@securecoms/agent-bridge 0.35.0 → 0.37.0

package/dist/bin.js

@@ -3084,7 +3084,7 @@ function eddsa(Point, cHash, eddsaOpts = {}) {
     if (outputLen !== expectedLen)
       throw new Error(`hash.outputLen must be ${expectedLen}, got ${outputLen}`);
   }
-  const randomBytes13 = opts.randomBytes === void 0 ? randomBytes4 : opts.randomBytes;
+  const randomBytes14 = opts.randomBytes === void 0 ? randomBytes4 : opts.randomBytes;
   const adjustScalarBytes3 = opts.adjustScalarBytes === void 0 ? (bytes) => bytes : opts.adjustScalarBytes;
   const domain = opts.domain === void 0 ? (data, ctx, phflag) => {
     abool2(phflag, "phflag");
@@ -3170,7 +3170,7 @@ function eddsa(Point, cHash, eddsaOpts = {}) {
     seed: _size
   };
   function randomSecretKey(seed) {
-    seed = seed === void 0 ? randomBytes13(lengths.seed) : seed;
+    seed = seed === void 0 ? randomBytes14(lengths.seed) : seed;
     return abytes3(seed, lengths.seed, "seed");
   }
   function isValidSecretKey(key) {
@@ -6419,7 +6419,7 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
     bits2int_modN: "function"
   });
   ecdsaOpts = Object.assign({}, ecdsaOpts);
-  const randomBytes13 = ecdsaOpts.randomBytes === void 0 ? randomBytes4 : ecdsaOpts.randomBytes;
+  const randomBytes14 = ecdsaOpts.randomBytes === void 0 ? randomBytes4 : ecdsaOpts.randomBytes;
   const hmac5 = ecdsaOpts.hmac === void 0 ? (key, msg) => hmac(hash_, key, msg) : ecdsaOpts.hmac;
   const { Fp: Fp3, Fn: Fn3 } = Point;
   const { ORDER: CURVE_ORDER, BITS: fnBits } = Fn3;
@@ -6565,7 +6565,7 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
       throw new Error("invalid private key");
     const seedArgs = [int2octets(d), int2octets(h1int)];
     if (extraEntropy != null && extraEntropy !== false) {
-      const e = extraEntropy === true ? randomBytes13(lengths.secretKey) : extraEntropy;
+      const e = extraEntropy === true ? randomBytes14(lengths.secretKey) : extraEntropy;
       seedArgs.push(abytes3(e, void 0, "extraEntropy"));
     }
     const seed = concatBytes4(...seedArgs);
@@ -7555,7 +7555,7 @@ __export(import_bundle_exports, {
   ModelImportError: () => ModelImportError,
   importModelBundle: () => importModelBundle
 });
-import { createHash as createHash6, randomBytes as randomBytes12 } from "node:crypto";
+import { createHash as createHash7, randomBytes as randomBytes13 } from "node:crypto";
 import { readFileSync as readFileSync16, statSync as statSync7, writeFileSync as writeFileSync4 } from "node:fs";
 import { join as join25 } from "node:path";
 async function importModelBundle(srcDir, root3, m) {
@@ -7578,14 +7578,14 @@ async function importModelBundle(srcDir, root3, m) {
     } catch {
       throw new ModelImportError(`${f.name} is missing from the import directory`);
     }
-    if (bytes.length !== f.size || createHash6("sha256").update(bytes).digest("hex") !== f.sha256) throw mismatch;
+    if (bytes.length !== f.size || createHash7("sha256").update(bytes).digest("hex") !== f.sha256) throw mismatch;
     verified.push({ f, bytes });
   }
   const imported = [];
   for (const { f, bytes } of verified) {
     try {
       const pdir = plainDirChain(root3, [".partial"], { create: true, fromModelsDir: true, mode: 448 });
-      const partial = join25(pdir, randomBytes12(12).toString("hex"));
+      const partial = join25(pdir, randomBytes13(12).toString("hex"));
       writeFileSync4(partial, bytes, { mode: 384, flag: "wx" });
       installVerified(root3, m.modelId, f, partial, { replace: true });
     } catch (e) {
@@ -19161,8 +19161,8 @@ function sameRef(a, b) {
 // ../connect-sdk-ts/dist/groupkey/own-removal.js
 async function probeOwnRemoval(mgr, commitBytes) {
   try {
-    const own = mgr.state?.privatePath?.leafIndex;
-    if (typeof own !== "number")
+    const own2 = mgr.state?.privatePath?.leafIndex;
+    if (typeof own2 !== "number")
       return null;
     if (!hoistedTsMlsMatchesCrypto(mgr))
       return null;
@@ -19187,7 +19187,7 @@ async function probeOwnRemoval(mgr, commitBytes) {
         committer = typeof incoming.senderLeafIndex === "number" ? Number(incoming.senderLeafIndex) : null;
         for (const p of incoming.proposals) {
           const prop = p.proposal;
-          if (prop.proposalType === "remove" && Number(prop.remove?.removed) === own)
+          if (prop.proposalType === "remove" && Number(prop.remove?.removed) === own2)
             removesOwn = true;
         }
       }
@@ -19195,7 +19195,7 @@ async function probeOwnRemoval(mgr, commitBytes) {
     }, cs);
     if (!sawCommit || !removesOwn)
       return null;
-    return { ownLeafIndex: own, committerLeafIndex: committer };
+    return { ownLeafIndex: own2, committerLeafIndex: committer };
   } catch {
     return null;
   }
@@ -20057,6 +20057,33 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
     }
     return { ownLeafIndex: this.ownLeafIndex(mgr), leaves };
   }
+  /**
+   * MCP client (bridge Task 16; audit H-2, round 2 H-D): a SYNCHRONOUS, read-only snapshot of the WARM in-memory
+   * manager for `channelId`: its group id, its epoch and EVERY non-blank leaf, reported exactly as
+   * {@link leafTreeSummary} reports them (non-basic credentials included, identity null, #771 HIGH-B). All three are
+   * read from ONE `state` object (MLSGroupManager replaces `state` whole on every commit), with no await, so they belong
+   * to the same epoch and no commit can land between them.
+   *
+   * `null` when no manager is warm: it never loads from the store, never takes the channel lock, never touches the
+   * network and never mutates. A caller treating `null` as "cannot tell" fails closed.
+   */
+  leafSnapshotCached(channelId) {
+    const state = this.managers.get(channelId)?.state;
+    const tree = state?.ratchetTree;
+    if (!state || !tree)
+      return null;
+    const leaves = [];
+    const numLeaves = Math.floor((tree.length + 1) / 2);
+    for (let i = 0; i < numLeaves; i++) {
+      const node = tree[i * 2];
+      if (!node || node.nodeType !== "leaf")
+        continue;
+      const cred = getCredentialFromLeafIndex(tree, toLeafIndex2(i));
+      const basic = cred.credentialType === "basic";
+      leaves.push({ leafIndex: i, basic, identity: basic ? new TextDecoder().decode(cred.identity) : null });
+    }
+    return { groupId: new TextDecoder().decode(state.groupContext.groupId), epoch: Number(state.groupContext.epoch), leaves };
+  }
   async fetchDeviceLeafCredential(deviceId) {
     const kps = await this.o.backend.fetchKeyPackages([deviceId]);
     const hex = kps[deviceId];
@@ -27390,10 +27417,12 @@ function openSchema(db) {
   ensureRuntimeReplyIntent(db);
   ensureRuntimeReplyIntentEnvelopeGroup(db);
   ensureRuntimeReplyIntentCredit(db);
+  ensureRuntimeReplyIntentMcpTurn(db);
   ensureGroupLink(db);
   ensureMlsCustody(db);
   ensureToolGrantTables(db);
   ensureToolGrantAppliedTable(db);
+  ensureToolGrantMcpSeenTable(db);
   ensureRoomSearchCapTable(db);
   ensureVoiceChannelParentTable(db);
   db.exec(`PRAGMA user_version = ${SCHEMA_VERSION}`);
@@ -27483,6 +27512,19 @@ function ensureRuntimeReplyIntentCredit(db) {
     throw e;
   }
 }
+function ensureRuntimeReplyIntentMcpTurn(db) {
+  const hasColumn = () => db.prepare("PRAGMA table_info(runtime_reply_intent)").all().some((c) => c.name === "mcp_turn");
+  const cols = db.prepare("PRAGMA table_info(runtime_reply_intent)").all();
+  if (cols.length === 0 || cols.some((c) => c.name === "mcp_turn"))
+    return;
+  try {
+    db.exec("ALTER TABLE runtime_reply_intent ADD COLUMN mcp_turn INTEGER NOT NULL DEFAULT 0");
+  } catch (e) {
+    if (hasColumn())
+      return;
+    throw e;
+  }
+}
 var RECALL_STATE_COLUMNS = [
   ["recall_enabled", "INTEGER NOT NULL DEFAULT 0"],
   ["recall_mode_epoch", "INTEGER NOT NULL DEFAULT 0"],
@@ -27594,6 +27636,15 @@ function ensureToolGrantAppliedTable(db) {
     );
   `);
 }
+function ensureToolGrantMcpSeenTable(db) {
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS tool_grant_mcp_seen (
+      identity_id  TEXT PRIMARY KEY,
+      sealed_state BLOB NOT NULL,
+      updated_at   INTEGER NOT NULL
+    );
+  `);
+}
 function ensureVoiceChannelParentTable(db) {
   db.exec(`
     CREATE TABLE IF NOT EXISTS voice_channel_parent (
@@ -28534,8 +28585,8 @@ var SqliteMlsStateStore = class _SqliteMlsStateStore {
     this.db.prepare("DELETE FROM runtime_reply_intent WHERE identity_id=? AND updated_at < ?").run(this.id, now - RUNTIME_REPLY_INTENT_RETENTION_MS);
     const info = this.db.prepare(`INSERT OR IGNORE INTO runtime_reply_intent
          (identity_id, scope, part, in_reply_to, channel_id, reply_message_id, body_mac,
-          sealed_body, sealed_envelope, state, created_at, updated_at, reply_credit)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, NULL, 'pending', ?, ?, ?)`).run(this.id, input.scope, input.part, input.inReplyTo, input.channelId, input.replyMessageId, input.bodyMac, sealed, now, now, input.replyCredit ?? null);
+          sealed_body, sealed_envelope, state, created_at, updated_at, reply_credit, mcp_turn)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, NULL, 'pending', ?, ?, ?, ?)`).run(this.id, input.scope, input.part, input.inReplyTo, input.channelId, input.replyMessageId, input.bodyMac, sealed, now, now, input.replyCredit ?? null, input.mcpTurn === true ? 1 : 0);
     const count = this.db.prepare("SELECT COUNT(*) AS n FROM runtime_reply_intent WHERE identity_id=?").get(this.id);
     if (count.n > RUNTIME_REPLY_INTENT_MAX) {
       this.db.prepare(`DELETE FROM runtime_reply_intent
@@ -28545,7 +28596,7 @@ var SqliteMlsStateStore = class _SqliteMlsStateStore {
          )`).run(this.id, this.id, RUNTIME_REPLY_INTENT_MAX);
     }
     const row = this.db.prepare(`SELECT scope, part, in_reply_to, channel_id, reply_message_id, body_mac,
-              sealed_body, sealed_envelope, sealed_envelope_group, state, created_at, reply_credit
+              sealed_body, sealed_envelope, sealed_envelope_group, state, created_at, reply_credit, mcp_turn
        FROM runtime_reply_intent WHERE identity_id=? AND scope=? AND part=?`).get(this.id, input.scope, input.part);
     if (!row)
       throw new Error("reply intent vanished after claim");
@@ -28554,7 +28605,7 @@ var SqliteMlsStateStore = class _SqliteMlsStateStore {
   /** SEC-06 #18: every intent answering `inReplyTo`, in claim order. */
   async listReplyIntents(inReplyTo) {
     const rows = this.db.prepare(`SELECT scope, part, in_reply_to, channel_id, reply_message_id, body_mac,
-              sealed_body, sealed_envelope, sealed_envelope_group, state, created_at, reply_credit
+              sealed_body, sealed_envelope, sealed_envelope_group, state, created_at, reply_credit, mcp_turn
        FROM runtime_reply_intent WHERE identity_id=? AND in_reply_to=?
        ORDER BY created_at ASC, rowid ASC`).all(this.id, inReplyTo);
     const out = [];
@@ -28565,7 +28616,7 @@ var SqliteMlsStateStore = class _SqliteMlsStateStore {
   /** SEC-06 #18: re-read one intent by its key (null when absent). */
   async getReplyIntent(scope, part) {
     const row = this.db.prepare(`SELECT scope, part, in_reply_to, channel_id, reply_message_id, body_mac,
-              sealed_body, sealed_envelope, sealed_envelope_group, state, created_at, reply_credit
+              sealed_body, sealed_envelope, sealed_envelope_group, state, created_at, reply_credit, mcp_turn
        FROM runtime_reply_intent WHERE identity_id=? AND scope=? AND part=?`).get(this.id, scope, part);
     return row ? this.openReplyIntent(row) : null;
   }
@@ -28640,7 +28691,9 @@ var SqliteMlsStateStore = class _SqliteMlsStateStore {
       envelopeGroupId: envelopeGroupFor(envelope, await openOrNull(row.sealed_envelope_group)),
       state: row.state === "sent" ? "sent" : row.state === "skipped" ? "skipped" : "pending",
       createdAt: Number(row.created_at),
-      replyCredit: typeof row.reply_credit === "string" ? row.reply_credit : null
+      replyCredit: typeof row.reply_credit === "string" ? row.reply_credit : null,
+      // Any value other than exactly 1 (0, NULL, a missing column) is false; the bridge's MAC decides what a 1 means.
+      mcpTurn: Number(row.mcp_turn ?? 0) === 1
     };
   }
   async recordMemory(input) {
@@ -29212,10 +29265,10 @@ var SqliteMlsStateStore = class _SqliteMlsStateStore {
     const r = this.db.prepare("SELECT owner_size_bytes AS b, owner_item_count AS n FROM agent_memory_state WHERE identity_id=?").get(this.id);
     if (r && Number(r.b) >= 0 && Number(r.n) >= 0)
       return { items: Number(r.n), bytes: Number(r.b) };
-    const own = this.scopeLoad("i.scope_kind='owner_dm'");
+    const own2 = this.scopeLoad("i.scope_kind='owner_dm'");
     this.ensureStateRow();
-    this.db.prepare("UPDATE agent_memory_state SET owner_size_bytes=?, owner_item_count=? WHERE identity_id=?").run(own.bytes, own.items, this.id);
-    return own;
+    this.db.prepare("UPDATE agent_memory_state SET owner_size_bytes=?, owner_item_count=? WHERE identity_id=?").run(own2.bytes, own2.items, this.id);
+    return own2;
   }
   /** Inside a transaction: delete one origin group (the row, or the parent and its chunks) and its token rows; returns the ids and the accounts it held. */
   deleteItemGroup(firstItemId) {
@@ -29389,8 +29442,8 @@ var SqliteMlsStateStore = class _SqliteMlsStateStore {
       const o2 = this.overCap();
       if (!o2.overItems && !o2.overBytes)
         break;
-      const own = this.ownerLoad();
-      const protectOwner = (!o2.overItems || own.items < this.itemCap * OWNER_DM_FLOOR_SHARE) && (!o2.overBytes || own.bytes < this.byteCap * OWNER_DM_FLOOR_SHARE);
+      const own2 = this.ownerLoad();
+      const protectOwner = (!o2.overItems || own2.items < this.itemCap * OWNER_DM_FLOOR_SHARE) && (!o2.overBytes || own2.bytes < this.byteCap * OWNER_DM_FLOOR_SHARE);
       const v = (protectOwner ? this.oldestAutoGroup({ notOwnerDm: true }) : void 0) ?? this.oldestAutoGroup({});
       if (v === void 0 || !drop(v))
         break;
@@ -29417,8 +29470,8 @@ var SqliteMlsStateStore = class _SqliteMlsStateStore {
        FROM agent_memory_item i WHERE identity_id=?`).get(this.id);
     const tk = this.db.prepare("SELECT COUNT(*) AS n FROM agent_memory_token WHERE identity_id=?").get(this.id);
     const size = Number(it.b) + Number(it.rows) * ITEM_ROW_OVERHEAD_BYTES + Number(tk.n) * TOKEN_ROW_OVERHEAD_BYTES;
-    const own = this.scopeLoad("i.scope_kind='owner_dm'");
-    this.db.prepare("UPDATE agent_memory_state SET size_bytes=?, item_count=?, owner_size_bytes=?, owner_item_count=? WHERE identity_id=?").run(size, Number(it.n), own.bytes, own.items, this.id);
+    const own2 = this.scopeLoad("i.scope_kind='owner_dm'");
+    this.db.prepare("UPDATE agent_memory_state SET size_bytes=?, item_count=?, owner_size_bytes=?, owner_item_count=? WHERE identity_id=?").run(size, Number(it.n), own2.bytes, own2.items, this.id);
   }
   /** Inside a transaction: delete every unified row of the identity and move each channel's content epoch. */
   deleteAllItems() {
@@ -30234,9 +30287,40 @@ var SqliteMlsStateStore = class _SqliteMlsStateStore {
   dropToolGrantAppliedExcept(pinKeyB64) {
     return Number(this.db.prepare("DELETE FROM tool_grant_applied WHERE identity_id=? AND pin_key_b64<>?").run(this.id, pinKeyB64).changes);
   }
+  // MCP client Phase 1, Task 14 (OQ-3 ruling item 3): the sticky R-3 flag, per agent identity.
+  /**
+   * False when never written. A row that does not open, or opens to anything but this identity's own record, THROWS:
+   * the bridge then holds R-3 (fail closed). Never returns false for an unreadable row.
+   */
+  async loadMcpSeen() {
+    const row = this.db.prepare("SELECT sealed_state FROM tool_grant_mcp_seen WHERE identity_id=?").get(this.id);
+    if (!row)
+      return false;
+    const v = await this.unsealJson(row.sealed_state);
+    if (v === null || typeof v !== "object" || v.identity_id !== this.id || typeof v.seen !== "boolean") {
+      throw new MlsStoreSealError("tool_grant_mcp_seen: unexpected record");
+    }
+    return v.seen;
+  }
+  /** The sealed value names its identity, so a blob copied to another agent's row does not read as that agent's. */
+  async saveMcpSeen(seen) {
+    const sealed = await this.sealJson({ identity_id: this.id, seen });
+    this.db.prepare(`INSERT INTO tool_grant_mcp_seen (identity_id, sealed_state, updated_at) VALUES (?, ?, ?)
+       ON CONFLICT(identity_id) DO UPDATE SET sealed_state = excluded.sealed_state, updated_at = excluded.updated_at`).run(this.id, sealed, Date.now());
+  }
   hasOwnerMessage(channelId, messageId) {
     return this.db.prepare("SELECT 1 FROM owner_replay WHERE identity_id=? AND channel_id=? AND message_id=?").get(this.id, channelId, messageId) !== void 0;
   }
+  /**
+   * MCP client Phase 1, Task 18 (audit M-3): the owner replay row for a verified owner message that is NEVER staged for
+   * the runtime (an `mcp_catalog_request`), so a redelivery of it is classed `replay`, after a restart too. The same row
+   * stageRuntimeInbox writes in its staging transaction; insert-if-absent; pruned by pruneOwnerReplay like any other.
