@shiftleftpt/sbd-toe-mcp 0.20.0-beta.22 → 0.20.0-beta.24

package/assets/agent-guide.md

@@ -21,8 +21,10 @@ adjacências do grafo, de forma reproduzível e auditável.
    É a lista **fechada** de valores que aceito e, para cada valor, **o que ele activa**
    (categorias, capítulos, contagens por nível). É ele que substitui a adivinhação de palavras.
 2. **Mapeia e declara** — `select_sbd_toe_requirements(risk_level, concerns=[…], …)`.
-   O `task` podes enviá-lo à mesma: fica **registado para auditoria** (`role:
+   O enunciado podes enviá-lo à mesma em **`task_context`** (nome canónico desde
+   0.20.0-beta.24; `task` continua aceite): fica **registado para auditoria** (`role:
    "recorded_context"`, `affects_selection: false`) e **não influencia o resultado**.
+   O campo mudou de nome porque o nome antigo convidava a acreditar que o texto decide.
 3. **Sem declarações** recebes `needs_input`: o vocabulário aplicável, **candidatos A
    CONFIRMAR** derivados do texto (sugestão, nunca selecção) e um exemplo copiável.
    Nunca devolvo zero em silêncio e nunca invento o teu âmbito.
@@ -148,25 +150,17 @@ Use `search_sbd_toe_manual` for narrative/conceptual questions.
 **Output size:** L1 ≈ 22k chars, L2 ≈ 36k chars, L3 ≈ 36k chars (may exceed context).
 **Always use `concerns` to scope L2/L3 queries** — reduces to ~9k chars per concern set.
 
-#### Valid `concerns` values (ontology-controlled vocabulary)
-
-| concern | Categories resolved | Meaning |
-|---|---|---|
-| `auth` | AUT, ACC, SES | Authentication, access control, sessions |
-| `logging` | LOG | Audit logging, monitoring |
-| `validation` | VAL, ERR | Input validation, error handling |
-| `api` | API | API security |
-| `config` | CFG | Configuration & environment hardening |
-| `integrity` | INT | Integrity & integration |
-| `distribution` | DST | Supply chain, packaging |
-| `ide` | IDE | Development environment |
-| `requirements` | REQ | Security requirements in SDLC |
-| `architecture` | ARC | Secure architecture |
-| `iac` | IAC | Infrastructure-as-Code |
-| `encryption` | ENC | Cryptography & sensitive data |
-| `agents` | AGN | AI-agent / automation governance — mandate, autonomy A0–A4, kill-switch, intent declaration (`REQ-AGN-001…004`; consult only) |
-
-Pass concerns as exact lowercase strings from the table above.
+#### `concerns` — o vocabulário FECHADO desta linha (derivado do bundle)
+
+<!-- BEGIN GENERATED: concerns -->
+<!-- END GENERATED: concerns -->
+
+#### Os restantes activadores declaráveis
+
+<!-- BEGIN GENERATED: activators -->
+<!-- END GENERATED: activators -->
+
+
 
 ### GUIDE mode
 Use when the user asks *how to implement, design, structure, document, or review* something
@@ -192,13 +186,10 @@ get_threat_landscape         ← deterministic: threats relevant to a risk level
                                 use for: threat modelling context, "what threats apply to auth?"
