@stigmer/runner 3.11.1-dev.20260812192248 → 3.12.0

package/dist/shared/datastore-attachment.js

@@ -1,184 +0,0 @@
-/**
- * The runner-synthesized datastore records attachment (T05, DD-001 SD-2).
- *
- * When an agent declares `datastore_usages`, the runner synthesizes ONE
- * MCP attachment serving the five record tools (DD-005) — the agent
- * builder writes a usage line and gets tools; no McpServer resource, no
- * Environment, no credential in any manifest. Harness-agnostic like
- * mcp-resolver.ts: both ExecuteCursor and ExecuteDeepAgent inject the
- * synthesized entry through their existing ResolvedMcpServer paths.
- *
- * Two connection shapes, one roster (the bridge's records-only roster,
- * T05 R1):
- *   - Bridge endpoint configured (cloud): Streamable HTTP against the
- *     bridge's /records route, with the execution's own session-scoped
- *     credential as the Bearer token — the server's reach chain (DD-006
- *     Path 1) authorizes from that token; the bridge stays a
- *     non-validating passthrough.
- *   - No bridge endpoint (OSS/local): a spawned `stigmer mcp-server`
- *     stdio child with STIGMER_MCP_ROSTER=records against the local
- *     backend (zero new distribution — the CLI already embeds the
- *     bridge). No credential: the local backend is unauthenticated and
- *     OSS callers resolve as the local principal (T05 R2).
- *
- * Approval-free by construction (DD-001 SD-3): empty toolApprovals +
- * pinnedToolApprovals + toolApprovalOverrides mean mergeApprovalPolicies
- * emits no entries for this server — zero classifier involvement, and no
- * proto surface can target it (the attachment has no McpServerUsage, and
- * since issue #349 an agent's overrides are scoped to their own usage's
- * server, so a same-named override elsewhere cannot reach this one).
- * `discoveredCapabilitiesEmpty`
- * is false and the attachment has no McpServerUsage, so the connect
- * backfill (whose destructiveHint tightener would force-gate
- * delete_record — silently skipped on channels under UNATTENDED mode)
- * is structurally unable to touch it. Callers must still inject AFTER
- * resolve + backfill; both harness call sites do.
- */
-import { grpcTarget } from "./synthesized-attachment.js";
-/**
- * The synthesized attachment's slug. Reserved: a user McpServer with
- * this slug is shadowed by the synthesized attachment (the record tools
- * must exist whenever `datastore_usages` says so), with a warning.
- */
-export const DATASTORE_ATTACHMENT_SLUG = "stigmer-records";
-/** The bridge route serving the records-only roster (mcp-server T05 R1). */
-export const RECORDS_ROUTE = "/records";
-/**
- * Synthesize the records attachment for an agent's datastore usages.
- * Returns undefined when the agent uses no datastores — the attachment
- * exists exactly when the usage edge does.
- */
-export function synthesizeDatastoreAttachment(datastoreUsages, options) {
-    if (datastoreUsages.length === 0) {
-        return undefined;
-    }
-    // Approval-free by construction + backfill-proof: see file header.
-    const base = {
-        slug: DATASTORE_ATTACHMENT_SLUG,
-        toolApprovals: [],
-        pinnedToolApprovals: [],
-        toolApprovalOverrides: [],
-        discoveredCapabilitiesEmpty: false,
-    };
-    if (options.bridgeEndpoint !== null && options.bridgeEndpoint !== "") {
-        return {
-            ...base,
-            connectionType: "http",
-            url: options.bridgeEndpoint.replace(/\/+$/, "") + RECORDS_ROUTE,
-            headers: options.credential !== null && options.credential !== ""
-                ? { Authorization: `Bearer ${options.credential}` }
-                : undefined,
-        };
-    }
-    return {
-        ...base,
-        connectionType: "stdio",
-        command: "stigmer",
-        args: ["mcp-server"],
-        env: {
-            STIGMER_MCP_ROSTER: "records",
-            STIGMER_SERVER_ADDRESS: grpcTarget(options.backendEndpoint),
-        },
-    };
-}
-/**
- * The five record tools the records roster always serves (DD-005; the
- * mcp-server's records roster registers all five unconditionally for the
- * agent audience — only the `org` argument shape varies by audience, see
- * mcp-server/src/domains/records/tools.ts). Because the roster never
- * legitimately narrows, any of these missing from the connected toolset
- * means the store is degraded (issue #325) — the prompt section and the
- * reconciliation both derive from this one list so they cannot drift.