+   */
+  recordOwnerMessage(channelId, messageId, groupId, epoch, processedAt = Date.now()) {
+    this.db.prepare(`INSERT OR IGNORE INTO owner_replay
+         (identity_id, channel_id, message_id, group_id, epoch, processed_at)
+       VALUES (?, ?, ?, ?, ?, ?)`).run(this.id, channelId, messageId, groupId, epoch, processedAt);
+  }
   isOwnerEpochClosed(channelId, groupId, epoch) {
     return this.db.prepare("SELECT 1 FROM owner_replay_closed_epoch WHERE identity_id=? AND channel_id=? AND group_id=? AND epoch=?").get(this.id, channelId, groupId, epoch) !== void 0;
   }
@@ -30381,6 +30465,7 @@ function checkGroupLink(v) {
 }
 
 // src/bridge-agent.ts
+import { createHash as createHash6 } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 
 // src/reply-intent.ts
@@ -30410,8 +30495,9 @@ function decodeReplyBody(bytes) {
   if (b?.kind === "a2a" && b.a2a && typeof b.a2a === "object") return b;
   throw new Error("reply intent body is malformed");
 }
-function replyBodyMac(key, replyId, channelId, body, credit) {
-  return createHmac("sha256", key).update(JSON.stringify(credit === void 0 ? ["reply-body", replyId, channelId] : ["reply-body", replyId, channelId, credit])).update("\0").update(body).digest("hex");
+function replyBodyMac(key, replyId, channelId, body, credit, mcpTurn) {
+  const label = mcpTurn === true ? ["reply-body", replyId, channelId, credit ?? null, "mcp_turn"] : credit === void 0 ? ["reply-body", replyId, channelId] : ["reply-body", replyId, channelId, credit];
+  return createHmac("sha256", key).update(JSON.stringify(label)).update("\0").update(body).digest("hex");
 }
 function partOrdinal(part) {
   const m = /^p:(\d+)$/.exec(part);
@@ -32117,8 +32203,8 @@ var MembershipPurgeSweeper = class {
       const dms = /* @__PURE__ */ new Set();
       for (const c of this.d.conversations()) {
         if (stopping()) return { purged: [], held: 0, absent: 0 };
-        const own = this.d.enclaveOf(c);
-        const channels = own === void 0 ? void 0 : listed.get(own);
+        const own2 = this.d.enclaveOf(c);
+        const channels = own2 === void 0 ? void 0 : listed.get(own2);
         if (channels === void 0) continue;
         if (channels.has(c)) {
           this.d.clearAbsence(c);
@@ -35293,7 +35379,7 @@ function assertManagedName(name) {
 }
 function isLocalOnlyName(name) {
   const n = name.toLowerCase().replace(/[. ]+$/, "");
-  return n === "llm.key" || n.startsWith("llm.key.") || n === "local-config.json" || n === "secrets" || n === MANIFEST_POLICY_FILE;
+  return n === "llm.key" || n.startsWith("llm.key.") || n === "local-config.json" || n === "secrets" || n === MANIFEST_POLICY_FILE || n === MCP_POLICY_FILE;
 }
 var MANIFEST_POLICY_FILE = "manifest-policy.json";
 function removeManagedLlmSource(home, identityId, deps = REAL_FS) {
@@ -35312,6 +35398,28 @@ function writeManifestPolicy(home, identityId, policy, deps = REAL_FS) {
   }
   atomicWrite(join19(dir, MANIFEST_POLICY_FILE), JSON.stringify(policy) + "\n", deps);
 }
+var MCP_POLICY_FILE = "mcp-policy.json";
+var MCP_POLICY_TOP_STATES = Object.freeze([
+  "ok",
+  "not_entitled",
+  "kill_switch",
+  "suspended",
+  "no_config",
+  "switch_off",
+  "no_manifest",
+  "malformed",
+  "no_capability",
+  "section_absent"
+]);
+function writeMcpPolicy(home, identityId, doc, deps = REAL_FS) {
+  const parent3 = join19(home, ".securecoms", "runtime-config");
+  const dir = runtimeConfigDir(home, identityId);
+  for (const d of [join19(home, ".securecoms"), parent3, dir]) {
+    deps.mkdir(d, 448);
+    deps.chmod(d, 448);
+  }
+  atomicWrite(join19(dir, MCP_POLICY_FILE), JSON.stringify(doc) + "\n", deps);
+}
 function atomicWrite(path, body, deps) {
   const tmp = `${path}.${process.pid}.${randomUUID()}.tmp`;
   deps.writeFile(tmp, body, 384);
@@ -35589,6 +35697,195 @@ import { sha256 as sha25611 } from "@noble/hashes/sha256";
 
 // src/grants/manifest.ts
 import { ed25519 as ed255195 } from "@noble/curves/ed25519";
+
+// src/grants/mcp-section.ts
+var MCP_MAX_SERVERS = 8;
+var MCP_MAX_TOOLS_PER_SERVER = 64;
+var MCP_MAX_SIGNED_TOOLS = 160;
+var MCP_MAX_REMOVED = 8;
+var SECURECOMS_CIMD_CLIENT_ID = "https://app.securecoms.ai/oauth/securecoms-agent-client.json";
+var MCP_SERVER_ID = /^[a-z0-9-]{1,24}$/;
+var MCP_TOOL_NAME = /^[A-Za-z0-9_.-]{1,64}$/;
+var VENDOR_KEY = /^[a-z0-9_]{1,32}$/;
+var MCP_RESERVED_NAMES = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+var HEX64 = /^[0-9a-f]{64}$/;
+var PRINTABLE_ASCII = /^[\x21-\x7e]{1,256}$/;
+var MCP_GRANT = /^mcp:([a-z0-9-]{1,24})\/([A-Za-z0-9_.-]{1,64})$/;
+var isBag = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var keysExactly = (o, keys) => {
+  const have = Object.keys(o);
+  return have.length === keys.length && keys.every((k) => Object.prototype.hasOwnProperty.call(o, k));
+};
+function canonicalHttpsUrl(v) {
+  if (typeof v !== "string" || !PRINTABLE_ASCII.test(v) || !URL.canParse(v)) return false;
+  const u = new URL(v);
+  return u.protocol === "https:" && u.username === "" && u.password === "" && u.href === v;
+}
+function httpsIssuer(v) {
+  if (typeof v !== "string" || !PRINTABLE_ASCII.test(v) || !URL.canParse(v)) return false;
+  const u = new URL(v);
+  return u.protocol === "https:" && u.username === "" && u.password === "" && u.search === "" && u.hash === "" && (u.href === v || u.href === `${v}/`);
+}
+var MCP_AUTH_KEYS = Object.freeze({
+  oauth_securecoms_cimd: Object.freeze(["mode", "issuer", "client"]),
+  oauth_customer: Object.freeze(["mode", "issuer", "client", "client_id"]),
+  key: Object.freeze(["mode"])
+});
+function parseAuth(v) {
+  if (!isBag(v)) return null;
+  if (v.mode === "key") return keysExactly(v, MCP_AUTH_KEYS.key) ? Object.freeze({ mode: "key" }) : null;
+  if (v.mode !== "oauth" || !httpsIssuer(v.issuer)) return null;
+  if (v.client === "securecoms_cimd") {
+    if (!keysExactly(v, MCP_AUTH_KEYS.oauth_securecoms_cimd)) return null;
+    return Object.freeze({ mode: "oauth", issuer: v.issuer, client: "securecoms_cimd" });
+  }
+  if (v.client === "customer") {
+    if (!keysExactly(v, MCP_AUTH_KEYS.oauth_customer)) return null;
+    if (typeof v.client_id !== "string" || !PRINTABLE_ASCII.test(v.client_id)) return null;
+    return Object.freeze({ mode: "oauth", issuer: v.issuer, client: "customer", client_id: v.client_id });
+  }
+  return null;
+}
+function parseTools(v) {
+  if (!isBag(v)) return null;
+  const entries = Object.entries(v);
+  if (entries.length > MCP_MAX_TOOLS_PER_SERVER) return null;
+  const out = /* @__PURE__ */ Object.create(null);
+  for (const [name, t] of entries) {
+    if (!MCP_TOOL_NAME.test(name) || MCP_RESERVED_NAMES.has(name) || !isBag(t) || !keysExactly(t, ["sha256", "class"])) return null;
+    if (typeof t.sha256 !== "string" || !HEX64.test(t.sha256) || t.class !== "read") return null;
+    out[name] = Object.freeze({ sha256: t.sha256, class: "read" });
+  }
+  return out;
+}
+function parseServer(v) {
+  if (!isBag(v) || !keysExactly(v, ["vendor", "url", "auth", "tools"])) return null;
+  if (typeof v.vendor !== "string" || !VENDOR_KEY.test(v.vendor) || !canonicalHttpsUrl(v.url)) return null;
+  const auth = parseAuth(v.auth);
+  const tools = parseTools(v.tools);
+  if (auth === null || tools === null) return null;
+  return Object.freeze({ vendor: v.vendor, url: v.url, auth, tools: Object.freeze(tools) });
+}
+function parseRemoved(v, servers) {
+  if (v === "*") return Object.keys(servers).length === 0 ? "*" : null;
+  if (!Array.isArray(v) || v.length < 1 || v.length > MCP_MAX_REMOVED) return null;
+  const seen = /* @__PURE__ */ new Set();
+  for (const id of v) {
+    if (typeof id !== "string" || !MCP_SERVER_ID.test(id) || MCP_RESERVED_NAMES.has(id)) return null;
+    if (seen.has(id) || Object.prototype.hasOwnProperty.call(servers, id)) return null;
+    seen.add(id);
+  }
+  return Object.freeze([...seen]);
+}
+var NOT_REMOVED = Object.freeze([]);
+function parseMcp(v) {
+  if (!isBag(v) || !(keysExactly(v, ["servers"]) || keysExactly(v, ["servers", "removed"])) || !isBag(v.servers)) return null;
+  const entries = Object.entries(v.servers);
+  if (entries.length > MCP_MAX_SERVERS) return null;
+  const servers = /* @__PURE__ */ Object.create(null);
+  let signedTools = 0;
+  for (const [id, raw] of entries) {
+    if (!MCP_SERVER_ID.test(id) || MCP_RESERVED_NAMES.has(id)) return null;
+    const s = parseServer(raw);
+    if (s === null) return null;
+    signedTools += Object.keys(s.tools).length;
+    if (signedTools > MCP_MAX_SIGNED_TOOLS) return null;
+    servers[id] = s;
+  }
+  let removed = NOT_REMOVED;
+  if (Object.prototype.hasOwnProperty.call(v, "removed")) {
+    const r = parseRemoved(v.removed, servers);
+    if (r === null) return null;
+    removed = r;
+  }
+  return Object.freeze({ servers: Object.freeze(servers), removed });
+}
+function mcpServerCatalogRow(s, catalog) {
+  if (!Object.prototype.hasOwnProperty.call(catalog, s.vendor)) return null;
+  const row = catalog[s.vendor];
+  if (s.url !== row.readOnlyUrl) return null;
+  if (s.auth.mode === "oauth" && s.auth.issuer !== row.issuer) return null;
+  return row;
+}
+function parseMcpGrant(name) {
+  const g = MCP_GRANT.exec(name);
+  return g === null ? null : { serverId: g[1], tool: g[2] };
+}
+function mcpGrantWithinCeiling(name, mcp, catalog) {
+  const g = parseMcpGrant(name);
+  if (g === null || mcp === null || !Object.prototype.hasOwnProperty.call(mcp.servers, g.serverId)) return false;
+  const s = mcp.servers[g.serverId];
+  if (!Object.prototype.hasOwnProperty.call(s.tools, g.tool)) return false;
+  const row = mcpServerCatalogRow(s, catalog);
+  return row !== null && row.readTools.includes(g.tool);
+}
+
+// src/grants/mcp-catalog.ts
+var LINEAR = Object.freeze({
+  displayName: "Linear",
+  host: "mcp.linear.app",
+  readOnlyUrl: "https://mcp.linear.app/mcp/readonly",
+  readTools: Object.freeze([
+    "get_attachment",
+    "list_agent_skills",
+    "get_agent_skill",
+    "list_comments",
+    "list_cycles",
+    "list_custom_views",
+    "get_document",
+    "list_documents",
+    "extract_images",
+    "get_issue",
+    "list_issue_statuses",
+    "get_issue_status",
+    "list_issue_labels",
+    "list_projects",
+    "get_project",
+    "list_project_labels",
+    "list_release_pipelines",
+    "list_releases",
+    "get_release",
+    "list_release_notes",
+    "get_release_note",
+    "list_milestones",
+    "get_milestone",
+    "get_notifications",
+    "list_teams",
+    "get_team",
+    "get_triage_responsibility",
+    "list_templates",
+    "get_template",
+    "list_users",
+    "get_user",
+    "get_workspace",
+    "search_documentation",
+    "get_diff",
+    "list_diffs",
+    "get_diff_threads",
+    "list_initiatives",
+    "get_initiative",
+    "list_initiative_labels",
+    "get_status_updates"
+  ]),
+  scopes: Object.freeze(["read"]),
+  issuer: "https://mcp.linear.app",
+  authorizationEndpoint: "https://mcp.linear.app/authorize",
+  tokenEndpoint: "https://mcp.linear.app/token",
+  revocationEndpoint: "https://mcp.linear.app/token",
+  docs: Object.freeze({
+    host: "https://linear.app/docs/mcp",
+    readOnlyUrl: "https://linear.app/docs/mcp",
+    readTools: "https://linear.app/docs/mcp",
+    scopes: "https://linear.app/docs/mcp",
+    issuer: "https://mcp.linear.app/.well-known/oauth-authorization-server",
+    authorizationEndpoint: "https://mcp.linear.app/.well-known/oauth-authorization-server",
+    tokenEndpoint: "https://mcp.linear.app/.well-known/oauth-authorization-server",
+    revocationEndpoint: "https://mcp.linear.app/.well-known/oauth-authorization-server"
+  })
+});
+var MCP_CATALOG = Object.freeze({ linear: LINEAR });
+
+// src/grants/manifest.ts
 var TOOL_GRANTS_DOMAIN = "SECURECOMS-TOOL-GRANTS-V1:";
 var MANIFEST_KNOWN_TOOLS = Object.freeze({
   owner_dm: Object.freeze(["web_search", "web_extract", "fetch_url", "http_request", "sql_query", "weather_forecast", "currency_convert"]),
@@ -35613,9 +35910,9 @@ function wellTyped(v) {
   return false;
 }
 var WRAPPER_KEYS = ["algo", "manifest", "signature"];
-var HEX64 = /^[0-9a-f]{64}$/;
-var PRINTABLE_ASCII = /^[\x21-\x7e]+$/;
-var absolutePath = (v) => typeof v === "string" && v.startsWith("/") && PRINTABLE_ASCII.test(v);
+var HEX642 = /^[0-9a-f]{64}$/;
+var PRINTABLE_ASCII2 = /^[\x21-\x7e]+$/;
+var absolutePath = (v) => typeof v === "string" && v.startsWith("/") && PRINTABLE_ASCII2.test(v);
 var exactKeys = (o, required, optional = []) => required.every((k) => k in o) && Object.keys(o).every((k) => required.includes(k) || optional.includes(k));
 var isStringArray = (v) => Array.isArray(v) && v.every((x) => typeof x === "string");
 function parseEndpoints(v) {
@@ -35627,7 +35924,7 @@ function parseEndpoints(v) {
     const e = { ...raw };
     if (e.headersFile === "") delete e.headersFile;
     if (!exactKeys(e, ["baseUrl"], ["headersFile"])) return null;
-    if (typeof e.baseUrl !== "string" || e.baseUrl === "" || !PRINTABLE_ASCII.test(e.baseUrl)) return null;
+    if (typeof e.baseUrl !== "string" || e.baseUrl === "" || !PRINTABLE_ASCII2.test(e.baseUrl)) return null;
     let url;
     try {
       url = new URL(e.baseUrl);
@@ -35658,8 +35955,8 @@ function parseDatabases(v) {
 function parseConfig(v) {
   if (!isPlainObject(v)) return null;
   if (!exactKeys(v, ["persona_sha256", "flags", "memory", "legacy_assign_sha256"], ["llm", "search", "tools_allow"])) return null;
-  if (typeof v.persona_sha256 !== "string" || !HEX64.test(v.persona_sha256)) return null;
-  if (typeof v.legacy_assign_sha256 !== "string" || !HEX64.test(v.legacy_assign_sha256)) return null;
+  if (typeof v.persona_sha256 !== "string" || !HEX642.test(v.persona_sha256)) return null;
+  if (typeof v.legacy_assign_sha256 !== "string" || !HEX642.test(v.legacy_assign_sha256)) return null;
   if (!isStringArray(v.flags)) return null;
   if ("tools_allow" in v && !isStringArray(v.tools_allow)) return null;
   if ("llm" in v) {
@@ -35703,7 +36000,7 @@ function verifyToolGrantManifest(raw, ctx) {
   const m = raw.manifest;
   if (!isPlainObject(m)) return { state: "malformed" };
   if (m.type !== "securecoms.tool-grants" || m.v !== 1) return { state: "malformed" };
-  if (!wellTyped(m)) return { state: "malformed" };
+  if (!wellTyped(Object.fromEntries(Object.entries(m).filter(([k]) => k !== "mcp")))) return { state: "malformed" };
   if (typeof m.agent_identity_id !== "string" || typeof m.owner_identity_id !== "string") return { state: "malformed" };
   for (const k of ["owner_dm_channel_id", "owner_dm_relay_identity_id"]) {
     if (k in m && typeof m[k] !== "string") return { state: "malformed" };
@@ -35733,6 +36030,11 @@ function verifyToolGrantManifest(raw, ctx) {
     if (counter === ctx.storedCounter) return { state: "unchanged" };
     if (counter < ctx.storedCounter) return { state: "rollback" };
   }
+  const rawOwnerDm = m.grants.owner_dm;
+  const signedMcpPresent = Array.isArray(rawOwnerDm) && rawOwnerDm.some((t) => t.startsWith("mcp:"));
+  const mcpKey = "mcp" in m ? "present" : "absent";
+  const mcp = mcpKey === "present" ? parseMcp(m.mcp) : null;
+  const catalog = ctx.mcpCatalog ?? MCP_CATALOG;
   let droppedUnknown = false;
   const grants = {};
   for (const [audience, list] of Object.entries(m.grants)) {
@@ -35741,7 +36043,7 @@ function verifyToolGrantManifest(raw, ctx) {
       continue;
     }
     const known = MANIFEST_KNOWN_TOOLS[audience];
-    const kept = list.filter((t) => known.includes(t));
+    const kept = list.filter((t) => known.includes(t) || audience === "owner_dm" && mcpGrantWithinCeiling(t, mcp, catalog));
     if (kept.length !== list.length) droppedUnknown = true;
     grants[audience] = Object.freeze(kept);
   }
@@ -35756,7 +36058,10 @@ function verifyToolGrantManifest(raw, ctx) {
     grants: Object.freeze(grants),
     endpoints: Object.freeze(endpoints),
     databases: Object.freeze(databases),
-    config
+    config,
+    mcp,
+    mcpKey,
+    signedMcpPresent
   });
   return { state: "ok", manifest, droppedUnknown, wrapper: raw };
 }
@@ -36077,21 +36382,32 @@ var AGENT_TOTAL_KEY = "agent-total";
 // src/grants/effective.ts
 var TOOL_GRANT_CODE_CEILING = MANIFEST_KNOWN_TOOLS;
 var CURRENT_TIME = Object.freeze({ tool: "current_time", mode: "read" });
+var NO_WITHHELD = Object.freeze([]);
 function effectiveToolGrants(i) {
-  if (i.base.length === 0) return { grants: i.base, source: "none", withheldBySearchCap: false };
-  if (i.manifest === null) return { grants: i.base, source: "constant", withheldBySearchCap: false };
+  if (i.base.length === 0) return { grants: i.base, source: "none", withheldBySearchCap: false, withheld: NO_WITHHELD };
+  if (i.manifest === null) return { grants: i.base, source: "constant", withheldBySearchCap: false, withheld: NO_WITHHELD };
   const ceiling = TOOL_GRANT_CODE_CEILING[i.audience];
   const listed = new Set(i.manifest.grants[i.audience] ?? []);
   const signed = ceiling.filter((t) => listed.has(t));
   if (!i.eligible || !i.manifestSwitchOn) {
     const fallback = i.base.filter((g) => g.tool !== "current_time" && signed.includes(g.tool));
-    return { grants: Object.freeze([CURRENT_TIME, ...fallback]), source: "fallback", withheldBySearchCap: false };
+    return { grants: Object.freeze([CURRENT_TIME, ...fallback]), source: "fallback", withheldBySearchCap: false, withheld: NO_WITHHELD };
   }
   let withheld = false;
+  const dropped = [];
   const tools = signed.filter((t) => {
-    if (i.disabled.has(t)) return false;
-    if (t === "http_request" && i.signedTargets.endpoints === 0) return false;
-    if (t === "sql_query" && i.signedTargets.databases === 0) return false;
+    if (i.disabled.has(t)) {
+      dropped.push(Object.freeze({ tool: t, why: "disabled_by_owner" }));
+      return false;
+    }
+    if (t === "http_request" && i.signedTargets.endpoints === 0) {