 ```
 
-#### Valid `role` values for `get_guide_by_role`
-
-Canonical role IDs (pass exact or common alias — resolved automatically):
+#### `role` — papéis aceites por `get_guide_by_role`
 
-`developer` · `appsec` · `devops` · `grc` · `qa` · `security_champion` · `software_architect`
-· `product_owner` · `scrum_master` · `team_lead` · `ciso` · `executive_management`
-· `ops` · `compliance` · `auditor` · `ir` · `sre`
+<!-- BEGIN GENERATED: roles -->
+<!-- END GENERATED: roles -->
 
 #### Interpreting tool output
 
@@ -207,12 +198,14 @@ Canonical role IDs (pass exact or common alias — resolved automatically):
 | `rule_trace` contains `CONCERNS_FILTER_REQUIREMENTS` | Tell user scope was narrowed to the specified concerns |
 | `mitigation_confidence: "heuristic"` | Flag as inferred linkage — not structural evidence |
 | `mitigation_confidence: "derived"` | Structural chapter-match — reliable |
-| `assignments: []` / `threats: []` | Say "manual-grounded: not applicable in this scope" — do not invent |
+| `threats: []` **with** `unsupported_concerns` | **Do NOT say "not applicable in this scope".** The concern is valid and its requirements exist — this THREAT MAP does not route it. Cite `unsupported_concerns.note`, then call `select_sbd_toe_requirements` for the same concern; assert nothing about absence of threats |
+| `assignments: []` / `threats: []` **with no** `unsupported_concerns` | Empty *within a resolved scope*: say "manual-grounded: no entries at this risk level for this scope" — do not invent, and do not generalise beyond the scope actually resolved (check `meta.activeChapters` is non-empty before claiming coverage) |
 | `active_domains` | List the security domains active at this risk level |
 | `coverage_gaps.requirements_without_control_link` (consult) | Those requirements are active but have **no published control link** — say so (declared gap, routed to Codex); do not invent controls |
 | `match: "declared_gap"` / `meta.declared_gap` (query_sbd_toe_entities, resolve_entities) | Cite `declared_gap.note` verbatim — a legacy / unresolvable citation, not a missing requirement |
 | `citation_note` / `meta.citation_note` (informative) | The id is an illustrative example (`REQ-NNN`) or a non-requirement token (`CWE-`, `SHA-`) cited by the Manual — say so; it is not a requirement and not a gap |
 | `selection.selected[]` (select) | The recommendation for the task — cite each item's `selection_trace` when asked *why* |
+| `selection.out_of_scope_chapters` (select) | O que **nenhuma declaração activou**, por capítulo e por contagem, com `activate_with` copiável. **Não é «não aplicável»** — é não-perguntado: se o capítulo é relevante para a tarefa, re-chama com a declaração indicada. `SEM ACTIVADOR PUBLICADO` significa que o vocabulário não tem forma de o activar — diz-se, não se inventa |
 | `selection.narrowed_out[]` (select) | Eligible-but-narrowed, grouped with reason — never treat as "not applicable"; re-call with the missing signal to recover a group |
 | `completeness_report.selection` (prepare) | The same two-band summary behind the codegen context — `narrowed_out_ref` names the tool to inspect it |
 
@@ -341,54 +334,29 @@ Always distinguish between:
 
 ## Resources
 
-| Resource URI | When to use |
-|---|---|
-| `sbd://toe/agent-guide` | This document — full operational guide |
-| `sbd://toe/index-compact` | Full chapter map as JSON — fast structured lookup |
-| `sbd://toe/chapter-applicability/{riskLevel}` | Graduated applicability: every chapter present, per-chapter demand for the level |
-| `sbd://toe/ontology` | Full ontology YAML — domain_mapping, concerns, inference rules |
-| `sbd://toe/version` | Server identity + served knowledge provenance (manual/kg/ontology, from the pin) — read at session start |
+<!-- BEGIN GENERATED: resources -->
+<!-- END GENERATED: resources -->
 
 ---
 
 ## Prompts
 
-| Prompt | When to use |
-|---|---|
-| `setup_sbd_toe_agent(riskLevel, projectRole)` | Session setup — active chapters + risk-specific rules. **Prompt MCP** (clientes sem prompts: activadores directos no select) |
-| `ask_sbd_toe_manual(question)` | Direct grounded Q&A |
+<!-- BEGIN GENERATED: prompts -->
+<!-- END GENERATED: prompts -->
 
 ---
 
 ## Chapter reference
 
-| chapterId | Title | Min level | Domains |
-|---|---|---|---|
-| `00-fundamentos` | Fundamentos SbD-ToE | L1 | governance, foundation |
-| `01-classificacao-aplicacoes` | Classificação de Aplicações | L1 | governance, risk |
-| `02-requisitos-seguranca` | Requisitos de Segurança | L1 | governance, requirements |
-| `03-threat-modeling` | Threat Modeling | L1 | risk, architecture |
-| `04-arquitetura-segura` | Arquitetura Segura | L1 | architecture, design |
