@theronap/agnoclast-mcp 0.9.99 → 0.9.102

package/lib/capture.mjs

@@ -232,7 +232,7 @@ export async function runCapture() {
   // Recursion guard: edge extraction shells out to `claude --print` with CORTEX_SUMMARIZING=1. That
   // headless session fires its own Stop hook → this same capture command. Without this guard it would
   // recurse (and re-ingest the summarizer's prompt as a phantom session). Bail immediately.
-  if (process.env.CORTEX_SUMMARIZING) { process.stderr.write('cortex: summarizer subprocess, skipping\n'); return }
+  if (process.env.CORTEX_SUMMARIZING) { process.stderr.write(`cortex: ${new Date().toISOString()} (summarizer subprocess) skipping — recursion guard\n`); return }
 
   const stdinRaw = readStdin()
 
@@ -291,14 +291,29 @@ function spawnDetachedWorker(stdinRaw) {
 }
 
 async function captureWork(stdinRaw) {
+  // Parse the hook payload FIRST so every diagnostic below can name its session.
+  //
+  // This used to sit after the token check, which meant the `no CORTEX_TOKEN` line — the one that
+  // fires on a whole misconfigured machine — was the only failure that could not say which session
+  // it lost. Parsing stdin depends on nothing, so the old order bought nothing.
+  let hook = {}
+  try { hook = JSON.parse(stdinRaw) } catch { /* no/invalid stdin */ }
+
+  // Every line in ~/.cortex/capture.log carries an ISO timestamp and the session id, so a silent
+  // stretch can be reconstructed afterwards and matched against `records` and
+  // `page_revisions.session_key`. A line without a session id is a line you cannot act on: it tells
+  // you something was lost and not what. That was the state of all five early returns below until
+  // now — visible since the log landed, but unattributable, which is the same shape as the defect
+  // this whole file has been chasing.
+  const stamp = new Date().toISOString()
+  const sid = hook.session_id ?? '(no session_id)'
+
   // Env first (explicit override / legacy inlined hooks), else the token wired into this machine's
   // MCP config — so hook commands carry no secret (token-hygiene, 2026-07-02).
   const token = resolveTokenSource().token
-  if (!token) { process.stderr.write('cortex: no CORTEX_TOKEN in env or wired config, skipping\n'); return }
+  if (!token) { process.stderr.write(`cortex: ${stamp} ${sid} NOT RECORDED — no CORTEX_TOKEN in env or wired config\n`); return }
   const base = resolveBase(process.env.CORTEX_URL)
 
-  let hook = {}
-  try { hook = JSON.parse(stdinRaw) } catch { /* no/invalid stdin */ }
   const repo = projectFrom(hook.cwd)
   // Redact credential-shaped strings BEFORE anything leaves the machine — this `transcript`
   // feeds local edge/typed extraction AND the fallback POST to the org. A secret in a
@@ -322,11 +337,11 @@ async function captureWork(stdinRaw) {
   // unreadable for a moment is picked up by the next turn, so a transient miss self-heals; only a
   // genuinely persistence-disabled session is dropped, and that session has no content to capture.
   if (hook.transcript_path && !transcriptReadable(hook.transcript_path)) {
-    process.stderr.write('cortex: transcript_path unreadable (session persistence disabled?), skipping\n')
+    process.stderr.write(`cortex: ${stamp} ${sid} NOT RECORDED — transcript_path unreadable (session persistence disabled?)\n`)
     return
   }
 
-  if (!transcript && !hook.session_id) { process.stderr.write('cortex: empty session, skipping\n'); return }
+  if (!transcript && !hook.session_id) { process.stderr.write(`cortex: ${stamp} ${sid} NOT RECORDED — empty session\n`); return }
 
