@suveren/gateway 0.23.2 → 0.24.0

package/dist/mcp-server/http.mjs

@@ -3257,7 +3257,10 @@ function capText(text, max = PREVIEW_MESSAGE_CAP) {
   if (text === void 0) return void 0;
   return text.length > max ? text.slice(0, max) : text;
 }
-function getToolPreviewConfig(integrationId, toolName) {
+function getToolPreviewConfig(integrationManager2, integrationId, toolName) {
+  if (integrationManager2.isBuiltin(integrationId)) {
+    return integrationManager2.getBuiltinToolPreview(integrationId, toolName);
+  }
   const manifest = getManifest(integrationId);
   const overrides = manifest?.toolGating?.overrides ?? {};
   const entry = overrides[toolName];
@@ -3322,7 +3325,8 @@ function hashPreviewBody(body) {
   return computeContentHash2({ kind: "text", version: "1" }, body.text ?? "");
 }
 async function computeSubmissionPreviewHash(integrationManager2, integrationId, toolName, actionArgs) {
-  const preview = getToolPreviewConfig(integrationId, toolName);
+  if (integrationManager2.isBuiltin(integrationId)) return void 0;
+  const preview = getToolPreviewConfig(integrationManager2, integrationId, toolName);
   if (!preview || preview.version) return void 0;
   const mapped = mapPreviewArgs(preview, actionArgs);
   if (previewHasNoTarget(preview, mapped)) return void 0;
@@ -3331,7 +3335,7 @@ async function computeSubmissionPreviewHash(integrationManager2, integrationId,
   return hashPreviewBody(read.body);
 }
 async function previewChangedSinceSubmission(integrationManager2, integrationId, toolName, actionArgs, previousHash) {
-  const preview = getToolPreviewConfig(integrationId, toolName);
+  const preview = getToolPreviewConfig(integrationManager2, integrationId, toolName);
   if (!preview) return true;
   const mapped = mapPreviewArgs(preview, actionArgs);
   const read = await readPreview(integrationManager2, integrationId, preview.tool, mapped);
@@ -3339,7 +3343,7 @@ async function previewChangedSinceSubmission(integrationManager2, integrationId,
   return hashPreviewBody(read.body) !== previousHash;
 }
 async function buildInternalPreview(integrationManager2, integrationId, toolName, actionArgs) {
-  const preview = getToolPreviewConfig(integrationId, toolName);
+  const preview = getToolPreviewConfig(integrationManager2, integrationId, toolName);
   if (!preview) return { status: "none" };
   const mappedArgs = mapPreviewArgs(preview, actionArgs);
   if (previewHasNoTarget(preview, mappedArgs)) return { status: "none", reason: "no_target" };
@@ -3815,8 +3819,8 @@ function applyMapping(m, value, execution) {
       execution[m.field] = typeof value === "number" ? value : String(value);
   }
 }
-function profileMatches(profileId, shortName) {
-  return profileId === shortName || profileId.includes("/" + shortName + "@") || profileId.endsWith("/" + shortName);
+function profileMatches(profileId, shortName2) {
+  return profileId === shortName2 || profileId.includes("/" + shortName2 + "@") || profileId.endsWith("/" + shortName2);
 }
 function wireExecutionContext(profileId, execution) {
   const profile = getProfile2(profileId);
@@ -3933,6 +3937,12 @@ function recordAsRefusal(state2, tool, authorizationId, err) {
   });
 }
 function createGatedToolHandler(tool, integrationManager2, state2) {
+  if (tool.internal) {
+    return async () => ({
+      content: [{ type: "text", text: `Refused: "${tool.namespacedName}" is internal and cannot be called directly. No ticket was requested.` }],
+      isError: true
+    });
+  }
   if (isSimulationMode() && !integrationManager2.isSimulationSafe(tool.integrationId)) {
     return async () => {
       recordBlocked(state2, tool, {
@@ -4697,6 +4707,7 @@ function countToolsByGating(profileId, integrationManager2) {
   let gated = 0;
   let readOnly = 0;
   for (const tool of allTools) {
+    if (tool.internal) continue;
     if (!tool.gating || !tool.gating.profile) {
       readOnly++;
     } else if (tool.gating.profile === profileId || tool.gating.profile === shortProfileName(profileId)) {
@@ -4753,14 +4764,14 @@ function buildMandateBrief(opts) {
     for (const auth of active) {
       const earliestExpiry = Math.min(...auth.attestations.map((a) => a.expiresAt));
       const remainingMin = Math.max(0, Math.round((earliestExpiry - now) / 60));
-      const shortName = shortProfileName(auth.profileId);
+      const shortName2 = shortProfileName(auth.profileId);
       const version = auth.profileId.match(/@(.+)$/)?.[1] ?? "";
-      const shortId = version ? `${shortName}@${version}` : shortName;
+      const shortId = version ? `${shortName2}@${version}` : shortName2;