- */
-export const EXPECTED_RECORD_TOOLS = [
-    "describe_datastore",
-    "find_records",
-    "insert_record",
-    "update_record",
-    "delete_record",
-];
-/**
- * Reconcile the record tools actually connected against the roster
- * contract (issue #325). Returns the expected tools absent from
- * `actualToolNames` — empty means healthy. Names are bare tool names
- * exactly as reported by tools/list (the mcp-enabled-tools identity
- * space); extraneous names are ignored.
- */
-export function missingRecordTools(actualToolNames) {
-    const present = new Set(actualToolNames);
-    return EXPECTED_RECORD_TOOLS.filter((name) => !present.has(name));
-}
-/**
- * The operator-facing degradation notice (issue #325): pushed as a
- * MESSAGE_SYSTEM row on the execution status so "declared N datastores,
- * X/5 record tools connected" is visible without reading a transcript.
- * Lives HERE with the rest of the datastore-attachment wording — the
- * harness only threads it.
- */
-export function formatDatastoreDegradationNotice(declaredCount, missing) {
-    const connected = EXPECTED_RECORD_TOOLS.length - missing.length;
-    return (`Datastore record tools unavailable this turn: declared ` +
-        `${declaredCount} datastore(s), ${connected}/${EXPECTED_RECORD_TOOLS.length} ` +
-        `record tools connected (missing: ${missing.join(", ")}). The agent has ` +
-        `been instructed to disclose this instead of answering from memory.`);
-}
-/**
- * The datastores prompt section (DD-005 SD-5, the skills-section
- * precedent). Shared by both harnesses so the section text cannot drift
- * (the sender-identity precedent). Two honest renderings (issue #325):
- *
- * - Healthy (`missingToolNames` empty or omitted — the Cursor harness
- *   always calls it this way: the Cursor SDK connects MCP itself, so
- *   that harness can never observe the live roster):
- *   `<available_datastores>` names the attached datastores, points the
- *   model at describe_datastore first, and carries a standing
- *   failure-disclosure instruction — the only mechanism that covers
- *   tools which connected but fail at call time (the WhatsApp-pilot
- *   outage shape).
- * - Degraded (deep-agent only, from missingRecordTools against the
- *   connected roster): `<unavailable_datastores>` instead — the section
- *   must not promise tools the agent does not have. Names the declared
- *   datastores, states which record tools are missing, and instructs
- *   plain disclosure over improvisation.
- */
-export function formatDatastoresSection(datastoreUsages, missingToolNames = []) {
-    const entries = datastoreUsages
-        .map((u) => u.datastoreRef?.slug)
-        .filter((s) => !!s)
-        .map((slug) => `- ${slug}`);
-    if (missingToolNames.length > 0) {
-        return [
-            "<unavailable_datastores>",
-            "This agent is configured to use the datastores listed below, but the",
-            "following record tools failed to connect this turn:",
-            missingToolNames.join(", ") + ".",
-            "Treat these datastores as unreachable for any operation that needs a",
-            "missing tool.",
-            "",
-            ...entries,
-            "",
-            "When the user's request depends on one of these datastores, tell them",
-            "plainly that the datastore cannot be reached right now. Never answer",
-            "from memory, guess, or improvise a substitute for what the datastore",
-            "would have returned.",
-            "</unavailable_datastores>",
-        ].join("\n");
-    }
-    return [
-        "<available_datastores>",
-        "You have access to the following datastores through the record tools",
