@strixgov/mcp-proxy 0.1.8 → 0.2.1

package/CHANGELOG.md

@@ -5,6 +5,58 @@ All notable changes to `@strixgov/mcp-proxy` are documented here.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+## [0.2.1]
+
+### Fixed
+- `npm test` in the published package crashed with a missing
+  `scripts/preflight.mjs` (the tarball did not ship `scripts/`). `test` now runs
+  `scripts/run-tests.mjs`, which runs the suite in a source checkout and, in an
+  installed copy, exits non-zero with an explanation rather than crashing or
+  passing on zero tests. Reported by an external tester.
+
+## [0.2.0]
+
+Minor, not a patch: this release carries the already-merged shadow-discovery
+feature (below) to npm for the first time, alongside a dependency-range fix.
+Neither has shipped to npm before this release — `0.1.8` predates both.
+
+### Added
+- **Shadow discovery (GSD-1 Phase 4)** — `src/shadow-discovery.mjs`,
+  on by default (opt out with `shadowDiscovery: false`). The proxy
+  already sits on the live tool-call path; this module records what the
+  upstream actually advertises and what the agent actually calls, and
+  reports the delta against the classified capability set — the action
+  surfaces static discovery (source scanners, Semgrep pack) structurally
+  cannot see. Strictly observation: it never changes a verdict and never
+  touches the policy / approval / receipt pipeline. Output is a
+  `snapshot()` on the `startProxy` handle plus an append-only JSONL log
+  at `<storagePath>/shadow-discovery.jsonl`; every snapshot and log line
+  carries the mandatory `measurement` disclaimer (**unsigned
+  measurement, never proof**) and nothing receipt-shaped. New exports:
+  `createShadowDiscovery`, `SHADOW_LOG_BASENAME`,
+  `SHADOW_MEASUREMENT_DISCLAIMER`; new handle fields `shadowDiscovery`,
+  `shadowDiscoveryLogPath`. Program doc:
+  `solo-builder-core/docs/proposals/governed-surface-discovery-v1.md`.
+
+### Fixed
+- `dependencies["@strixgov/tool-gateway"]` was published (in `0.1.8`) as
+  `^0.4.1` — a hard, non-optional dependency, so a fresh `npm install
+  @strixgov/mcp-proxy` resolved the highest matching version, `0.4.1`,
+  never `0.5.0`. `0.5.0` fixed a real defect in `tool-gateway`'s
+  `terminalApprove()`: a non-interactive-session guard that could never
+  fire (`isTTY === false` — Node marks a real TTY `true` and leaves
+  everything else `undefined`, never `false`), so a headless approval
+  request fell through to writing a prompt banner onto `stdout`. For
+  this package specifically, `stdout` **is** the live MCP JSON-RPC
+  channel, so the stray banner corrupted the protocol stream a client
+  was mid-parse on. The in-repo dependency range was corrected to
+  `^0.5.0` when `tool-gateway@0.5.0` shipped, but this package was never
+  republished against it — every `npm install` of `0.1.8` (and, by the
+  same defect, of `0.1.5`–`0.1.7`) still pulled the buggy range. This
+  release is the republish; no other code changed for this fix.
+
 ## [0.1.8]
 
 Republish of 0.1.7 with correct dependency specifiers — code is

package/bin/strix-mcp-proxy.mjs

@@ -14,13 +14,7 @@
  *     --policy-default DENY \
  *     --risk-low ALLOW --risk-medium APPROVAL_REQUIRED
  *
- * The CLI is intentionally minimal — anything elaborate goes in the
- * config file. Operators wiring this into Claude Desktop, mcp-cli, or
- * an IDE integration just change their existing MCP command from
- * `<upstream>` to `strix-mcp-proxy --config <path>`.
- *
- * Audit events (proxy lifecycle + denied calls) print to stderr so the
- * MCP stdio channel on stdout stays clean for the protocol.
+ * Audit events print to stderr so the MCP stdio channel on stdout stays clean.
  */
 
 import { startProxy, loadConfig, resolveCapabilities } from "../src/index.mjs";
@@ -41,15 +35,22 @@ try {
   const handle = await startProxy({
     ...opts,
     onAudit: (event) => {
-      // stderr: doesn't collide with the MCP stdio protocol on stdout.
       console.error(`[strix-proxy] ${event.kind} ${JSON.stringify(event.detail)}`);
     },
     onReceipt: (r) => {
-      // One-line summary per receipt; full receipts persist via storagePath when set.
-      console.error(`[strix-proxy] receipt ${r.decision} ${r.capabilityId}`);
+      // This is the signed pre-invocation authorization receipt.
+      console.error(`[strix-proxy] authorization ${r.decision} ${r.capabilityId} ${r.receiptId}`);
     },
   });
 
+  // Signed post-execution outcomes are separate artifacts. They are emitted
+  // only after an ALLOW path actually attempts the upstream call.
+  handle.gateway.on("outcome", (outcome) => {
+    console.error(
+      `[strix-proxy] outcome ${outcome.executionStatus} ${outcome.capabilityId} ${outcome.outcomeId}`,
+    );
+  });
+
   const shutdown = async (signal) => {
     console.error(`[strix-proxy] shutting down (${signal})`);
     try { await handle.stop(); } catch { /* best-effort */ }
@@ -62,8 +63,6 @@ try {
   process.exit(1);
 }
 