+      dropped.push(Object.freeze({ tool: t, why: "no_endpoint" }));
+      return false;
+    }
+    if (t === "sql_query" && i.signedTargets.databases === 0) {
+      dropped.push(Object.freeze({ tool: t, why: "no_database" }));
+      return false;
+    }
     if (i.audience === "team_room" && t === "web_search" && i.roomSearchCapped) {
       withheld = true;
       return false;
@@ -36101,7 +36417,8 @@ function effectiveToolGrants(i) {
   return {
     grants: Object.freeze([CURRENT_TIME, ...tools.map((tool) => Object.freeze({ tool, mode: "read", source: "manifest" }))]),
     source: "manifest",
-    withheldBySearchCap: withheld
+    withheldBySearchCap: withheld,
+    withheld: Object.freeze(dropped)
   };
 }
 
@@ -36406,6 +36723,200 @@ function classifyVoiceFrame(f) {
   return b.text.trim() === VOICE_CALL_START_MARKER ? "greeting" : "drop";
 }
 
+// src/grants/tool-status.ts
+var TOOL_STATUS_ALLOWLIST = [
+  "current_time",
+  "web_search",
+  "web_extract",
+  "fetch_url",
+  "http_request",
+  "sql_query",
+  "weather_forecast",
+  "currency_convert"
+];
+var ALLOW2 = new Set(TOOL_STATUS_ALLOWLIST);
+var TOOL_STATUS_BUCKET_MS = 9e5;
+function bucketStartAt(ms) {
+  return new Date(Math.floor(ms / TOOL_STATUS_BUCKET_MS) * TOOL_STATUS_BUCKET_MS).toISOString().slice(0, 16) + "Z";
+}
+function bucketEndMs(at) {
+  return Date.parse(at) + TOOL_STATUS_BUCKET_MS;
+}
+var SIGNATURE_FAILURES = /* @__PURE__ */ new Set(["bad_signature", "malformed", "unknown_algo", "no_signature"]);
+function ownerDmCause(i) {
+  try {
+    const v = i.verdict;
+    if (v.kind === "failed" && v.reason === "replay") return null;
+    if (v.kind !== "verified" && v.kind !== "constants_only" && v.kind !== "failed") return null;
+    const failedReason = v.kind === "failed" ? v.reason : void 0;
+    const blocked = i.killSwitchOff || i.pinMissingOrAnomalous || i.senderNotOwner || i.stale || v.kind === "failed";
+    const eligible = v.kind === "verified" && i.signedDmChannel === i.channelId && i.boundNow && i.consumerAttached;
+    const source = blocked ? "none" : !i.manifestPresent ? "constant" : !eligible || i.manifestSwitchOff ? "fallback" : "manifest";
+    const at = (cause, sub) => sub === void 0 ? { source, cause } : { source, cause, sub };
+    if (i.killSwitchOff) return at("owner_dm_unavailable", "kill_switch");
+    if (i.manifestSwitchOff) return at("manifest_switch_off");
+    if (i.pinMissingOrAnomalous) return at("owner_dm_unavailable", "pin");
+    if (i.senderNotOwner) return at("owner_dm_unavailable", "sender_not_owner");
+    if (i.stale) return at("owner_dm_unavailable", "stale");
+    if (failedReason === "not_owner_dm_leaves") return at("unexpected_member_in_dm");
+    if (failedReason !== void 0 && SIGNATURE_FAILURES.has(failedReason)) return at("owner_turn_failed");
+    if (failedReason === "verify_error") return at("agent_state_error");
+    if (failedReason === "wrong_dm_channel" || v.kind === "verified" && i.manifestPresent && i.signedDmChannel !== void 0 && i.signedDmChannel !== i.channelId) {
+      return at("dm_channel_mismatch");
+    }
+    if (failedReason !== void 0) return null;
+    if (i.manifestPresent && i.signedDmChannel === void 0) return at("dm_not_linked");
+    if (v.kind === "constants_only") return at("unsigned_relay_in_dm");
+    if (!i.manifestPresent || !i.boundNow) return at("manifest_not_bound");
+    if (!i.consumerAttached) return at("no_runtime_consumer");
+    return source === "manifest" ? { source } : null;
+  } catch {
+    return null;
+  }
+}
+function sameTuple(a, b) {
+  if (!a || !b) return false;
+  return a.source === b.source && a.cause === b.cause && a.sub === b.sub && a.relay === b.relay && a.mcp_issued === b.mcp_issued && a.counter === b.counter && a.issued.length === b.issued.length && a.issued.every((t, k) => t === b.issued[k]) && a.withheld.length === b.withheld.length && a.withheld.every((w, k) => w.tool === b.withheld[k].tool && w.why === b.withheld[k].why);
+}
+function sanitizeIssued(names) {
+  return [...new Set(names.filter((n) => ALLOW2.has(n)))].sort();
+}
+
+// src/tool-status-sender.ts
+var TOOL_STATUS_JITTER_MS = 6e4;
+var RETRY_AFTER_FLOOR_MS = 6e4;
+function defaultToolStatusSetTimer(fn, ms) {
+  const t = setTimeout(fn, ms);
+  t.unref?.();
+  return t;
+}
+function defaultToolStatusClearTimer(h) {
+  clearTimeout(h);
+}
+function retryAfterMs(raw) {
+  if (typeof raw !== "string" || !/^\d{1,9}$/.test(raw.trim())) return RETRY_AFTER_FLOOR_MS;
+  return Math.max(RETRY_AFTER_FLOOR_MS, Number(raw.trim()) * 1e3);
+}
+var ToolStatusSender = class {
+  postFn;
+  now;
+  setTimer;
+  clearTimer;
+  random;
+  onFailure;
+  /** The latest noted record while its bucket is still open. */
+  open = null;
+  /** The latest noted record whose bucket has closed: the only record an attempt or carry() may send. */
+  closed = null;
+  lastPosted = null;
+  terminalFor = null;
+  notBefore = Number.NEGATIVE_INFINITY;
+  timer = null;
+  inFlight = false;
+  shut = false;
+  constructor(o) {
+    this.postFn = o.post;
+    this.now = o.now ?? (() => Date.now());
+    this.setTimer = o.setTimer ?? defaultToolStatusSetTimer;
+    this.clearTimer = o.clearTimer ?? defaultToolStatusClearTimer;
+    this.random = o.random ?? Math.random;
+    this.onFailure = o.onFailure ?? (() => {
+    });
+  }
+  note(rec) {
+    if (this.shut) return;
+    try {
+      this.promote(this.now());
+      this.open = rec;
+      this.schedule();
+    } catch {
+    }
+  }
+  /** Ruling M-2: what the apply-time report carries. The closed record only; an open bucket is never revealed early. */
+  carry() {
+    try {
+      this.promote(this.now());
+    } catch {
+    }
+    return this.closed;
+  }
+  /** R2-M1: the record belongs to an owner who is no longer the manifest's; forget it and what was posted. */
+  drop() {
+    this.open = null;
+    this.closed = null;
+    this.lastPosted = null;
+    this.terminalFor = null;
+    this.cancelTimer();
+  }
+  close() {
+    this.shut = true;
+    this.cancelTimer();
+  }
+  cancelTimer() {
+    if (this.timer !== null) this.clearTimer(this.timer);
+    this.timer = null;
+  }
+  promote(t) {
+    if (this.open !== null && bucketEndMs(this.open.at) <= t) {
+      this.closed = this.open;
+      this.open = null;
+    }
+  }
+  pending() {
+    return this.closed !== null && !sameTuple(this.closed, this.lastPosted) && !sameTuple(this.closed, this.terminalFor);
+  }
+  schedule() {
+    if (this.shut || this.inFlight || this.timer !== null) return;
+    if (this.open === null && !this.pending()) return;
+    const t = this.now();
+    let b = (Math.floor(t / TOOL_STATUS_BUCKET_MS) + 1) * TOOL_STATUS_BUCKET_MS;
+    while (b < this.notBefore) b += TOOL_STATUS_BUCKET_MS;
+    const jitter = Math.floor(this.random() * TOOL_STATUS_JITTER_MS);
+    this.timer = this.setTimer(() => {
+      this.timer = null;
+      this.fire();
+    }, b - t + jitter);
+  }
+  fire() {
+    try {
+      if (this.shut) return;
+      this.promote(this.now());
+      if (this.pending()) {
+        void this.attempt(this.closed);
+        return;
+      }
+      this.schedule();
+    } catch {
+    }
+  }
+  async attempt(rec) {
+    this.inFlight = true;
+    const attemptAt = this.now();
+    let result;
+    try {
+      result = await this.postFn(rec);
+    } catch {
+      result = "network";
+    }
+    this.inFlight = false;
+    try {
+      if (typeof result === "object" && result.status >= 200 && result.status < 300) {
+        this.lastPosted = rec;
+      } else if (typeof result === "object" && result.status === 429) {
+        this.notBefore = attemptAt + retryAfterMs(result.retryAfter);
+        this.onFailure("http_error");
+      } else if (typeof result === "object" && result.status >= 400 && result.status < 500) {
+        this.terminalFor = rec;
+        this.onFailure("http_error");
+      } else {
+        this.onFailure(typeof result === "object" ? "http_error" : result);
+      }
+      this.schedule();
+    } catch {
+    }
+  }
+};
+
 // src/grants/owner-turn.ts
 import { ed25519 as ed255196 } from "@noble/curves/ed25519";
 var HEX = /^(?:[0-9a-fA-F]{2})+$/;
@@ -36449,6 +36960,312 @@ function classifyOwnerDmLeaves(leaves, allowed) {
   }
   return "foreign";
 }
+function ownerDmLeavesRelayFree(leaves, ids) {
+  let owner = false;
+  let agent = false;
+  for (const l of leaves) {
+    if (!l.basic || l.identity === null) return false;
+    if (l.identity === ids.ownerIdentityId) owner = true;
+    else if (l.identity === ids.agentIdentityId) agent = true;
+    else return false;
+  }
+  return owner && agent;
+}
+function relayLeafFromPhase0Relay(relay) {
+  return relay !== "none";
+}
+function ownerDmRelayOf(leafClass, leaves, ids) {
+  if (leafClass === "unsigned_relay") return "unsigned";
+  if (ownerDmLeavesRelayFree(leaves, ids)) return "none";
+  if (ids.relayIdentityId !== void 0 && leaves.some((l) => l.identity === ids.relayIdentityId)) return "signed";
+  return void 0;
+}
+
+// src/grants/mcp-policy.ts
+var MCP_POLICY_WRITER_FEATURE = "mcp_policy_writer_v1";
+var MCP_DELETION_ACK_FEATURE = "mcp_deletion_ack_v1";
+var MCP_ACK_STATES = /* @__PURE__ */ new Set(["ok", "not_entitled", "kill_switch"]);
+function mcpEntitlementReading(mcpEntitled, mcpCause) {
+  if (mcpEntitled === true && mcpCause === "entitled") return "entitled";
+  if (mcpEntitled === false && mcpCause === "not_entitled") return "not_entitled";
+  return "suspended";
+}
+function mcpGrantsHostSwitch(env, log = writeServiceLog) {
+  const v = env.SECURECOMS_MCP_GRANTS;
+  if (v === void 0 || v === "on") return "on";
+  if (v === "off") return "off";
+  log("warn", "config.mcp_grants_switch_suspended", { state: ServiceLogEnum.of("suspended", ["suspended"]) });
+  return "suspended";
+}
+var empty = (state, r3Hold) => Object.freeze({ v: 1, state, r3_hold: r3Hold, servers: Object.freeze({}), remove: NO_REMOVE });
+var NO_REMOVE = Object.freeze([]);
+function policyAuth(s) {
+  if (s.auth.mode === "key") return Object.freeze({ mode: "key" });
+  const clientId = s.auth.client === "customer" ? s.auth.client_id : SECURECOMS_CIMD_CLIENT_ID;
+  return Object.freeze({ mode: "oauth", issuer: s.auth.issuer, client: s.auth.client, client_id: clientId });
+}
+function mcpPolicyFor(i) {
+  const m = i.manifest;
+  const r3Hold = m?.signedMcpPresent === true || i.mcpSeen;
+  if (i.hostSwitch === "off") return empty("kill_switch", r3Hold);
+  if (i.hostSwitch !== "on") return empty("suspended", r3Hold);
+  if (!i.config.fetched) return empty("no_config", r3Hold);
+  const ent = mcpEntitlementReading(i.config.mcp_entitled, i.config.mcp_cause);
+  if (ent !== "entitled") return empty(ent, r3Hold);
+  if (!i.ownerDmManifestSwitchOn) return empty("switch_off", r3Hold);
+  if (m === null) return empty("no_manifest", r3Hold);
+  if (m.mcpKey === "absent") return empty("section_absent", r3Hold);
+  if (m.mcp === null) return empty("malformed", r3Hold);
+  if (!i.capability) return empty("no_capability", r3Hold);
+  const catalog = i.catalog ?? MCP_CATALOG;
+  const granted = /* @__PURE__ */ new Map();
+  for (const name of m.grants.owner_dm ?? []) {
+    const g = parseMcpGrant(name);
+    if (g === null) continue;
+    if (!granted.has(g.serverId)) granted.set(g.serverId, /* @__PURE__ */ new Set());
+    granted.get(g.serverId).add(g.tool);
+  }
+  const servers = {};
+  for (const id of Object.keys(m.mcp.servers).sort()) {
+    const s = m.mcp.servers[id];
+    const row = mcpServerCatalogRow(s, catalog);
+    if (row === null) {
+      servers[id] = Object.freeze({ state: "refused" });
+      continue;
+    }
+    const tools = {};
+    for (const t of Object.keys(s.tools).sort()) {
+      if (granted.get(id)?.has(t) === true && row.readTools.includes(t)) tools[t] = Object.freeze({ sha256: s.tools[t].sha256, class: "read" });
+    }
+    servers[id] = Object.freeze({ state: "ok", vendor: s.vendor, url: row.readOnlyUrl, auth: policyAuth(s), tools: Object.freeze(tools) });
+  }
+  const remove = m.mcp.removed === "*" ? "*" : Object.freeze([...m.mcp.removed]);
+  return Object.freeze({ v: 1, state: "ok", r3_hold: r3Hold, servers: Object.freeze(servers), remove });
+}
+
+// src/grants/mcp-issuance.ts
+var NONE = Object.freeze([]);
+var own = (o, k) => Object.prototype.hasOwnProperty.call(o, k);
+function mcpPolicyAllows(policy, serverId, tool) {
+  if (policy === null || policy.state !== "ok" || !own(policy.servers, serverId)) return false;
+  const s = policy.servers[serverId];
+  return s.state === "ok" && own(s.tools, tool);
+}
+function mcpIssuance(i) {
+  if (i.source !== "manifest") return NONE;
+  if (i.verdict?.kind !== "verified" || i.verdict.relayLeaf !== false) return NONE;
+  if (i.entitlement !== "entitled" || i.hostSwitch !== "on" || !i.ownerDmManifestSwitchOn) return NONE;
+  if (i.manifest === null || i.policy === null || i.policy.state !== "ok") return NONE;
+  const out = [];
+  for (const name of i.manifest.grants.owner_dm ?? []) {
+    const g = parseMcpGrant(name);
+    if (g === null || i.disabled.has(name) || !mcpPolicyAllows(i.policy, g.serverId, g.tool)) continue;
+    out.push(Object.freeze({ tool: name, mode: "read", source: "manifest" }));
+  }
+  return out.length === 0 ? NONE : Object.freeze(out);
+}
+
+// src/consumer-grants.ts
+var NO_GRANTS = Object.freeze([]);
+var PER_TOOL_GRANTS_FEATURE = "per_tool_grants";
+function withConsumerGrants(m, perToolConsumer) {
+  if (perToolConsumer) return m;
+  const a = m.authorization;
+  if (!a) return m;
+  const stripGrants = !(a.tool_grants.length === 0 || a.audience === "owner_dm" || a.relay_speaker === "owner");
+  const stripMemory = "memory_write" in a;
+  if (!stripGrants && !stripMemory) return m;
+  const { memory_write: _dropped, ...rest } = a;
+  return { ...m, authorization: Object.freeze({ ...rest, ...stripGrants ? { tool_grants: NO_GRANTS } : {} }) };
+}
+var MANIFEST_GRANTS_FEATURE = "manifest_grants_v1";
+var SEARCH_PROVIDERS_FEATURE = "search_providers_v2";
+var UTILITY_TOOLS_FEATURE = "utility_tools_v1";
+var MCP_CLIENT_FEATURE = "mcp_client_v1";
+var CONSTANT_TOOL_NAMES = Object.freeze({
+  owner_dm: Object.freeze(["current_time", "web_search"]),
+  team_room: Object.freeze(["current_time"])
+});
+var isManifestGrant = (g) => g.mode === "read" && g.source === "manifest";
+function withManifestCapability(m, manifestConsumer) {
+  if (manifestConsumer) return m;
+  const a = m.authorization;
+  if (!a || !a.tool_grants.some(isManifestGrant)) return m;
+  const constants5 = new Set(a.audience === "owner_dm" || a.audience === "team_room" ? CONSTANT_TOOL_NAMES[a.audience] : []);
+  const narrowed = a.tool_grants.flatMap((g) => {
+    if (!isManifestGrant(g)) return [g];
+    return constants5.has(g.tool) ? [Object.freeze({ tool: g.tool, mode: "read" })] : [];
+  });
+  return { ...m, authorization: Object.freeze({ ...a, tool_grants: Object.freeze(narrowed) }) };
+}
+function withHarnessGrants(m, withheld) {
+  if (!withheld) return m;
+  const a = m.authorization;
+  if (!a || a.tool_grants.length === 0) return m;
+  return { ...m, authorization: Object.freeze({ ...a, tool_grants: NO_GRANTS }) };
+}
+function withSearchCapability(m, consumerHasFeature, signedProvider) {
+  if (consumerHasFeature) return m;
+  const a = m.authorization;
+  if (!a) return m;
+  const stripSearch = signedProvider !== void 0 && signedProvider !== "brave";
+  const kept = a.tool_grants.filter((g) => g.tool !== "web_extract" && !(stripSearch && g.tool === "web_search"));
+  if (kept.length === a.tool_grants.length) return m;
+  return { ...m, authorization: Object.freeze({ ...a, tool_grants: kept.length === 0 ? NO_GRANTS : Object.freeze(kept) }) };
+}
+var UTILITY_TOOL_NAMES = /* @__PURE__ */ new Set(["weather_forecast", "currency_convert"]);
+function withUtilityCapability(m, consumerHasFeature) {
+  if (consumerHasFeature) return m;
+  const a = m.authorization;
+  if (!a) return m;
+  const kept = a.tool_grants.filter((g) => !UTILITY_TOOL_NAMES.has(g.tool));
+  if (kept.length === a.tool_grants.length) return m;
+  return { ...m, authorization: Object.freeze({ ...a, tool_grants: kept.length === 0 ? NO_GRANTS : Object.freeze(kept) }) };
+}
+var MCP_GRANT_PREFIX = "mcp:";
+var isMcpGrant = (g) => g.tool.startsWith(MCP_GRANT_PREFIX);
+function withMcpCapability(m, consumerHasFeature) {
+  const a = m.authorization;
+  if (!a) return m;
+  const { relay_free: _relayFree, ...rest } = a;
+  if (!a.tool_grants.some(isMcpGrant)) return "relay_free" in a ? { ...m, authorization: Object.freeze(rest) } : m;
+  if (consumerHasFeature && a.audience === "owner_dm" && a.relay_speaker === void 0) return m;
+  const kept = a.tool_grants.filter((g) => !isMcpGrant(g));
+  return { ...m, authorization: Object.freeze({ ...rest, tool_grants: kept.length === 0 ? NO_GRANTS : Object.freeze(kept) }) };
+}
+var R3_KEEP_TOOLS = /* @__PURE__ */ new Set(["current_time", "web_search", "weather_forecast", "currency_convert"]);
+function withR3Holds(m, hold) {
+  if (!hold) return m;
+  const a = m.authorization;
+  if (!a || !(a.audience === "owner_dm" || a.relay_speaker === "owner")) return m;
+  const kept = a.tool_grants.filter((g) => R3_KEEP_TOOLS.has(g.tool) || isMcpGrant(g));
+  if (kept.length === a.tool_grants.length) return m;
+  return { ...m, authorization: Object.freeze({ ...a, tool_grants: kept.length === 0 ? NO_GRANTS : Object.freeze(kept) }) };
+}
+
+// src/mcp-catalog-message.ts
+var MCP_CATALOG_MAX_BYTES = 384 * 1024;
+var MCP_CATALOG_MAX_TOOLS = 64;
+var MCP_CATALOG_LIST_TIMEOUT_MS = 5e4;
+var REQUEST_ID = /^[0-9a-f]{32}$/;
+var SERVER_ID = /^[a-z0-9-]{1,24}$/;
+var TOOL_NAME = /^[A-Za-z0-9_.-]{1,64}$/;
+var RESERVED = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+var ISO_TIME = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?Z$/;