   // T11: digest node refs surfaced to this session (stashed by the MCP server's my_context, keyed by
   // cwd). Forwarded as hydratedFrom so the materializer excludes this session from the digests it
@@ -370,7 +385,7 @@ async function captureWork(stdinRaw) {
     ...(hydratedFrom.length ? { hydratedFrom } : {}),
   }
   const extracted = transcript ? extractSession(transcript) : null
-  if (extracted && /^NOOP\b/i.test(extracted.summary)) { process.stderr.write('cortex: no-op session, skipping\n'); return }
+  if (extracted && /^NOOP\b/i.test(extracted.summary)) { process.stderr.write(`cortex: ${stamp} ${sid} NOT RECORDED — summarizer classified it a no-op session\n`); return }
   const ingestBody = extracted
     ? { ...common, summary: extracted.summary, people: extracted.people, entities: extracted.namedEntities }
     : { ...common, transcript }
@@ -388,12 +403,6 @@ async function captureWork(stdinRaw) {
     } catch { /* best-effort — never block capture */ }
   }
 
-  // Defined before the fetch so the throw path below can stamp its line the same way. Every line in
-  // capture.log carries an ISO timestamp and the session id, so a silent day can be reconstructed
-  // afterwards and matched against `records` / `page_revisions.session_key`.
-  const stamp = new Date().toISOString()
-  const sid = hook.session_id ?? '(no session_id)'
-
   let res
   try {
     // Best-effort background ingest: bound it tight and retry once so a hanging/504-ing server

package/lib/edge_extract.mjs

@@ -105,9 +105,67 @@ const ENTITY_FRAGMENT =
   '"importance" ("high" if central to the work, "low" if incidental). ' +
   'Do NOT include people or companies (those go in "people"). Omit vague/generic mentions. Empty array is fine.)'
 