-// ─── arg parsing ────────────────────────────────────────────────────────────
-
 async function parseArgs(argv) {
   const flag = (name) => {
     const i = argv.indexOf(name);
@@ -83,6 +82,7 @@ async function parseArgs(argv) {
     return {
       serverId: cfg.serverId,
       upstream: cfg.upstream,
+      upstreamCredentials: cfg.upstreamCredentials,
       capabilities: await resolveCapabilities(cfg.capabilities),
       policy: cfg.policy,
       approval: cfg.approval,
@@ -101,8 +101,8 @@ async function parseArgs(argv) {
   const policyDefault = flag("--policy-default") ?? "DENY";
   const riskOverrides = {};
   for (const level of ["LOW", "MEDIUM", "HIGH", "CRITICAL"]) {
-    const v = flag(`--risk-${level.toLowerCase()}`);
-    if (v) riskOverrides[level] = v;
+    const value = flag(`--risk-${level.toLowerCase()}`);
+    if (value) riskOverrides[level] = value;
   }
   const approvalEnabled = argv.includes("--approval-enabled");
   const storagePath = flag("--storage-path");
@@ -143,15 +143,22 @@ FLAG MODE
   --risk-high <D>           Override decision for HIGH-risk calls
   --risk-critical <D>       Override decision for CRITICAL-risk calls
   --approval-enabled        Enable the approval gate (requires custom prompt)
-  --storage-path <dir>      Persist receipts to JSONL at this directory
-                            (default: in-memory)
+  --storage-path <dir>      Persist authorization receipts and execution outcomes
+                            (default: ~/.strix-mcp-proxy/<serverId>)
+
+TRUSTED WORKLOAD IDENTITY
+  STRIX_TRUSTED_ACTOR_ID          Fixed authenticated workload identity
+  STRIX_TRUSTED_ACTOR_ROLE        Optional role bound to authorization receipts
+  STRIX_REQUIRE_TRUSTED_IDENTITY  Set true to reject client-only identity claims
+  STRIX_TENANT_ID                 Tenant bound into signed artifacts
+  STRIX_ENVIRONMENT               Environment bound into signed artifacts
 
 GENERAL
   --help, -h                Show this help
   --version, -v             Show proxy version
 
-The proxy speaks MCP over stdio toward its consumer. Configure your
-MCP-aware client (Claude Desktop, mcp-cli, etc.) to spawn this binary
-in place of the upstream MCP server you previously used directly.
+The proxy speaks MCP over stdio toward its consumer. NVIDIA OO Agents,
+Claude Desktop, mcp-cli, and other .mcp.json clients can spawn this binary
+in place of the upstream MCP server.
 `);
 }

package/examples/nvidia-nooa/.mcp.json

@@ -0,0 +1,20 @@
+{
+  "mcpServers": {
+    "strix_secure_coding": {
+      "command": "node",
+      "args": [
+        "./packages/strixgov-mcp-proxy/bin/strix-mcp-proxy.mjs",
+        "--config",
+        "./packages/strixgov-mcp-proxy/examples/nvidia-nooa/proxy-config.json"
+      ],
+      "env": {
+        "STRIX_TRUSTED_ACTOR_ID": "spiffe://openshell.local/nooa/remediator",
+        "STRIX_TRUSTED_ACTOR_ROLE": "agent",
+        "STRIX_REQUIRE_TRUSTED_IDENTITY": "true",
+        "STRIX_TENANT_ID": "nvidia-nooa-demo",
+        "STRIX_ENVIRONMENT": "openshell"
+      },
+      "transport": "stdio"
+    }
+  }
+}

package/examples/nvidia-nooa/README.md

@@ -0,0 +1,181 @@
+# NVIDIA OO Agents + Strix governed MCP profile
+
+This example connects NVIDIA OO Agents (NOOA) to an existing MCP server through
+`@strixgov/mcp-proxy`.
+
+NOOA keeps its native object model: `MCPManager.create_from_server()` discovers
+the MCP tools and generates typed Python methods from their JSON Schemas. Strix
+is inserted at the MCP side-effect boundary, not into the model prompt or NOOA
+reasoning loop.
+
+## Architecture
+
+```text
+NOOA Agent
+  |
+  | MCP stdio (.mcp.json)
+  v
+Strix MCP Proxy
+  |-- trusted workload identity
+  |-- capability classification
+  |-- ALLOW / APPROVAL_REQUIRED / DENY
+  |-- signed authorization receipt before invocation
+  |-- signed execution outcome after an allowed invocation
+  v
+Upstream MCP server
+```
+
+The example policy permits repository inspection and patch proposal, requires
+separate approval for production merge, and denies credential rotation.
+
+## Prerequisites
+
+- Node.js 18+
+- the Strix monorepo dependencies installed
+- a checkout of NVIDIA `labs-OO-Agents` with its MCP extra installed
+- Python and `uv` as required by NOOA
+
+From the Strix monorepo root:
+
+```bash
+pnpm install --frozen-lockfile
+```
+
+From the NVIDIA OO Agents checkout:
+
+```bash
+uv sync --extra mcp
+```
+
+## Run without OpenShell
+
+The Python process must use the NOOA environment, while its working directory
+must be the Strix monorepo root so the relative paths in `.mcp.json` and
+`proxy-config.json` resolve.
+
+Activate the NOOA environment first:
+
+```bash
+# Linux or macOS, from the NVIDIA OO Agents checkout
+source .venv/bin/activate
+
+# Windows PowerShell
+.\.venv\Scripts\Activate.ps1
+```
+
+Then change to the Strix monorepo root and run:
+
+```bash
+python packages/strixgov-mcp-proxy/examples/nvidia-nooa/nooa_agent.py
+```
+
+The NOOA MCP configuration starts the Strix proxy, and the proxy starts the demo
+upstream MCP server. Running `uv run` from the Strix repository without selecting
+the NOOA project environment is not sufficient because Strix itself does not
+declare the NOOA Python package.
+
+## Run in NVIDIA OpenShell
+
+Create the sandbox first, then apply the complete policy and wait for the
+sandbox to confirm the hot-reload:
+
+```bash
+openshell sandbox create --name nooa-strix
+
+openshell policy set nooa-strix \
+  --policy packages/strixgov-mcp-proxy/examples/nvidia-nooa/openshell-policy.yaml \
+  --wait
+
+openshell sandbox connect nooa-strix
+```
+
+The policy file includes the static filesystem/process fields because
+`openshell policy set` replaces the entire policy. Its GitHub REST rule uses
+`tls: terminate`, `enforcement: enforce`, and `access: read-only`, allowing the
+listed Node proxy binaries to make read requests while rejecting mutating HTTP
+methods. All other outbound traffic remains denied unless another policy or
+configured inference provider permits it.
+
+Adapt binary paths, endpoints, and inference-provider configuration to the
+actual image before treating the template as production configuration.
+
+## Trusted identity
+
+`.mcp.json` supplies a fixed workload identity to the proxy process:
+
+```text
+STRIX_TRUSTED_ACTOR_ID=spiffe://openshell.local/nooa/remediator
+STRIX_REQUIRE_TRUSTED_IDENTITY=true
+```
+
+This identity overrides any `strix_actor_id` value supplied by the MCP client.
+Client metadata remains a claim, not an authentication boundary. If required
+identity cannot be resolved, Strix emits a signed DENY authorization receipt and
+does not call the upstream handler.
+
+For production, replace the fixed identity with an authenticated resolver tied
+to the workload transport or OpenShell control plane.
+
+## Evidence
+
+The proxy writes two append-only files under `.strix-nooa/evidence/`:
+
+```text
+receipts.jsonl            signed pre-invocation authorization receipts
+execution-outcomes.jsonl  signed post-invocation outcome records
+```
+
+A denied or unapproved action has no execution-outcome record because the
+upstream handler was not invoked. An allowed action has a linked `SUCCEEDED` or
+`FAILED` outcome.
+
+The public key is stored under `.strix-nooa/keys/public-jwk.json`. Verify both
+the authorization chain and all linked execution outcomes offline from the
+Strix monorepo root:
+
+```bash
+node packages/strixgov-mcp-proxy/examples/nvidia-nooa/verify-proof.mjs
+```
+
+The command exits `0` only when the authorization chain and every published
+execution outcome return `VERIFIED`. It prints machine-readable JSON with the
+schema, hash, key-resolution, signature, consistency, and authorization-link
+results for each outcome.
+
+The independent outcome verifier is also exported for other tools:
+
+```javascript
+import { verifyExecutionOutcomeRecord } from "@strixgov/verifier/execution-outcome";
+```
+
+Verification checks the published schema, rejects unsigned extension fields,
+and reports the outcome hash, key resolution, Ed25519 signature,
+execution-state consistency, and authorization-receipt link separately.
+
+## Approval behavior
+
+`merge_production` uses the file approver. The proxy writes an approval request
+under `.strix-nooa/approvals/` and waits up to five minutes. Without an approved
+response, execution fails closed and the upstream merge handler is not invoked.
+
+`rotate_credentials` is denied directly by policy.
+
+## Truthful claim boundary
+
+This example demonstrates that calls flowing through the configured Strix proxy
+are evaluated before invocation and produce portable signed authorization and
+outcome evidence.
+
+It does not prove that every possible route to a real downstream service is
+blocked. The stronger anti-bypass claim requires one of these deployment
+conditions:
+
+- OpenShell or network policy prevents the agent from reaching the downstream
+  directly;
+- the proxy is the sole credential holder; or
+- the downstream validates a Strix `execution_authorization_v1` token before
+  performing the side effect.
+
+The demo upstream is intentionally non-consequential. Replace it with a real MCP
+server only after capability classification, approval handling, credential
+custody, and anti-bypass controls have been reviewed for that deployment.