+var MCP_CATALOG_REASONS = /* @__PURE__ */ new Set(["catalog", "write_name", "hint", "schema", "header_param", "too_large"]);
+var isBag2 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var keysExactly2 = (o, keys) => {
+  const k = Object.keys(o);
+  return k.length === keys.length && keys.every((x) => Object.prototype.hasOwnProperty.call(o, x));
+};
+function parseMcpCatalogRequest(body) {
+  if (!isBag2(body) || !keysExactly2(body, ["v", "type", "server_id", "request_id"])) return null;
+  if (body.v !== 1 || body.type !== "mcp_catalog_request") return null;
+  const { server_id: serverId, request_id: requestId } = body;
+  if (typeof serverId !== "string" || !SERVER_ID.test(serverId) || RESERVED.has(serverId)) return null;
+  if (typeof requestId !== "string" || !REQUEST_ID.test(requestId)) return null;
+  return Object.freeze({ serverId, requestId });
+}
+var PROJECTION_KEYS = /* @__PURE__ */ new Set(["name", "title", "description", "inputSchema", "annotations"]);
+function validProjection(p, toolName) {
+  if (!Object.keys(p).every((k) => PROJECTION_KEYS.has(k))) return false;
+  if (p.name !== toolName || typeof p.description !== "string" || !isBag2(p.inputSchema)) return false;
+  if (Object.prototype.hasOwnProperty.call(p, "title") && typeof p.title !== "string") return false;
+  if (Object.prototype.hasOwnProperty.call(p, "annotations") && !isBag2(p.annotations)) return false;
+  return true;
+}
+function validTool(t) {
+  if (!isBag2(t) || typeof t.name !== "string" || typeof t.grantable !== "boolean") return null;
+  if (t.grantable) {
+    if (!TOOL_NAME.test(t.name) || t.reason !== null || !isBag2(t.projection) || !validProjection(t.projection, t.name)) return null;
+    return { name: t.name, projection: t.projection, grantable: true, reason: null };
+  }
+  if (t.projection !== void 0 || typeof t.reason !== "string" || !MCP_CATALOG_REASONS.has(t.reason)) return null;
+  if (t.name.length < 1 || t.name.length > 64 || !/^[\x20-\x7e]+$/.test(t.name)) return null;
+  return { name: t.name, grantable: false, reason: t.reason };
+}
+function validateCatalogListReply(frame, serverId, vendor) {
+  if (!isBag2(frame) || frame.ok !== true || frame.server_id !== serverId || frame.vendor !== vendor) return null;
+  if (typeof frame.listed_at !== "string" || !ISO_TIME.test(frame.listed_at) || typeof frame.truncated !== "boolean") return null;
+  if (!Array.isArray(frame.tools) || frame.tools.length > MCP_CATALOG_MAX_TOOLS) return null;
+  const tools = [];
+  const names = /* @__PURE__ */ new Set();
+  for (const t of frame.tools) {
+    const v = validTool(t);
+    if (v === null) return null;
+    if (names.has(v.name)) return null;
+    names.add(v.name);
+    tools.push(v);
+  }
+  return { listedAt: frame.listed_at, truncated: frame.truncated, tools };
+}
+var utf8 = (v) => Buffer.byteLength(JSON.stringify(v), "utf8");
+var mcpCatalogBodyBytes = (b) => utf8(b);
+function buildMcpCatalogBody(i) {
+  const head = { v: 1, type: "mcp_catalog", server_id: i.serverId, request_id: i.requestId, vendor: i.vendor, issuer: i.issuer, listed_at: i.reply.listedAt };
+  const full = { ...head, tools: [...i.reply.tools], truncated: i.reply.truncated };
+  if (mcpCatalogBodyBytes(full) <= MCP_CATALOG_MAX_BYTES) return full;
+  const stub = (t) => ({ name: t.name, grantable: false, reason: "too_large" });
+  const tools = i.reply.tools.map(stub);
+  const body = { ...head, tools, truncated: true };
+  let size = mcpCatalogBodyBytes(body);
+  for (let k = 0; k < tools.length; k++) {
+    const want = i.reply.tools[k];
+    const delta = utf8(want) - utf8(tools[k]);
+    if (size + delta <= MCP_CATALOG_MAX_BYTES) {
+      tools[k] = want;
+      size += delta;
+    }
+  }
+  return body;
+}
+
+// src/mcp-catalog-rate.ts
+var MINUTE_MS = 6e4;
+var HOUR_MS = 60 * MINUTE_MS;
+var MCP_CATALOG_PER_SERVER_MINUTE = 3;
+var MCP_CATALOG_PER_SERVER_HOUR = 20;
+var MCP_CATALOG_PER_AGENT_HOUR = 40;
+var McpCatalogRateLimiter = class {
+  now;
+  onRateLimited;
+  inFlight = /* @__PURE__ */ new Set();
+  perServer = /* @__PURE__ */ new Map();
+  agent = [];
+  /** Per scope key: no further log until this time (the end of the window that was full when it last logged). */
+  quietUntil = /* @__PURE__ */ new Map();
+  constructor(deps = {}) {
+    this.now = deps.now ?? Date.now;
+    this.onRateLimited = deps.onRateLimited ?? (() => {
+    });
+  }
+  /** "ok" admits (and counts) the request and marks the server in flight; the caller MUST call release(serverId). */
+  admit(serverId) {
+    if (this.inFlight.has(serverId)) return "in_flight";
+    const t = this.now();
+    const server = (this.perServer.get(serverId) ?? []).filter((x) => t - x < HOUR_MS);
+    this.perServer.set(serverId, server);
+    this.agent = this.agent.filter((x) => t - x < HOUR_MS);
+    const lastMinute = server.filter((x) => t - x < MINUTE_MS);
+    if (lastMinute.length >= MCP_CATALOG_PER_SERVER_MINUTE) return this.limited(`m:${serverId}`, "server_minute", lastMinute[0] + MINUTE_MS, t);
+    if (server.length >= MCP_CATALOG_PER_SERVER_HOUR) return this.limited(`h:${serverId}`, "server_hour", server[0] + HOUR_MS, t);
+    if (this.agent.length >= MCP_CATALOG_PER_AGENT_HOUR) return this.limited("a", "agent_hour", this.agent[0] + HOUR_MS, t);
+    server.push(t);
+    this.agent.push(t);
+    this.inFlight.add(serverId);
+    return "ok";
+  }
+  release(serverId) {
+    this.inFlight.delete(serverId);
+  }
+  limited(key, scope, windowEnd, t) {
+    if (t >= (this.quietUntil.get(key) ?? -Infinity)) {
+      this.quietUntil.set(key, windowEnd);
+      this.onRateLimited(scope);
+    }
+    return "rate_limited";
+  }
+};
 
 // src/bridge-agent.ts
 function logSendSupersededAdoption(kind2) {
@@ -36588,6 +37405,7 @@ function selectVoiceGuidance(isDm, voiceDefaultResponder) {
   }
   return VOICE_MODE_GUIDANCE;
 }
+var MCP_INERT_STATES = /* @__PURE__ */ new Set(["suspended", "no_config", "switch_off", "no_manifest", "section_absent", "malformed", "no_capability"]);
 var VOICE_COALESCE_WINDOW_MS = 0;
 var VOICE_COALESCE_WINDOW_MAX_MS = 5e3;
 function voiceCoalesceWindowFromEnv(env = process.env) {
@@ -36638,10 +37456,10 @@ var ChannelPendingError = class extends Error {
   }
 };
 var RateLimitedError = class extends Error {
-  constructor(channelId, retryAfterMs) {
-    super(`channel ${channelId} send rate limit exceeded (retry in ${retryAfterMs}ms)`);
+  constructor(channelId, retryAfterMs2) {
+    super(`channel ${channelId} send rate limit exceeded (retry in ${retryAfterMs2}ms)`);
     this.channelId = channelId;
-    this.retryAfterMs = retryAfterMs;
+    this.retryAfterMs = retryAfterMs2;
     this.name = "RateLimitedError";
   }
 };
@@ -36769,6 +37587,31 @@ var SendForbiddenError = class extends Error {
     this.name = "SendForbiddenError";
   }
 };
+var MCP_POLICY_RETRY_DELAYS_MS = Object.freeze([1e3, 5e3, 3e4, 12e4, 3e5]);
+function logMcpCatalogRequest(state) {
+  writeServiceLog(state === "sent" ? "info" : "warn", "mcp.catalog_request", { state: ServiceLogEnum.of(state, [
+    "malformed",
+    "not_owner_dm",
+    "not_verified",
+    "replay",
+    "relay_leaf",
+    "not_ready",
+    "in_flight",
+    "runtime_timeout",
+    "runtime_refused",
+    "withheld",
+    "send_failed",
+    "failed",
+    "sent"
+  ]) });
+}
+var McpReplyWithheldError = class extends SendForbiddenError {
+  constructor(channelId) {
+    super(channelId);
+    this.name = "McpReplyWithheldError";
+    this.message = "reply withheld: the chat is no longer private to the owner and the agent; no retry";
+  }
+};
 var RoomClassChangedSendError = class extends SendForbiddenError {
   constructor(channelId) {
     super(channelId);
@@ -36788,6 +37631,7 @@ function rosterFreshAt(entry, heldEpoch, heldGroupId) {
 var RoomGrantEpochMovedError = class extends Error {
 };
 var ROOM_GRANT_TRACK_MAX = 4096;
+var MCP_DELIVERED_TRACK_MAX = 4096;
 var VOICE_FRAME_PARENT_MAX = 4096;
 var SessionSupersededError = class extends Error {
   constructor() {
@@ -36939,8 +37783,12 @@ var BridgeAgent = class _BridgeAgent {
       onSupersedeUnopenable: (channelId, groupId) => this.healSupersedeUnopenable(channelId, groupId, this.drainExemptionAtCallIn())
     });
     this.home = deps.home ?? homedir4();
+    this.mcpCatalog = deps.mcpCatalog;
+    this.mcpDeliveredTrackMax = deps.mcpDeliveredTrackMax ?? MCP_DELIVERED_TRACK_MAX;
+    this.mcpPolicyRetryDelaysMs = deps.mcpPolicyRetryDelaysMs?.length ? deps.mcpPolicyRetryDelaysMs : MCP_POLICY_RETRY_DELAYS_MS;
     this.grantWriters = {
       writeManifestPolicy: deps.grantWriters?.writeManifestPolicy ?? writeManifestPolicy,
+      writeMcpPolicy: deps.grantWriters?.writeMcpPolicy ?? writeMcpPolicy,
       writeManagedFiles: deps.grantWriters?.writeManagedFiles ?? writeManagedFiles,
       bindRuntimeConfig: deps.grantWriters?.bindRuntimeConfig ?? bindRuntimeConfig,
       removeManagedLlmSource: deps.grantWriters?.removeManagedLlmSource ?? removeManagedLlmSource
@@ -37426,6 +38274,62 @@ var BridgeAgent = class _BridgeAgent {
   roomDefaultGrants = roomDefaultGrantsEnabled();
   /** Owner grants (spec §7.4): the two manifest switches, read once at construction. */
   ownerDmManifestGrants = ownerDmManifestGrantsEnabled();
+  /**
+   * MCP client Task 16 (OQ-16, coordinator ruling D-7): SECURECOMS_MCP_GRANTS, read ONCE at construction. "off" writes
+   * kill_switch (deleting); any value other than unset/"on"/"off" is suspended (non-deleting, one content-free warn).
+   */
+  mcpHostSwitch = mcpGrantsHostSwitch(process.env);
+  /** MCP Task 16 test seam (BridgeAgentDeps.mcpCatalog); undefined in production, so MCP_CATALOG decides. */
+  mcpCatalog;
+  /**
+   * MCP Task 16 (OQ-1; PR-B1 audit M-2): the two raw /files fields from the LAST fetch. Any failed or rejected fetch
+   * sets `fetched: false` (no_config, non-deleting): the last values are never kept to keep an `ok` document alive.
+   */
+  mcpConfig = Object.freeze({ fetched: false });
+  /**
+   * MCP Task 16: the mcp-policy.json document this process last WROTE (the file the runtime reads), or null before the
+   * first write and after a failed one (fail closed: issuance reads only a document known to be on disk).
+   */
+  mcpPolicyWritten = null;
+  mcpPolicyWrittenJson = null;
+  /** Deletion-ack ruling §3: the manifest counter in force when `mcpPolicyWrittenJson` was written (never read live). */
+  mcpPolicyWrittenCounter = null;
+  /** Ruling §3: newest counter whose written policy the runtime fully acted on. Memory only, monotonic, starts at 0. */
+  mcpDeletionsThrough = 0;
+  /** Ruling §3: the last `credentials_present` an accepted frame carried; null until one arrives. */
+  mcpCredentialsPresentValue = null;
+  /** Ruling §3: per attached socket, whether its latest hello declared mcp_deletion_ack_v1 (harness noted false). */
+  mcpDeletionAckSockets = /* @__PURE__ */ new Map();
+  /** Ruling §3 rate: the ack-derived report values in the last report posted (null until one is). */
+  lastReportedMcpAck = null;
+  /** #1351 round 2 M-1: bumped on every byte-changing policy write (and on the inert document being put in force). */
+  policyWriteSeq = 0;
+  /** M-1: per ack-capable socket, the policyWriteSeq at the dispatch of each owner-DM turn, by message id (bounded). */
+  mcpTurnSeq = /* @__PURE__ */ new Map();
+  /**
+   * #1351 round 2 H-1: the ack values the REPORT may carry. An ack lands seconds after an owner-DM turn and a report
+   * posted then would time the turn (record_report sets applied_at). So, as the tool-status sender: `open` holds a
+   * change while its 15-minute UTC bucket is open, `closed` what the report carries, and the only post is from one
+   * timer at the next bucket boundary plus jitter.
+   */
+  mcpAckOpen = null;
+  mcpAckClosed = { through: 0, credentials: null };
+  mcpAckTimer = null;
+  /** PR-B2 follow-up: a failed write is retried on this backoff (the last value repeats) until one lands or close(). */
+  mcpPolicyRetryDelaysMs;
+  mcpPolicyRetryTimer = null;
+  mcpPolicyRetryAttempt = 0;
+  /** MCP Task 18: the loopback catalog listers of the attached runtime sockets that declared mcp_client_v1 (ws-server.ts). */
+  mcpCatalogListers = /* @__PURE__ */ new Map();
+  /** MCP Task 18 (OQ-15): per server 1 in flight, 3 / 60 s, 20 / hour; per agent 40 / hour. Memory only. */
+  mcpCatalogRate = new McpCatalogRateLimiter({
+    onRateLimited: (scope) => writeServiceLog("warn", "mcp.catalog_request", {
+      state: ServiceLogEnum.of("catalog_rate_limited", ["catalog_rate_limited"]),
+      scope: ServiceLogEnum.of(scope, ["server_minute", "server_hour", "agent_hour"])
+    })
+  });
+  /** MCP Task 18: answers in progress (outside the ingest cycle). Observable by tests; close() does not wait on them. */
+  mcpCatalogWork = /* @__PURE__ */ new Set();
   roomManifestGrants = roomManifestGrantsEnabled();
   /**
    * Audit M-B4: DM channels whose roster was epoch-fresh at THIS ingest
@@ -37436,6 +38340,39 @@ var BridgeAgent = class _BridgeAgent {
   // RECORDED here and in the sealed store; no grant code reads it in step 1.
   toolGrantManifest = null;
   toolGrantCounter = null;
+  /**
+   * Tool status Phase 0 (spec §3.1, §3.2; plan Task 8): the latest owner-DM last-turn record, in memory only (no store
+   * table: after a restart there is none until the next typed owner-DM turn). ADVISORY: nothing reads it to decide a
+   * grant. Content-free: enums, booleans, one 15-minute bucket `at` (ruling M-2), one counter, built-in names from the
+   * allowlist. This is the latest record, open bucket included; what leaves the host is the sender's closed record.
+   */
+  ownerDmLastTurn = null;
+  /**
+   * Test seams (Task 8; ruling M-2): the cause function, the bridge clock the record and the sender read, and the
+   * sender's timer and jitter source.
+   */
+  toolStatusCause = ownerDmCause;
+  toolStatusNow = () => Date.now();
+  toolStatusSetTimer = defaultToolStatusSetTimer;
+  toolStatusClearTimer = defaultToolStatusClearTimer;
+  toolStatusRandom = Math.random;
+  /**
+   * Phase 0 Task 9 (spec §3.5), ruling M-2: the post of the record to the narrow route, only just after a 15-minute
+   * UTC bucket boundary, and only a record whose bucket has closed.
+   */
+  toolStatusSender = new ToolStatusSender({
+    post: (rec) => this.postToolStatus(rec),
+    now: () => this.toolStatusNow(),
+    setTimer: (fn, ms) => this.toolStatusSetTimer(fn, ms),
+    clearTimer: (h) => this.toolStatusClearTimer(h),
+    random: () => this.toolStatusRandom(),
+    onFailure: (kind2) => writeServiceLog("warn", "tool_status.post_failed", { status: ServiceLogEnum.of(kind2, ["http_error", "timeout", "network"]) })
+  });
+  /**
+   * MCP Phase 1 Task 14 (OQ-3 ruling item 3): the sticky R-3 flag, mirrored from the sealed store. Starts false and is
+   * set true at start() by the store (or by a failed read, fail closed). Only applyToolGrantManifest changes it after.
+   */
+  mcpSeen = false;
   manifestState = "no_manifest";
   /** Failed owner-turn checks since the last successful runtime-config report (§7.7). */
   ownerVerifyFailures = 0;
@@ -37901,10 +38838,12 @@ var BridgeAgent = class _BridgeAgent {
       const payload = await res.json();
       if (!payload) {
         writeServiceLog("warn", "runtime_config.empty_response");
+        this.noteMcpConfigUnfetched();
         return;
       }
       if (typeof payload.version !== "number") {
         writeServiceLog("warn", "runtime_config.invalid_version");
+        this.noteMcpConfigUnfetched();
         return;
       }
       const version = payload.version;
@@ -37918,6 +38857,9 @@ var BridgeAgent = class _BridgeAgent {
         manifestStepThrew = true;
         writeServiceLog("warn", "authz.config_binding", { state: ServiceLogEnum.of("bind_failed", ["bind_failed"]) }, e);
       }
+      const raw = payload;
+      this.mcpConfig = Object.freeze({ fetched: true, mcp_entitled: raw.mcp_entitled, mcp_cause: raw.mcp_cause });
+      this.recomputeMcpPolicy();
       const pin = this.cfg.ownerGrantPin?.pin ?? null;
       const inForce = pin !== null ? this.toolGrantManifest : null;
       if (inForce !== null && pin !== null) {
@@ -37984,7 +38926,88 @@ var BridgeAgent = class _BridgeAgent {
       await this.postRuntimeConfigReport(base, version, skillsJson);
     } catch (e) {
       writeServiceLog("warn", "runtime_config.refetch_failed", {}, e);
+      this.noteMcpConfigUnfetched();
+    }
+  }
+  /** MCP Task 16 (OQ-1): the bridge's in-force entitlement reading; not fetched (or failed) is suspended. */
+  mcpEntitlementInForce() {
+    return this.mcpConfig.fetched ? mcpEntitlementReading(this.mcpConfig.mcp_entitled, this.mcpConfig.mcp_cause) : "suspended";
+  }
+  /** PR-B1 audit M-2: forget the last /files fields and rewrite mcp-policy.json (no_config: no grants, no deletion). */
+  noteMcpConfigUnfetched() {
+    this.mcpConfig = Object.freeze({ fetched: false });
+    this.recomputeMcpPolicy();
+  }
+  /** MCP Task 16: the live inputs of mcp-policy.json (the pinned manifest in force only). */
+  mcpPolicyInput() {
+    const pin = this.cfg.ownerGrantPin?.pin ?? null;
+    return {
+      hostSwitch: this.mcpHostSwitch,
+      config: this.mcpConfig,
+      ownerDmManifestSwitchOn: this.ownerDmManifestGrants,
+      manifest: pin !== null ? this.toolGrantManifest : null,
+      capability: this.mcpClientCapable(),
+      mcpSeen: this.mcpSeen,
+      ...this.mcpCatalog ? { catalog: this.mcpCatalog } : {}
+    };
+  }
+  /**
+   * MCP Task 16 (spec §12.1): recompute mcp-policy.json and write it when it changed. The written document is what MCP
+   * issuance and release-time re-narrowing read, so it is cleared BEFORE the write and set only after it lands: a failed
+   * write leaves no document in force here (no MCP grant), and the next trigger tries again. Never throws.