       const boundsDesc = Object.entries(auth.frame).filter(([key]) => key !== "profile" && key !== "path").map(([key, value]) => `${key}:${value}`).join(" \xB7 ");
       const parts = [];
       if (boundsDesc) parts.push(boundsDesc);
       if (executionLog) {
-        const profile = getProfile3(auth.profileId) ?? getProfile3(shortName);
+        const profile = getProfile3(auth.profileId) ?? getProfile3(shortName2);
         const consumption = getConsumptionState(auth, executionLog, profile);
         const compact = formatConsumptionCompact(consumption);
         if (compact) parts.push(compact);
@@ -4769,7 +4780,7 @@ function buildMandateBrief(opts) {
       if (gated > 0 || readOnly > 0) parts.push(`${gated} gated tools`);
       parts.push(`${remainingMin} min remaining`);
       lines.push(`[${shortId}] ${parts.join(" \xB7 ")}`);
-      lines.push(`  \u2192 list-authorizations(domain: "${shortName}") for intent & details`);
+      lines.push(`  \u2192 list-authorizations(domain: "${shortName2}") for intent & details`);
       lines.push("");
     }
   }
@@ -4807,7 +4818,7 @@ function shortProfileName2(profileId) {
 function buildCapabilityMap(profileId, integrationManager2) {
   if (!integrationManager2) return "";
   const allTools = integrationManager2.getAllTools();
-  const shortName = shortProfileName2(profileId);
+  const shortName2 = shortProfileName2(profileId);
   const gated = [];
   const readOnly = [];
   const undescribed = [];
@@ -4815,7 +4826,7 @@ function buildCapabilityMap(profileId, integrationManager2) {
     if (!tool.gating || !tool.gating.profile) {
       continue;
     }
-    if (!profileMatches(tool.gating.profile, shortName) && tool.gating.profile !== profileId) {
+    if (!profileMatches(tool.gating.profile, shortName2) && tool.gating.profile !== profileId) {
       continue;
     }
     const gating = tool.gating;
@@ -4871,8 +4882,8 @@ function listAuthorizationsHandler(state2, integrationManager2, contextDir) {
     }
     if (domain) {
       const matching = authorizations.filter((auth) => {
-        const shortName = shortProfileName2(auth.profileId);
-        return shortName === domain || profileMatches(auth.profileId, domain);
+        const shortName2 = shortProfileName2(auth.profileId);
+        return shortName2 === domain || profileMatches(auth.profileId, domain);
       });
       if (matching.length === 0) {
         return {
@@ -4903,8 +4914,8 @@ function listAuthorizationsHandler(state2, integrationManager2, contextDir) {
           }
         } catch {
         }
-        const shortName = shortProfileName2(auth.profileId);
-        const profile = getProfile4(auth.profileId) ?? getProfile4(shortName);
+        const shortName2 = shortProfileName2(auth.profileId);
+        const profile = getProfile4(auth.profileId) ?? getProfile4(shortName2);
         if (profile) {
           const consumption = getConsumptionState(auth, state2.executionLog, profile);
           const consumptionText = formatConsumptionFull(consumption);
@@ -4963,8 +4974,8 @@ function listAuthorizationsHandler(state2, integrationManager2, contextDir) {
         if ((auth.deferredCommitmentDomains ?? []).length > 0) {
           lines.push("    Mode: review (each action requires your approval)");
         }
-        const shortName = shortProfileName2(auth.profileId);
-        const profile = getProfile4(auth.profileId) ?? getProfile4(shortName);
+        const shortName2 = shortProfileName2(auth.profileId);
+        const profile = getProfile4(auth.profileId) ?? getProfile4(shortName2);
         if (profile) {
           const consumption = getConsumptionState(auth, state2.executionLog, profile);
           const compact = formatConsumptionCompact(consumption);
@@ -5603,6 +5614,7 @@ function createMcpServer(state2, integrationManager2) {
       }
     }
     for (const tool of allTools) {
+      if (tool.internal) continue;
       const existing = proxiedTools.get(tool.namespacedName);
       if (existing) {
         if (existing.tool === tool) continue;
@@ -6443,6 +6455,8 @@ var IntegrationManager = class {
         integrationId: def.id,
         description: tool.description,
         inputSchema: withoutBlockedArgs(tool.inputSchema, gating?.blockedArgs),
+        ...tool.outputSchema ? { outputSchema: tool.outputSchema } : {},
+        ...tool.internal ? { internal: true } : {},
         gating
       };
     });
@@ -6488,19 +6502,39 @@ var IntegrationManager = class {
   }
   /**
    * The built-in's own refusal for this call, checked before the gate (no proposal,
-   * no ticket): `simulationOnly` outside simulation mode, then the tool's `validate`.