-        `(${EXPECTED_RECORD_TOOLS.join(", ")}).`,
-        "Before your first operation against a datastore, call describe_datastore to",
-        "learn its collections, field encodings, and which operations you are allowed",
-        "to perform.",
-        "",
-        ...entries,
-        "",
-        "If any record tool is missing from your toolset or a record tool call",
-        "fails, the datastore is unreachable: tell the user plainly that you cannot",
-        "reach it right now, and do not answer from memory, guess, or improvise a",
-        "substitute for what it would have returned.",
-        "</available_datastores>",
-    ].join("\n");
-}
-//# sourceMappingURL=datastore-attachment.js.map

package/dist/shared/datastore-attachment.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"datastore-attachment.js","sourceRoot":"","sources":["../../src/shared/datastore-attachment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAIH,OAAO,EAAE,UAAU,EAAqC,MAAM,6BAA6B,CAAC;AAE5F;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,iBAAiB,CAAC;AAE3D,4EAA4E;AAC5E,MAAM,CAAC,MAAM,aAAa,GAAG,UAAU,CAAC;AAExC;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAC3C,eAAiC,EACjC,OAAqC;IAErC,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,mEAAmE;IACnE,MAAM,IAAI,GAAG;QACX,IAAI,EAAE,yBAAyB;QAC/B,aAAa,EAAE,EAAE;QACjB,mBAAmB,EAAE,EAAE;QACvB,qBAAqB,EAAE,EAAE;QACzB,2BAA2B,EAAE,KAAK;KACnC,CAAC;IAEF,IAAI,OAAO,CAAC,cAAc,KAAK,IAAI,IAAI,OAAO,CAAC,cAAc,KAAK,EAAE,EAAE,CAAC;QACrE,OAAO;YACL,GAAG,IAAI;YACP,cAAc,EAAE,MAAM;YACtB,GAAG,EAAE,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,aAAa;YAC/D,OAAO,EAAE,OAAO,CAAC,UAAU,KAAK,IAAI,IAAI,OAAO,CAAC,UAAU,KAAK,EAAE;gBAC/D,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,UAAU,EAAE,EAAE;gBACnD,CAAC,CAAC,SAAS;SACd,CAAC;IACJ,CAAC;IAED,OAAO;QACL,GAAG,IAAI;QACP,cAAc,EAAE,OAAO;QACvB,OAAO,EAAE,SAAS;QAClB,IAAI,EAAE,CAAC,YAAY,CAAC;QACpB,GAAG,EAAE;YACH,kBAAkB,EAAE,SAAS;YAC7B,sBAAsB,EAAE,UAAU,CAAC,OAAO,CAAC,eAAe,CAAC;SAC5D;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,oBAAoB;IACpB,cAAc;IACd,eAAe;IACf,eAAe;IACf,eAAe;CACP,CAAC;AAEX;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,eAAiC;IAClE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IACzC,OAAO,qBAAqB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gCAAgC,CAC9C,aAAqB,EACrB,OAA0B;IAE1B,MAAM,SAAS,GAAG,qBAAqB,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAChE,OAAO,CACL,yDAAyD;QACzD,GAAG,aAAa,kBAAkB,SAAS,IAAI,qBAAqB,CAAC,MAAM,GAAG;QAC9E,oCAAoC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB;QACzE,oEAAoE,CACrE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,uBAAuB,CACrC,eAAiC,EACjC,mBAAsC,EAAE;IAExC,MAAM,OAAO,GAAG,eAAe;SAC5B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE,IAAI,CAAC;SAChC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;SAC/B,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAE9B,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,OAAO;YACL,0BAA0B;YAC1B,sEAAsE;YACtE,qDAAqD;YACrD,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG;YACjC,sEAAsE;YACtE,eAAe;YACf,EAAE;YACF,GAAG,OAAO;YACV,EAAE;YACF,uEAAuE;YACvE,sEAAsE;YACtE,sEAAsE;YACtE,sBAAsB;YACtB,2BAA2B;SAC5B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC;IAED,OAAO;QACL,wBAAwB;QACxB,sEAAsE;QACtE,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;QACxC,6EAA6E;QAC7E,8EAA8E;QAC9E,aAAa;QACb,EAAE;QACF,GAAG,OAAO;QACV,EAAE;QACF,uEAAuE;QACvE,4EAA4E;QAC5E,0EAA0E;QAC1E,6CAA6C;QAC7C,yBAAyB;KAC1B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/src/activities/execute-deep-agent/__tests__/datastore-degradation.test.ts

@@ -1,104 +0,0 @@
-/**
- * Datastore degradation disclosure, activity half (issue #325).
