@receiz/ai-skills 124.0.0 → 124.0.2

package/receiz-mcp-agent-skill/SKILL.md

@@ -30,7 +30,7 @@ Receiz MCP is an agent-callable tool layer beneath Receiz proof truth. It can ca
 
 ## Required Behavior
 
-1. Choose a tool from [resources/mcp-tool-map.md](resources/mcp-tool-map.md).
+1. Choose a tool from [resources/mcp-tool-map.md](resources/mcp-tool-map.md). For production-runtime operations, use the exact [V124 runtime tool map](resources/v124-runtime-tool-map.md).
 2. Validate required inputs before calling.
 3. Classify the action as read-only, preview-only, delegated write, settlement-risk, ownership-risk, or public-proof-risk.
 4. Ask for confirmation before write or settlement-affecting actions.
@@ -47,7 +47,7 @@ Receiz MCP is an agent-callable tool layer beneath Receiz proof truth. It can ca
 
 ## MCP Usage Rules
 
-Read [resources/safe-tool-calling.md](resources/safe-tool-calling.md) before executing tools. Read [resources/auth-boundaries.md](resources/auth-boundaries.md) before delegated actions. Read [resources/action-confirmation-rules.md](resources/action-confirmation-rules.md) before any publish, append, transfer, checkout, or settlement action.
+Read [resources/safe-tool-calling.md](resources/safe-tool-calling.md) before executing tools. Read [resources/auth-boundaries.md](resources/auth-boundaries.md) before delegated actions. Read [resources/action-confirmation-rules.md](resources/action-confirmation-rules.md) before any publish, append, transfer, checkout, settlement, V124 execution, or authority-session action. Use the [V124 runtime tool map](resources/v124-runtime-tool-map.md) for exact SDK mappings, scopes, references, process-local handles, and trusted-host custody.
 
 ## SDK Usage Rules
 
@@ -82,6 +82,8 @@ Agents may acquire scoped delegated access through Receiz Connect/OIDC Authoriza
 Resources:
 
 - [MCP tool map](resources/mcp-tool-map.md)
+- [V124 runtime tool map](resources/v124-runtime-tool-map.md)
+- [Machine-readable V124 runtime map](resources/v124-runtime-tool-map.json)
 - [Agent operating rules](resources/agent-operating-rules.md)
 - [Safe tool calling](resources/safe-tool-calling.md)
 - [Auth boundaries](resources/auth-boundaries.md)
@@ -97,3 +99,7 @@ Use exactly `receiz_artifact_verify`, `receiz_artifact_admit`, `receiz_artifact_
 Use canonical head → entire proof history → bounded index retrieval → exact primary-object resolution → reasoning → provenance. The 96-object window is working context, never history truncation. AI speech and performance remain non-authoritative. Consequential actions require typed deterministic command admission; meetings, relationships, trades, gifts, and battles require atomic multi-subject transactions. Autonomous execution requires a current digest-bound mandate at lease time. Bearer transfer preserves identity, full history, memory policy, inventory disposition, and unknown namespace bytes while immediately revoking former-owner authority.
 
 Concrete v120 evidence must include: a creature speaking from exact long-form proof memory; absent-owner exploration inside a mandate; a mutual relationship; a bounded autonomous trade; an atomic battle; exact device restoration; queued-action revocation; partition convergence without history replacement; rejection of an AI-invented event; and cross-application subject continuity.
+
+## v124 production-runtime contract
+
+Use only the 22 exact `receiz_v124_*` adapters in the [V124 runtime tool map](resources/v124-runtime-tool-map.md). `handleRef` is a non-authoritative process-local reference. `sessionRef` may resolve a local session or a trusted-host `persistedSessionRef`, but the canonical SDK/server path must re-verify it before use. Execute and cancel require the process-local handle plus the re-verified session. Refresh rotates session custody; close consumes it. Replay export returns an unsealed non-authoritative candidate with `exactBytesB64u`; canonically Record -> Seal those exact bytes before admitting `sealedReplayProofObjectRef` for restore. Exact private additions remain in trusted-host custody under `privateAdditionsRef` and never enter model output. `applicationId` and `audience` are runtime-pinned and never tool inputs. Never reconstruct authority from MCP JSON.

package/receiz-mcp-agent-skill/resources/mcp-tool-map.md

@@ -1,5 +1,7 @@
 # MCP Tool Map
 
+The exact universal V124 production-runtime adapters, SDK methods, fixed and conditional scopes, and process-local custody rules are defined in the [V124 runtime tool map](v124-runtime-tool-map.md). That 22-tool surface composes with the inherited inventories below; it does not replace or reinterpret them.
+
 ## V120 Application Compiler
 
 | Need | Tool | Mutation |
@@ -22,20 +24,20 @@ verification verdict or proof authority.
 