-   * Null for connector tools and for calls that may proceed.
+   * no ticket): an `internal` tool (defence in depth — `index.ts` already never
+   * registers one with the MCP server, so an agent cannot reach this in the first
+   * place), `simulationOnly` outside simulation mode (group-level OR this one
+   * tool's — DL1: a group may now mix test-setup-only tools with ones that work
+   * outside simulation), then the tool's `validate`. Null for connector tools and
+   * for calls that may proceed.
    */
   async precheckBuiltin(tool, args) {
     const builtin = this.builtins.get(tool.integrationId);
     if (!builtin) return null;
-    if (builtin.def.simulationOnly && !isSimulationMode()) {
+    const def = builtin.def.tools.find((t) => t.name === tool.originalName);
+    if (def?.internal) {
+      return `Refused: "${tool.namespacedName}" is internal and cannot be called directly. No ticket was requested.`;
+    }
+    if ((builtin.def.simulationOnly || def?.simulationOnly) && !isSimulationMode()) {
       return `Refused: "${tool.namespacedName}" is not available. No ticket was requested.`;
     }
-    const def = builtin.def.tools.find((t) => t.name === tool.originalName);
     const refusal = await def?.validate?.(args);
     return refusal ? `Refused: ${refusal} No ticket was requested.` : null;
   }
+  /**
+   * A built-in's own declared preview (AU3 — `BuiltinTool`/toolGating override's
+   * `preview`, same shape a manifest declares for a connector tool). `preview.ts`'s
+   * `getToolPreviewConfig` reads a connector's declared preview from its loaded
+   * manifest (`getManifest`); a built-in has no manifest, so it reads it from here
+   * instead — same override object, widened the same way `resolveToolGating`
+   * already widens it for `approvalView`/`hideUnlessAuthorized`.
+   */
+  getBuiltinToolPreview(integrationId, toolName) {
+    const builtin = this.builtins.get(integrationId);
+    const override = builtin?.def.toolGating.overrides?.[toolName];
+    return override?.preview;
+  }
   /**
    * Why this tool's integration refuses the held mandate `auth`, or null when
    * it accepts it (always null for connectors and built-ins that declare no
@@ -6522,7 +6556,14 @@ var IntegrationManager = class {
       }
       try {
         const result = await tool.handler(args);
-        return { content: result.content.map((c) => ({ type: c.type, text: c.text })), isError: result.isError };
+        return {
+          content: result.content.map((c) => ({ type: c.type, text: c.text })),
+          isError: result.isError,
+          // DL1: a built-in's internal preview tools (describe_mandate_proposal /
+          // describe_brief_proposal) return structuredContent, same as a connector's
+          // declared-output-schema read — see the field's doc comment above.