+// PURE. The scheduled task this transcript is an unattended run of, or null for a human session.
+// Claude Code wraps a scheduled run's instructions in <scheduled-task name="..." file="...">.
+export function scheduledTaskName(transcript) {
+  const m = String(transcript ?? '').match(/<scheduled-task\s+[^>]*name="([^"]+)"/)
+  return m ? m[1] : null
+}
+
+// PURE. Drop the <scheduled-task>…</scheduled-task> blocks — they are the task's OWN INSTRUCTIONS,
+// not anything the run observed, and Claude Code emits them TWICE per transcript. Measured
+// 2026-08-19 on real units: ~2.1KB of instructions repeated, so ~4.2KB of the summarizer's 12KB
+// window went to text describing what the agent was told to do before a single line of what it
+// found. Stripping them spends the budget on the run's actual output.
+export function stripScheduledTaskBlocks(transcript) {
+  return String(transcript ?? '').replace(/<scheduled-task\b[\s\S]*?<\/scheduled-task>/g, '').trim()
+}
+
+// The NOOP bar for an unattended run. The generic bar ("greetings, no tasks") does not fit these and
+// was never meant to: a scheduled run DID do something — it read a file, evaluated a condition,
+// maybe sent a notification — so a summarizer following the generic instruction correctly writes
+// "Automated scripture study check ran; no confirmation for 2026-08-14; reminder sent." That is a
+// faithful summary of a heartbeat, and it is why 36% of session records since 2026-08-01 are
+// automation reporting its own execution. The summarizer was not malfunctioning; it was answering
+// the question it was asked.
+//
+// The distinction that matters is not attended-vs-unattended, it is CHANGED-vs-UNCHANGED. A routine
+// run that found the expected state is a heartbeat. The SAME task finding the domain finally
+// reactivated, or the backlog crossing a threshold, is exactly the thing the knowledge base exists
+// to hold — so this deliberately does not blanket-skip scheduled tasks, which would throw away the
+// one run in a hundred that matters. There are 12 tasks configured and one of them alone fires up to
+// 11 times a day.
+// ⚠ THE WORDING HERE IS LOAD-BEARING AND WAS WRONG ON THE FIRST ATTEMPT. Verified 2026-08-19 against
+// two real transcripts: a first draft ended "when it is genuinely borderline, prefer NOOP" and
+// correctly suppressed the heartbeat — but ALSO suppressed a run of the same task that had flagged a
+// live read path into the frozen Robin archive, a genuine finding. Every unit test still passed,
+// because they cover the stripping, not the judgement. The prompt was killing signal with the noise.
+//
+// Two fixes: the borderline tilt is gone (it resolved every mixed case toward silence), and an
+// incidental observation now counts explicitly — these findings arrive as an aside at the END of an
+// otherwise routine report, which is exactly where a "was this routine?" reading drops them.
+const scheduledTaskFragment = (name) =>
+  '\n\nIMPORTANT — this session is an UNATTENDED run of the scheduled task "' + name + '". ' +
+  'Its instructions have been removed; what remains is only what the run reported. ' +
+  'Judge what it FOUND and what it CHANGED — never merely that it executed. ' +
+  'If the run only confirmed the state it expected and changed nothing, set summary to exactly ' +
+  '"NOOP": a routine run that found nothing new is a heartbeat, not knowledge, and these fire many ' +
+  'times a day. ' +
+  'BUT summarize whenever the run found something changed, hit an error, took an action with a ' +
+  'lasting effect, OR raised a problem, risk or observation the operator would not already know — ' +
+  'INCLUDING one mentioned only in passing at the very end of an otherwise routine report. ' +
+  'One genuine finding outweighs an otherwise unremarkable run; summarize the FINDING, not the run.'
+
 export function extractSession(transcript) {
-  const text = (transcript ?? '').trim()
-  if (!text || process.env.CORTEX_SUMMARIZE_DISABLED) return null
+  const raw = (transcript ?? '').trim()
+  if (!raw || process.env.CORTEX_SUMMARIZE_DISABLED) return null
+  const task = scheduledTaskName(raw)
+  // Strip instructions only for scheduled runs; a human transcript has no such blocks and is passed
+  // through untouched, so this cannot change how ordinary sessions are summarized.
+  const text = task ? stripScheduledTaskBlocks(raw) : raw
+  // A run whose entire transcript WAS the instruction block leaves nothing to judge. That is a
+  // heartbeat by definition — skip without spending a `claude -p` call on it.
+  if (task && !text) return { summary: 'NOOP', people: [], namedEntities: [] }
   const prompt =
     'You are processing a Claude Code work session for a knowledge base. Return ONLY minified JSON ' +
     '(no prose, no markdown fences) with EXACTLY these three keys:\n' +
@@ -115,6 +173,7 @@ export function extractSession(transcript) {
     'had no real work — greetings, no tasks — set summary to exactly "NOOP"),\n' +
     PEOPLE_FRAGMENT + ',\n' +
     ENTITY_FRAGMENT +
+    (task ? scheduledTaskFragment(task) : '') +
     '\n\n--- SESSION ---\n' + text.slice(0, 12000) + '\n--- END ---'
   // Single-flight: if another session already has a summarizer running, skip (caller ships the tail;
   // server summarizes). Prevents the concurrent-`claude -p` stampede that deadlocks the OAuth refresh.

package/lib/server.mjs

@@ -662,6 +662,7 @@ export async function runServer(version) {
       inputSchema: {
         claimKind: z.enum(['relevance', 'cleanup']).optional().describe('default relevance'),
         limit: z.number().optional().describe('max items (default 10). Ignored when intakeItemIds is given.'),
+        leaseMinutes: z.number().optional().describe('lease length in minutes, 5-60 (default 30). Prefer intake_look for read-only inspection — a short lease is only for briefly exclusive work.'),
         intakeItemIds: z.array(z.string()).optional().describe(
           'claim these specific units instead of the head of the queue (max 50). Without it you get FIFO, ' +
           'so reaching one known unit means claiming everything ahead of it. Ids come from intake_changes ' +
@@ -673,7 +674,7 @@ export async function runServer(version) {
         ),
       },
     },
-    async ({ claimKind, limit, intakeItemIds }) => {
+    async ({ claimKind, limit, intakeItemIds, leaseMinutes }) => {
       const res = await fetchCortex(`${BASE}/api/intake/claim`, {
         method: 'POST',
         headers: { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' },
@@ -681,6 +682,7 @@ export async function runServer(version) {
           claimKind: claimKind ?? 'relevance',
           limit,
           includePayload: true,
+          ...(leaseMinutes ? { leaseMinutes } : {}),
           // Forwarded only when present. An empty array is a real request to claim nothing and must
           // survive as one; sending `[]` where the caller sent nothing would silently switch a FIFO
           // claim into a no-op.
@@ -883,6 +885,40 @@ export async function runServer(version) {
     },
   )
 