-| `05-dependencias-sbom-sca` | Dependências, SBOM e SCA | L1 | supply-chain |
-| `06-desenvolvimento-seguro` | Desenvolvimento Seguro | L2 | development, coding |
-| `07-cicd-seguro` | CI/CD Seguro | L1 | devops, pipeline |
-| `08-iac-infraestrutura` | IaC e Infraestrutura | L1 | infrastructure |
-| `09-containers-imagens` | Containers e Imagens | L1 | containers |
-| `10-testes-seguranca` | Testes de Segurança | L1 | testing |
-| `11-deploy-seguro` | Deploy Seguro | L2 | deploy |
-| `12-monitorizacao-operacoes` | Monitorização e Operações | L1 | monitoring |
-| `13-formacao-onboarding` | Formação e Onboarding | L3 | training |
-| `14-governanca-contratacao` | Governança e Contratação | L1 | governance |
+<!-- BEGIN GENERATED: chapters -->
+<!-- END GENERATED: chapters -->
 
 ---
 
 ## Risk levels
 
-| Level | Scope | Unlocks |
-|---|---|---|
-| `L1` | Low risk — internal, no sensitive data | ALL chapters — demand mostly recomendado/opcional |
-| `L2` | Medium risk — public APIs, user data | + chapters 06, 11 |
-| `L3` | High risk — PII, regulated systems | + chapter 13 |
+<!-- BEGIN GENERATED: risk-levels -->
+<!-- END GENERATED: risk-levels -->
 
 ---
 

package/dist/index.js

@@ -8,7 +8,7 @@ import readline from "node:readline";
 import { getConfig, resolveAppPath } from "./config.js";
 import { formatSampledAnswerResult, inspectManualRetrieval, prepareManualAnsweringContext, searchManualQuestion } from "./orchestrator/ask-manual.js";
 import { loadSystemPromptTemplate } from "./prompt/system-prompt.js";
-import { loadBundleProvenance, servedKgReleaseTag } from "./version-info.js";
+import { loadBundleProvenance, servedKgReleaseTag, servingServerVersion } from "./version-info.js";
 import { handleGetSbdToeChapterBrief, handleListSbdToeChapters, handleMapSbdToeApplicability, handleQuerySbdToeEntities } from "./tools/structured-tools.js";
 import { handleGenerateSbdToeSkill } from "./tools/generate-sbd-toe-skill.js";
 import { handleMapSbdToeReviewScope } from "./tools/map-review-scope.js";
@@ -38,6 +38,8 @@ const DECLARED_CONCERNS = buildActivationVocabulary().concerns.values.map((c) =>
 const CONCERNS_VOCABULARY_NOTE = `Conjunto FECHADO de ${DECLARED_CONCERNS.length} valores, gerado do mesmo vocabulário que sbd://toe/activation-vocabulary publica (com o que cada valor activa e quantos requisitos traz por nível). Valores fora do conjunto são DECLARADOS na resposta (unknown_concerns), nunca descartados em silêncio.`;
 import { buildCodegenInstructionsResourceContent, handlePrepareCodegenContext } from "./tools/prepare-codegen-context.js";
 import { buildChapterApplicabilityJson, buildGroundedCodegenPrompt, buildSetupAgentPrompt, readGroundedCodegenGuide } from "./resources/sbd-toe-resources.js";
+import { RESOURCE_CATALOG, PROMPT_CATALOG } from "./serving/server-surface.js";
+import { buildAgentGuide } from "./serving/agent-guide.js";
 const PROTOCOL_VERSION = "2025-03-26";
 let cachedPackageMetadata;
 const LOG_LEVELS = [
@@ -70,83 +72,6 @@ function loadPackageMetadata() {
     };
     return cachedPackageMetadata;
 }
-/** The single source of the resource surface — resources/list AND the
- * read_sbd_toe_resource tool derive from THIS list (never hardcoded twice). */
-const RESOURCE_CATALOG = [
-    {
-        uri: "sbd://toe/agent-guide",
-        name: "SbD-ToE Agent Guide",
-        description: "ENTRY POINT — READ THIS FIRST. Operational guide for AI agents: SbD-ToE identity (Security by Design — Theory of Everything), CONSULT/GUIDE modes, routing by SDLC phase and domain, tool selection, epistemic standards, chapter map, risk levels, identifier conventions.",
-        mimeType: "text/markdown"
-    },
-    {
-        uri: "sbd://toe/chapter-applicability/{riskLevel}",
-        name: "SbD-ToE Chapter Applicability",
-        description: "Graduated chapter applicability for a risk level (L1/L2/L3): presence always, demand scales — derived from authored assignment proportionality (0.14.0).",
-        mimeType: "application/json"
-    },
-    {
-        uri: "sbd://toe/activation-vocabulary",
-        name: "SbD-ToE Activation Vocabulary",
-        description: "DECLARATIVE-FIRST (0.20-beta): the CLOSED vocabulary this server accepts and what each value activates — concerns, exposure, data_sensitivity, technologies, changed_files path table, roles, phases, risk levels. Derived from the served bundle and the engine's own tables, never hand-written. Read it, map your reading of the request onto these values, and DECLARE them: the server answers the declared, it does not interpret prose.",
-        mimeType: "application/json"
-    },
-    {
-        uri: "sbd://toe/index-compact",