 Source: `packages/receiz-mcp-server/src/index.ts`.
 
-## V120 Current Profile And Ownership Outcomes
+## Current SDK-Only Profile And Ownership Outcomes
 
-| Need | Tool | Mutation |
+The current MCP runtime exposes no direct profile-mutation or bearer-claim adapters. Use the canonical SDK operations instead:
+
+| Need | Canonical SDK operation | Boundary |
 |---|---|---|
-| Plan authenticated profile update | `receiz_identity_profile_update_plan` | Read-only plan; accepts `{ profile }` only |
-| Execute authenticated profile update | `receiz_identity_profile_update_execute` | Exact confirmation; calls `client.profile.update(profile)` and requires the same-UID result |
-| Plan bearer ownership claim | `receiz_bearer_asset_claim_plan` | Accepts `{ artifactBase64, filename, mimeType }` for the complete sealed artifact |
-| Execute bearer ownership claim | `receiz_bearer_asset_claim_execute` | Exact confirmation; returns the newly claimed complete native artifact bytes and evidence |
+| Authenticated profile update | `client.profile.update(profile)` | Requires the returned UID to remain the authenticated actor UID; performs no identity/profile pre-read |
+| Bearer ownership claim | `client.artifacts.verifyAndOpen(completeFile)`, then `client.ownership.claimBearerAsset({ artifact: opened.sealedArtifact })` | Accepts the complete sealed artifact and returns the new native Record -> Seal artifact |
 
-The profile plan performs no profile read and accepts no account selector, key, caller head, or idempotency field. The authenticated session/OIDC actor is the account, and execution requires the returned UID to remain unchanged.
+The profile operation accepts no caller-selected account UID, identity key, or proof head. The authenticated session/OIDC actor is the account.
 
-The bearer plan verifies the complete sealed artifact with `client.artifacts.verifyAndOpen`. Execution passes only `opened.sealedArtifact` to `client.ownership.claimBearerAsset` and returns the new native Record -> Seal artifact. Prior ownership comes from the verified carried proof. MCP never accepts a detached payload, caller owner, claim key, or caller head.
+The bearer operation passes only the runtime-issued sealed-artifact handle into the claim. Prior ownership comes from the verified carried proof. Never accept a detached payload, caller owner, claim key, or caller head, and never invent an MCP tool name or substitute an unrelated MCP mutation.
 
-A verified proof object is not limited to the platform that created it. Any lawful platform may append authenticated ownership and history only while preserving the same immutable object identity, payload, provenance root, prior history, and unknown namespaces, then returning a complete verified proof object. These MCP tools invoke that same SDK continuity and never create an origin-platform lock or parallel chain.
+A verified proof object is not limited to the platform that created it. Any lawful platform may append authenticated ownership and history only while preserving the same immutable object identity, payload, provenance root, prior history, and unknown namespaces, then returning a complete verified proof object. The SDK workflow preserves that continuity and creates neither an origin-platform lock nor a parallel chain.
 