+  server.registerTool(
+    'intake_look',
+    {
+      title: 'Read an intake unit without claiming it',
+      description:
+        'Read a PENDING intake unit\'s FULL decrypted body without taking a lease — a read RECEIPT, not a claim (ADR-0035). Use it when the settling feed\'s headline + candidate identifiers cannot tell you whether the unit belongs to your current work; looking is non-exclusive (any number of sessions may inspect the same unit) and always logged, so look freely rather than guessing from the headline — diligence is subsidized here. After looking: claim it if it is yours to process, or simply move on — no release needed, you never held it. The response includes how many sessions have looked (`looks`/`distinctLookers`): several looks and no claim is a sign the unit needs the triage agent or the owner, not another look. Resolved units are refused — read those as records.',
+      inputSchema: {
+        intakeItemId: z.string().describe('intake item uuid, from the settling feed (intake_changes) or intake_claim'),
+        workingIdentifiers: z.array(z.string()).optional().describe('the identifiers your current work touches (repo:…, file:…, project:…) — stored on the receipt; feeds look→claim conversion analysis'),
+      },
+    },
+    async ({ intakeItemId, workingIdentifiers }) => {
+      let res
+      try {
+        res = await fetchCortex(`${BASE}/api/intake/look`, {
+          method: 'POST',
+          headers: { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' },
+          body: JSON.stringify({ intakeItemId, workingIdentifiers: workingIdentifiers ?? [] }),
+        })
+      } catch (e) {
+        return toolError(`Could not look: ${e.message}`)
+      }
+      const out = await res.json().catch(() => null)
+      if (!res.ok) {
+        if (out?.error === 'not_lookable') {
+          return toolError(`Not lookable: the unit is ${out?.state ?? 'resolved'} — resolved units are read as records, not looks.`)
+        }
+        if (out?.error === 'not_found') return toolError('No such intake unit in your account.')
+        return toolError(`Could not look: ${out?.error ?? res.status}${out?.detail ? ` — ${out.detail}` : ''}`)
+      }
+      return { content: [{ type: 'text', text: JSON.stringify(out, null, 2) }] }
+    },
+  )
+
   server.registerTool(
     'intake_cleanup_status',
     {
@@ -1400,9 +1436,10 @@ export async function runServer(version) {
         tier: z.enum(['accessible', 'scoped', 'confidential']).optional().describe('only when the page exists at MORE THAN ONE tier — which one to rename in. A rename never moves content between tiers.'),
         ordinal: z.number().optional().describe('only when the same heading appears more than once on the page — which occurrence to rename (the error lists the ordinals).'),
         reason: z.string().optional().describe('why you are renaming it — recorded in page_history like any other edit'),
+        identity_claim_ack: z.boolean().optional().describe('ONLY after a 409 identity_claim refusal, and only if the answer is genuinely yes: this text is meant to publish an email address or phone number as page content at this tier — e.g. the subject is publishing their OWN contact detail on their own page. Leave unset otherwise; the alternatives the refusal names (a confidential section, or set_routing_identifier for a private claim) are the right answer in every other case.'),
       },
     },
-    async ({ name, from, to, base_version, tier, ordinal, reason }) => {
+    async ({ name, from, to, base_version, tier, ordinal, reason, identity_claim_ack }) => {
       let res
       try {
         res = await fetchCortex(`${BASE}/api/brain/rename-section`, {
@@ -1411,7 +1448,7 @@ export async function runServer(version) {
           body: JSON.stringify({
             name, from, to, base_version,
             ...(tier ? { tier } : {}), ...(ordinal !== undefined ? { ordinal } : {}),
-            ...(reason ? { reason } : {}),
+            ...(reason ? { reason } : {}), ...(identity_claim_ack ? { identity_claim_ack: true } : {}),
           }),
         })
       } catch (e) {
@@ -1423,6 +1460,7 @@ export async function runServer(version) {
         // rather than something to retry blindly.