-        name: "SbD-ToE Index Compact",
-        description: "Compact JSON index of the manual, DERIVED at read-time from the served bundle (graduated demand_by_level; no minLevel). Injectable into system prompt to eliminate exploratory discovery.",
-        mimeType: "application/json"
-    },
-    {
-        uri: "sbd://toe/ontology",
-        name: "SbD-ToE Ontology",
-        description: "Full SbD-ToE ontology YAML: domain_mapping (requirement category → control domains), " +
-            "inference rules with priorities, resolution pipelines (consult/guide/threats/review), " +
-            "and entity schemas. Read once per session to understand the deterministic resolution model " +
-            "before calling consult_security_requirements, get_threat_landscape or get_guide_by_role.",
-        mimeType: "application/yaml"
-    },
-    {
-        uri: "sbd://toe/skill/{role}",
-        name: "SbD-ToE Role Skill",
-        description: "Role-specialised SbD-ToE skill for a canonical role — RISK LEVEL FIXED AT L2 neste URI; " +
-            "para outro nível usa generate_sbd_toe_skill(role, risk_level=…). Same output as generate_sbd_toe_skill(role, format=skill).",
-        mimeType: "text/markdown"
-    },
-    {
-        uri: "sbd://toe/subagent/{role}",
-        name: "SbD-ToE Role Sub-agent Definition",
-        description: "Installable sub-agent definition for a canonical role (default risk L2, harnessed flavour — " +
-            "grants mcp__sbd-toe__* tools). Same output as generate_sbd_toe_skill(role, format=subagent).",
-        mimeType: "text/markdown"
-    },
-    {
-        uri: "sbd://toe/codegen-instructions/{mode}",
-        name: "SbD-ToE Codegen Instructions (per mode)",
-        description: "Static per-mode boilerplate of prepare_sbd_toe_codegen_context (mode: codegen, review or " +
-            "test-plan): llm_codegen_instructions slots + security_rationale_template skeleton — " +
-            "byte-identical to the detail=full inline content when assembled per the embedded rules — " +
-            "plus the detail_encoding legend for detail=standard/minimal payloads (v2 token diet). " +
-            "Referenced by codegen_instructions_ref in dieted payloads.",
-        mimeType: "application/json"
-    },
-    {
-        uri: "sbd://toe/version",
-        name: "SbD-ToE MCP Version",
-        description: "Version of the running SbD-ToE MCP server (name, version, description) plus the provenance of the served knowledge: manual {version, commit}, kg {release_tag, substrate_version, consumer_contract_version} and ontology {tag, commit}, read from the consumed-bundle pin.",
-        mimeType: "application/json"
-    },
-    {
-        uri: "sbd://toe/grounded-codegen-guide",
-        name: "SbD-ToE Grounded Codegen Guide",
-        description: "Agent-facing guide for using prepare_sbd_toe_codegen_context. " +
-            "Covers workflow, branching by status (ready_for_codegen / needs_clarification / " +
-            "needs_decomposition / unsupported_scope), output discipline (cite citation_map, fill " +
-            "security_rationale, distinguish code/tests/evidence), and explicit prohibitions " +
-            "(no invented IDs, no compliance claims, no rastreabilidade-noise inside source files).",
-        mimeType: "text/markdown"
-    }
-];
 /** Declared resource-read failure (never-silent): carries the JSON-RPC code. */
 /**
  * Materialize any resource of RESOURCE_CATALOG by concrete URI (templated URIs
@@ -195,7 +120,7 @@ async function materializeResource(uri) {
     }
     if (uri === "sbd://toe/agent-guide") {
         try {
-            return { mimeType: "text/markdown", text: readFileSync(resolveAppPath("assets/agent-guide.md"), "utf-8") };
+            return { mimeType: "text/markdown", text: buildAgentGuide() };
         }
         catch {
             throw new ResourceReadError(-32603, "Could not read SbD-ToE agent guide.");
@@ -1035,16 +960,21 @@ class McpRuntime {
                     title: "Select SbD-ToE Requirements (MP1)",
                     description: "START HERE — para qualquer tarefa concreta esta é a 1ª tool. Arranque: lê sbd://toe/agent-guide (read_sbd_toe_resource); setup_sbd_toe_agent é um PROMPT MCP — clientes sem prompts (p.ex. Desktop) não o expõem: segue directo por aqui. DECLARATIVO PRIMEIRO (contrato v1.18-beta, linha 0.20): TU tens o contexto — lê o pedido, o código e a conversa e DECLARA o que interpretaste (risk_level, concerns, exposure, data_sensitivity, technologies, changed_files). EU NÃO INTERPRETO PROSA: respondo com o que o KG sabe sobre o declarado, mais as adjacências do grafo, de forma reproduzível. Vocabulário fechado em sbd://toe/activation-vocabulary. O `task` fica REGISTADO para auditoria e NÃO influencia o resultado; sem nenhuma declaração devolvo needs_input com o vocabulário e candidatos A CONFIRMAR (nunca adivinho, nunca devolvo zero em silêncio); a baseline do nível pede-se explicitamente (mode='baseline'); o motor inferencial antigo fica em mode='discover' (exploratório). The MP1 selection operation (Classificar → Seleccionar): which requirements apply to THIS task in THIS " +