+          ...result.structuredContent ? { structuredContent: result.structuredContent } : {}
+        };
       } catch (err) {
         const message = err instanceof Error ? err.message : String(err);
         return { content: [{ type: "text", text: `Tool call failed: ${message}` }], isError: true };
@@ -7117,9 +7158,9 @@ function loadProfiles(profilesDir) {
     try {
       const profile = JSON.parse(readFileSync18(profilePath, "utf-8"));
       registerProfile(profileId, profile);
-      const shortName = profileId.split("/").pop()?.replace(/@.*$/, "");
-      if (shortName && shortName !== profileId) {
-        registerProfile(shortName, profile);
+      const shortName2 = profileId.split("/").pop()?.replace(/@.*$/, "");
+      if (shortName2 && shortName2 !== profileId) {
+        registerProfile(shortName2, profile);
       }
       loaded++;
     } catch (err) {
@@ -7151,6 +7192,9 @@ function warnNoProfiles(reason) {
 function builtinText(text) {
   return { content: [{ type: "text", text }] };
 }
+function builtinStructured(structuredContent) {
+  return { content: [{ type: "text", text: JSON.stringify(structuredContent) }], structuredContent };
+}
 
 // src/lib/builtins/report.ts
 var MAX_REPORT_HTML_BYTES = 512 * 1024;
@@ -7579,6 +7623,45 @@ function fillGenerated(body, sections) {
   return body.replace(/<!--\s*generated:\s*([a-z-]+)\s*-->/g, (m, key) => sections[key] ? sections[key]() : m);
 }
 
+// src/lib/unified-diff.ts
+function unifiedLineDiff(before, after) {
+  const a = before.split("\n");
+  const b = after.split("\n");
+  const n = a.length;
+  const m = b.length;
+  const dp = Array.from({ length: n + 1 }, () => new Array(m + 1).fill(0));
+  for (let i2 = n - 1; i2 >= 0; i2--) {
+    for (let j2 = m - 1; j2 >= 0; j2--) {
+      dp[i2][j2] = a[i2] === b[j2] ? dp[i2 + 1][j2 + 1] + 1 : Math.max(dp[i2 + 1][j2], dp[i2][j2 + 1]);
+    }
+  }
+  const lines = [];
+  let i = 0;
+  let j = 0;
+  while (i < n && j < m) {
+    if (a[i] === b[j]) {
+      lines.push(a[i]);
+      i++;
+      j++;
+    } else if (dp[i + 1][j] >= dp[i][j + 1]) {
+      lines.push(`-${a[i]}`);
+      i++;
+    } else {
+      lines.push(`+${b[j]}`);
+      j++;
+    }
+  }
+  while (i < n) {
+    lines.push(`-${a[i]}`);
+    i++;
+  }
+  while (j < m) {
+    lines.push(`+${b[j]}`);
+    j++;
+  }
+  return lines.join("\n");
+}
+
 // src/lib/builtins/setup.ts
 import { getProfile as getProfile6 } from "@hap/core";
 var DELEGATION_PROFILE = "delegation";
@@ -7587,7 +7670,12 @@ var DELEGATION_INTENT_HINT = [
   "",
   "Goal \u2014 Follow the setup guide: interview me about the company, the team and the work; prepare test data from real cases, renamed to .example names; propose the mandates and the working instructions (agent brief) that the AI doing the work will need.",
   "",
-  "Watch out \u2014 You only propose; nothing happens until I approve it in the Suveren Gateway. Ask, don't guess: never invent a rule, a limit or a step. One proposal at a time. Steps customers would see start with my review. Never use real names or customer data \u2014 proposals are stored readable on the Suveren server. Never give the working AI a reporting mandate during a test run. Keep the setup and the working AI in separate conversations."
+  "Watch out \u2014 You only propose; nothing happens until I approve it in the Suveren Gateway. Ask, don't guess: never invent a rule, a limit or a step. One proposal at a time. Steps customers would see start with my review. Never use real names or customer data \u2014 proposals are stored readable on the Suveren server. Never give the working AI a reporting mandate during a test run. Keep the setup and the working AI in separate conversations.",
+  "",
+  // DL1 — outside simulation, the same mandate also covers ongoing, real-system
+  // use: the Scope above (which profiles, which mode) is what actually bounds
+  // the AI from here, not simulation mode. Plain words, per the brief.
+  "Outside simulation \u2014 once you have connected real systems: the AI proposes mandates and its own working instructions (agent brief) for the profiles you allow above; you approve each one before it takes effect. Delegation itself can never be proposed."