 ## V120 Current Artifact Coordination
 

package/receiz-mcp-agent-skill/resources/v124-runtime-tool-map.json

@@ -0,0 +1,375 @@
+{
+  "schema": "receiz.ai-skills.v124-mcp-tool-map.v1",
+  "authority": {
+    "mcpIsAuthority": false,
+    "grantIsIdentityAuthority": false,
+    "bearerIsIdentityAuthority": false,
+    "strongerTruth": "sealed-receiz-proof-object",
+    "identityAuthority": "receiz-identity-artifact",
+    "databaseRole": "sync-and-recovery-only"
+  },
+  "runtimePinnedCoordinates": [
+    "applicationId",
+    "audience"
+  ],
+  "custodyRules": [
+    "handleRef-is-process-local-and-non-authoritative",
+    "sessionRef-is-local-or-trusted-host-persisted-and-non-authoritative",
+    "trusted-host-persisted-session-is-reverified-by-the-canonical-sdk-server-path",
+    "execute-and-cancel-require-custodied-handle-and-session",
+    "refresh-rotates-and-close-consumes-session-custody",
+    "replay-export-is-an-unsealed-non-authoritative-candidate",
+    "replay-candidate-must-be-canonically-sealed-before-restore",
+    "restore-accepts-only-sealedReplayProofObjectRef",
+    "private-additions-remain-in-trusted-host-custody-behind-privateAdditionsRef",
+    "private-additions-exact-result-is-never-returned-to-the-model",
+    "mcp-never-reconstructs-sdk-authority-from-json"
+  ],
+  "tools": [
+    {
+      "name": "receiz_v124_kai_now",
+      "sdkMethod": "receizKaiNow",
+      "scopeMode": "none",
+      "fixedScopes": [],
+      "conditionalScopes": [],
+      "inputRefs": [],
+      "outputRefs": [],
+      "actionClass": "read-only",
+      "custody": "No authority object is created; the SDK returns the genesis-derived Kai pulse coordinate."
+    },
+    {
+      "name": "receiz_v124_proof_authority_challenge_create",
+      "sdkMethod": "createReceizProofAuthorityChallenge",
+      "scopeMode": "requested-exact",
+      "fixedScopes": [],
+      "conditionalScopes": [
+        "exact-requested-scopes-within-registered-application-grant"
+      ],
+      "inputRefs": [],
+      "outputRefs": [],
+      "actionClass": "confirmed-identity-bound-challenge",
+      "custody": "The canonical signable challenge is not identity authority and must remain exact through local artifact signing."
+    },
+    {
+      "name": "receiz_v124_execution_plan_atomic_operation",
+      "sdkMethod": "client.execution.planAtomicOperationV124",
+      "scopeMode": "none",
+      "fixedScopes": [],
+      "conditionalScopes": [],
+      "inputRefs": [],
+      "outputRefs": [
+        "planRef"
+      ],
+      "actionClass": "plan-only",
+      "custody": "The SDK plan is a deterministic execution projection, not proof or commit authority."
+    },
+    {
+      "name": "receiz_v124_execution_stage",
+      "sdkMethod": "client.execution.stage",
+      "scopeMode": "fixed-all",
+      "fixedScopes": [
+        "receiz:domains.write"
+      ],
+      "conditionalScopes": [],
+      "inputRefs": [
+        "planRef"
+      ],
+      "outputRefs": [
+        "handleRef"
+      ],
+      "actionClass": "confirmed-mutation",
+      "custody": "The MCP runtime holds the exact SDK handle and returns only a process-local non-authoritative handleRef."
+    },
+    {
+      "name": "receiz_v124_execution_stage_prepared",
+      "sdkMethod": "client.execution.stagePrepared",
+      "scopeMode": "fixed-all",
+      "fixedScopes": [
+        "receiz:domains.write"
+      ],
+      "conditionalScopes": [],
+      "inputRefs": [
+        "planRef",
+        "transitionSetRef"
+      ],
+      "outputRefs": [
+        "handleRef"
+      ],
+      "actionClass": "confirmed-mutation",
+      "custody": "The MCP runtime holds the exact SDK handle and returns only a process-local non-authoritative handleRef."
+    },
+    {
+      "name": "receiz_v124_execution_execute",
+      "sdkMethod": "client.execution.execute",
+      "scopeMode": "active-session-route-and-category-rail",
+      "fixedScopes": [
+        "receiz:domains.write"
+      ],
+      "conditionalScopes": [
+        "exact-stored-granted-scopes",
+        "settlement-or-reserve-granted-rail-when-operation-category-requires-it"
+      ],
+      "inputRefs": [
+        "handleRef",
+        "sessionRef"
+      ],
+      "outputRefs": [
+        "planRef"
+      ],
+      "actionClass": "confirmed-mutation",
+      "custody": "Requires the process-local exact handle plus a local or trusted-host-persisted authority session; the canonical SDK/server path re-verifies the session and JSON reconstruction is rejected."
+    },
+    {
+      "name": "receiz_v124_execution_resolve",
+      "sdkMethod": "client.execution.resolve",
+      "scopeMode": "fixed-all",
+      "fixedScopes": [
+        "receiz:domains.read"