package/examples/nvidia-nooa/demo-upstream.mjs

@@ -0,0 +1,89 @@
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import {
+  CallToolRequestSchema,
+  ListToolsRequestSchema,
+} from "@modelcontextprotocol/sdk/types.js";
+
+const server = new Server(
+  { name: "strix-nooa-secure-coding-demo", version: "0.1.0" },
+  { capabilities: { tools: {} } },
+);
+
+const tools = [
+  {
+    name: "inspect_repository",
+    description: "Inspect repository metadata without modifying the repository.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        repository: { type: "string" },
+        ref: { type: "string", default: "HEAD" },
+      },
+      required: ["repository"],
+    },
+  },
+  {
+    name: "propose_patch",
+    description: "Create a patch proposal on a remediation branch without merging it.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        repository: { type: "string" },
+        finding: { type: "string" },
+      },
+      required: ["repository", "finding"],
+    },
+  },
+  {
+    name: "merge_production",
+    description: "Merge an approved commit to the production branch.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        repository: { type: "string" },
+        commit: { type: "string" },
+      },
+      required: ["repository", "commit"],
+    },
+  },
+  {
+    name: "rotate_credentials",
+    description: "Rotate a production credential.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        credential: { type: "string" },
+      },
+      required: ["credential"],
+    },
+  },
+];
+
+server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools }));
+
+server.setRequestHandler(CallToolRequestSchema, async (request) => {
+  const { name, arguments: args = {} } = request.params;
+  switch (name) {
+    case "inspect_repository":
+      return {
+        content: [{ type: "text", text: JSON.stringify({ repository: args.repository, ref: args.ref ?? "HEAD", findings: 1 }) }],
+      };
+    case "propose_patch":
+      return {
+        content: [{ type: "text", text: JSON.stringify({ branch: "remediation/nooa-demo", patchProposed: true }) }],
+      };
+    case "merge_production":
+      return {
+        content: [{ type: "text", text: JSON.stringify({ merged: true, commit: args.commit }) }],
+      };
+    case "rotate_credentials":
+      return {
+        content: [{ type: "text", text: JSON.stringify({ rotated: true, credential: args.credential }) }],
+      };
+    default:
+      throw new Error(`Unknown tool '${name}'`);
+  }
+});
+
+await server.connect(new StdioServerTransport());

package/examples/nvidia-nooa/nooa_agent.py

@@ -0,0 +1,45 @@
+from pathlib import Path
+
+try:
+    from nooa.mcp import MCPManager
+except ImportError as exc:
+    raise ImportError(
+        "NVIDIA OO Agents MCP support is required. In the NOOA repository run: uv sync --extra mcp"
+    ) from exc
+
+from nooa.util.quickstart import Agent, autorun, llm
+
+
+MCP_CONFIG = Path(__file__).with_name(".mcp.json")
+
+
+class GovernedRemediationAgent(Agent, llm=llm):
+    """Inspect a repository and propose remediation without bypassing Strix governance.
+
+    Use the Strix-governed MCP tools. Repository inspection and patch proposal are
+    permitted by the demo policy. Production merge requires a separate approval.
+    Credential rotation is prohibited.
+    """
+
+    secure_coding = MCPManager.create_from_server(
+        "strix_secure_coding",
+        mcp_file=MCP_CONFIG,
+    )
+
+    async def remediate(self, repository: str, finding: str) -> str:
+        """Inspect the repository, propose a patch for the finding, and report the result.
+
+        Do not attempt production merge or credential rotation unless the user
+        explicitly requests it; Strix will independently evaluate every tool call.
+        """
+        ...
+
+
+@autorun
+async def main() -> None:
+    agent = GovernedRemediationAgent()
+    result = await agent.remediate(
+        "demo/repo",
+        "Dependency input is accepted without validation",
+    )
+    print(result)