 ].join("\n");
 function briefRefusal(args) {
   if (typeof args.content !== "string" || args.content.trim() === "") return "`content` must be the complete new brief (markdown text).";
@@ -7611,6 +7699,149 @@ function connectedSystems(im) {
   }
   return [...byId.values()].sort((a, b) => a.id.localeCompare(b.id));
 }
+function shortName(idOrName) {
+  const stripped = idOrName.replace(/@.*$/, "").split("/").pop() ?? idOrName;
+  return stripped.toLowerCase();
+}
+function versionOf(id) {
+  return id.split("@")[1] ?? "";
+}
+function delegationItselfRefusal(args) {
+  const requested = typeof args.profile === "string" ? args.profile : "";
+  if (shortName(requested) === DELEGATION_PROFILE) {
+    return "Delegation can never be proposed \u2014 the AI cannot widen its own delegation.";
+  }
+  return void 0;
+}
+function delegationMandateRefusal(auth) {
+  if (isSimulationMode()) return void 0;
+  const profile = getProfile6(auth.profileId);
+  if (profile?.scopeSchema?.fields?.allowed_profiles) return void 0;
+  return `your Delegation mandate (${shortName(auth.profileId)} ${versionOf(auth.profileId)}) does not declare which profiles or modes you may propose \u2014 only a Delegation mandate on delegation 0.4 or later works outside simulation mode. Ask the person to give a current Delegation mandate.`;
+}
+function formatUnit(unit) {
+  if (!unit || unit === "count") return "";
+  if (unit === "minutes") return "min";
+  if (unit === "hours") return "hr";
+  if (unit === "days") return "days";
+  if (unit === "percent") return "%";
+  if (unit.startsWith("currency:")) return unit.slice("currency:".length);
+  return unit;
+}
+function formatBoundValue2(value, unit) {
+  if (typeof value !== "number" && typeof value !== "string") return String(value);
+  const u = formatUnit(unit);
+  if (!u) return String(value);
+  if (unit === "percent") return `${value}${u}`;
+  if (unit?.startsWith("currency:")) return `${u} ${value}`;
+  return `${value} ${u}`;
+}
+function labeledRecord(values, fields) {
+  const out = {};
+  if (!values || typeof values !== "object" || Array.isArray(values)) return out;
+  for (const [key, value] of Object.entries(values)) {
+    const def = fields?.[key];
+    out[def?.displayName ?? key] = formatBoundValue2(value, def?.unit);
+  }
+  return out;
+}
+function formatValidity(args, profile) {
+  const hours = typeof args.duration_hours === "number" && args.duration_hours > 0 ? args.duration_hours : void 0;
+  const totalSeconds = hours !== void 0 ? Math.round(hours * 3600) : profile.ttl?.default ?? 0;
+  if (totalSeconds <= 0) return "unknown";
+  if (totalSeconds % 86400 === 0) {
+    const days = totalSeconds / 86400;
+    return `${days} day${days === 1 ? "" : "s"}`;
+  }
+  if (totalSeconds % 3600 === 0) {
+    const hrs = totalSeconds / 3600;
+    return `${hrs} hour${hrs === 1 ? "" : "s"}`;
+  }
+  return `${Math.round(totalSeconds / 3600)} hours`;
+}
+function delegationChecks(deps, args, targetShortName, targetDisplayName) {
+  const governing = deps.state.getEnrichedAuthorizations().filter((a) => a.complete && shortName(a.profileId) === DELEGATION_PROFILE);
+  const listed = (ctx, field) => typeof ctx?.[field] === "string" ? ctx[field].split(",").map((s) => s.trim().toLowerCase()).filter(Boolean) : [];
+  const profileOk = governing.some((g) => listed(g.context, "allowed_profiles").includes(targetShortName.toLowerCase()));
+  const mode = typeof args.mode === "string" ? args.mode : "";
+  const modeOk = mode !== "" && governing.some((g) => listed(g.context, "allowed_modes").includes(mode.toLowerCase()));
+  const checks = [
+    profileOk ? `${targetDisplayName} is allowed by your Delegation mandate` : `${targetDisplayName} is not confirmed as allowed by an active Delegation mandate`
+  ];
+  checks.push(
+    mode === "" ? "No mode was given" : modeOk ? `${mode} \u2014 within the modes your Delegation mandate allows` : `${mode} is not among the modes your Delegation mandate allows`
+  );
+  const first = governing[0];
+  if (first) {
+    const delegationProfile = getProfile6(first.profileId);
+    const entry = getConsumptionState(first, deps.state.executionLog, delegationProfile).find((e) => e.field === "mandate_daily_max");
+    if (entry && entry.limit !== null) {
+      checks.push(`Proposals today: ${entry.current} of ${entry.limit}`);
+    }
+  }
+  return checks;
+}
+function resolveTargetProfile(input) {
+  if (typeof input !== "string" || !input.trim()) return void 0;
+  const profile = getProfile6(input.trim());
+  if (!profile) return void 0;
+  return { profile, shortName: shortName(profile.id) };
+}
+var CREATE_MANDATE_INPUT_SCHEMA = {
+  type: "object",
+  properties: {
+    team: { type: "string", description: 'Team name or id, or "personal". Omit to use the workspace of your Delegation mandate.' },
+    // Short name only (e.g. "sales") — a full profile id is refused here, at input
+    // validation, before the tool ever runs (DL1 Interface contract).