+      ],
+      "conditionalScopes": [],
+      "inputRefs": [],
+      "outputRefs": [
+        "planRef"
+      ],
+      "actionClass": "read-only",
+      "custody": "Reads the durable authenticated execution projection through the SDK; the projection does not become proof authority."
+    },
+    {
+      "name": "receiz_v124_execution_resolve_by_idempotency",
+      "sdkMethod": "client.execution.resolveByIdempotencyKey",
+      "scopeMode": "fixed-all",
+      "fixedScopes": [
+        "receiz:domains.read"
+      ],
+      "conditionalScopes": [],
+      "inputRefs": [],
+      "outputRefs": [
+        "planRef"
+      ],
+      "actionClass": "read-only-recovery",
+      "custody": "Resolves the durable semantic idempotency coordinate without manufacturing or replaying a replacement plan."
+    },
+    {
+      "name": "receiz_v124_execution_cancel",
+      "sdkMethod": "client.execution.cancel",
+      "scopeMode": "active-session-route-and-category-rail",
+      "fixedScopes": [
+        "receiz:domains.write"
+      ],
+      "conditionalScopes": [
+        "exact-stored-granted-scopes",
+        "settlement-or-reserve-granted-rail-when-operation-category-requires-it"
+      ],
+      "inputRefs": [
+        "handleRef",
+        "sessionRef"
+      ],
+      "outputRefs": [
+        "planRef"
+      ],
+      "actionClass": "confirmed-mutation",
+      "custody": "Requires the process-local exact handle plus a local or trusted-host-persisted authority session; the canonical SDK/server path re-verifies terminal authorization."
+    },
+    {
+      "name": "receiz_v124_runtime_authority_session_open",
+      "sdkMethod": "client.runtime.openAuthoritySessionV124",
+      "scopeMode": "challenge-session-plus-requested-rail-write",
+      "fixedScopes": [],
+      "conditionalScopes": [
+        "exact-signed-challenge-scopes",
+        "receiz:<requested-rail>.write"
+      ],
+      "inputRefs": [
+        "identityArtifactRef",
+        "subjectSourceArtifactRef",
+        "signedChallengeRef"
+      ],
+      "outputRefs": [
+        "sessionRef",
+        "persistedSessionRef"
+      ],
+      "actionClass": "confirmed-session-mutation",
+      "custody": "Returns a non-authoritative local sessionRef and, when configured, a trusted-host persistedSessionRef; every later use is re-verified by the canonical SDK/server path."
+    },
+    {
+      "name": "receiz_v124_runtime_authority_session_refresh",
+      "sdkMethod": "client.runtime.refreshAuthoritySessionV124",
+      "scopeMode": "challenge-session-plus-requested-rail-write",
+      "fixedScopes": [],
+      "conditionalScopes": [
+        "exact-signed-challenge-scopes",
+        "exact-stored-session-scopes",
+        "receiz:<requested-rail>.write"
+      ],
+      "inputRefs": [
+        "sessionRef",
+        "identityArtifactRef",
+        "signedChallengeRef"
+      ],
+      "outputRefs": [
+        "sessionRef",
+        "persistedSessionRef"
+      ],
+      "actionClass": "confirmed-session-mutation",
+      "custody": "Refresh re-verifies a local sessionRef or trusted-host persistedSessionRef supplied as sessionRef, rotates custody, and returns new local and optional persisted references."
+    },
+    {
+      "name": "receiz_v124_runtime_authority_session_close",
+      "sdkMethod": "client.runtime.closeAuthoritySessionV124",
+      "scopeMode": "stored-session-grant",
+      "fixedScopes": [],
+      "conditionalScopes": [
+        "exact-stored-session-scopes"
+      ],
+      "inputRefs": [
+        "sessionRef"
+      ],
+      "outputRefs": [],
+      "actionClass": "confirmed-session-mutation",
+      "custody": "Close re-verifies a local or trusted-host-persisted session reference and consumes the active session custody."
+    },
+    {
+      "name": "receiz_v124_runtime_qualify",
+      "sdkMethod": "client.runtime.qualifyV124",
+      "scopeMode": "application-bound-bearer",
+      "fixedScopes": [],
+      "conditionalScopes": [
+        "application-bound-bearer"
+      ],
+      "inputRefs": [],
+      "outputRefs": [],
+      "actionClass": "read-only",
+      "custody": "Capability descriptors report operational dependencies but cannot establish proof, identity, or execution authority."
+    },
+    {
+      "name": "receiz_v124_domain_verified_additions",
+      "sdkMethod": "client.domains.verifiedAdditionsV124",
+      "scopeMode": "fixed-all",
+      "fixedScopes": [
+        "receiz:domains.read"
+      ],
+      "conditionalScopes": [],
+      "inputRefs": [],
+      "outputRefs": [],
+      "actionClass": "read-only-verified",
+      "custody": "The SDK authenticates transport and verifies additions against the exact predecessor before admission into its replay context."