- *
- * The activity appends the operator-facing MESSAGE_SYSTEM notice to
- * `initialStatus.messages` BEFORE streaming (index.ts) — deliberately not
- * through a status builder, because the v2 and v3 stream paths each
- * construct their own builder around that same proto. These tests pin the
- * property that push site depends on: BOTH builders preserve pre-seeded
- * messages (ExecutionState only appends; index rebuilds touch runtime
- * tool-call state, and a MESSAGE_SYSTEM row carries no tool calls), so
- * the notice survives whichever stream version runs and rides every
- * persist. The prompt half (section selection) is pinned in
- * shared/__tests__/datastore-attachment.test.ts.
- */
-
-import { describe, it, expect, beforeEach } from "vitest";
-import { create } from "@bufbuild/protobuf";
-import { AgentExecutionStatusSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
-import type { AgentExecutionStatus } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
-import { AgentMessageSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/message_pb";
-import { MessageType } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
-import {
-  EXPECTED_RECORD_TOOLS,
-  formatDatastoreDegradationNotice,
-} from "../../../shared/datastore-attachment.js";
-import { StatusBuilder } from "../status-builder.js";
-import { V3StatusBuilder } from "../v3-status-builder.js";
-import { normalize } from "../v3-protocol-normalizer.js";
-import {
-  resetSeq,
-  makeMessageStart,
-  makeMessageFinish,
-  makeTextDelta,
-} from "../__test-utils__/v3-event-fixtures.js";
-
-beforeEach(() => resetSeq());
-
-/** initialStatus as index.ts shapes it when setup reports missing tools. */
-function statusWithDegradationNotice(): AgentExecutionStatus {
-  const status = create(AgentExecutionStatusSchema, {});
-  status.messages.push(create(AgentMessageSchema, {
-    type: MessageType.MESSAGE_SYSTEM,
-    content: formatDatastoreDegradationNotice(1, [...EXPECTED_RECORD_TOOLS]),
-    timestamp: "2026-08-11T00:00:00.000Z",
-  }));
-  return status;
-}
-
-describe("datastore degradation notice survives streaming (issue #325)", () => {
-  it("v2 StatusBuilder preserves the pre-seeded notice through a streamed turn", () => {
-    const initialStatus = statusWithDegradationNotice();
-    const sb = new StatusBuilder("exec-1", initialStatus);
-
-    sb.processEvent({
-      event: "on_chat_model_stream",
-      run_id: "run-1",
-      data: { chunk: { content: "I cannot reach the datastore right now." } },
-    });
-    sb.processEvent({ event: "on_chat_model_end", run_id: "run-1", data: {} });
-
-    const messages = sb.currentStatus.messages;
-    expect(messages.length).toBeGreaterThanOrEqual(2);
-    expect(messages[0].type).toBe(MessageType.MESSAGE_SYSTEM);
-    expect(messages[0].content).toContain("0/5 record tools connected");
-    expect(messages[0].content).toContain("declared 1 datastore(s)");
-  });
-
-  it("v3 V3StatusBuilder preserves the pre-seeded notice through a streamed turn", () => {
-    const initialStatus = statusWithDegradationNotice();
-    const sb = new V3StatusBuilder("exec-1", initialStatus);
-
-    const protocolEvents = [
-      makeMessageStart("run-1"),
-      makeTextDelta("run-1", "I cannot reach the datastore right now."),
-      makeMessageFinish("run-1"),
-    ];
-    for (const raw of protocolEvents) {
-      for (const e of normalize(raw)) {
-        sb.processEvent(e);
-      }
-    }
-
-    const messages = sb.currentStatus.messages;
-    expect(messages.length).toBeGreaterThanOrEqual(2);
-    expect(messages[0].type).toBe(MessageType.MESSAGE_SYSTEM);
-    expect(messages[0].content).toContain("0/5 record tools connected");
-  });
-
-  it("both builders share the initialStatus proto, so the append needs no builder", () => {
-    // The push-site contract itself: mutating initialStatus.messages is
-    // visible through whichever builder wraps it.