+    profile: { type: "string", pattern: "^[a-z][a-z0-9-]*$", description: 'Profile short name, e.g. "sales" (newest version).' },
+    limits: { type: "object", description: "The limits (bounds) by field name, as the profile defines them." },
+    scope: { type: "object", description: "The scope (context) by field name, as the profile defines it." },
+    intent: { type: "string", description: "Why, goal and watch-outs \u2014 signed with the mandate (at most 2000 characters)." },
+    mode: { type: "string", enum: ["review", "automatic"], description: "review = each action needs approval; automatic = within the limits." },
+    duration_hours: { type: "number", description: "How long the mandate is valid, in hours. Omit for the profile default." },
+    title: { type: "string", description: "A short name for the mandate." },
+    ticket_id: {
+      type: "string",
+      description: "Authorization reference for this call, set by the governing gateway \u2014 agents do not set this."
+    }
+  },
+  required: ["profile", "limits", "intent", "mode"]
+};
+var SET_AGENT_BRIEF_INPUT_SCHEMA = {
+  type: "object",
+  properties: {
+    content: { type: "string", description: "The complete new agent brief, in markdown (at most 16 KB)." },
+    ticket_id: {
+      type: "string",
+      description: "Authorization reference for this call, set by the governing gateway \u2014 agents do not set this."
+    }
+  },
+  required: ["content"]
+};
+var DESCRIBE_MANDATE_PROPOSAL_OUTPUT_SCHEMA = {
+  type: "object",
+  properties: {
+    proposal: { type: "string", title: "Proposal" },
+    profile_version: { type: "string", title: "Version" },
+    workspace: { type: "string", title: "Workspace" },
+    mode: { type: "string", title: "Mode" },
+    valid: { type: "string", title: "Valid" },
+    limits: { type: "object", title: "Limits" },
+    scope: { type: "object", title: "Scope" },
+    title: { type: ["string", "null"], title: "Title" },
+    intent: { type: "string", title: "Intent", description: "Written by the AI \u2014 becomes your words when you sign" },
+    checks: { type: "array", title: "Checks", items: { type: "string" } }
+  },
+  required: ["proposal", "profile_version", "workspace", "mode", "valid", "limits", "scope", "title", "intent", "checks"]
+};
+var DESCRIBE_BRIEF_PROPOSAL_OUTPUT_SCHEMA = {
+  type: "object",
+  properties: {
+    change: { type: "string", title: "Change", contentMediaType: "text/x-diff" },
+    words: { type: "number", title: "Words" }
+  },
+  required: ["change", "words"]
+};
 function setupBuiltin(deps) {
   return {
     id: "setup",
@@ -7619,18 +7850,24 @@ function setupBuiltin(deps) {
     // name they'll see everywhere else (Mandates page, dashboard first-run
     // card), not the internal "test setup" framing. Description is unchanged.
     name: "Delegation",
-    description: "Your AI sets up a test of itself: it reads the setup guides and proposes its agent brief and its mandates. Every proposal waits for your approval. Simulation mode only.",
+    description: "Your AI proposes mandates and its agent brief \u2014 in a test (simulation mode) and, within the profiles and modes you allow, on your real systems too. Every proposal waits for your approval.",
     intentHint: DELEGATION_INTENT_HINT,
     profile: DELEGATION_PROFILE,
     simulation: true,
-    simulationOnly: true,
+    // DL1: no longer simulationOnly at the GROUP level — create_mandate and
+    // set_agent_brief now work outside simulation too (decision 1); only
+    // get_guide keeps the per-tool flag below (decision 2).
+    mandateRefusal: delegationMandateRefusal,
     toolGating: {
       overrides: {
         set_agent_brief: {
           executionMapping: {},
           staticExecution: { action_type: "brief" },
           hideUnlessAuthorized: true,
-          approvalView: { content: { label: "New agent brief", kind: "markdown" } }
+          approvalView: { content: { label: "New agent brief", kind: "markdown" } },
+          // AU3 — the approval card's preview of this pending proposal (DL1
+          // Interface contract). Identity arg mapping: same field name either side.
+          preview: { tool: "describe_brief_proposal", args: { content: "content" } }
         },
         get_guide: {
           category: "read",
@@ -7638,7 +7875,7 @@ function setupBuiltin(deps) {
           requiredValue: "unlimited"
         },
         create_mandate: {
-          executionMapping: {},
+          executionMapping: { profile: "allowed_profiles", mode: "allowed_modes" },
           staticExecution: { action_type: "mandate" },
           hideUnlessAuthorized: true,
           // Shown like the mandate screen: limits and scope by the profile's own names.