         const extra = [
           out?.detail ? `existing: ${out.detail}` : '',
+          Array.isArray(out?.identityClaims) ? `identity identifiers this would publish: ${out.identityClaims.join(', ')}` : '',
           Array.isArray(out?.tiers) ? `tiers: ${out.tiers.join(', ')}` : '',
           Array.isArray(out?.ordinals) ? `ordinals: ${out.ordinals.join(', ')}` : '',
           out?.currentVersion ? `current version: ${out.currentVersion}` : '',
@@ -1445,9 +1483,10 @@ export async function runServer(version) {
         base_version: z.string().describe('the `version` read_page prints for this page (64-hex). REQUIRED — it is the concurrency check AND how the right brain is resolved. A per-SECTION hash is not valid here.'),
         reason: z.string().optional().describe('WHY the summary was wrong, in one short phrase — recorded in page_history. Say what changed ("blocker resolved 08-04; was still claiming BLOCKED"), not what you did.'),
         tier: z.enum(['accessible', 'scoped', 'confidential']).optional().describe('only when the page exists at MORE THAN ONE tier — which one to rewrite. This never moves content between tiers.'),
+        identity_claim_ack: z.boolean().optional().describe('ONLY after a 409 identity_claim refusal, and only if the answer is genuinely yes: this text is meant to publish an email address or phone number as page content at this tier — e.g. the subject is publishing their OWN contact detail on their own page. Leave unset otherwise; the alternatives the refusal names (a confidential section, or set_routing_identifier for a private claim) are the right answer in every other case.'),
       },
     },
-    async ({ name, summary, base_version, reason, tier }) => {
+    async ({ name, summary, base_version, reason, tier, identity_claim_ack }) => {
       let res
       try {
         res = await fetchCortex(`${BASE}/api/brain/set-summary`, {
@@ -1456,6 +1495,7 @@ export async function runServer(version) {
           body: JSON.stringify({
             name, summary, base_version,
             ...(tier ? { tier } : {}), ...(reason ? { reason } : {}),
+            ...(identity_claim_ack ? { identity_claim_ack: true } : {}),
           }),
         })
       } catch (e) {
@@ -1467,6 +1507,7 @@ export async function runServer(version) {
         // rather than something to retry blindly.
         const extra = [
           out?.detail ? `detail: ${out.detail}` : '',
+          Array.isArray(out?.identityClaims) ? `identity identifiers this would publish: ${out.identityClaims.join(', ')}` : '',
           Array.isArray(out?.tiers) ? `tiers: ${out.tiers.join(', ')}` : '',
           out?.currentVersion ? `current version: ${out.currentVersion}` : '',
         ].filter(Boolean).join(' · ')
@@ -1492,9 +1533,10 @@ export async function runServer(version) {
         reason: z.string().describe('WHY you are making this change, in one short phrase — recorded in page_history exactly like an author edit.'),
         tier: z.enum(['accessible', 'scoped', 'confidential']).optional().describe('only when the page exists at MORE THAN ONE tier — which one to edit. An edit never moves content between tiers.'),
         ordinal: z.number().optional().describe('only when the same heading appears more than once on the page — which occurrence (the error lists the ordinals).'),
+        identity_claim_ack: z.boolean().optional().describe('ONLY after a 409 identity_claim refusal, and only if the answer is genuinely yes: this text is meant to publish an email address or phone number as page content at this tier — e.g. the subject is publishing their OWN contact detail on their own page. Leave unset otherwise; the alternatives the refusal names (a confidential section, or set_routing_identifier for a private claim) are the right answer in every other case.'),
       },
     },
-    async ({ name, heading, old_string, new_string, base_version, reason, tier, ordinal }) => {
+    async ({ name, heading, old_string, new_string, base_version, reason, tier, ordinal, identity_claim_ack }) => {
       let res
       try {
         res = await fetchCortex(`${BASE}/api/brain/edit-page`, {
@@ -1503,6 +1545,7 @@ export async function runServer(version) {
           body: JSON.stringify({