                         "context. Composes the reference semantics the published ontology declares — baseline (cap. 02 base " +
-                        "catalogue, by risk level) ∪ domain chapters activated by the context (changed_files, technologies, stack, " +
-                        "task) ⊕ regulatory overlay (extend) — then narrows deterministically by the task's declared signals. " +
-                        "Returns BOTH bands: selected[] (each with its selection_trace: source/trigger/score) and narrowed_out[] " +
-                        "(eligible-without-signal, grouped by category, with reason) — never silent. Paginated. " +
+                        "catalogue, by risk level) ∪ domain chapters activated by the DECLARED activators (concerns, exposure, " +
+                        "data_sensitivity, technologies, changed_files) ∪ the categories the published vocabulary promises " +
+                        "⊕ regulatory overlay (extend) — then narrows deterministically by those same declarations. The task " +
+                        "text is NEVER an activator in declarative mode (it is recorded context; it is only an engine in " +
+                        "mode='discover'). Returns the bands: selected[] (each with its selection_trace: source/trigger/score), " +
+                        "narrowed_out[] (eligible-without-signal, grouped by category, with reason), excluded_by_level[] and " +
+                        "out_of_scope_chapters (what no declaration activated, by chapter and count, with how to bring it in) — " +
+                        "never silent, and the SCOPE of that promise is the universe, not just the baseline. Paginated. " +
                         "All data from the published deterministic runtime bundle — nothing is invented.",
                     inputSchema: {
                         type: "object",
                         properties: {
                             risk_level: { type: "string", enum: ["L1", "L2", "L3"], description: "Application risk level (drives the baseline)." },
-                            task: { type: "string", description: "RECORDED CONTEXT (auditoria): o enunciado da tarefa. NÃO influencia a selecção no modo declarativo — o servidor não interpreta prosa. Só é motor em mode='discover'." },
+                            task_context: { type: "string", description: "CONTEXTO REGISTADO (auditoria): o enunciado da tarefa. NOME CANÓNICO desde 0.20.0-beta.24 — um campo chamado `task` convidava a ser o motor, e não é: NÃO influencia a selecção no modo declarativo. Alias `task` continua aceite (aditivo, nunca renomeámos nada); em mode='discover' o texto é motor e `task` é o nome a usar." },
+                            task: { type: "string", description: "ALIAS de `task_context` (compatibilidade). Em mode='discover' é o MOTOR (casamento lexical, exploratório); no modo declarativo é apenas contexto registado." },
                             mode: { type: "string", enum: ["declarative", "baseline", "discover"], description: "declarative (default): responde ao DECLARADO; sem declarações devolve needs_input com vocabulário e candidatos a confirmar. baseline: baseline completa do nível, por pedido EXPLÍCITO (nunca fallback). discover: motor inferencial histórico (casamento lexical da prosa), exploratório — investigação e estudo de paráfrase." },
                             stack: { type: "string", description: "Texto livre da stack. No modo declarativo só conta quando traz, como TOKEN EXACTO, um valor de `technologies` (normalizar o declarado é legítimo; adivinhar prosa não). Preferir `technologies`." },
                             exposure: { type: "string", enum: ["local", "internal", "authenticated", "public"], description: "Declared activator: authenticated/public activate auth+logging (+api/validation/architecture for public)." },
@@ -1437,88 +1367,10 @@ class McpRuntime {
         });
     }
     getPromptDefinition() {
-        return {
-            name: "ask_sbd_toe_manual",
-            title: "Ask SbD-ToE Manual",
-            description: "MCP prompt to guide the AI chat to answer questions about the SbD-ToE manual with grounding.",
-            arguments: [
-                {