@@ -7651,13 +7888,23 @@ function setupBuiltin(deps) {
             mode: { label: "Mode" },
             duration_hours: { label: "Valid for (hours)" },
             title: { label: "Title" }
-          }
-        }
+          },
+          preview: { tool: "describe_mandate_proposal", args: { team: "team", profile: "profile", limits: "limits", scope: "scope", intent: "intent", mode: "mode", duration_hours: "duration_hours", title: "title" } }
+        },
+        // Internal preview tools (DL1): never listed, never callable by an
+        // agent (BuiltinTool.internal — enforced in index.ts and
+        // tool-proxy.ts); explicitly disabled here too, so a direct call
+        // through the normal gate (defence in depth) refuses cleanly instead
+        // of falling through to the "not described in manifest" default.
+        describe_mandate_proposal: { category: "disabled" },
+        describe_brief_proposal: { category: "disabled" }
       }
     },
     tools: [
       {
         name: "get_guide",
+        // DL1 decision 2: stays simulation-only, per-tool (the group no longer is).
+        simulationOnly: true,
         description: "Start here when the person asks how to begin with Suveren or how to set up their work with it. Simulation mode only: the setup guides \u2014 how to interview the person, build the test data, propose mandates and the agent brief, set up the working AI's process, and what can make a test misleading. Call without `topic` for the list and the order to follow; then read each topic before doing that step.",
         inputSchema: {
           type: "object",
@@ -7701,21 +7948,10 @@ ${body}`);
       },
       {
         name: "set_agent_brief",
-        description: "Simulation mode only: propose a new agent brief \u2014 the standing instructions every agent session starts with. `content` replaces the whole brief (markdown, at most 16 KB). A person approves or rejects the proposal; only after approval is the brief replaced, and it applies from the next session. Write the complete brief, not a change to the current one.",
-        inputSchema: {
-          type: "object",
-          properties: {
-            content: { type: "string", description: "The complete new agent brief, in markdown (at most 16 KB)." },
-            ticket_id: {
-              type: "string",
-              description: "Authorization reference for this call, set by the governing gateway \u2014 agents do not set this."
-            }
-          },
-          required: ["content"]
-        },
+        description: "Propose a new agent brief \u2014 the standing instructions every agent session starts with. `content` replaces the whole brief (markdown, at most 16 KB). A person approves or rejects the proposal; only after approval is the brief replaced, and it applies from the next session. Write the complete brief, not a change to the current one.",
+        inputSchema: SET_AGENT_BRIEF_INPUT_SCHEMA,
         validate: briefRefusal,
         handler: async (args) => {
-          if (!isSimulationMode()) return { ...builtinText("Refused: not available outside simulation mode."), isError: true };
           const refusal = briefRefusal(args);
           if (refusal) return { ...builtinText(`Refused: ${refusal}`), isError: true };
           writeContextFile(args.content);
@@ -7726,37 +7962,86 @@ ${body}`);
       },
       {
         name: "create_mandate",
-        description: "Simulation mode only: propose a new mandate for the person running this gateway \u2014 the authority another tool needs (e.g. sales quotes up to a value). A person approves or rejects the proposal; only after approval is the mandate created, exactly as if they had signed it on the mandate screen. Checked against the profile before the proposal: unknown limits, a mode the profile does not allow, or a team where the person may not give this mandate are refused at once. Create only.",
-        inputSchema: {
-          type: "object",
-          properties: {
-            team: { type: "string", description: 'Team name or id, or "personal". Omit to use the workspace of your Delegation mandate.' },
-            profile: { type: "string", description: 'Profile, e.g. "sales" (newest version) or a full profile id.' },
-            limits: { type: "object", description: "The limits (bounds) by field name, as the profile defines them." },
-            scope: { type: "object", description: "The scope (context) by field name, as the profile defines it." },
-            intent: { type: "string", description: "Why, goal and watch-outs \u2014 signed with the mandate (at most 2000 characters)." },
-            mode: { type: "string", enum: ["review", "automatic"], description: "review = each action needs approval; automatic = within the limits." },
-            duration_hours: { type: "number", description: "How long the mandate is valid, in hours. Omit for the profile default." },
-            title: { type: "string", description: "A short name for the mandate." },
-            ticket_id: {
-              type: "string",
-              description: "Authorization reference for this call, set by the governing gateway \u2014 agents do not set this."