package/examples/nvidia-nooa/openshell-policy.yaml

@@ -0,0 +1,43 @@
+version: 1
+
+# Static controls. Paths not listed are inaccessible.
+filesystem_policy:
+  include_workdir: true
+  read_only:
+    - /usr
+    - /lib
+    - /proc
+    - /dev/urandom
+    - /etc
+    - /app
+    - /var/log
+  read_write:
+    - /sandbox
+    - /tmp
+    - /dev/null
+
+landlock:
+  compatibility: best_effort
+
+process:
+  run_as_user: sandbox
+  run_as_group: sandbox
+
+# Dynamic network controls. The Python NOOA process receives no ordinary
+# outbound network permission here. A production deployment should route model
+# inference through OpenShell's configured inference provider. Only the Node
+# proxy process receives read-only GitHub API access in this example; mutating
+# methods remain blocked at OpenShell even if application policy is bypassed.
+network_policies:
+  strix_proxy_github_readonly:
+    name: strix-proxy-github-readonly
+    endpoints:
+      - host: api.github.com
+        port: 443
+        protocol: rest
+        tls: terminate
+        enforcement: enforce
+        access: read-only
+    binaries:
+      - path: /usr/bin/node
+      - path: /usr/local/bin/node

package/examples/nvidia-nooa/proxy-config.json

@@ -0,0 +1,56 @@
+{
+  "serverId": "nooa-secure-coding",
+  "upstream": {
+    "command": "node",
+    "args": [
+      "./packages/strixgov-mcp-proxy/examples/nvidia-nooa/demo-upstream.mjs"
+    ]
+  },
+  "capabilities": [
+    {
+      "id": "mcp.nooa-secure-coding.inspect_repository",
+      "name": "inspect_repository",
+      "risk": "LOW",
+      "mode": "READ",
+      "description": "Inspect repository metadata without modification."
+    },
+    {
+      "id": "mcp.nooa-secure-coding.propose_patch",
+      "name": "propose_patch",
+      "risk": "HIGH",
+      "mode": "WRITE",
+      "description": "Create a patch proposal without merging it."
+    },
+    {
+      "id": "mcp.nooa-secure-coding.merge_production",
+      "name": "merge_production",
+      "risk": "CRITICAL",
+      "mode": "WRITE",
+      "description": "Merge an approved commit to production."
+    },
+    {
+      "id": "mcp.nooa-secure-coding.rotate_credentials",
+      "name": "rotate_credentials",
+      "risk": "CRITICAL",
+      "mode": "WRITE",
+      "description": "Rotate a production credential."
+    }
+  ],
+  "policy": {
+    "rules": {
+      "mcp.nooa-secure-coding.inspect_repository": "ALLOW",
+      "mcp.nooa-secure-coding.propose_patch": "ALLOW",
+      "mcp.nooa-secure-coding.merge_production": "APPROVAL_REQUIRED",
+      "mcp.nooa-secure-coding.rotate_credentials": "DENY"
+    },
+    "default": "DENY"
+  },
+  "approval": {
+    "enabled": true,
+    "type": "file",
+    "requestDir": "./.strix-nooa/approvals",
+    "timeoutMs": 300000
+  },
+  "storagePath": "./.strix-nooa/evidence",
+  "keyPath": "./.strix-nooa/keys"
+}

package/examples/nvidia-nooa/verify-proof.mjs

@@ -0,0 +1,79 @@
+#!/usr/bin/env node
+
+import fs from "node:fs/promises";
+import path from "node:path";
+
+import { verifyReceiptChain } from "@strixgov/verifier";
+import { verifyExecutionOutcomeRecord } from "@strixgov/verifier/execution-outcome";
+
+const root = process.argv[2] ?? ".strix-nooa";
+const evidenceDir = path.join(root, "evidence");
+const keyDir = path.join(root, "keys");
+
+const receipts = await readJsonl(path.join(evidenceDir, "receipts.jsonl"));
+const outcomes = await readJsonl(path.join(evidenceDir, "execution-outcomes.jsonl"));
+const publicJwk = JSON.parse(
+  await fs.readFile(path.join(keyDir, "public-jwk.json"), "utf8"),
+);
+const jwks = "keys" in publicJwk ? publicJwk : { keys: [publicJwk] };
+
+const authorization = await verifyReceiptChain(receipts, { jwks });
+const byId = new Map(receipts.map((receipt) => [receipt.receiptId, receipt]));
+const execution = outcomes.map((outcome) => {
+  const authorizationReceipt = byId.get(outcome.authorizationReceiptId) ?? null;
+  return verifyExecutionOutcomeRecord(outcome, {
+    jwks,
+    authorizationReceipt,
+  });
+});
+
+const verdict =
+  authorization.chainValid === true &&
+  authorization.receipts.every(
+    (receipt) => receipt.verificationStatus === "VERIFIED",
+  ) &&
+  execution.every((outcome) => outcome.verificationStatus === "VERIFIED")
+    ? "VERIFIED"
+    : "FAILED";
+
+const report = {
+  verdict,
+  authorization: {
+    chainValid: authorization.chainValid,
+    count: authorization.count,
+    receipts: authorization.receipts.map((receipt) => ({
+      receiptId: receipt.receiptId,
+      verificationStatus: receipt.verificationStatus,
+    })),
+  },
+  execution: execution.map((outcome) => ({
+    outcomeId: outcome.outcomeId,
+    schemaValid: outcome.schemaValid,
+    hashValid: outcome.hashValid,
+    keyResolved: outcome.keyResolved,
+    signatureValid: outcome.signatureValid,
+    consistencyValid: outcome.consistencyValid,
+    linkValid: outcome.linkValid,
+    verificationStatus: outcome.verificationStatus,
+    error: outcome.error,
+  })),
+};
+
+console.log(JSON.stringify(report, null, 2));
+process.exit(verdict === "VERIFIED" ? 0 : 1);
+
+async function readJsonl(file) {
+  const text = await fs.readFile(file, "utf8");
+  return text
+    .split("\n")
+    .filter(Boolean)
+    .map((line, index) => {
+      try {
+        return JSON.parse(line);
+      } catch (err) {
+        throw new Error(
+          `${file}:${index + 1}: ${err instanceof Error ? err.message : String(err)}`,
+        );
+      }
+    });
+}