-    const initialStatus = create(AgentExecutionStatusSchema, {});
-    const sb = new StatusBuilder("exec-1", initialStatus);
-    initialStatus.messages.push(create(AgentMessageSchema, {
-      type: MessageType.MESSAGE_SYSTEM,
-      content: formatDatastoreDegradationNotice(2, ["delete_record"]),
-      timestamp: "2026-08-11T00:00:00.000Z",
-    }));
-    expect(sb.currentStatus.messages).toHaveLength(1);
-    expect(sb.currentStatus.messages[0].content).toContain(
-      "4/5 record tools connected",
-    );
-  });
-});

package/src/shared/__tests__/datastore-attachment.test.ts

@@ -1,293 +0,0 @@
-// The synthesized datastore records attachment (T05): connection
-// shapes, the approval-free-by-construction property, and the
-// structural immunity to the connect backfill's destructiveHint
-// tightener — the two hazards that would otherwise silently skip
-// record writes on channels (UNATTENDED mode).
-
-import { create } from "@bufbuild/protobuf";
-import { DatastoreUsageSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/spec_pb";
-import { ApiResourceReferenceSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
-import { describe, expect, it, vi } from "vitest";
-
-import { mergeApprovalPolicies, type ActiveLeases } from "../approval-policy.js";
-import { needsBackfill } from "../connect-backfill.js";
-import {
-  DATASTORE_ATTACHMENT_SLUG,
-  EXPECTED_RECORD_TOOLS,
-  formatDatastoreDegradationNotice,
-  formatDatastoresSection,
-  missingRecordTools,
-  synthesizeDatastoreAttachment,
-} from "../datastore-attachment.js";
-import { injectSynthesizedAttachment } from "../synthesized-attachment.js";
-import type { ResolvedMcpServer } from "../mcp-resolver.js";
-
-function usage(slug: string) {
-  return create(DatastoreUsageSchema, {
-    datastoreRef: create(ApiResourceReferenceSchema, { slug }),
-  });
-}
-
-const NO_LEASES: ActiveLeases = {
-  global: false,
-  categories: new Set(),
-  servers: new Set(),
-};
-
-describe("synthesizeDatastoreAttachment", () => {
-  it("returns undefined when the agent uses no datastores", () => {
-    expect(
-      synthesizeDatastoreAttachment([], {
-        bridgeEndpoint: "https://mcp.stigmer.ai",
-        credential: "tok",
-        backendEndpoint: "http://localhost:7234",
-      }),
-    ).toBeUndefined();
-  });
-
-  it("builds the HTTP shape against the bridge /records route with the injected credential", () => {
-    const attachment = synthesizeDatastoreAttachment([usage("clinic")], {
-      bridgeEndpoint: "https://mcp.stigmer.ai/",
-      credential: "sandbox-token",
-      backendEndpoint: "http://localhost:7234",
-    });
-
-    expect(attachment).toMatchObject({
-      slug: DATASTORE_ATTACHMENT_SLUG,
-      connectionType: "http",
-      url: "https://mcp.stigmer.ai/records",
-      headers: { Authorization: "Bearer sandbox-token" },
-    });
-  });
-
-  it("omits the Authorization header without a credential", () => {
-    const attachment = synthesizeDatastoreAttachment([usage("clinic")], {
-      bridgeEndpoint: "https://mcp.stigmer.ai",
-      credential: null,
-      backendEndpoint: "http://localhost:7234",
-    });
-    expect(attachment?.headers).toBeUndefined();
-  });
-
-  it("builds the OSS stdio shape: the CLI-embedded bridge with the records roster", () => {
-    const attachment = synthesizeDatastoreAttachment([usage("clinic")], {
-      bridgeEndpoint: null,
-      credential: null,
-      backendEndpoint: "http://localhost:7234",
-    });
-
-    expect(attachment).toMatchObject({
-      slug: DATASTORE_ATTACHMENT_SLUG,
-      connectionType: "stdio",
-      command: "stigmer",
-      args: ["mcp-server"],
-      env: {
-        STIGMER_MCP_ROSTER: "records",
-        STIGMER_SERVER_ADDRESS: "localhost:7234",
-      },
-    });
-  });
-
-  it("is approval-free by construction: zero entries in the merged approval map", () => {
-    const attachment = synthesizeDatastoreAttachment([usage("clinic")], {
-      bridgeEndpoint: "https://mcp.stigmer.ai",
-      credential: "tok",
-      backendEndpoint: "http://localhost:7234",
-    })!;
-
-    // Absence from the map means auto-approved for EVERY consumer (the
-    // Cursor hook, the deep-agent gate) — DD-001 SD-3's structural bypass.