+    },
+    {
+      "name": "receiz_v124_domain_verified_replay",
+      "sdkMethod": "client.domains.verifiedReplayV124",
+      "scopeMode": "fixed-all",
+      "fixedScopes": [
+        "receiz:domains.read"
+      ],
+      "conditionalScopes": [],
+      "inputRefs": [],
+      "outputRefs": [],
+      "actionClass": "read-only-verified",
+      "custody": "Verified replay custody belongs to the canonical SDK client runtime, never to an MCP property bag."
+    },
+    {
+      "name": "receiz_v124_domain_verified_checkpoint",
+      "sdkMethod": "client.domains.verifiedCheckpointV124",
+      "scopeMode": "fixed-all",
+      "fixedScopes": [
+        "receiz:domains.read"
+      ],
+      "conditionalScopes": [],
+      "inputRefs": [],
+      "outputRefs": [],
+      "actionClass": "read-only-verified",
+      "custody": "Checkpoint creation consumes SDK-held verified replay custody and binds the authenticated exact head."
+    },
+    {
+      "name": "receiz_v124_domain_verified_private_additions",
+      "sdkMethod": "client.domains.verifiedPrivateAdditionsV124",
+      "scopeMode": "active-session-route-and-stored-grant",
+      "fixedScopes": [
+        "receiz:world.private"
+      ],
+      "conditionalScopes": [
+        "exact-stored-granted-scopes"
+      ],
+      "inputRefs": [
+        "sessionRef"
+      ],
+      "outputRefs": [
+        "privateAdditionsRef"
+      ],
+      "actionClass": "private-read-verified",
+      "custody": "The exact authenticated private-additions result remains in trusted host custody behind privateAdditionsRef; the model receives only safe coordinates, counts, and digests."
+    },
+    {
+      "name": "receiz_v124_domain_replay_proof_object_export",
+      "sdkMethod": "client.domains.exportVerifiedReplayProofObjectV124",
+      "scopeMode": "none",
+      "fixedScopes": [],
+      "conditionalScopes": [],
+      "inputRefs": [],
+      "outputRefs": [],
+      "actionClass": "local-custody-export",
+      "custody": "Returns an unsealed non-authoritative candidate containing exactBytesB64u. It must pass the canonical Record -> Seal ceremony before admission as sealedReplayProofObjectRef."
+    },
+    {
+      "name": "receiz_v124_domain_replay_proof_object_restore",
+      "sdkMethod": "client.domains.restoreVerifiedReplayProofObjectV124",
+      "scopeMode": "none",
+      "fixedScopes": [],
+      "conditionalScopes": [],
+      "inputRefs": [
+        "sealedReplayProofObjectRef"
+      ],
+      "outputRefs": [],
+      "actionClass": "local-custody-restore",
+      "custody": "Accepts only sealedReplayProofObjectRef, resolves the exact sealed artifact in trusted host custody, and requires canonical SDK verification before restoring replay custody."
+    },
+    {
+      "name": "receiz_v124_subject_namespaces_resolve",
+      "sdkMethod": "client.subjects.resolveNamespacesV124",
+      "scopeMode": "fixed-all",
+      "fixedScopes": [
+        "receiz:subjects.read"
+      ],
+      "conditionalScopes": [],
+      "inputRefs": [],
+      "outputRefs": [],
+      "actionClass": "read-only",
+      "custody": "Returns authenticated namespace projections bound to exact heads; projections cannot replace sealed subject truth."
+    },
+    {
+      "name": "receiz_v124_identity_public_recipient_resolve",
+      "sdkMethod": "client.identity.resolvePublicRecipientV124",
+      "scopeMode": "active-session-route-and-stored-grant",
+      "fixedScopes": [
+        "receiz:subjects.read"
+      ],
+      "conditionalScopes": [
+        "exact-stored-granted-scopes"
+      ],
+      "inputRefs": [
+        "sessionRef"
+      ],
+      "outputRefs": [],
+      "actionClass": "rate-limited-read-only",
+      "custody": "Returns only the privacy-safe public recipient projection needed for transfer planning; it is not identity authority."
+    },
+    {
+      "name": "receiz_v124_source_publish_sealed",
+      "sdkMethod": "client.sources.publishSealedSourceV124",
+      "scopeMode": "source-kind-and-stored-grant",
+      "fixedScopes": [],
+      "conditionalScopes": [
+        "subject:receiz:subjects.write:no-session",
+        "replay-segment:receiz:domains.write:exact-stored-granted-scopes",
+        "checkpoint:receiz:domains.write:exact-stored-granted-scopes"
+      ],
+      "inputRefs": [
+        "sealedSourceArtifactRef",
+        "sessionRef"
+      ],
+      "outputRefs": [],
+      "actionClass": "confirmed-mutation",
+      "custody": "The exact sealedSourceArtifactRef stays in trusted host custody. Subject publication needs no session; replay-segment/checkpoint publication re-verifies a local or persisted session's exact stored grant."
+    }
+  ]
+}