package/examples/youspot/README.md

@@ -0,0 +1,58 @@
+# Govern YouSpot with the Strix MCP proxy
+
+This example uses YouSpot's official stdio bridge as the upstream server:
+
+`MCP host -> @strixgov/mcp-proxy -> @youspot/mcp -> https://youspot.com/mcp/v1`
+
+No YouSpot tool implementation is changed.
+
+## 1. Provide the YouSpot token to the host environment
+
+```bash
+export YOUSPOT_TOKEN="..."
+```
+
+`@youspot/mcp` requires the token for `tools/call`. The example config intentionally does not store it; the proxy passes the process environment through to the upstream when `upstream.env` is omitted.
+
+## 2. Point the MCP host at Strix
+
+```json
+{
+  "mcpServers": {
+    "youspot-governed": {
+      "command": "npx",
+      "args": [
+        "-y",
+        "@strixgov/mcp-proxy",
+        "--config",
+        "/absolute/path/to/youspot-proxy-config.json"
+      ]
+    }
+  }
+}
+```
+
+The same shape works in stdio-capable hosts that accept command/args MCP definitions. Use the host's normal secure environment mechanism for `YOUSPOT_TOKEN`.
+
+## 3. What the starter policy does
+
+- reviewed read tools -> explicit ALLOW rules
+- every other LOW/MEDIUM/HIGH tool -> APPROVAL_REQUIRED
+- CRITICAL -> DENY
+- policy default -> DENY
+
+The explicit rules are intentional. `@strixgov/mcp-proxy` documents name heuristics as a discovery fallback, not a production security boundary. A YouSpot tool added after this example was reviewed therefore does not inherit an automatic LOW/ALLOW path.
+- bundled approval channel -> disabled
+
+With approval disabled, any call that evaluates to `APPROVAL_REQUIRED` is refused rather than auto-approved. Configure a separate approver only when the response channel is not writable by the acting agent.
+
+## 4. Verify
+
+```bash
+npx @strixgov/verifier chain ~/.strix-mcp-proxy/youspot/receipts.jsonl \
+  --jwks ~/.strix-mcp-proxy/youspot/keys/public-jwk.json
+```
+
+## Coverage boundary
+
+Only traffic routed through this local proxy is governed. Direct `https://youspot.com/mcp/v1` connections remain outside this example. Remote-HTTP-only clients require a hosted Strix gateway.

