  MCP or `curl` is the client. `GET /workflows` lists each wrapper with its Charts inside its entry, not beside it, and
+  while a run is live answers at once and the run goes on. It lists in `jr2 workflows` and the Console with its origin
+  shown ([ADR-0009](0009-cli-and-instance-interface.md)); there is no verb for `PUT` or `DELETE`, an MCP or `curl` is
+  the client. `GET /workflows` lists each wrapper with its Charts inside its entry, not beside it, and
   `GET /workflows/<wrapper>` carries each Open body's declaration. So a Workflow is one of three things: a Machine from
   the Assembly, a Chart file from the Assembly, or a runtime Chart, and the last two are children of the first. **There
   is no collision rule between a Machine and a Chart**: a Machine's name is a filename stem and holds no slash, a