package/receiz-mcp-agent-skill/resources/v124-runtime-tool-map.md

@@ -0,0 +1,59 @@
+# V124 Runtime MCP Tool Map
+
+This is the exact universal V124 MCP adapter surface. It is not application-specific. Each tool calls the named SDK primitive and must not reimplement SDK verification, authority, clock, replay, or execution law. The machine-readable companion is [v124-runtime-tool-map.json](v124-runtime-tool-map.json).
+
+## Authority hierarchy
+
+- The sealed Receiz proof object remains proof authority.
+- The Receiz identity artifact remains identity authority.
+- A grant, challenge, bearer, authority session, handle, MCP reference, server response, or database row is not proof or identity authority.
+- The database supports durable coordination, synchronization, and recovery beneath proof-object continuity.
+- UTC supplies elapsed duration to the genesis-derived Kai bridge; UTC is not Kai authority.
+
+## Exact tools, SDK methods, and scopes
+
+`Fixed scopes` means every listed scope is required by that route. `Conditional scopes` means the exact challenge/session scope set or the one scope selected by the sealed source kind; it never means all scopes may be inferred.
+
+`applicationId` and `audience` are pinned by the authenticated MCP runtime. They are never model-supplied tool inputs.
+
+| MCP tool | Canonical SDK method | Fixed and conditional scopes | Input refs | Output refs |
+|---|---|---|---|---|
+| `receiz_v124_kai_now` | `receizKaiNow` | none | none | none |
+| `receiz_v124_proof_authority_challenge_create` | `createReceizProofAuthorityChallenge` | exact requested scopes within the registered application grant | none | none |
+| `receiz_v124_execution_plan_atomic_operation` | `client.execution.planAtomicOperationV124` | none | none | `planRef` |
+| `receiz_v124_execution_stage` | `client.execution.stage` | fixed `receiz:domains.write` | `planRef` | `handleRef` |
+| `receiz_v124_execution_stage_prepared` | `client.execution.stagePrepared` | fixed `receiz:domains.write` | `planRef`, `transitionSetRef` | `handleRef` |
+| `receiz_v124_execution_execute` | `client.execution.execute` | fixed `receiz:domains.write`; exact stored grant; Settlement/Reserve rail grant when that category is executed | `handleRef`, `sessionRef` | `planRef` only for an unknown outcome retained for recovery |
+| `receiz_v124_execution_resolve` | `client.execution.resolve` | fixed `receiz:domains.read` | none | `planRef` only for an unknown outcome retained for recovery |
+| `receiz_v124_execution_resolve_by_idempotency` | `client.execution.resolveByIdempotencyKey` | fixed `receiz:domains.read` | none | `planRef` only for an unknown outcome retained for recovery |
+| `receiz_v124_execution_cancel` | `client.execution.cancel` | fixed `receiz:domains.write`; exact stored grant; Settlement/Reserve rail grant when that category is cancelled | `handleRef`, `sessionRef` | `planRef` only for an unknown outcome retained for recovery |
+| `receiz_v124_runtime_authority_session_open` | `client.runtime.openAuthoritySessionV124` | exact signed-challenge scopes plus `receiz:<requested-rail>.write` for every requested rail | `identityArtifactRef`, `subjectSourceArtifactRef`, `signedChallengeRef` | `sessionRef`; optional `persistedSessionRef` |
+| `receiz_v124_runtime_authority_session_refresh` | `client.runtime.refreshAuthoritySessionV124` | exact signed-challenge and stored-session scopes plus `receiz:<requested-rail>.write` | `sessionRef`, `identityArtifactRef`, `signedChallengeRef` | rotated `sessionRef`; optional `persistedSessionRef` |
+| `receiz_v124_runtime_authority_session_close` | `client.runtime.closeAuthoritySessionV124` | exact stored session grant | `sessionRef` | none |
+| `receiz_v124_runtime_qualify` | `client.runtime.qualifyV124` | application-bound bearer | none | none |