package/examples/youspot-proxy-config.json

@@ -0,0 +1,236 @@
+{
+  "serverId": "youspot",
+  "upstream": {
+    "command": "npx",
+    "args": [
+      "-y",
+      "@youspot/mcp"
+    ]
+  },
+  "capabilities": [
+    {
+      "id": "mcp.youspot.get_graph_object",
+      "name": "get_graph_object",
+      "risk": "LOW",
+      "mode": "READ",
+      "description": "Read one object from the YouSpot graph."
+    },
+    {
+      "id": "mcp.youspot.list_graph_objects",
+      "name": "list_graph_objects",
+      "risk": "LOW",
+      "mode": "READ",
+      "description": "List objects from the YouSpot graph."
+    },
+    {
+      "id": "mcp.youspot.search_graph_objects",
+      "name": "search_graph_objects",
+      "risk": "LOW",
+      "mode": "READ",
+      "description": "Search the YouSpot graph."
+    },
+    {
+      "id": "mcp.youspot.get_gmail_message",
+      "name": "get_gmail_message",
+      "risk": "LOW",
+      "mode": "READ",
+      "description": "Read one Gmail message."
+    },
+    {
+      "id": "mcp.youspot.search_gmail_messages",
+      "name": "search_gmail_messages",
+      "risk": "LOW",
+      "mode": "READ",
+      "description": "Search connected Gmail mailboxes."
+    },
+    {
+      "id": "mcp.youspot.list_gmail_labels",
+      "name": "list_gmail_labels",
+      "risk": "LOW",
+      "mode": "READ",
+      "description": "List Gmail labels."
+    },
+    {
+      "id": "mcp.youspot.get_calendar_events",
+      "name": "get_calendar_events",
+      "risk": "LOW",
+      "mode": "READ",
+      "description": "Read calendar events."
+    },
+    {
+      "id": "mcp.youspot.list_google_calendars",
+      "name": "list_google_calendars",
+      "risk": "LOW",
+      "mode": "READ",
+      "description": "List Google calendars."
+    },
+    {
+      "id": "mcp.youspot.list_slack_channels",
+      "name": "list_slack_channels",
+      "risk": "LOW",
+      "mode": "READ",
+      "description": "List Slack channels known to YouSpot."
+    },
+    {
+      "id": "mcp.youspot.get_slack_thread",
+      "name": "get_slack_thread",
+      "risk": "LOW",
+      "mode": "READ",
+      "description": "Read a saved Slack thread."
+    },
+    {
+      "id": "mcp.youspot.search_slack_messages",
+      "name": "search_slack_messages",
+      "risk": "LOW",
+      "mode": "READ",
+      "description": "Search saved Slack messages."
+    },
+    {
+      "id": "mcp.youspot.list_integrations",
+      "name": "list_integrations",
+      "risk": "LOW",
+      "mode": "READ",
+      "description": "List connected integrations."
+    },
+    {
+      "id": "mcp.youspot.add_slack_reaction",
+      "name": "add_slack_reaction",
+      "risk": "MEDIUM",
+      "mode": "WRITE",
+      "description": "Add a reaction to a Slack message."
+    },
+    {
+      "id": "mcp.youspot.archive_gmail_message",
+      "name": "archive_gmail_message",
+      "risk": "MEDIUM",
+      "mode": "WRITE",
+      "description": "Archive a Gmail message."
+    },
+    {
+      "id": "mcp.youspot.connect_graph_objects",
+      "name": "connect_graph_objects",
+      "risk": "MEDIUM",
+      "mode": "WRITE",
+      "description": "Create a directed edge between graph objects."
+    },
+    {
+      "id": "mcp.youspot.create_gmail_draft",
+      "name": "create_gmail_draft",
+      "risk": "MEDIUM",
+      "mode": "WRITE",
+      "description": "Create a Gmail draft."
+    },
+    {
+      "id": "mcp.youspot.create_graph_object",
+      "name": "create_graph_object",
+      "risk": "MEDIUM",
+      "mode": "WRITE",
+      "description": "Create a YouSpot graph object."
+    },
+    {
+      "id": "mcp.youspot.disconnect_graph_objects",
+      "name": "disconnect_graph_objects",
+      "risk": "MEDIUM",
+      "mode": "WRITE",
+      "description": "Remove a graph-object edge."
+    },
+    {
+      "id": "mcp.youspot.set_follow_up",
+      "name": "set_follow_up",
+      "risk": "MEDIUM",
+      "mode": "WRITE",
+      "description": "Create a dated follow-up fact."
+    },
+    {
+      "id": "mcp.youspot.set_notification_emails",
+      "name": "set_notification_emails",
+      "risk": "MEDIUM",
+      "mode": "WRITE",
+      "description": "Change YouSpot notification-email settings."
+    },
+    {
+      "id": "mcp.youspot.update_graph_object",
+      "name": "update_graph_object",
+      "risk": "MEDIUM",
+      "mode": "WRITE",
+      "description": "Update fields on a graph object."
+    },
+    {
+      "id": "mcp.youspot.create_calendar_event",
+      "name": "create_calendar_event",
+      "risk": "HIGH",
+      "mode": "WRITE",
+      "description": "Create or queue a calendar event."
+    },
+    {
+      "id": "mcp.youspot.send_email",
+      "name": "send_email",
+      "risk": "HIGH",
+      "mode": "WRITE",
+      "description": "Send email to the signed-in user's own address."
+    },
+    {
+      "id": "mcp.youspot.send_slack_message",
+      "name": "send_slack_message",
+      "risk": "HIGH",
+      "mode": "WRITE",
+      "description": "Post a Slack message or DM."
+    },
+    {
+      "id": "mcp.youspot.send_text_to_user",
+      "name": "send_text_to_user",
+      "risk": "HIGH",
+      "mode": "WRITE",
+      "description": "Send an iMessage/SMS to the user's verified phone."
+    },
+    {
+      "id": "mcp.youspot.delete_graph_object",
+      "name": "delete_graph_object",
+      "risk": "CRITICAL",
+      "mode": "WRITE",
+      "description": "Delete one graph object."
+    },
+    {
+      "id": "mcp.youspot.delete_graph_objects",
+      "name": "delete_graph_objects",
+      "risk": "CRITICAL",
+      "mode": "WRITE",
+      "description": "Delete all graph objects of one type."
+    },
+    {
+      "id": "mcp.youspot.disconnect_integration",
+      "name": "disconnect_integration",
+      "risk": "CRITICAL",
+      "mode": "WRITE",
+      "description": "Disconnect an integration; may delete synced records."
+    }
+  ],
+  "policy": {
+    "rules": {
+      "mcp.youspot.get_graph_object": "ALLOW",
+      "mcp.youspot.list_graph_objects": "ALLOW",
+      "mcp.youspot.search_graph_objects": "ALLOW",
+      "mcp.youspot.get_gmail_message": "ALLOW",
+      "mcp.youspot.search_gmail_messages": "ALLOW",
+      "mcp.youspot.list_gmail_labels": "ALLOW",
+      "mcp.youspot.get_calendar_events": "ALLOW",
+      "mcp.youspot.list_google_calendars": "ALLOW",
+      "mcp.youspot.list_slack_channels": "ALLOW",
+      "mcp.youspot.get_slack_thread": "ALLOW",
+      "mcp.youspot.search_slack_messages": "ALLOW",
+      "mcp.youspot.list_integrations": "ALLOW"
+    },
+    "riskOverrides": {
+      "LOW": "APPROVAL_REQUIRED",
+      "MEDIUM": "APPROVAL_REQUIRED",
+      "HIGH": "APPROVAL_REQUIRED",
+      "CRITICAL": "DENY"
+    },
+    "default": "DENY"
+  },
+  "approval": {
+    "enabled": false
+  },
+  "storagePath": "~/.strix-mcp-proxy/youspot",
+  "keyPath": "~/.strix-mcp-proxy/youspot/keys"
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@strixgov/mcp-proxy",
-  "version": "0.1.8",
+  "version": "0.2.1",
   "description": "Strix MCP Proxy — the distribution wedge for governed agent tool execution. Point your MCP client at the proxy instead of the underlying server; every callTool is intercepted, evaluated against policy, and emits a signed Ed25519 receipt. Designed so Mode 3 (capability-enforced) is the v0.2.0 upgrade path, not a rewrite.",
   "license": "Elastic-2.0",
   "type": "module",
@@ -18,7 +18,10 @@
     "@modelcontextprotocol/sdk": "^1.0.0",
     "@strixgov/capabilities-mcp-common": "^0.1.0",
     "@strixgov/mcp-adapter": "^0.1.0",
-    "@strixgov/tool-gateway": "^0.4.1"
+    "@strixgov/tool-gateway": "^0.5.0"
+  },
+  "devDependencies": {
+    "zod": "^3.25.76"
   },
   "keywords": [
     "strix",
@@ -40,6 +43,7 @@
   "files": [
     "src/",
     "bin/",
+    "scripts/run-tests.mjs",
     "examples/",
     "README.md",
     "CHANGELOG.md",
@@ -54,6 +58,6 @@
     "node": ">=18.0.0"
   },
   "scripts": {
-    "test": "node --test test/*.test.mjs"
+    "test": "node scripts/run-tests.mjs"
   }
 }

package/scripts/run-tests.mjs

@@ -0,0 +1,41 @@
+#!/usr/bin/env node
+/**
+ * `npm test` entry point for @strixgov/mcp-proxy.
+ *
+ * The suite needs a source checkout (devDependencies and pnpm workspace links),
+ * so the npm tarball does not ship test/ or scripts/preflight.mjs. Previously
+ * `test` called preflight.mjs directly, so `npm test` in an installed copy died
+ * with "Cannot find module scripts/preflight.mjs". This wrapper fails closed
+ * with an explanation instead: it never exits 0 having run zero tests.
+ */
+import { existsSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+
+const root = fileURLToPath(new URL("..", import.meta.url));
+const testDir = fileURLToPath(new URL("../test", import.meta.url));
+const preflight = fileURLToPath(new URL("./preflight.mjs", import.meta.url));
+
+if (!existsSync(testDir) || !existsSync(preflight)) {
+  process.stderr.write(
+    [
+      "",
+      "  @strixgov/mcp-proxy: no tests to run here.",
+      "",
+      "  The test suite is not included in the published npm package.",
+      "  Run it from a source checkout of https://github.com/Strixgov/strix:",
+      "",
+      "      pnpm install",
+      "      pnpm --dir packages/strixgov-mcp-proxy test",
+      "",
+      "  Exiting non-zero on purpose: zero tests run must not read as a pass.",
+      "",
+    ].join("\n"),
+  );
+  process.exit(1);
+}
+
+for (const args of [[preflight], ["--test"]]) {
+  const r = spawnSync(process.execPath, args, { cwd: root, stdio: "inherit" });
+  if (r.status !== 0) process.exit(r.status ?? 1);
+}