-            }
-          },
-          required: ["profile", "limits", "intent", "mode"]
-        },
+        description: "Propose a new mandate for the person running this gateway \u2014 the authority another tool needs (e.g. sales quotes up to a value). A person approves or rejects the proposal; only after approval is the mandate created, exactly as if they had signed it on the mandate screen. Checked against the profile before the proposal: unknown limits, a mode the profile does not allow, or a team where the person may not give this mandate are refused at once. Outside simulation mode, the profile and mode you may propose are themselves limited by your Delegation mandate's scope \u2014 Delegation itself can never be proposed. Create only.",
+        inputSchema: CREATE_MANDATE_INPUT_SCHEMA,
         validate: async (args) => {
+          const fixed = delegationItselfRefusal(args);
+          if (fixed) {
+            deps.state.denialLog?.record({
+              ts: Date.now(),
+              tool: "create_mandate",
+              integrationId: "setup",
+              profile: DELEGATION_PROFILE,
+              kind: "bound",
+              detail: fixed,
+              who: "gateway",
+              code: "DELEGATION_NOT_PROPOSABLE"
+            });
+            return fixed;
+          }
           const check = await controlPlaneMandate(true, mandateRequest(args));
           return check.ok ? void 0 : check.message;
         },
         handler: async (args) => {
-          if (!isSimulationMode()) return { ...builtinText("Refused: not available outside simulation mode."), isError: true };
+          const fixed = delegationItselfRefusal(args);
+          if (fixed) return { ...builtinText(`Refused: ${fixed}`), isError: true };
           const r = await controlPlaneMandate(false, mandateRequest(args));
           if (!r.ok) return { ...builtinText(`Refused: ${r.message}`), isError: true };
           return builtinText(
             `Mandate created: ${r.authorizationId} \u2014 profile ${r.profileId}, ${r.groupName}, mode ${r.mode}, valid for ${Math.round((r.ttlSeconds ?? 0) / 3600)} h. It is active now.`
           );
         }
+      },
+      {
+        // AU3 internal preview (DL1 Interface contract) — never listed, never
+        // callable by an agent. Builds the "What you would sign" card for a
+        // pending create_mandate proposal from the SAME args, local data only.
+        name: "describe_mandate_proposal",
+        internal: true,
+        description: "Internal \u2014 the approval card's preview of a pending create_mandate proposal. Not for agent use.",
+        inputSchema: CREATE_MANDATE_INPUT_SCHEMA,
+        outputSchema: DESCRIBE_MANDATE_PROPOSAL_OUTPUT_SCHEMA,
+        handler: async (args) => {
+          const resolved = resolveTargetProfile(args.profile);
+          if (!resolved) {
+            return { ...builtinText(`Refused: unknown profile "${String(args.profile)}".`), isError: true };
+          }
+          const { profile, shortName: targetShortName } = resolved;
+          const displayName = profile.name ?? targetShortName;
+          const rawTeam = typeof args.team === "string" ? args.team.trim() : "";
+          const workspace = rawTeam && rawTeam.toLowerCase() !== "personal" ? rawTeam : "Personal";
+          const mode = typeof args.mode === "string" ? args.mode : "";
+          const structured = {
+            proposal: `New mandate \xB7 ${displayName}`,
+            profile_version: `${targetShortName} ${profile.version}`,
+            workspace,
+            mode,
+            valid: formatValidity(args, profile),
+            limits: labeledRecord(args.limits, profile.boundsSchema?.fields),
+            scope: labeledRecord(args.scope, profile.scopeSchema?.fields),
+            title: typeof args.title === "string" && args.title.trim() ? args.title.trim() : null,
+            intent: typeof args.intent === "string" ? args.intent : "",
+            checks: delegationChecks(deps, args, targetShortName, displayName)
+          };
+          return builtinStructured(structured);
+        }
+      },
+      {
+        // AU3 internal preview (DL1 Interface contract) — never listed, never
+        // callable by an agent. Builds the "New agent brief" diff card.
+        name: "describe_brief_proposal",
+        internal: true,
+        description: "Internal \u2014 the approval card's preview of a pending set_agent_brief proposal. Not for agent use.",
+        inputSchema: SET_AGENT_BRIEF_INPUT_SCHEMA,
+        outputSchema: DESCRIBE_BRIEF_PROPOSAL_OUTPUT_SCHEMA,
+        handler: async (args) => {
+          const proposed = typeof args.content === "string" ? args.content : "";
+          const current = readContextFile() ?? "";
+          const change = unifiedLineDiff(current, proposed);
+          const trimmed = proposed.trim();
+          const words = trimmed === "" ? 0 : trimmed.split(/\s+/).length;
+          return builtinStructured({ change, words });
+        }
       }
     ]
   };