+| `receiz_v124_domain_verified_additions` | `client.domains.verifiedAdditionsV124` | fixed `receiz:domains.read` | none | none |
+| `receiz_v124_domain_verified_replay` | `client.domains.verifiedReplayV124` | fixed `receiz:domains.read` | none | none |
+| `receiz_v124_domain_verified_checkpoint` | `client.domains.verifiedCheckpointV124` | fixed `receiz:domains.read` | none | none |
+| `receiz_v124_domain_verified_private_additions` | `client.domains.verifiedPrivateAdditionsV124` | fixed `receiz:world.private` plus exact stored grant | `sessionRef` | trusted-host `privateAdditionsRef` only |
+| `receiz_v124_domain_replay_proof_object_export` | `client.domains.exportVerifiedReplayProofObjectV124` | none | none | none; returns an unsealed candidate with `exactBytesB64u` |
+| `receiz_v124_domain_replay_proof_object_restore` | `client.domains.restoreVerifiedReplayProofObjectV124` | none | `sealedReplayProofObjectRef` | none |
+| `receiz_v124_subject_namespaces_resolve` | `client.subjects.resolveNamespacesV124` | fixed `receiz:subjects.read` | none | none |
+| `receiz_v124_identity_public_recipient_resolve` | `client.identity.resolvePublicRecipientV124` | fixed `receiz:subjects.read` plus exact stored grant | `sessionRef` | none |
+| `receiz_v124_source_publish_sealed` | `client.sources.publishSealedSourceV124` | subject: `receiz:subjects.write`, no session; replay/checkpoint: `receiz:domains.write` plus exact stored grant | `sealedSourceArtifactRef`; `sessionRef` for replay/checkpoint | none |
+
+## Reference and trusted-host custody
+
+- `planRef`, `transitionSetRef`, identity/source artifact references, signed-challenge references, sealed-source references, and sealed replay references resolve only through application-bound trusted-host custody. The model never supplies the underlying material.
+- `handleRef` is always process-local and non-authoritative. `receiz_v124_execution_stage` and `receiz_v124_execution_stage_prepared` keep the exact SDK handle in the MCP client runtime.
+- `sessionRef` may name a local held session or a trusted-host-persisted session. A returned `persistedSessionRef` is supplied to a later tool as its `sessionRef` value. The canonical SDK/server path re-verifies the persisted session before use; the reference and persisted projection are not authority.
+- Execute and cancel require the process-local held handle and a re-verified held/persisted authority session. Never reconstruct either object from JSON.
+- Refresh rotates session custody and invalidates the prior local reference. Close consumes the authenticated session.
+- Private additions remain entirely in trusted-host custody under `privateAdditionsRef`. The model receives only authenticated safe coordinates, counts, and event digests—not the exact encrypted additions or recipient material.
+- Replay export returns an unsealed, non-authoritative candidate containing `exactBytesB64u`. It is not a sealed proof object. Canonically Record -> Seal those exact bytes, admit the result into trusted-host custody as `sealedReplayProofObjectRef`, and only then call restore.
+- Restore accepts only `sealedReplayProofObjectRef`; the SDK verifies the exact sealed proof object before restoring replay custody. Caller-constructed replay JSON is forbidden.
+
+## Mutation and recovery law
+
+Challenge creation, stage, execute, cancel, authority-session open/refresh/close, and sealed-source publication require the exact MCP confirmation digest before mutation. A confirmation digest authorizes only the exact pending request and never becomes proof, identity, session, or execution authority. Recovery reads use the durable semantic idempotency coordinate before any replacement plan is created.
+
+All tool output remains a subordinate projection. Secret-bearing values and private proof material must not be echoed by the MCP adapter.