package/src/index.mjs

@@ -17,3 +17,8 @@
 
 export { startProxy } from "./proxy.mjs";
 export { loadConfig, resolveCapabilities } from "./config.mjs";
+export {
+  createShadowDiscovery,
+  SHADOW_LOG_BASENAME,
+  SHADOW_MEASUREMENT_DISCLAIMER,
+} from "./shadow-discovery.mjs";

package/src/proxy.mjs

@@ -34,6 +34,7 @@ import os from "node:os";
 import { governMCPServer } from "@strixgov/mcp-adapter";
 import { loadOrCreateSigningKey, fileApprover } from "@strixgov/tool-gateway";
 import { webhookApprover } from "./webhook-approver.mjs";
+import { createShadowDiscovery } from "./shadow-discovery.mjs";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
@@ -59,9 +60,16 @@ import {
  *   connectedMode?: object,
  *   onReceipt?: (receipt: object) => void,
  *   onAudit?: (event: { kind: string, detail: object }) => void,
+ *   shadowDiscovery?: boolean,
  *   transport?: { kind: "stdio" } | { kind: "test", server: object, client: object },
  * }} opts
- * @returns {Promise<{ stop: () => Promise<void>, gateway: object, signingKey: object }>}
+ * @returns {Promise<{
+ *   stop: () => Promise<void>,
+ *   gateway: object,
+ *   signingKey: object,
+ *   shadowDiscovery: object | null,
+ *   shadowDiscoveryLogPath: string | null,
+ * }>}
  */
 export async function startProxy(opts) {
   if (!opts) {
@@ -254,6 +262,37 @@ export async function startProxy(opts) {
     governed.gateway.on("receipt", opts.onReceipt);
   }
 
+  // ─── 3d. Shadow discovery (GSD-1 Phase 4) — observation only ───────────────
+  // Records what the upstream actually advertises and what actually gets
+  // called, and reports the delta against the classified capability set —
+  // the actions runtime traffic sees that static discovery missed.
+  // Strictly read-only over events the proxy already handles: it never
+  // changes a verdict and never touches the policy/approval/receipt
+  // pipeline. Opt out with `shadowDiscovery: false`. The JSONL shadow log
+  // shares the receipt store's lifecycle (only written when a storagePath
+  // is in effect) and is an unsigned measurement — never proof.
+  const shadowDiscovery =
+    opts.shadowDiscovery === false
+      ? null
+      : createShadowDiscovery({
+          serverId,
+          capabilities: opts.capabilities,
+          storagePath: resolvedStoragePath,
+          onAudit: (event) => audit(opts, event),
+        });
+
+  // Seed the advertised-tool universe once at startup so a proxy that
+  // never receives a tools/list from its consumer still reports the
+  // upstream's surface. Best-effort: a slow/broken upstream listTools
+  // must not fail proxy startup — the same call will be retried on the
+  // consumer's first tools/list anyway.
+  if (shadowDiscovery) {
+    try {
+      const seed = await upstreamClient.listTools();
+      shadowDiscovery.recordToolList(seed.tools ?? []);
+    } catch { /* best-effort seed; consumer-driven listTools re-records */ }
+  }
+
   // ─── 4. Expose the proxy as an MCP server toward the consumer ──────────────
   const proxyServer = new Server(
     { name: `strix-proxy:${serverId}`, version: "0.1.0" },
@@ -267,6 +306,7 @@ export async function startProxy(opts) {
     // Re-fetch the full descriptors from the upstream so callers see
     // the original argument shapes — governance doesn't reshape tools.
     const upstream = await upstreamClient.listTools();
+    shadowDiscovery?.recordToolList(upstream.tools ?? []);
     const upstreamByName = new Map(upstream.tools.map((t) => [t.name, t]));
     return {
       tools: tools.map((t) => upstreamByName.get(t.name) ?? { name: t.name }),
@@ -275,6 +315,9 @@ export async function startProxy(opts) {
 
   proxyServer.setRequestHandler(CallToolRequestSchema, async (request) => {
     const { name, arguments: args } = request.params;
+    // Shadow discovery counts the call BEFORE governance evaluates —
+    // a denied call is still an observed action surface.
+    shadowDiscovery?.recordCall(name);
     // Forward actor context if the client put it in _meta — this is how
     // mcp-aware clients attribute calls to a specific agent identity.
     const ctx = {
@@ -316,6 +359,8 @@ export async function startProxy(opts) {
   return {
     gateway: governed.gateway,
     signingKey: governed.signingKey,
+    shadowDiscovery,
+    shadowDiscoveryLogPath: shadowDiscovery?.logPath ?? null,
     async stop() {
       try { await proxyServer.close(); } catch { /* best-effort */ }
       try { await upstreamClient.close(); } catch { /* best-effort */ }