+   */
+  recomputeMcpPolicy() {
+    const doc = mcpPolicyFor(this.mcpPolicyInput());
+    const json2 = JSON.stringify(doc);
+    if (json2 === this.mcpPolicyWrittenJson) {
+      if (this.mcpPolicyWritten !== null && this.mcpPolicyWrittenCounter !== null) this.mcpPolicyWrittenCounter = this.toolGrantCounter;
+      return;
     }
+    if (MCP_INERT_STATES.has(doc.state) && !doc.r3_hold && Object.keys(doc.servers).length === 0 && !existsSync5(join20(runtimeConfigDir(this.home, this.cfg.identityId), MCP_POLICY_FILE))) {
+      this.mcpPolicyWritten = doc;
+      this.mcpPolicyWrittenJson = json2;
+      this.mcpPolicyWrittenCounter = this.toolGrantCounter;
+      this.policyWriteSeq++;
+      this.clearMcpPolicyRetry();
+      return;
+    }
+    this.mcpPolicyWritten = null;
+    this.mcpPolicyWrittenJson = null;
+    this.mcpPolicyWrittenCounter = null;
+    this.policyWriteSeq++;
+    try {
+      this.grantWriters.writeMcpPolicy(this.home, this.cfg.identityId, doc);
+    } catch (e) {
+      writeServiceLog("warn", "authz.mcp_policy", { state: ServiceLogEnum.of("write_failed", ["write_failed"]) }, e);
+      this.scheduleMcpPolicyRetry();
+      return;
+    }
+    this.mcpPolicyWritten = doc;
+    this.mcpPolicyWrittenJson = json2;
+    this.mcpPolicyWrittenCounter = this.toolGrantCounter;
+    this.clearMcpPolicyRetry();
+  }
+  /** A document is in force: no pending retry, and the next failure starts the backoff from the first delay. */
+  clearMcpPolicyRetry() {
+    this.mcpPolicyRetryAttempt = 0;
+    if (this.mcpPolicyRetryTimer !== null) clearTimeout(this.mcpPolicyRetryTimer);
+    this.mcpPolicyRetryTimer = null;
+  }
+  /**
+   * PR-B2 follow-up: one pending retry at a time. The retry recomputes from the state THEN (never re-writes a stale
+   * document); any other trigger that writes successfully meanwhile cancels it. Nothing is in force on the bridge side
+   * until a write lands (mcpPolicyWritten stays null).
+   */
+  scheduleMcpPolicyRetry() {
+    if (this.closingDown || this.mcpPolicyRetryTimer !== null) return;
+    const d = this.mcpPolicyRetryDelaysMs;
+    const delay = d[Math.min(this.mcpPolicyRetryAttempt, d.length - 1)];
+    this.mcpPolicyRetryAttempt++;
+    this.mcpPolicyRetryTimer = setTimeout(() => {
+      this.mcpPolicyRetryTimer = null;
+      if (!this.closingDown) this.recomputeMcpPolicy();
+    }, delay);
+    this.mcpPolicyRetryTimer.unref?.();
   }
   /**
    * Plan 4 Task 11: the refetch under a manifest in force. Returns false when the binding failed (H-4),
@@ -38077,6 +39100,8 @@ var BridgeAgent = class _BridgeAgent {
     const local = readLocalReport(this.home, this.cfg.identityId);
     const reportedSearchProviders = this.searchProvidersCapable();
     const reportedUtilityTools = this.utilityToolsCapable();
+    const reportedMcpAck = this.mcpAckSignature();
+    const carriedOwnerDmTurn = this.toolStatusSender.carry();
     const report = {
       applied_version: version,
       paths: checkConfiguredPaths(skillsJson),
@@ -38146,8 +39171,20 @@ var BridgeAgent = class _BridgeAgent {
         // D19 item 4: content-free; the signed provider is one the attached runtime(s) cannot honour.
         search_provider_unsupported: this.searchProviderUnsupported(reportedSearchProviders),
         // Weather/currency §8 item 5: a separate key, false with no runtime attached.
-        utility_tools_v1: reportedUtilityTools
-      }
+        utility_tools_v1: reportedUtilityTools,
+        // MCP Task 19 (spec §12.3): separate from `capability`; content-free enums and pattern tokens only.
+        mcp_capability: this.reportedMcpCapability(),
+        mcp_servers: this.reportedMcpServers(),
+        // Deletion-ack ruling §5.3: content-free scalars. `mcp_deletions_through` only while EVERY attached runtime socket
+        // declared mcp_deletion_ack_v1 (absent = cannot acknowledge); `mcp_credentials_present` only once one reported.
+        ...this.reportedMcpAck(),
+        // Tool status Phase 0 (spec §3.5, round 2 H-5): an updated bridge, with or without a record yet.
+        tool_status_v1: true
+      },
+      // Tool status Phase 0 (spec §3.5): the record rides every apply-time report, so record_report's wholesale replace
+      // never erases it. Ruling M-2: the sender's CLOSED record, never the latest one, so a report sent inside a bucket
+      // never reveals that bucket's change early. Advisory and content-free.
+      ...carriedOwnerDmTurn ? { owner_dm_last_turn: carriedOwnerDmTurn } : {}
     };
     const reportedVerifyFailures = this.ownerVerifyFailures;
     const posted = await this.fetchBounded("runtime_config_report", "control", `${base}/report`, {
@@ -38169,6 +39206,7 @@ var BridgeAgent = class _BridgeAgent {
     this.ownerVerifyFailures = Math.max(0, this.ownerVerifyFailures - reportedVerifyFailures);
     this.lastReportedSearchProviders = reportedSearchProviders;
     this.lastReportedUtilityTools = reportedUtilityTools;
+    this.lastReportedMcpAck = reportedMcpAck;
     if (version) writeServiceLog("info", "runtime_config.applied", { version });
     else writeServiceLog("info", "runtime_config.legacy_memory_reported");
   }
@@ -38245,6 +39283,7 @@ var BridgeAgent = class _BridgeAgent {
     }
     await this.restoreRuntimeInbox();
     await this.loadToolGrantState();
+    this.recomputeMcpPolicy();
     this.recomputeManifestPolicy(NO_FEATURES);
     try {
       this.store.pruneRoomSearchCap(utcDayOf(Date.now()));
@@ -39262,7 +40301,9 @@ var BridgeAgent = class _BridgeAgent {
    * for every envelope built, BEFORE it is published (SEC-06 #18 persists it
    * there so a retry can resend the exact bytes).
    */
-  async publishBody(channelId, body, id, onEnvelope, sealCheck) {
+  async publishBody(channelId, body, id, onEnvelope, sealCheck, inReplyTo, mcpTurn) {
+    const mcpGuard = mcpTurn === true || this.mcpReplyGuarded(channelId, inReplyTo ?? void 0);
+    let attempt = 0;
     this.enforceBodyRateFloor(channelId, body);
     this.statusGate.replyStarted(channelId);
     const joined = await this.reconcileJoin(channelId);
@@ -39302,6 +40343,8 @@ var BridgeAgent = class _BridgeAgent {
         );
       },
       async (envelope) => {
+        attempt++;
+        if (mcpGuard) this.assertMcpReplyRelayFree(channelId, envelope, attempt);
         if (onEnvelope) await onEnvelope(envelope);
         return this.publishEnvelope(
           channelId,
@@ -39311,6 +40354,77 @@ var BridgeAgent = class _BridgeAgent {
     );
     this.latency.record("send.total", performance.now() - sendStart);
   }
+  /**
+   * MCP Task 16 (round 2 H-D): message ids whose DELIVERED authorization (after release-time re-narrowing) carried an
+   * `mcp:` grant, with their channel and whether the runtime acked them. Recorded at the buffer exit, the one place
+   * every consumer's copy leaves from (over-recording a turn a non-capable consumer then received without the grant only
+   * adds a check). Kept after the ack, so a late frame citing the turn is still checked. Bounded: the oldest ACKED entry
+   * goes first.
+   */
+  mcpDeliveredTurns = /* @__PURE__ */ new Map();
+  mcpDeliveredTrackMax;
+  /**
+   * Record `m` when its authorization carries an `mcp:` grant. Returns false ONLY when `m` is a new turn, the record is
+   * at its bound and no entry is acked: the caller (the buffer exit) must then issue no mcp: grant (audit M-2, fail
+   * closed). `rebuild` (PR-B2 audit C-1 (b): a restored runtime-inbox row, or a replayed turn) records unconditionally:
+   * those grants were issued before, so the record may exceed its bound by at most the runtime inbox's size.
+   */
+  noteMcpDelivered(m, rebuild = false) {
+    if (!m.authorization?.tool_grants.some((g) => g.tool.startsWith(MCP_GRANT_PREFIX))) return true;
+    if (!this.mcpDeliveredTurns.has(m.message_id) && this.mcpDeliveredTurns.size >= this.mcpDeliveredTrackMax) {
+      let victim;
+      for (const [id, r] of this.mcpDeliveredTurns) if (r.acked) {
+        victim = id;
+        break;
+      }
+      if (victim !== void 0) this.mcpDeliveredTurns.delete(victim);
+      else if (!rebuild) return false;
+    }
+    this.mcpDeliveredTurns.set(m.message_id, { channelId: m.channel_id, acked: false });
+    return true;
+  }
+  /**
+   * H-D: whether a frame to `channelId` must pass the relay-free check: it answers a recorded MCP turn (any channel:
+   * a frame of that turn sent elsewhere is checked against ITS channel), or it cites no turn while an MCP turn is
+   * unacked in the same channel.
+   */
+  mcpReplyGuarded(channelId, inReplyTo) {
+    if (inReplyTo !== void 0 && this.mcpDeliveredTurns.has(inReplyTo)) return true;
+    if (inReplyTo !== void 0) return false;
+    for (const r of this.mcpDeliveredTurns.values()) if (!r.acked && r.channelId === channelId) return true;
+    return false;
+  }
+  /**
+   * H-D, synchronous: read the channel's local leaves from the warm manager in one step and tie the read to the
+   * envelope's SEALED group and epoch, so the leaf set is exactly the membership that can open these bytes. Owner and
+   * agent only: pass. Anyone else: withhold. The tree moved past the seal on the first attempt: StaleEpochError, which
+   * sendWithSelfHeal answers with its one converge-and-re-seal (the existing semantics); still unprovable on the retry,
+   * or no warm manager, no pin, or any throw: withhold (fail closed). Read-only; never touches the group.
+   *
+   * Scope (PR-B2 audit item 5): this guards the `send` path (publishBody) only. `status` detail, the `action_*` run
+   * frames, `/v1/send-attachment` and summary frames are NOT checked; they are safe for MCP turns only because the
+   * runtime emits none of them (pinned by connect-agent-runtime/src/outbound-frames.arch.test.ts). A runtime that starts
+   * emitting any of them needs this guard extended to that frame first.
+   */
+  assertMcpReplyRelayFree(channelId, envelope, attempt) {
+    let verdict = "unknown";
+    try {
+      const pin = this.cfg.ownerGrantPin?.pin ?? null;
+      const snap = this.provider.leafSnapshotCached(channelId);
+      const sealedGroup = sealedGroupIdOf(envelope);
+      if (pin !== null && snap !== null && sealedGroup !== void 0 && snap.groupId === sealedGroup) {
+        if (snap.epoch === envelope.mls_group_epoch) {
+          verdict = ownerDmLeavesRelayFree(snap.leaves, { ownerIdentityId: pin.ownerIdentityId, agentIdentityId: this.cfg.identityId }) ? "free" : "relay";
+        } else if (snap.epoch > envelope.mls_group_epoch) verdict = "moved";
+      }
+    } catch {
+      verdict = "unknown";
+    }
+    if (verdict === "free") return;
+    if (verdict === "moved" && attempt === 1) throw new StaleEpochError(envelope.mls_group_epoch, envelope.mls_group_epoch + 1);
+    writeServiceLog("warn", "mcp.reply_withheld", { state: ServiceLogEnum.of(verdict, ["relay", "moved", "unknown"]) });
+    throw new McpReplyWithheldError(channelId);
+  }
   /**
    * Audit M-B1 (controller ruling): a reply to a room-granted turn is sealed
    * only at the epoch the room was classified at. On a move, the room is
@@ -39322,9 +40436,9 @@ var BridgeAgent = class _BridgeAgent {
    * the redelivery replay (replayReplyIntents, which has no in_reply_to in its
    * options) is checked the same as a live send.
    */
-  async publishBodyForReply(channelId, body, id, inReplyTo, onEnvelope) {
+  async publishBodyForReply(channelId, body, id, inReplyTo, onEnvelope, mcpTurn) {
     const grant = inReplyTo !== null ? this.roomGrantEpochs.get(inReplyTo) : void 0;
-    if (grant === void 0) return this.publishBody(channelId, body, id, onEnvelope);
+    if (grant === void 0) return this.publishBody(channelId, body, id, onEnvelope, void 0, inReplyTo, mcpTurn);
     if (channelId !== grant.channelId) {
       writeServiceLog("warn", "reply.room_class_changed");
       throw new RoomClassChangedSendError(channelId);
@@ -39346,7 +40460,9 @@ var BridgeAgent = class _BridgeAgent {
           },
           (epoch) => {
             if (epoch !== grant.epoch) throw new RoomGrantEpochMovedError();
-          }
+          },
+          inReplyTo,
+          mcpTurn
         );
       } catch (e) {
         if (!(e instanceof RoomGrantEpochMovedError)) throw e;
@@ -39481,14 +40597,15 @@ var BridgeAgent = class _BridgeAgent {
         const k = replyIntentKey({ inReplyTo: opts.inReplyTo, idempotencyKey: opts.idempotencyKey, ordinal: () => 0 });
         if (!k) throw new Error("idempotent send without a key");
         const id = replyMessageId(this.replyIdKey, this.cfg.identityId, channelId, k);
-        const mac2 = replyBodyMac(this.replyIdKey, id, channelId, bytes, opts.credit);
-        const { intent } = await this.store.claimReplyIntent({ ...k, channelId, replyMessageId: id, bodyMac: mac2, body: bytes, replyCredit: opts.credit ?? null });
-        if (intent.bodyMac !== mac2 || intent.channelId !== channelId || intent.state === "skipped") {
+        const mcpTurn = this.mcpReplyGuarded(channelId, opts.inReplyTo);
+        const mac2 = replyBodyMac(this.replyIdKey, id, channelId, bytes, opts.credit, mcpTurn);
+        const { intent } = await this.store.claimReplyIntent({ ...k, channelId, replyMessageId: id, bodyMac: mac2, body: bytes, replyCredit: opts.credit ?? null, mcpTurn });
+        if (intent.bodyMac !== replyBodyMac(this.replyIdKey, id, channelId, bytes, opts.credit, intent.mcpTurn) || intent.channelId !== channelId || intent.state === "skipped") {
           throw new IdempotencyConflictError();
         }
         return k;
       }
-      return this.claimUnkeyedPart(opts.inReplyTo, channelId, bytes, true, opts.credit ?? null);
+      return this.claimUnkeyedPart(opts.inReplyTo, channelId, bytes, true, opts.credit ?? null, false);
     });
     return this.publishIntent(key, opts);
   }
@@ -39497,25 +40614,26 @@ var BridgeAgent = class _BridgeAgent {
    * the reply to `inReplyTo`. Caller holds the scope lock. `matchRetry` false
    * after a slot collision: the body must go to a NEW part.
    */
-  async claimUnkeyedPart(inReplyTo, channelId, bytes, matchRetry, replyCredit) {
+  async claimUnkeyedPart(inReplyTo, channelId, bytes, matchRetry, replyCredit, inheritedMcpTurn) {
     const credit = replyCredit ?? void 0;
+    const mcpTurn = inheritedMcpTurn || this.mcpReplyGuarded(channelId, inReplyTo);
     const scope = `reply:${inReplyTo}`;
     let latest = null;
     for (const intent of await this.store.listReplyIntents(inReplyTo)) {
       const n = intent.scope === scope ? partOrdinal(intent.part) : null;
       if (n !== null && (latest === null || n > latest.ordinal)) latest = { ordinal: n, intent };
     }
-    if (matchRetry && latest && latest.intent.state !== "skipped" && latest.intent.channelId === channelId && latest.intent.bodyMac === replyBodyMac(this.replyIdKey, latest.intent.replyMessageId, channelId, bytes, credit)) {
+    if (matchRetry && latest && latest.intent.state !== "skipped" && latest.intent.channelId === channelId && latest.intent.bodyMac === replyBodyMac(this.replyIdKey, latest.intent.replyMessageId, channelId, bytes, credit, latest.intent.mcpTurn)) {
       return { scope, part: latest.intent.part, inReplyTo };
     }
     let ordinal = latest ? latest.ordinal + 1 : 0;
     for (let i = 0; i < REPLY_MAX_PART_ADVANCES; i++, ordinal++) {
       const k = { scope, part: `p:${ordinal}`, inReplyTo };
       const id = replyMessageId(this.replyIdKey, this.cfg.identityId, channelId, k);
-      const mac2 = replyBodyMac(this.replyIdKey, id, channelId, bytes, credit);
-      const { created, intent } = await this.store.claimReplyIntent({ ...k, channelId, replyMessageId: id, bodyMac: mac2, body: bytes, replyCredit });
+      const mac2 = replyBodyMac(this.replyIdKey, id, channelId, bytes, credit, mcpTurn);
+      const { created, intent } = await this.store.claimReplyIntent({ ...k, channelId, replyMessageId: id, bodyMac: mac2, body: bytes, replyCredit, mcpTurn });
       if (created) return k;
-      if (matchRetry && intent.state !== "skipped" && intent.bodyMac === mac2 && intent.channelId === channelId) return k;
+      if (matchRetry && intent.state !== "skipped" && intent.channelId === channelId && intent.bodyMac === replyBodyMac(this.replyIdKey, id, channelId, bytes, credit, intent.mcpTurn)) return k;
       writeServiceLog("info", "reply.part_slot_taken", { attempt: i + 1 });
     }
     throw new Error("could not claim a reply part");
@@ -39567,7 +40685,7 @@ var BridgeAgent = class _BridgeAgent {
       const purgeEpochBeforePublish = this.store.conversationPurgeEpoch(intent.channelId);
       const replyCapture = this.unifiedReplyCapture(intent.channelId, intent.inReplyTo ?? void 0);
       try {
-        await this.publishIntentWithRetry(intent.channelId, body, intent.replyMessageId, key, intent.inReplyTo);
+        await this.publishIntentWithRetry(intent.channelId, body, intent.replyMessageId, key, intent.inReplyTo, intent.mcpTurn);
       } catch (e) {
         if (e instanceof AgentPausedSendError || e instanceof SendForbiddenError) {
           if (intent.inReplyTo !== null) this.store.deletePendingReplyIntents(intent.inReplyTo);
@@ -39594,7 +40712,7 @@ var BridgeAgent = class _BridgeAgent {
             JSON.stringify(["scope", key.scope]),
             () => (
               // r2 BLOCKER 1: the colliding row's OWN credit (verified above), never `opts`.