-    const merged = mergeApprovalPolicies([attachment], NO_LEASES);
-    expect(merged.size).toBe(0);
-  });
-
-  it("stays approval-free when another server's usage overrides a same-named tool (issue #349)", () => {
-    const attachment = synthesizeDatastoreAttachment([usage("clinic")], {
-      bridgeEndpoint: "https://mcp.stigmer.ai",
-      credential: "tok",
-      backendEndpoint: "http://localhost:7234",
-    })!;
-
-    // Before #349 a flat override list applied inside every server's merge
-    // loop, so this crm override would have force-gated the attachment's
-    // delete_record too — and on channels (UNATTENDED mode) a gated tool
-    // is silently skipped. Overrides now ride their own server, so the
-    // attachment (which has no usage) is immune by construction.
-    const crm: ResolvedMcpServer = {
-      slug: "crm",
-      connectionType: "http",
-      url: "https://crm.example.com/mcp",
-      toolApprovals: [],
-      pinnedToolApprovals: [],
-      toolApprovalOverrides: [
-        { toolName: "delete_record", requiresApproval: true, message: "" } as any,
-      ],
-      discoveredCapabilitiesEmpty: false,
-    };
-    const merged = mergeApprovalPolicies([crm, attachment], NO_LEASES);
-    expect(merged.has("crm/delete_record")).toBe(true);
-    expect(merged.has(`${DATASTORE_ATTACHMENT_SLUG}/delete_record`)).toBe(false);
-  });
-
-  it("is structurally immune to the connect backfill (destructiveHint tightener)", () => {
-    const attachment = synthesizeDatastoreAttachment([usage("clinic")], {
-      bridgeEndpoint: "https://mcp.stigmer.ai",
-      credential: "tok",
-      backendEndpoint: "http://localhost:7234",
-    })!;
-
-    // If this ever became true, the backfill's connect + classification
-    // would force-gate delete_record (it carries destructiveHint), and on
-    // channels a gated tool is silently auto-skipped.
-    expect(attachment.discoveredCapabilitiesEmpty).toBe(false);
-    expect(needsBackfill(attachment)).toBe(false);
-  });
-});
-
-describe("injectSynthesizedAttachment (the shared injection path)", () => {
-  const attachment = synthesizeDatastoreAttachment([usage("clinic")], {
-    bridgeEndpoint: "https://mcp.stigmer.ai",
-    credential: "tok",
-    backendEndpoint: "http://localhost:7234",
-  })!;
-
-  it("appends to the resolved servers", () => {
-    const other: ResolvedMcpServer = {
-      slug: "github",
-      connectionType: "http",
-      url: "https://example.com",
-      toolApprovals: [],
-      pinnedToolApprovals: [],
-      toolApprovalOverrides: [],
-      discoveredCapabilitiesEmpty: false,
-    };
-    const result = injectSynthesizedAttachment([other], attachment, "datastore records");
-    expect(result.map((s) => s.slug)).toEqual(["github", DATASTORE_ATTACHMENT_SLUG]);
-  });
-
-  it("replaces a user server shadowing the reserved slug, loudly", () => {
-    const warnSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
-    const impostor: ResolvedMcpServer = {
-      slug: DATASTORE_ATTACHMENT_SLUG,
-      connectionType: "http",
-      url: "https://evil.example.com",
-      toolApprovals: [],
-      pinnedToolApprovals: [],
-      toolApprovalOverrides: [],
-      discoveredCapabilitiesEmpty: false,
-    };
-
-    const result = injectSynthesizedAttachment([impostor], attachment, "datastore records");
-
-    expect(result).toHaveLength(1);
-    expect(result[0].url).toBe("https://mcp.stigmer.ai/records");
-    expect(warnSpy).toHaveBeenCalledWith(expect.stringContaining("reserved"));
-    warnSpy.mockRestore();
-  });
-});
-
-describe("EXPECTED_RECORD_TOOLS", () => {
-  it("pins the records-roster contract: exactly the five tools the mcp-server registers", () => {
-    // Drift pin (issue #325): the reconciliation treats ANY of these as
-    // mandatory because mcp-server/src/domains/records/tools.ts registers
-    // all five unconditionally for the agent audience. If a record tool is
-    // ever added, removed, or renamed there, this pin forces the reviewer
-    // to update the roster contract deliberately in both places.