package/src/shadow-discovery.mjs

@@ -0,0 +1,179 @@
+/**
+ * Shadow discovery — runtime reconciliation for static governed-surface
+ * discovery (GSD-1 Phase 4; program doc:
+ * solo-builder-core/docs/proposals/governed-surface-discovery-v1.md).
+ *
+ * Static scanners (the /strix-wire scanner, `solo govern scan`, the
+ * Semgrep pack) can only find action points that pattern-match in
+ * source. They structurally cannot see (a) tools an upstream MCP server
+ * exposes that no companion capability pack has classified, or (b) the
+ * genuinely runtime-decided agent tool call. The proxy already sits on
+ * the live tool-call path, so it is the natural observation point: this
+ * module records what the upstream ACTUALLY advertises and what the
+ * agent ACTUALLY calls, and reports the delta against the classified
+ * capability registry.
+ *
+ * Two honesty rules, both load-bearing:
+ *
+ *   1. **Observation only, never enforcement.** Shadow discovery reads
+ *      the same events the proxy already handles; it never changes a
+ *      verdict, never blocks a call, never touches the policy /
+ *      approval / receipt pipeline. Every enforcement decision remains
+ *      with governMCPServer.
+ *
+ *   2. **Unsigned measurement, never proof.** The shadow log and every
+ *      snapshot carry a mandatory `measurement` disclaimer and are
+ *      shaped nothing like a signed receipt (no signature, no kid, no
+ *      canonical payload). A shadow report says "the runtime saw X" —
+ *      it proves nothing and must never be rendered as if it did.
+ *
+ * Output surfaces:
+ *   - in-memory `snapshot()` for programmatic consumers / the CLI,
+ *   - an append-only JSONL log at `<storagePath>/shadow-discovery.jsonl`
+ *     when a storagePath is configured (same lifecycle as receipts).
+ */
+
+import fs from "node:fs";
+import path from "node:path";
+
+export const SHADOW_MEASUREMENT_DISCLAIMER =
+  "unsigned measurement, never proof — runtime observation only";
+
+export const SHADOW_LOG_BASENAME = "shadow-discovery.jsonl";
+
+/**
+ * Create a shadow-discovery recorder.
+ *
+ * @param {{
+ *   serverId?: string,
+ *   capabilities?: Array<{ name?: string, id?: string }>,
+ *   storagePath?: string | null,
+ *   onAudit?: (event: { kind: string, detail: object }) => void,
+ *   now?: () => string,
+ * }} [opts]
+ */
+export function createShadowDiscovery(opts = {}) {
+  const serverId = opts.serverId ?? "proxy";
+  const now = opts.now ?? (() => new Date().toISOString());
+
+  // The classified universe: tool names the companion capability pack
+  // (or an inline caller-managed list) already knows. A tool outside
+  // this set still executes under the gateway's generic fallback
+  // classification — but static discovery never saw it, which is
+  // exactly what this module exists to surface.
+  const classifiedNames = new Set(
+    (opts.capabilities ?? [])
+      .map((cap) => cap?.name)
+      .filter((name) => typeof name === "string" && name.length > 0),
+  );
+
+  const logPath = opts.storagePath
+    ? path.join(opts.storagePath, SHADOW_LOG_BASENAME)
+    : null;
+
+  /** @type {Map<string, { name: string, description?: string, classified: boolean }>} */
+  const advertised = new Map();
+  /** @type {Map<string, number>} */
+  const calls = new Map();
+  /** @type {Map<string, number>} */
+  const unclassifiedCalls = new Map();
+
+  function audit(kind, detail) {
+    if (typeof opts.onAudit === "function") {
+      try { opts.onAudit({ kind, detail }); } catch { /* observation must never throw */ }
+    }
+  }
+
+  function appendLog(entry) {
+    if (!logPath) return;
+    try {
+      fs.mkdirSync(path.dirname(logPath), { recursive: true });
+      fs.appendFileSync(
+        logPath,
+        JSON.stringify({
+          measurement: SHADOW_MEASUREMENT_DISCLAIMER,
+          serverId,
+          at: now(),
+          ...entry,
+        }) + "\n",
+        "utf8",
+      );
+    } catch {
+      // Best-effort telemetry: a full disk or read-only mount must never
+      // take down the governed call path this module merely observes.
+    }
+  }
+
+  return {
+    logPath,
+
+    /**
+     * Record the upstream's advertised tool universe (a tools/list
+     * response). Newly-seen unclassified tools are logged + audited —
+     * each one is a surface static discovery missed.
+     *
+     * @param {Array<{ name: string, description?: string }>} tools
+     */
+    recordToolList(tools) {
+      if (!Array.isArray(tools)) return;
+      const newlyUnclassified = [];
+      for (const tool of tools) {
+        const name = tool?.name;
+        if (typeof name !== "string" || name.length === 0) continue;
+        const known = advertised.has(name);
+        const classified = classifiedNames.has(name);
+        advertised.set(name, { name, description: tool.description, classified });
+        if (!known && !classified) newlyUnclassified.push(name);
+      }
+      if (newlyUnclassified.length > 0) {
+        audit("shadow.unclassified-tools", { serverId, tools: newlyUnclassified });
+        appendLog({ kind: "tool-list", unclassified: newlyUnclassified, advertised: tools.length });
+      }
+    },
+
+    /**
+     * Record a tool invocation flowing through the proxy. Counting
+     * happens regardless of the governance verdict — a denied call is
+     * still an observed action surface.
+     *
+     * @param {string} name
+     */
+    recordCall(name) {
+      if (typeof name !== "string" || name.length === 0) return;
+      calls.set(name, (calls.get(name) ?? 0) + 1);
+      if (!classifiedNames.has(name)) {
+        const n = (unclassifiedCalls.get(name) ?? 0) + 1;
+        unclassifiedCalls.set(name, n);
+        // First sighting of each unclassified tool gets an audit event
+        // + a log line; repeat calls only bump the counter (a chatty
+        // agent shouldn't flood the shadow log).
+        if (n === 1) {
+          audit("shadow.unclassified-call", { serverId, tool: name });
+          appendLog({ kind: "unclassified-call", tool: name });
+        }
+      }
+    },
+
+    /**
+     * The reconciliation report: what the runtime saw vs what static
+     * classification covers. Type-disjoint from receipts by
+     * construction (no signature-shaped fields), with the mandatory
+     * measurement disclaimer on every snapshot.
+     */
+    snapshot() {
+      const advertisedList = [...advertised.values()];
+      return {
+        measurement: SHADOW_MEASUREMENT_DISCLAIMER,
+        serverId,
+        classifiedCapabilityCount: classifiedNames.size,
+        advertisedToolCount: advertisedList.length,
+        unclassifiedAdvertised: advertisedList
+          .filter((t) => !t.classified)
+          .map((t) => t.name)
+          .sort(),
+        callCounts: Object.fromEntries([...calls.entries()].sort()),
+        unclassifiedCallCounts: Object.fromEntries([...unclassifiedCalls.entries()].sort()),
+      };
+    },
+  };
+}