-              this.claimUnkeyedPart(inReplyTo, intent.channelId, bytes, false, isReplyCredit(intent.replyCredit) ? intent.replyCredit : null)
+              this.claimUnkeyedPart(inReplyTo, intent.channelId, bytes, false, isReplyCredit(intent.replyCredit) ? intent.replyCredit : null, intent.mcpTurn)
             )
           );
           return this.publishIntent(next, opts, advances + 1);
@@ -39616,7 +40734,7 @@ var BridgeAgent = class _BridgeAgent {
     if (credit !== null && !isReplyCredit(credit)) return false;
     const id = replyMessageId(this.replyIdKey, this.cfg.identityId, intent.channelId, intent);
     if (id !== intent.replyMessageId) return false;
-    return replyBodyMac(this.replyIdKey, intent.replyMessageId, intent.channelId, intent.body, credit ?? void 0) === intent.bodyMac;
+    return replyBodyMac(this.replyIdKey, intent.replyMessageId, intent.channelId, intent.body, credit ?? void 0, intent.mcpTurn === true) === intent.bodyMac;
   }
   /**
    * Weather/currency Task 17: what a verified row's reply is RECORDED as. Null credit: the decoded text unchanged (null
@@ -39637,12 +40755,12 @@ var BridgeAgent = class _BridgeAgent {
    * failure. Either way the intent stays pending, so the redelivery
    * republishes the same reply.
    */
-  async publishIntentWithRetry(channelId, body, id, key, inReplyTo) {
+  async publishIntentWithRetry(channelId, body, id, key, inReplyTo, mcpTurn) {
     let rateLimited = 0;
     let inFlight = 0;
     for (; ; ) {
       try {
-        await this.publishIntentOnce(channelId, body, id, key, inReplyTo);
+        await this.publishIntentOnce(channelId, body, id, key, inReplyTo, mcpTurn);
         return;
       } catch (e) {
         if (e instanceof ReplyInFlightError) {
@@ -39713,8 +40831,9 @@ var BridgeAgent = class _BridgeAgent {
    * original ack; a conflict can only mean the slot belongs to another
    * message (for example an old reply whose intent was pruned).
    */
-  async publishIntentOnce(channelId, body, id, key, inReplyTo) {
+  async publishIntentOnce(channelId, body, id, key, inReplyTo, mcpTurn) {
     const current = await this.store.getReplyIntent(key.scope, key.part);
+    const guardMcp = mcpTurn || current?.mcpTurn === true;
     try {
       if (current?.envelope) {
         const cached = JSON.parse(new TextDecoder().decode(current.envelope));
@@ -39764,7 +40883,8 @@ var BridgeAgent = class _BridgeAgent {
             key.part,
             new TextEncoder().encode(JSON.stringify(envelope)),
             sealedGroupIdOf(envelope)
-          )
+          ),
+          guardMcp
         );
       } catch (e) {
         if (publishConflictCode(e) === "message_id_conflict") throw new ReplyIdCollisionError();
@@ -42275,16 +43395,20 @@ var BridgeAgent = class _BridgeAgent {
       }
       if (v.sender_id !== pin.ownerIdentityId) return this.ownerTurnFailed(m, "malformed");
       let leafClass = "ok";
+      let relay = void 0;
       if (this.freshMeta(keyChannel)?.is_dm === true) {
         const signedDm = this.toolGrantManifest?.owner_dm_channel_id;
         if (signedDm !== void 0 && signedDm !== keyChannel) return this.ownerTurnFailed(m, "wrong_dm_channel");
-        leafClass = classifyOwnerDmLeaves((await this.provider.leafTreeSummary(m.channelId)).leaves, {
+        const leaves = (await this.provider.leafTreeSummary(m.channelId)).leaves;
+        const relayIdentityId = this.toolGrantManifest?.owner_dm_relay_identity_id;
+        leafClass = classifyOwnerDmLeaves(leaves, {
           ownerIdentityId: pin.ownerIdentityId,
           agentIdentityId: this.cfg.identityId,
-          relayIdentityId: this.toolGrantManifest?.owner_dm_relay_identity_id,
+          relayIdentityId,
           isServerRelay: (id) => this.freshRoster(m.channelId)?.get(id)?.is_relay === true
         });
         if (leafClass === "foreign") return this.ownerTurnFailed(m, "not_owner_dm_leaves");
+        relay = ownerDmRelayOf(leafClass, leaves, { ownerIdentityId: pin.ownerIdentityId, agentIdentityId: this.cfg.identityId, relayIdentityId });
       }
       const held = await this.heldPosition(m.channelId);
       if (held.groupId === null) return this.ownerTurnFailed(m, "verify_error");
@@ -42293,7 +43417,9 @@ var BridgeAgent = class _BridgeAgent {
       }
       const replay = Object.freeze({ channelId: m.channelId, groupId: held.groupId, epoch: v.mls_group_epoch });
       this.ownerReplayPending.set(m.messageId, replay);
-      return Object.freeze({ kind: leafClass === "unsigned_relay" ? "constants_only" : "verified", replay });
+      const relayField = relay !== void 0 ? { relay } : {};
+      if (leafClass === "unsigned_relay") return Object.freeze({ kind: "constants_only", replay, ...relayField });
+      return Object.freeze({ kind: "verified", replay, ...relayField, relayLeaf: relayLeafFromPhase0Relay(relay) });
     } catch {
       return this.ownerTurnFailed(m, "verify_error");
     }
@@ -42369,6 +43495,12 @@ var BridgeAgent = class _BridgeAgent {
   }
   /** start(): drop other keys' manifest state, re-verify the stored one for the pinned key, and prune. */
   async loadToolGrantState() {
+    try {
+      this.mcpSeen = await this.store.loadMcpSeen();
+    } catch (e) {
+      this.mcpSeen = true;
+      writeServiceLog("warn", "authz.mcp_seen_load_failed", {}, e);
+    }
     const pin = this.cfg.ownerGrantPin?.pin;
     if (!pin) return;
     try {
@@ -42376,9 +43508,10 @@ var BridgeAgent = class _BridgeAgent {
       this.store.dropToolGrantAppliedExcept(pin.publicKeyB64);
       const saved = await this.store.loadToolGrantManifest(pin.publicKeyB64);
       if (saved) {
-        const v = verifyToolGrantManifest(saved.wrapper, { pin, agentIdentityId: this.cfg.identityId, storedCounter: null });
+        const v = verifyToolGrantManifest(saved.wrapper, { pin, agentIdentityId: this.cfg.identityId, storedCounter: null, ...this.mcpCatalog ? { mcpCatalog: this.mcpCatalog } : {} });
         if (v.state === "ok") {
           this.toolGrantManifest = v.manifest;
+          if (v.manifest.signedMcpPresent && !this.mcpSeen) await this.setMcpSeen(true);
           this.toolGrantCounter = v.manifest.counter;
         } else {
           this.logManifest("malformed");
@@ -42403,8 +43536,9 @@ var BridgeAgent = class _BridgeAgent {
       this.logManifest("no_manifest");
       return;
     }
-    const v = verifyToolGrantManifest(raw, { pin, agentIdentityId: this.cfg.identityId, storedCounter: this.toolGrantCounter });
+    const v = verifyToolGrantManifest(raw, { pin, agentIdentityId: this.cfg.identityId, storedCounter: this.toolGrantCounter, ...this.mcpCatalog ? { mcpCatalog: this.mcpCatalog } : {} });
     if (v.state === "ok") {
+      if (v.manifest.signedMcpPresent) await this.setMcpSeen(true);
       try {
         await this.store.saveToolGrantManifest(pin.publicKeyB64, v.manifest.counter, v.wrapper);
       } catch {
@@ -42413,13 +43547,39 @@ var BridgeAgent = class _BridgeAgent {
       }
       this.toolGrantManifest = v.manifest;
       this.toolGrantCounter = v.manifest.counter;
+      this.recomputeMcpPolicy();
+      if (v.manifest.mcpKey === "present" && !v.manifest.signedMcpPresent && this.mcpSeen) await this.setMcpSeen(false);
       this.logManifest("ok");
       if (v.droppedUnknown) this.logManifest("unknown_entry");
       return;
     }
     this.logManifest(v.state);
+    if (v.state === "wrong_owner") {
+      this.dropOwnerDmLastTurn();
+      this.mcpDeletionsThrough = 0;
+      this.mcpPolicyWrittenCounter = null;
+      this.noteMcpAckChanged();
+    }
     if (v.state !== "unchanged" && this.toolGrantManifest) this.logManifest("kept_last_good");
   }
+  /**
+   * MCP Task 14: the R-3 hold Task 17 filters on and Task 15 writes as `r3_hold`. True while the manifest in force signs
+   * an owner_dm `mcp:` string, or while the sticky flag is set (an old client's re-sign cannot lift it, audit C-1).
+   */
+  r3Hold() {
+    return this.toolGrantManifest?.signedMcpPresent === true || this.mcpSeen;
+  }
+  /** Persist then mirror. Setting mirrors even on a failed write; clearing mirrors only after the write (fail closed). */
+  async setMcpSeen(seen) {
+    if (seen) this.mcpSeen = true;
+    try {
+      await this.store.saveMcpSeen(seen);
+    } catch (e) {
+      writeServiceLog("warn", "authz.mcp_seen_save_failed", {}, e);
+      return;
+    }
+    this.mcpSeen = seen;
+  }
   logManifest(state) {
     this.manifestState = state;
     const quiet = state === "ok" || state === "unchanged" || state === "no_pin" || state === "no_manifest";
@@ -42516,6 +43676,7 @@ var BridgeAgent = class _BridgeAgent {
     let tool_grants = NO_TOOL_GRANTS;
     let relaySpeaker;
     let memoryWrite = false;
+    let relayFree = false;
     const epochFresh = rosterFreshAt(entry, heldEpoch, heldGroupId) && (opts.voice === void 0 || rosterFreshAt(vEntry, opts.voice.heldEpoch, opts.voice.heldGroupId));
     const ownerDmFresh = epochFresh || opts.voice === void 0 && this.ownerDmCycleFresh.has(channelId);
     if (ownerDmFresh && this.ownerDmDefaultGrants && meta?.is_dm === true && sender) {
@@ -42542,6 +43703,7 @@ var BridgeAgent = class _BridgeAgent {
       tool_grants = ROOM_DEFAULT_READ_GRANTS;
     }
     let grantSource = tool_grants.length ? "constant" : "none";
+    let ownerDmEffective = null;
     const manifest = this.cfg.ownerGrantPin?.pin ? this.toolGrantManifest : null;
     const binding = this.manifestBinding;
     const boundNow = binding !== null && binding.state === "bound" && binding.counter === this.toolGrantCounter;
@@ -42560,6 +43722,21 @@ var BridgeAgent = class _BridgeAgent {
       });
       tool_grants = r.grants;
       grantSource = r.source;
+      ownerDmEffective = r;
+      const mcp = mcpIssuance({
+        source: r.source,
+        verdict: opts.ownerVerdict,
+        entitlement: this.mcpEntitlementInForce(),
+        hostSwitch: this.mcpHostSwitch,
+        ownerDmManifestSwitchOn: this.ownerDmManifestGrants,
+        disabled: this.payloadToolDeny,
+        manifest,
+        policy: this.mcpPolicyWritten
+      });
+      if (mcp.length > 0) {
+        tool_grants = Object.freeze([...tool_grants, ...mcp]);
+        relayFree = true;
+      }
     } else if (tool_grants === ROOM_DEFAULT_READ_GRANTS) {
       const r = effectiveToolGrants({
         audience: "team_room",
@@ -42577,12 +43754,39 @@ var BridgeAgent = class _BridgeAgent {
     if (opts.ownerVerdict?.kind === "failed") {
       tool_grants = NO_TOOL_GRANTS;
       memoryWrite = false;
+      relayFree = false;
       relaySpeaker = void 0;
       grantSource = "none";
     }
     const roomClass = meta?.is_dm !== false ? "na" : entry?.crossOrg === false ? "internal" : entry?.crossOrg === true ? "cross_org" : "unknown";
     if (opts.log !== false) {
       this.logAuthzDecision(channelId, senderId, relaySpeakerId, audience, tool_grants.length, roomClass, epochFresh, memoryWrite, grantSource);
+      const pinOwner = this.cfg.ownerGrantPin?.pin?.ownerIdentityId;
+      const verdict = opts.ownerVerdict;
+      if (pinOwner !== void 0 && senderId === pinOwner && meta?.is_dm === true && relaySpeakerId === void 0 && opts.voiceScoped !== true && opts.voice === void 0 && verdict !== void 0 && verdict.kind !== "unchecked" && !(verdict.kind === "failed" && verdict.reason === "replay")) {
+        const pinned = this.channelOwner.get(channelId);
+        const ownerId = pinned && pinned !== "anomalous" ? pinned.identityId : void 0;
+        const ownerDirect = ownerId !== void 0 && audience === "owner_dm" && senderId === ownerId;
+        this.noteOwnerDmTurn({
+          cause: {
+            killSwitchOff: !this.ownerDmDefaultGrants,
+            manifestSwitchOff: !this.ownerDmManifestGrants,
+            pinMissingOrAnomalous: ownerId === void 0,
+            // OQ-5: only from a PRESENT roster entry; a missing (TTL-expired) entry is `stale` below.
+            senderNotOwner: entry !== void 0 && (sender === void 0 || !ownerDirect),
+            stale: !ownerDmFresh || entry === void 0,
+            verdict,
+            manifestPresent: manifest !== null,
+            signedDmChannel: manifest?.owner_dm_channel_id,
+            channelId,
+            boundNow,
+            consumerAttached: this.manifestConsumer !== null
+          },
+          grantSource,
+          toolGrants: tool_grants,
+          withheld: grantSource === "manifest" && ownerDmEffective !== null ? ownerDmEffective.withheld : []
+        });
+      }
     }
     return Object.freeze({
       version: 1,
@@ -42590,9 +43794,78 @@ var BridgeAgent = class _BridgeAgent {
       sender_membership: sender ? "active" : "unknown",
       tool_grants,
       ...relaySpeaker ? { relay_speaker: relaySpeaker } : {},
-      ...memoryWrite ? { memory_write: true } : {}
+      ...memoryWrite ? { memory_write: true } : {},
+      ...relayFree ? { relay_free: true } : {}
     });
   }
+  /**
+   * Tool status Phase 0 (spec §3.2, §3.5; plan Task 8; round 1 H-2, M-4; round 2 H-4): build the candidate record and
+   * keep the previous one (and its `at`) when the change tuple is the same, so `at` means "last changed". Never throws
+   * into the authorization path. Never logs a channel id, sender id or tool name.
+   */
+  noteOwnerDmTurn(t) {
+    try {
+      const v = t.cause.verdict;
+      const relay = (v.kind === "verified" || v.kind === "constants_only") && v.relay !== void 0 ? v.relay : "unknown";
+      let reason = {};
+      if (t.grantSource !== "manifest") {
+        const c = this.toolStatusCause(t.cause);
+        if (c !== null && c.source === t.grantSource && c.cause !== void 0) {
+          reason = c.sub !== void 0 ? { cause: c.cause, sub: c.sub } : { cause: c.cause };
+        } else {
+          writeServiceLog("warn", "tool_status.source_mismatch");
+        }
+      } else {
+        const c = this.toolStatusCause(t.cause);
+        if (c === null || c.source !== "manifest") writeServiceLog("warn", "tool_status.source_mismatch");
+      }
+      const names = t.toolGrants.map((g) => g.tool);
+      const candidate = Object.freeze({
+        at: bucketStartAt(this.toolStatusNow()),
+        // ruling M-2: the 15-minute UTC bucket, never the minute
+        counter: this.toolGrantCounter,
+        source: t.grantSource,
+        ...reason,
+        relay,
+        issued: Object.freeze(sanitizeIssued(names)),
+        withheld: Object.freeze(t.withheld.map((w) => Object.freeze({ tool: w.tool, why: w.why }))),
+        // A count only, never a name (content-free). 0 unless the MCP issuance above added mcp: grants.
+        mcp_issued: Math.min(160, names.filter((n) => n.startsWith("mcp:")).length)
+      });
+      if (sameTuple(this.ownerDmLastTurn, candidate)) return;
+      this.ownerDmLastTurn = candidate;
+      this.toolStatusSender.note(candidate);
+    } catch (e) {
+      writeServiceLog("warn", "tool_status.record_failed", {}, e);
+    }
+  }
+  /** R2-M1: the served manifest names another owner than the pin; the held record belongs to the old owner. */
+  dropOwnerDmLastTurn() {
+    this.ownerDmLastTurn = null;
+    this.toolStatusSender.drop();
+  }
+  /**
+   * Phase 0 Task 9 (spec §3.5): POST the record, body = the record only, to the narrow agent-key route. The backend
+   * resolves the identity from the device credential; no identity, channel or sender id is in the URL or the body.
+   * Returns the status class only; never throws.
+   */
+  async postToolStatus(rec) {
+    try {
+      const res = await this.fetchBounded("runtime_config_tool_status", "control", `${this.cfg.apiBase}/api/v1/agents/me/runtime-config/tool-status`, {
+        method: "POST",
+        headers: { authorization: `Bearer ${this.cfg.apiKey}`, "content-type": "application/json" },
+        body: JSON.stringify(rec)
+      });
+      const retryAfter = res.headers.get("retry-after");
+      try {
+        await res.body?.cancel();
+      } catch {
+      }
+      return { status: res.status, retryAfter };
+    } catch (e) {
+      return e?.name === "FetchDeadlineError" ? "timeout" : "network";
+    }
+  }
   /**
    * One content-free INFO line per authorization decision (every call site of
    * authorizationFor stages exactly one runtime turn). It says WHY a turn got
@@ -42816,6 +44089,111 @@ var BridgeAgent = class _BridgeAgent {
    * client's own wait already renders "Summary unavailable" — so there is
    * nothing to catch here besides the send itself.
    */
+  /**
+   * MCP client Task 18 (spec §8 item 2; audit M-3, H-3; OQ-2, OQ-15). Accept an `mcp_catalog_request` only when: its
+   * body is exactly the §8 shape; it is a direct frame (never a voice channel's) in a channel the server marks as a DM
+   * that IS the signed owner DM; verifyOwnerTurn says `verified` (the pinned owner's signature, the signed DM, the leaf
+   * check, not a replay) with `relayLeaf === false`; mcp-policy.json as written is `ok` with this server `ok`; a runtime
+   * socket that declared mcp_client_v1 is attached; and the rate limits admit it. The replay row is written HERE
+   * (M-3: the request never reaches stageRuntimeInbox, where it is otherwise written), for every verified request, before
+   * anything is answered; the ownerReplayPending entry is removed in `finally`. A failure to record answers nothing.
+   * Never throws. The answer runs outside the ingest cycle, so the row is acked now.