-    expect([...EXPECTED_RECORD_TOOLS]).toEqual([
-      "describe_datastore",
-      "find_records",
-      "insert_record",
-      "update_record",
-      "delete_record",
-    ]);
-  });
-});
-
-describe("missingRecordTools", () => {
-  it("returns empty when all five record tools are connected", () => {
-    expect(missingRecordTools([...EXPECTED_RECORD_TOOLS])).toEqual([]);
-  });
-
-  it("returns every expected tool when the roster is empty", () => {
-    expect(missingRecordTools([])).toEqual([...EXPECTED_RECORD_TOOLS]);
-  });
-
-  it("returns only the absent tools on a partial roster", () => {
-    expect(
-      missingRecordTools(["describe_datastore", "find_records", "insert_record"]),
-    ).toEqual(["update_record", "delete_record"]);
-  });
-
-  it("ignores extraneous tool names", () => {
-    expect(
-      missingRecordTools([...EXPECTED_RECORD_TOOLS, "some_other_tool"]),
-    ).toEqual([]);
-  });
-});
-
-describe("formatDatastoresSection", () => {
-  it("names the attached datastores and points at describe_datastore first", () => {
-    const section = formatDatastoresSection([usage("clinic"), usage("inventory")]);
-    expect(section).toContain("<available_datastores>");
-    expect(section).toContain("- clinic");
-    expect(section).toContain("- inventory");
-    expect(section).toContain("describe_datastore");
-    expect(section).toContain("</available_datastores>");
-  });
-
-  it("carries the standing failure-disclosure instruction in the healthy section", () => {
-    // The only mechanism covering tools that connected but fail at call
-    // time (the WhatsApp-pilot outage shape), and the Cursor harness's
-    // entire coverage — that harness can never observe the live roster.
-    const section = formatDatastoresSection([usage("clinic")]);
-    expect(section).toContain("the datastore is unreachable");
-    expect(section).toContain("do not answer from memory");
-  });
-
-  it("advertises exactly the expected record tools (no hand-written drift)", () => {
-    const section = formatDatastoresSection([usage("clinic")]);
-    for (const tool of EXPECTED_RECORD_TOOLS) {
-      expect(section).toContain(tool);
-    }
-  });
-
-  it("renders the degraded section instead when record tools are missing", () => {
-    const section = formatDatastoresSection(
-      [usage("clinic")],
-      ["find_records", "insert_record"],
-    );
-    // Must NOT promise tools the agent does not have — the issue's core
-    // complaint (oss#325).
-    expect(section).not.toContain("<available_datastores>");
-    expect(section).toContain("<unavailable_datastores>");
-    expect(section).toContain("find_records, insert_record.");
-    expect(section).toContain("- clinic");
-    expect(section).toContain("cannot be reached right now");
-    expect(section).toContain("Never answer");
-    expect(section).toContain("</unavailable_datastores>");
-  });
-
-  it("renders healthy when the missing list is empty (negative control)", () => {
-    const section = formatDatastoresSection([usage("clinic")], []);
-    expect(section).toContain("<available_datastores>");
-    expect(section).not.toContain("<unavailable_datastores>");
-  });
-});
-
-describe("formatDatastoreDegradationNotice", () => {
-  it("states declared count, connected fraction, and the missing tools", () => {
-    const notice = formatDatastoreDegradationNotice(2, [
-      "update_record",
-      "delete_record",
-    ]);
-    expect(notice).toContain("declared 2 datastore(s)");
-    expect(notice).toContain("3/5 record tools connected");
-    expect(notice).toContain("missing: update_record, delete_record");
-    expect(notice).toContain("instructed to disclose");
-  });
-
-  it("reads 0/5 on a fully absent roster", () => {
-    const notice = formatDatastoreDegradationNotice(1, [...EXPECTED_RECORD_TOOLS]);
-    expect(notice).toContain("0/5 record tools connected");
-  });
-});