-                    name: "question",
-                    description: "Question about the SbD-ToE manual.",
-                    required: true
-                }
-            ]
-        };
+        return PROMPT_CATALOG[0];
     }
     handlePromptsList(request) {
-        this.sendResponse(request.id, {
-            prompts: [
-                this.getPromptDefinition(),
-                {
-                    name: "setup_sbd_toe_agent",
-                    title: "Setup SbD-ToE Agent",
-                    description: "START HERE — entry point (2ª chamada, após leres sbd://toe/agent-guide): MCP PROMPT (clientes sem suporte de prompts não o expõem — alternativa: activadores estruturados directos no select) to configure an agent with SbD-ToE manual context and rules for a given risk level.",
-                    arguments: [
-                        {
-                            name: "riskLevel",
-                            description: "Project risk level: L1, L2 or L3.",
-                            required: true
-                        },
-                        {
-                            name: "projectRole",
-                            description: "Project role or description (optional).",
-                            required: false
-                        }
-                    ]
-                },
-                {
-                    name: "prepare_grounded_codegen",
-                    title: "Prepare Grounded Codegen (SbD-ToE)",
-                    description: "MCP prompt that bundles the grounded-codegen guide with a user task and instructs the " +
-                        "agent to call prepare_sbd_toe_codegen_context before producing code. Forces citation of " +
-                        "citation_map IDs, fills security_rationale_template, distinguishes code/tests/evidence, " +
-                        "blocks compliance claims, and routes needs_clarification / needs_decomposition / " +
-                        "unsupported_scope to user dialog instead of silent guessing.",
-                    arguments: [
-                        {
-                            name: "task",
-                            description: "Concrete coding task (e.g. 'Add payload validation to PATCH /users/:id/email').",
-                            required: true
-                        },
-                        {
-                            name: "mode",
-                            description: "codegen | review | test-plan. Defaults to codegen.",
-                            required: false
-                        },
-                        {
-                            name: "riskLevel",
-                            description: "Project risk level: L1, L2 or L3.",
-                            required: false
-                        },
-                        {
-                            name: "concerns",
-                            description: "Optional explicit concerns (comma-separated string or array). Otherwise inferred by the activation engine.",
-                            required: false
-                        },
-                        {
-                            name: "stack",
-                            description: "Stack hint (e.g. 'Node.js/Express'). Informational.",
-                            required: false
-                        },
-                        {
-                            name: "regulatoryFrameworks",
-                            description: "Optional regulatory framework short codes or IDs (e.g. 'GDPR', 'EXT-DORA'). Comma-separated string or array.",
-                            required: false
-                        },
-                        {
-                            name: "includeRegulatoryOverlay",
-                            description: "When true, asks the tool to surface regulatory overlay context.",
-                            required: false
-                        }
-                    ]
-                }
-            ]
-        });
+        this.sendResponse(request.id, { prompts: [...PROMPT_CATALOG] });
     }
     handlePromptGet(request) {
         const name = typeof request.params?.name === "string" ? request.params.name : "";
@@ -2077,6 +1929,7 @@ class McpRuntime {
                             size_estimate: { chars: text.length, approx_tokens: Math.ceil(text.length / 4) },
                             provenance: {
                                 kg: servedKgReleaseTag(),
+                                server: servingServerVersion(),
                                 content_type: "canonical",
                                 produced_by: "resources_read_mirror",
                                 source_data: uriArg,