+   */
+  async acceptMcpCatalogRequest(m, body) {
+    try {
+      const req = parseMcpCatalogRequest(body);
+      if (req === null) return logMcpCatalogRequest("malformed");
+      const signedDm = this.toolGrantManifest?.owner_dm_channel_id;
+      if (this.keyChannelForFrame(m) !== m.channelId || this.freshMeta(m.channelId)?.is_dm !== true || signedDm === void 0 || signedDm !== m.channelId) {
+        return logMcpCatalogRequest("not_owner_dm");
+      }
+      const verdict = await this.verifyOwnerTurn(m);
+      if (verdict.kind !== "verified") return logMcpCatalogRequest(verdict.kind === "failed" && verdict.reason === "replay" ? "replay" : "not_verified");
+      this.store.recordOwnerMessage(verdict.replay.channelId, m.messageId, verdict.replay.groupId, verdict.replay.epoch, Date.now());
+      if (verdict.relayLeaf !== false) return logMcpCatalogRequest("relay_leaf");
+      const target = this.mcpCatalogTarget(req.serverId);
+      const lister = this.mcpClientCapable() ? this.mcpCatalogListers.values().next().value : void 0;
+      if (target === null || lister === void 0) return logMcpCatalogRequest("not_ready");
+      const admitted = this.mcpCatalogRate.admit(req.serverId);
+      if (admitted !== "ok") return admitted === "in_flight" ? logMcpCatalogRequest("in_flight") : void 0;
+      const work = this.outsideIngestCycle(() => this.answerMcpCatalogRequest(m.channelId, req, lister)).finally(() => {
+        this.mcpCatalogRate.release(req.serverId);
+        this.mcpCatalogWork.delete(work);
+      });
+      this.mcpCatalogWork.add(work);
+    } catch {
+      logMcpCatalogRequest("failed");
+    } finally {
+      this.ownerReplayPending.delete(m.messageId);
+    }
+  }
+  /** The signed server's vendor and the bridge catalog row's issuer, when mcp-policy.json as WRITTEN is `ok` with it `ok`. */
+  mcpCatalogTarget(serverId) {
+    const doc = this.mcpPolicyWritten;
+    if (doc === null || doc.state !== "ok" || !Object.prototype.hasOwnProperty.call(doc.servers, serverId)) return null;
+    const s = doc.servers[serverId];
+    if (s.state !== "ok" || s.vendor === void 0) return null;
+    const catalog = this.mcpCatalog ?? MCP_CATALOG;
+    if (!Object.prototype.hasOwnProperty.call(catalog, s.vendor)) return null;
+    return { vendor: s.vendor, issuer: catalog[s.vendor].issuer };
+  }
+  /** Ask the runtime, re-check, build (384 KB cap) and send. Never throws. */
+  async answerMcpCatalogRequest(channelId, req, lister) {
+    try {
+      const target = this.mcpCatalogTarget(req.serverId);
+      if (target === null) return logMcpCatalogRequest("not_ready");
+      const frame = await lister(req.serverId, MCP_CATALOG_LIST_TIMEOUT_MS);
+      if (frame === null || frame === void 0) return logMcpCatalogRequest("runtime_timeout");
+      const listed = validateCatalogListReply(frame, req.serverId, target.vendor);
+      if (listed === null) return logMcpCatalogRequest("runtime_refused");
+      const still = this.mcpCatalogTarget(req.serverId);
+      if (still === null || still.vendor !== target.vendor) return logMcpCatalogRequest("not_ready");
+      await this.sendMcpCatalog(channelId, buildMcpCatalogBody({ serverId: req.serverId, requestId: req.requestId, vendor: still.vendor, issuer: still.issuer, reply: listed }));
+      logMcpCatalogRequest("sent");
+    } catch (e) {
+      logMcpCatalogRequest(e instanceof McpReplyWithheldError ? "withheld" : "send_failed");
+    }
+  }
+  /**
+   * The `mcp_catalog` reply: a system_event envelope with a body-level type (the sendSummary shape), on the shared
+   * self-heal seam and the one publish chokepoint. H-D applies to EVERY attempt (it carries vendor-supplied tool
+   * descriptions): after the seal, before the POST, the leaves at the SEALED group and epoch must be exactly the owner
+   * and the agent, or the frame is withheld. One message id across the retry.
+   */
+  async sendMcpCatalog(channelId, body) {
+    const joined = await this.reconcileJoin(channelId);
+    if (!joined) throw new ChannelPendingError(channelId);
+    const messageId = crypto.randomUUID();
+    let attempt = 0;
+    await this.sendWithSelfHealTerminal(
+      this.provider,
+      channelId,
+      (epoch) => buildOutboundEnvelope({
+        custody: this.custody,
+        groupKey: this.provider,
+        messageId,
+        channelId,
+        enclaveId: this.resolveEnclave(channelId),
+        senderId: this.cfg.identityId,
+        senderType: "agent",
+        type: "system_event",
+        bodyPlaintext: JSON.stringify(body),
+        bindingId: "",
+        bindingVersion: "0.0.0",
+        agentSkillId: null,
+        epoch,
+        traceparent: ZERO_TRACEPARENT,
+        references: [],
+        stage5Outcome: "allow",
+        stage5Evaluators: []
+      }),
+      async (envelope) => {
+        attempt++;
+        this.assertMcpReplyRelayFree(channelId, envelope, attempt);
+        return this.publishEnvelope(channelId, () => this.transport.publish(envelope));
+      }
+    );
+  }
   async handleSummarize(channelId, request) {
     const body = await runSummarize({
       request,
@@ -43326,6 +44704,11 @@ var BridgeAgent = class _BridgeAgent {
           new TextDecoder().decode(m.plaintext)
         );
         if (parsed.type && parsed.type !== "text") {
+          if (parsed.type === "mcp_catalog_request" || parsed.type === "mcp_catalog") {
+            if (parsed.type === "mcp_catalog_request") await this.acceptMcpCatalogRequest(m, parsed);
+            acked.push(m.queueId);
+            continue;
+          }
           if (parsed.type === "summarize") {
             const request = parseSummarizeBody(parsed, this.cfg.identityId, writeServiceLog);
             if (request !== null) {
@@ -43834,7 +45217,11 @@ var BridgeAgent = class _BridgeAgent {
   }
   /** Every buffer exit: re-narrow manifest grants (review H-1), then note the frame's attribution class (review H-3). */
   delivering(m) {
-    const out = this.renarrowManifestGrants(m);
+    let out = this.renarrowManifestGrants(m);
+    if (!this.noteMcpDelivered(out)) {
+      out = withMcpCapability(out, false);
+      writeServiceLog("warn", "mcp.delivered_record_full");
+    }
     this.noteDeliveredFrame(out);
     return out;
   }
@@ -43845,6 +45232,50 @@ var BridgeAgent = class _BridgeAgent {
    * audience that is still signed, else dropped. Only narrows; an unchanged message is returned by reference.
    */
   renarrowManifestGrants(m) {
+    const narrowed = this.renarrowManifestGrantsBase(m);
+    return this.renarrowMcpGrants(narrowed);
+  }
+  /**
+   * MCP Task 16 (audit H-2; round 2 LOW), after the base re-narrowing: a buffered `mcp:` grant survives release only
+   * when, NOW, the turn is still a plain owner-DM turn in the signed DM channel, the host switch reads "on", the
+   * entitlement reading is in force, the name is not in skills.disabled, the mcp-policy.json document last written
+   * lists the server ok with the tool, and a FRESH synchronous read of the DM's local leaves holds exactly the pinned
+   * owner and the agent (MlsGroupKeyProvider.leafSnapshotCached: one `state` object, no await; null fails closed). Any
+   * other mcp: grant is dropped, never kept as a fallback. relay_free is dropped whenever no mcp: grant survives.
+   * Read-only: never touches the MLS group. Only narrows; returns `m` by reference when nothing changes.
+   */
+  renarrowMcpGrants(m) {
+    const a = m.authorization;
+    if (!a) return m;
+    const isMcp = (g) => g.tool.startsWith(MCP_GRANT_PREFIX);
+    if (!a.tool_grants.some(isMcp) && a.relay_free === void 0) return m;
+    const pin = this.cfg.ownerGrantPin?.pin ?? null;
+    const manifest = pin !== null ? this.toolGrantManifest : null;
+    const turnOk = pin !== null && manifest !== null && a.audience === "owner_dm" && a.relay_speaker === void 0 && manifest.owner_dm_channel_id === m.channel_id && this.mcpHostSwitch === "on" && this.ownerDmManifestGrants && this.mcpEntitlementInForce() === "entitled" && this.ownerDmRelayFreeNow(m.channel_id, pin.ownerIdentityId);
+    const kept = a.tool_grants.filter((g) => {
+      if (!isMcp(g)) return true;
+      const parsed = parseMcpGrant(g.tool);
+      return turnOk && g.mode === "read" && g.source === "manifest" && parsed !== null && !this.payloadToolDeny.has(g.tool) && mcpPolicyAllows(this.mcpPolicyWritten, parsed.serverId, parsed.tool);
+    });
+    const keepRelayFree = a.relay_free === true && kept.some(isMcp);
+    if (kept.length === a.tool_grants.length && keepRelayFree === (a.relay_free === true)) return m;
+    const { relay_free: _relayFree, ...rest } = a;
+    return { ...m, authorization: Object.freeze({ ...rest, tool_grants: Object.freeze(kept), ...keepRelayFree ? { relay_free: true } : {} }) };
+  }
+  /**
+   * MCP Task 16 (OQ-2; audit H-2, round 2 H-D): a FRESH read of the channel's local leaf set holds exactly the pinned
+   * owner and this agent. Synchronous (one manager `state`, so the leaves belong to one epoch); a cold manager or any
+   * throw reads as NOT relay-free.
+   */
+  ownerDmRelayFreeNow(channelId, ownerIdentityId) {
+    try {
+      const snap = this.provider.leafSnapshotCached(channelId);
+      return snap !== null && ownerDmLeavesRelayFree(snap.leaves, { ownerIdentityId, agentIdentityId: this.cfg.identityId });
+    } catch {
+      return false;
+    }
+  }
+  renarrowManifestGrantsBase(m) {
     const a = m.authorization;
     if (!a || !a.tool_grants.some((g) => g.mode === "read" && g.source === "manifest")) return m;
     const audience = a.audience === "owner_dm" || a.audience === "team_room" ? a.audience : null;
@@ -43940,6 +45371,7 @@ var BridgeAgent = class _BridgeAgent {
       return;
     }
     if (!this.admitRuntimeDelivery(m)) return;
+    this.noteMcpDelivered(m, true);
     const ch = m.channel_id;
     this.replayingChannels.add(ch);
     this.replyIntentReplays++;
@@ -44290,11 +45722,11 @@ ${channelId}`;
       if (!res.ok) return void 0;
       const rows = await res.json();
       if (!Array.isArray(rows)) return void 0;
-      const own = rows.find(
+      const own2 = rows.find(
         (r) => r?.identity_id === this.cfg.identityId
       );
-      if (!own) return void 0;
-      return typeof own.paused_at === "string" && own.paused_at.length > 0;
+      if (!own2) return void 0;
+      return typeof own2.paused_at === "string" && own2.paused_at.length > 0;
     } catch (e) {
       writeServiceLog("warn", "pause.probe_failed", {}, e);
       return void 0;
@@ -44327,6 +45759,10 @@ ${channelId}`;
   /** Complete the durable handoff only after the runtime explicitly acks. */
   ackRuntimeMessages(messageIds) {
     for (const id of messageIds) this.roomGrantEpochs.delete(id);
+    for (const id of messageIds) {
+      const r = this.mcpDeliveredTurns.get(id);
+      if (r) r.acked = true;
+    }
     for (const messageId of messageIds) {
       this.store.ackRuntimeInbox(messageId);
       this.runtimePendingIds.delete(messageId);
@@ -44408,6 +45844,7 @@ ${channelId}`;
       const message = rest;
       this.applyStagedMarks(message.message_id, marks);
       this.runtimePendingIds.add(message.message_id);
+      this.noteMcpDelivered(message, true);
       if (this.cfg.ownerGrantPin?.pin && this.isOwnerVerifyFailed(message.message_id)) {
         this.ownerVerifyFailedIds.set(message.message_id, message.channel_id);
       }
@@ -44588,6 +46025,179 @@ ${channelId}`;
   clearSearchProvidersSocket(token) {
     if (this.searchProvidersSockets.delete(token)) this.onCapabilityMaybeChanged();
   }
+  /** MCP Task 16 (spec §15): the same AND-over-sockets state for mcp_client_v1, kept per socket. */
+  mcpClientSockets = /* @__PURE__ */ new Map();
+  noteMcpClientSocket(token, declared) {
+    this.mcpClientSockets.set(token, declared);
+    this.onCapabilityMaybeChanged();
+  }
+  clearMcpClientSocket(token) {
+    if (this.mcpClientSockets.delete(token)) this.onCapabilityMaybeChanged();
+  }
+  /** Deletion-ack ruling §3: ws-server notes every runtime hello's mcp_deletion_ack_v1 declaration (harness: false). */
+  noteMcpDeletionAckSocket(token, declared) {
+    this.mcpDeletionAckSockets.set(token, declared);
+    if (!declared) this.mcpTurnSeq.delete(token);
+    this.forgetCredentialsIfNoAckSocket();
+    this.maybeReportMcpAck();
+  }
+  /** #1351 round 2 observation: with no ack-capable socket left (detached, or re-hello'd without the feature), the last
+   *  credentials value is no longer known: forget it, so a later socket does not inherit a stale value. */
+  forgetCredentialsIfNoAckSocket() {
+    if ([...this.mcpDeletionAckSockets.values()].some(Boolean)) return;
+    this.mcpCredentialsPresentValue = null;
+    this.mcpAckClosed = { ...this.mcpAckClosed, credentials: null };
+    if (this.mcpAckOpen !== null) this.mcpAckOpen = { ...this.mcpAckOpen, credentials: null };
+  }
+  clearMcpDeletionAckSocket(token) {
+    this.mcpTurnSeq.delete(token);
+    if (!this.mcpDeletionAckSockets.delete(token)) return;
+    this.forgetCredentialsIfNoAckSocket();
+    this.maybeReportMcpAck();
+  }
+  /** #1351 round 2 M-1: ws-server calls this when it sends an owner-DM turn to an ack-capable socket. Bounded. */
+  noteMcpTurnDispatch(token, messageId) {
+    let m = this.mcpTurnSeq.get(token);
+    if (m === void 0) this.mcpTurnSeq.set(token, m = /* @__PURE__ */ new Map());
+    m.set(messageId, this.policyWriteSeq);
+    while (m.size > 64) m.delete(m.keys().next().value);
+  }
+  /** Ruling §3 / §5.3: the AND over attached sockets, false with none attached (as mcpClientCapable). */
+  mcpDeletionAckCapable() {
+    if (this.mcpDeletionAckSockets.size === 0) return false;
+    for (const v of this.mcpDeletionAckSockets.values()) if (!v) return false;
+    return true;
+  }
+  /**
+   * Deletion-ack ruling (2026-10-31) §3 acceptance. ws-server has validated the frame shape and the socket (declared
+   * mcp_deletion_ack_v1 and mcp_client_v1, no harness). `credentials_present` is taken as is. `applied_sha256` advances
+   * `mcpDeletionsThrough` only when it is the SHA-256 of the bytes THIS bridge last wrote (JSON + newline) and still
+   * holds in force, and that document's top state is one whose deletion set covers the signed removal; then to the
+   * counter recorded at that write, never the live one. Anything else is ignored silently. Never throws.
+   */
+  noteMcpDeletionAck(token, frame) {
+    this.mcpCredentialsPresentValue = frame.credentials_present === true;
+    const json2 = this.mcpPolicyWrittenJson;
+    const doc = this.mcpPolicyWritten;
+    const counter = this.mcpPolicyWrittenCounter;
+    const turns = frame.message_id !== void 0 ? this.mcpTurnSeq.get(token) : void 0;
+    const seqAtDispatch = frame.message_id !== void 0 ? turns?.get(frame.message_id) : void 0;
+    if (frame.message_id !== void 0) turns?.delete(frame.message_id);
+    if (frame.applied_sha256 !== void 0 && seqAtDispatch !== void 0 && seqAtDispatch === this.policyWriteSeq && json2 !== null && doc !== null && counter !== null && MCP_ACK_STATES.has(doc.state) && frame.applied_sha256 === createHash6("sha256").update(json2 + "\n", "utf8").digest("hex")) {
+      this.mcpDeletionsThrough = Math.max(this.mcpDeletionsThrough, counter);
+    }
+    this.noteMcpAckChanged();
+  }
+  /** H-1: a change of the ack values goes into the open bucket; the report sees it only once the bucket has closed. */
+  noteMcpAckChanged() {
+    const now = this.toolStatusNow();
+    this.promoteMcpAck(now);
+    const live = { through: this.mcpDeletionsThrough, credentials: this.mcpCredentialsPresentValue };
+    const base = this.mcpAckOpen ?? this.mcpAckClosed;
+    if (base.through === live.through && base.credentials === live.credentials) return;
+    this.mcpAckOpen = { ...live, end: bucketEndMs(bucketStartAt(now)) };
+    this.scheduleMcpAckReport();
+  }
+  promoteMcpAck(now) {
+    if (this.mcpAckOpen !== null && this.mcpAckOpen.end <= now) {
+      this.mcpAckClosed = { through: this.mcpAckOpen.through, credentials: this.mcpAckOpen.credentials };
+      this.mcpAckOpen = null;
+    }
+  }
+  /** H-1: one timer, at the first bucket boundary strictly after now plus a jitter in [0, 60 s), as the tool-status sender. */
+  scheduleMcpAckReport() {
+    if (this.mcpAckTimer !== null || this.closingDown) return;
+    const now = this.toolStatusNow();
+    const boundary = (Math.floor(now / TOOL_STATUS_BUCKET_MS) + 1) * TOOL_STATUS_BUCKET_MS;
+    const at = boundary + Math.floor(this.toolStatusRandom() * TOOL_STATUS_JITTER_MS);
+    this.mcpAckTimer = this.toolStatusSetTimer(() => {
+      this.mcpAckTimer = null;
+      this.promoteMcpAck(this.toolStatusNow());
+      if (this.lastReportedMcpAck !== this.mcpAckSignature() && this.bootConfigSettled && !this.closingDown) void this.refetchRuntimeConfig();
+      if (this.mcpAckOpen !== null) this.scheduleMcpAckReport();
+    }, Math.max(0, at - now));
+  }
+  /**
+   * Ruling §5.3: the three keys. The two ack values come from the CLOSED bucket only (H-1), so no report, whatever
+   * posts it, reveals an owner-DM turn before its 15-minute bucket has closed. `mcp_r3_hold` is not DM timing: live.
+   */
+  reportedMcpAck() {
+    this.promoteMcpAck(this.toolStatusNow());
+    const ackCapable = this.mcpDeletionAckCapable();
+    const anyAck = [...this.mcpDeletionAckSockets.values()].some(Boolean);
+    const closed = this.mcpAckClosed;
+    return {
+      mcp_r3_hold: this.r3Hold(),
+      ...ackCapable ? { mcp_deletions_through: closed.through } : {},
+      // `anyAck` is an equivalent mutant today (forgetCredentialsIfNoAckSocket nulls the value whenever no ack socket is
+      // left), kept as defense in depth so the report never depends on that reset alone.
+      ...anyAck && closed.credentials !== null ? { mcp_credentials_present: closed.credentials } : {}
+    };
+  }
+  mcpAckSignature() {
+    return JSON.stringify(this.reportedMcpAck());
+  }
+  /**
+   * A SOCKET change (attach, detach, a hello) can change which keys the report carries; their values are the closed
+   * ones, so this is not owner-DM timing and may use the capability refetch. An ACK never comes here (H-1): it goes
+   * through noteMcpAckChanged and the bucket timer.
+   */
+  maybeReportMcpAck() {
+    if (this.lastReportedMcpAck === this.mcpAckSignature()) return;
+    this.scheduleCapabilityRefetch();
+  }
+  /** MCP Task 18: ws-server registers (or, with null, removes) a socket's loopback catalog lister. */
+  noteMcpCatalogLister(token, lister) {
+    if (lister === null) this.mcpCatalogListers.delete(token);
+    else this.mcpCatalogListers.set(token, lister);
+  }
+  /**
+   * MCP Task 19 (spec §12.3): "ok" when every attached runtime socket declared mcp_client_v1 (the AND, which harness
+   * sockets hold false: a harness socket counts in the AND and never declares it); else "harness_consumer" when the
+   * latest hello was a harness; else "missing".
+   */
+  reportedMcpCapability() {
+    if (this.mcpClientCapable()) return "ok";
+    return this.lastConsumerCapability === "harness_consumer" ? "harness_consumer" : "missing";
+  }
+  /**
+   * MCP Task 19 (spec §12.3): at most 8 `{server_id, vendor, state}` for the signed servers of the manifest in force,
+   * from mcp-policy.json as WRITTEN. Only the states the bridge itself knows: top `kill_switch` and `not_entitled` give
+   * that state per server; top `ok` gives `ok` for a server the bridge lists `ok` and `malformed` for one it refused.
+   * Every other top state (no capability, suspended, no config, switch off, section absent, malformed section) gives no
+   * row. The runtime-only states (needs_login, login_expired, definition_changed, server_version_unsupported,
+   * server_unreachable) have no runtime-to-bridge report path in Phase 1. `vendor` is reported only when it is a key of
+   * the bridge's compiled catalog; a signed vendor outside it gives no row. Never a tool name, URL or issuer.
+   */
+  reportedMcpServers() {
+    const doc = this.mcpPolicyWritten;
+    const signed = (this.cfg.ownerGrantPin?.pin ?? null) !== null ? this.toolGrantManifest?.mcp?.servers : void 0;
+    if (doc === null || signed === void 0) return [];
+    const catalog = this.mcpCatalog ?? MCP_CATALOG;
+    const out = [];
+    for (const id of Object.keys(signed).sort()) {
+      if (out.length >= 8) break;
+      const vendor = signed[id].vendor;
+      if (!Object.prototype.hasOwnProperty.call(catalog, vendor)) continue;
+      let state;
+      if (doc.state === "kill_switch" || doc.state === "not_entitled") state = doc.state;
+      else if (doc.state === "ok") state = Object.prototype.hasOwnProperty.call(doc.servers, id) && doc.servers[id].state === "ok" ? "ok" : "malformed";
+      else continue;
+      out.push({ server_id: id, vendor, state });
+    }
+    return out;
+  }
+  /**
+   * MCP Task 16: every attached runtime socket declared mcp_client_v1; no socket attached means absent (false).
+   * PR-B2 follow-up (documented): a HARNESS socket counts in this AND. ws-server notes every socket that said hello,
+   * and a harness hello is always noted `false` (harnessClaimed never resets), so one attached harness connector holds
+   * the capability false for files, the report and mcp-policy.json (top `no_capability`) while it is attached.
+   */
+  mcpClientCapable() {
+    if (this.mcpClientSockets.size === 0) return false;
+    for (const v of this.mcpClientSockets.values()) if (!v) return false;
+    return true;
+  }
   noteUtilityToolsSocket(token, declared) {
     this.utilityToolsSockets.set(token, declared);
     this.onCapabilityMaybeChanged();
@@ -44606,6 +46216,7 @@ ${channelId}`;
     const out = /* @__PURE__ */ new Set();
     if (this.searchProvidersCapable()) out.add("search_providers_v2");
     if (this.utilityToolsCapable()) out.add("utility_tools_v1");
+    if (this.mcpClientCapable()) out.add("mcp_client_v1");
     return out;
   }
   /** D28: every attached runtime socket declared search_providers_v2; no socket attached means absent (false). */
@@ -44634,13 +46245,19 @@ ${channelId}`;
    * switches and the new capability, then a debounced refetch (one per burst) only when needed.
    */
   onCapabilityMaybeChanged() {
-    const next = { search: this.searchProvidersCapable(), utility: this.utilityToolsCapable() };
+    const next = { search: this.searchProvidersCapable(), utility: this.utilityToolsCapable(), mcp: this.mcpClientCapable() };
     const prev = this.capabilityState;
-    if (prev !== null && prev.search === next.search && prev.utility === next.utility) return;
+    if (prev !== null && prev.search === next.search && prev.utility === next.utility && prev.mcp === next.mcp) return;
     this.capabilityState = next;
     this.recomputeManifestPolicy(this.capabilityFeatures());
+    this.recomputeMcpPolicy();
     if (this.closingDown) return;
     if (prev === null && !next.search && !next.utility) return;
+    this.scheduleCapabilityRefetch();
+  }
+  /** Debounced, with a max wait: a burst that never pauses still refetches at most maxWait after its first change. */
+  scheduleCapabilityRefetch() {
+    if (this.closingDown) return;
     const now = Date.now();
     if (this.searchCapabilityRefetchTimer !== null) clearTimeout(this.searchCapabilityRefetchTimer);
     else this.searchCapabilityBurstStart = now;
@@ -44658,7 +46275,7 @@ ${channelId}`;
   searchCapabilityRefetchNeeded() {
     if (!this.bootConfigSettled || this.closingDown) return false;
     const inForce = (this.cfg.ownerGrantPin?.pin ?? null) !== null && this.toolGrantManifest !== null;
-    return inForce || this.lastReportedSearchProviders !== this.searchProvidersCapable() || this.lastReportedUtilityTools !== this.utilityToolsCapable();
+    return inForce || this.lastReportedSearchProviders !== this.searchProvidersCapable() || this.lastReportedUtilityTools !== this.utilityToolsCapable() || this.lastReportedMcpAck !== this.mcpAckSignature();
   }
   /**
    * D35: the local recompute. Widening (web_extract back in) only while the binding for the in-force manifest stands,
@@ -44884,6 +46501,11 @@ ${channelId}`;
   async closeOnce() {
     this.closingDown = true;
     this.statusGate.close();
+    this.toolStatusSender.close();
+    if (this.mcpAckTimer !== null) {
+      this.toolStatusClearTimer(this.mcpAckTimer);
+      this.mcpAckTimer = null;
+    }
     for (const t of this.pauseRecheckTimers.values()) clearTimeout(t);
     this.pauseRecheckTimers.clear();
     for (const t of this.supersedeRecheckTimers.values()) clearTimeout(t);
@@ -44892,6 +46514,8 @@ ${channelId}`;
     this.redeliveryTimer = null;
     if (this.searchCapabilityRefetchTimer !== null) clearTimeout(this.searchCapabilityRefetchTimer);
     this.searchCapabilityRefetchTimer = null;
+    if (this.mcpPolicyRetryTimer !== null) clearTimeout(this.mcpPolicyRetryTimer);
+    this.mcpPolicyRetryTimer = null;
     this.pingHandle?.close();
     if (this.safetyTimer) clearInterval(this.safetyTimer);
     if (this.runtimeConfigTimer) clearInterval(this.runtimeConfigTimer);
@@ -45100,63 +46724,6 @@ function wsErrorFrame(code, detail) {
   return { type: "error", ...errorBody(code, detail) };
 }
 
-// src/consumer-grants.ts
-var NO_GRANTS = Object.freeze([]);
-var PER_TOOL_GRANTS_FEATURE = "per_tool_grants";
-function withConsumerGrants(m, perToolConsumer) {
-  if (perToolConsumer) return m;
-  const a = m.authorization;
-  if (!a) return m;
-  const stripGrants = !(a.tool_grants.length === 0 || a.audience === "owner_dm" || a.relay_speaker === "owner");
-  const stripMemory = "memory_write" in a;
-  if (!stripGrants && !stripMemory) return m;
-  const { memory_write: _dropped, ...rest } = a;
-  return { ...m, authorization: Object.freeze({ ...rest, ...stripGrants ? { tool_grants: NO_GRANTS } : {} }) };
-}
-var MANIFEST_GRANTS_FEATURE = "manifest_grants_v1";
-var SEARCH_PROVIDERS_FEATURE = "search_providers_v2";
-var UTILITY_TOOLS_FEATURE = "utility_tools_v1";
-var CONSTANT_TOOL_NAMES = Object.freeze({
-  owner_dm: Object.freeze(["current_time", "web_search"]),
-  team_room: Object.freeze(["current_time"])
-});
-var isManifestGrant = (g) => g.mode === "read" && g.source === "manifest";
-function withManifestCapability(m, manifestConsumer) {
-  if (manifestConsumer) return m;
-  const a = m.authorization;
-  if (!a || !a.tool_grants.some(isManifestGrant)) return m;
-  const constants5 = new Set(a.audience === "owner_dm" || a.audience === "team_room" ? CONSTANT_TOOL_NAMES[a.audience] : []);
-  const narrowed = a.tool_grants.flatMap((g) => {
-    if (!isManifestGrant(g)) return [g];
-    return constants5.has(g.tool) ? [Object.freeze({ tool: g.tool, mode: "read" })] : [];
-  });
-  return { ...m, authorization: Object.freeze({ ...a, tool_grants: Object.freeze(narrowed) }) };
-}
-function withHarnessGrants(m, withheld) {
-  if (!withheld) return m;
-  const a = m.authorization;
-  if (!a || a.tool_grants.length === 0) return m;
-  return { ...m, authorization: Object.freeze({ ...a, tool_grants: NO_GRANTS }) };
-}
-function withSearchCapability(m, consumerHasFeature, signedProvider) {
-  if (consumerHasFeature) return m;
-  const a = m.authorization;
-  if (!a) return m;
-  const stripSearch = signedProvider !== void 0 && signedProvider !== "brave";
-  const kept = a.tool_grants.filter((g) => g.tool !== "web_extract" && !(stripSearch && g.tool === "web_search"));
-  if (kept.length === a.tool_grants.length) return m;
-  return { ...m, authorization: Object.freeze({ ...a, tool_grants: kept.length === 0 ? NO_GRANTS : Object.freeze(kept) }) };
-}
-var UTILITY_TOOL_NAMES = /* @__PURE__ */ new Set(["weather_forecast", "currency_convert"]);
-function withUtilityCapability(m, consumerHasFeature) {
-  if (consumerHasFeature) return m;
-  const a = m.authorization;
-  if (!a) return m;
-  const kept = a.tool_grants.filter((g) => !UTILITY_TOOL_NAMES.has(g.tool));
-  if (kept.length === a.tool_grants.length) return m;
-  return { ...m, authorization: Object.freeze({ ...a, tool_grants: kept.length === 0 ? NO_GRANTS : Object.freeze(kept) }) };
-}
-
 // src/http-server.ts
 function writeSse(res, msgs, onWriteError) {
   for (let i = 0; i < msgs.length; i++) {
@@ -45179,7 +46746,8 @@ data: ${JSON.stringify(msgs[i])}
 function deliverSseBatch(res, batch, agent, onWriteError) {
   const withheld = agent.harnessGrantsWithheld();
   const provider = agent.signedSearchProvider();
-  const left3 = writeSse(res, batch.map((m) => withUtilityCapability(withSearchCapability(withManifestCapability(withHarnessGrants(withConsumerGrants(m, false), withheld), false), false, provider), false)), onWriteError);
+  const hold = agent.r3Hold();
+  const left3 = writeSse(res, batch.map((m) => withR3Holds(withMcpCapability(withUtilityCapability(withSearchCapability(withManifestCapability(withHarnessGrants(withConsumerGrants(m, false), withheld), false), false, provider), false), false), hold)), onWriteError);
   const leftIds = new Set(left3.map((message) => message.message_id));
   agent.ackRuntimeMessages(batch.filter((message) => !leftIds.has(message.message_id)).map((message) => message.message_id));
   if (left3.length) agent.requeueFront(batch.filter((message) => leftIds.has(message.message_id)));
@@ -45456,7 +47024,8 @@ function createHttpServer(agent, opts) {
         const drained = await agent.drain(channel, wait);
         const withheld = agent.harnessGrantsWithheld();
         const provider = agent.signedSearchProvider();
-        return json(res, 200, drained.map((m) => withUtilityCapability(withSearchCapability(withManifestCapability(withHarnessGrants(withConsumerGrants(m, false), withheld), false), false, provider), false)));
+        const hold = agent.r3Hold();
+        return json(res, 200, drained.map((m) => withR3Holds(withMcpCapability(withUtilityCapability(withSearchCapability(withManifestCapability(withHarnessGrants(withConsumerGrants(m, false), withheld), false), false, provider), false), false), hold)));
       }
       if (method === "GET" && path === "/v1/events") {
         const channel = url.searchParams.get("channel_id") ?? void 0;
@@ -45526,6 +47095,7 @@ function parseHarnessReport(raw) {
 }
 
 // src/ws-server.ts
+import { randomBytes as randomBytes12 } from "node:crypto";
 import { WebSocketServer, WebSocket } from "ws";
 
 // src/memory/consumer-notes.ts
@@ -45636,6 +47206,8 @@ function attachAgentWebSocket(server, agent, opts) {
       manifestGrants: false,
       searchProviders: false,
       utilityTools: false,
+      mcpClient: false,
+      pendingCatalog: /* @__PURE__ */ new Map(),
       // helloWaitMs 0 keeps today's synchronous initial flush exactly (the opt-out the existing tests use).
       deliveryOpen: helloWaitMs <= 0,
       deliveryToken: /* @__PURE__ */ new Map(),
@@ -45689,14 +47261,14 @@ function attachAgentWebSocket(server, agent, opts) {
             continue;
           }
           const out = withConsumerNotes(
-            withUtilityCapability(withSearchCapability(
+            withR3Holds(withMcpCapability(withUtilityCapability(withSearchCapability(
               withManifestCapability(
                 withHarnessGrants(withConsumerGrants(batch[i], session.perToolGrants), !session.perToolGrants && agent.harnessGrantsWithheld()),
                 session.manifestGrants
               ),
               session.searchProviders,
               agent.signedSearchProvider()
-            ), session.utilityTools),
+            ), session.utilityTools), session.mcpClient), agent.r3Hold()),
             batch[i],
             session,
             agent
@@ -45707,6 +47279,10 @@ function attachAgentWebSocket(server, agent, opts) {
           try {
             sock.send(JSON.stringify(frame));
             inflight.set(batch[i].message_id, batch[i]);
+            const a = frame.authorization;
+            if (session.mcpDeletionAck === true && (a?.audience === "owner_dm" || a?.relay_speaker === "owner")) {
+              agent.noteMcpTurnDispatch(session, batch[i].message_id);
+            }
             session.deliveryToken.set(batch[i].message_id, ++session.deliverySeq);
             session.shownRecall.set(batch[i].message_id, { token: session.deliverySeq, ids: recallOut.shown });
             session.shownUnified.set(batch[i].message_id, { token: session.deliverySeq, ids: unifiedOut.shown });
@@ -45754,6 +47330,11 @@ function attachAgentWebSocket(server, agent, opts) {
       if (session.manifestGrants) agent.clearManifestConsumer(session);
       agent.clearSearchProvidersSocket(session);
       agent.clearUtilityToolsSocket(session);
+      agent.clearMcpClientSocket(session);
+      agent.clearMcpDeletionAckSocket(session);
+      agent.noteMcpCatalogLister(session, null);
+      for (const settle of session.pendingCatalog.values()) settle(null);
+      session.pendingCatalog.clear();
     };
     current = { sock, cleanup, sweepStale };
     sock.on("close", cleanup);
@@ -45787,6 +47368,32 @@ function attachAgentWebSocket(server, agent, opts) {
     }
   };
 }
+var MCP_CATALOG_PENDING_MAX = 8;
+function mcpCatalogLister(sock, session) {
+  return (serverId, timeoutMs) => new Promise((resolve5) => {
+    if (session.closed || sock.readyState !== WebSocket.OPEN || session.pendingCatalog.size >= MCP_CATALOG_PENDING_MAX) {
+      resolve5(null);
+      return;
+    }
+    const requestId = randomBytes12(16).toString("hex");
+    const timer = setTimeout(() => {
+      session.pendingCatalog.delete(requestId);
+      resolve5(null);
+    }, timeoutMs);
+    timer.unref?.();
+    session.pendingCatalog.set(requestId, (frame) => {
+      clearTimeout(timer);
+      resolve5(frame);
+    });
+    try {
+      sock.send(JSON.stringify({ type: "mcp_catalog_list", request_id: requestId, server_id: serverId }));
+    } catch {
+      session.pendingCatalog.delete(requestId);
+      clearTimeout(timer);
+      resolve5(null);
+    }
+  });
+}
 function sendJson(sock, body) {
   if (sock.readyState !== WebSocket.OPEN) return;
   try {
@@ -45860,6 +47467,11 @@ async function handleInbound(sock, agent, data, inflight, flush, session) {
     agent.noteSearchProvidersSocket(session, session.searchProviders);
     session.utilityTools = session.consumer === "runtime" && session.harnessClaimed !== true && perTool && Array.isArray(m.features) && m.features.includes(UTILITY_TOOLS_FEATURE);
     agent.noteUtilityToolsSocket(session, session.utilityTools);
+    session.mcpClient = session.consumer === "runtime" && session.harnessClaimed !== true && perTool && Array.isArray(m.features) && m.features.includes(MANIFEST_GRANTS_FEATURE) && m.features.includes(MCP_CLIENT_FEATURE);
+    agent.noteMcpClientSocket(session, session.mcpClient);
+    agent.noteMcpCatalogLister(session, session.mcpClient ? mcpCatalogLister(sock, session) : null);
+    session.mcpDeletionAck = session.consumer === "runtime" && session.harnessClaimed !== true && Array.isArray(m.features) && m.features.includes(MCP_DELETION_ACK_FEATURE);
+    agent.noteMcpDeletionAckSocket(session, session.mcpDeletionAck);
     if (session.consumer === "runtime" && session.harnessClaimed !== true && Array.isArray(m.features) && m.features.includes(MEMORY_NOTES_FEATURE)) {
       agent.noteNotesConsumer();
     }
@@ -45867,13 +47479,21 @@ async function handleInbound(sock, agent, data, inflight, flush, session) {
     if (session.recallConsumer) agent.noteRecallConsumer();
     session.unifiedConsumer = agent.unifiedFeatureOn() && session.consumer === "runtime" && session.harnessClaimed !== true && Array.isArray(m.features) && m.features.includes(MEMORY_UNIFIED_FEATURE);
     if (session.unifiedConsumer) agent.noteUnifiedConsumer();
-    sendJson(sock, { type: "hello", features: ["nack", MEMORY_NOTES_FEATURE, MEMORY_RECALL_FEATURE, ...agent.unifiedFeatureOn() ? [MEMORY_UNIFIED_FEATURE] : [], MANIFEST_GRANTS_FEATURE, SEARCH_PROVIDERS_FEATURE, REPLY_CREDIT_FEATURE] });
+    sendJson(sock, { type: "hello", features: ["nack", MEMORY_NOTES_FEATURE, MEMORY_RECALL_FEATURE, ...agent.unifiedFeatureOn() ? [MEMORY_UNIFIED_FEATURE] : [], MANIFEST_GRANTS_FEATURE, SEARCH_PROVIDERS_FEATURE, REPLY_CREDIT_FEATURE, MCP_POLICY_WRITER_FEATURE, MCP_DELETION_ACK_FEATURE] });
     if (!session.deliveryOpen) {
       session.deliveryOpen = true;
       flush();
     }
     return;
   }
+  if (m.type === "mcp_catalog_list_result") {
+    const id = m.request_id;
+    const settle = typeof id === "string" ? session.pendingCatalog.get(id) : void 0;
+    if (settle === void 0) return;
+    session.pendingCatalog.delete(id);
+    settle(m);
+    return;
+  }
   if (m.type === "nack") {
     if (typeof m.message_id !== "string" || !m.message_id) {
       sendJson(sock, wsErrorFrame("invalid_request"));
@@ -46090,6 +47710,20 @@ async function handleInbound(sock, agent, data, inflight, flush, session) {
     }
     return;
   }
+  if (m.type === "mcp_deletion_ack") {
+    const keys = Object.keys(m).sort().join(",");
+    const valid = session.mcpDeletionAck === true && session.mcpClient === true && session.harnessClaimed !== true && (keys === "credentials_present,type" || keys === "credentials_present,message_id,type" || keys === "applied_sha256,credentials_present,message_id,type") && typeof m.credentials_present === "boolean" && (m.message_id === void 0 || typeof m.message_id === "string" && m.message_id.length > 0 && m.message_id.length <= 256) && (m.applied_sha256 === void 0 || typeof m.applied_sha256 === "string" && /^[0-9a-f]{64}$/.test(m.applied_sha256));
+    if (!valid) {
+      sendJson(sock, wsErrorFrame("invalid_request"));
+      return;
+    }
+    agent.noteMcpDeletionAck(session, {
+      credentials_present: m.credentials_present,
+      ...typeof m.message_id === "string" ? { message_id: m.message_id } : {},
+      ...typeof m.applied_sha256 === "string" ? { applied_sha256: m.applied_sha256 } : {}
+    });
+    return;
+  }
   if (m.type === "room_cap_reached") {
     if (!session.manifestGrants || typeof m.channel_id !== "string" || !LOWER_UUID.test(m.channel_id)) {
       sendJson(sock, wsErrorFrame("invalid_request"));