             name, heading, old_string, new_string, base_version, reason,
             ...(tier ? { tier } : {}), ...(ordinal !== undefined ? { ordinal } : {}),
+            ...(identity_claim_ack ? { identity_claim_ack: true } : {}),
           }),
         })
       } catch (e) {
@@ -1518,6 +1561,7 @@ export async function runServer(version) {
           Array.isArray(out?.ordinals) ? `ordinals: ${out.ordinals.join(', ')}` : '',
           out?.count ? `matches: ${out.count}` : '',
           out?.whitespaceNear === true ? 'YOUR TEXT IS PRESENT but the whitespace differs — re-copy it from the stored body' : '',
+          Array.isArray(out?.identityClaims) ? `identity identifiers this edit would publish: ${out.identityClaims.join(', ')}` : '',
           out?.currentVersion ? `current version: ${out.currentVersion}` : '',
         ].filter(Boolean).join('\n')
         const cur = out?.currentSectionBody
@@ -2893,10 +2937,11 @@ export async function runServer(version) {
         base_version: z.string().optional().describe('the `version` hash shown when you read this page (read_page) — REQUIRED when updating an existing page, so a concurrent edit is caught instead of clobbered. Omit only for a brand-new node. If the save returns "stale" or "read first", read_page again and retry with the fresh version.'),
         reason: z.string().describe('WHY you are making this edit, in one short phrase — recorded permanently in page_history so a later reader can tell a routine addition from a correction. Say what CHANGED and what prompted it ("Ben pilot abandoned per Theron 07-17", "corrected: 0069 already widened the CHECK"), not what you did ("updated page"). This is the field that makes staleness auditable.'),
         change_kind: z.enum(['add', 'correct', 'supersede', 'expand', 'retire']).optional().describe('what KIND of edit: "add" (new information), "correct" (the page said something FALSE — the currency-critical one), "supersede" (was true, now outdated by events), "expand" (elaborates, no claim changed), "retire" (putting the page or a section to rest). Be honest with "correct" — a page whose history shows repeated corrections is a page whose claims need checking, and that signal is the point.'),
+        identity_claim_ack: z.boolean().optional().describe('ONLY after a 409 identity_claim_unacked refusal, and only if the answer is genuinely yes: this page is meant to publish an email address or phone number as page content at this tier — e.g. the subject is publishing their OWN contact detail on their own page. Leave unset otherwise; the alternatives the refusal names (a confidential section, or set_routing_identifier for a private claim) are the right answer in every other case.'),
         brain: z.string().optional().describe('which brain a genuinely NEW page is created in — a brain name or its org id. Choose by RELEVANCE to what you are writing (`my_brains` shows what each brain holds), not by the active pointer. Has top precedence, so it also disambiguates a page name you hold in several brains. Unnecessary when the brain is resolvable from the write itself (base_version, or an existing page of this name) and unnecessary when you only have one brain.'),
       },
     },
-    async ({ kind, name, summary, sections, tier, base_version, reason, change_kind, brain }) => {
+    async ({ kind, name, summary, sections, tier, base_version, reason, change_kind, brain, identity_claim_ack }) => {
       // No client-side tier default — the server computes the per-kind safe default (page-privacy
       // T4/D10) so version-pinned installs can't bake a stale policy.
       const pages = [{ ...(tier ? { tier } : {}), summary, base_version, sections: Array.isArray(sections) ? sections : [] }]
@@ -2908,7 +2953,7 @@ export async function runServer(version) {
           // `brain` is forwarded only when the caller named one. The server's resolveAuthorBrain gives
           // an explicit brain top precedence and 409s on an unknown one rather than falling back to
           // the pointer, so sending an empty value would turn "I did not choose" into "I chose wrong".
-          body: JSON.stringify({ kind, name, pages, reason, change_kind, ...(brain ? { brain } : {}) }),
+          body: JSON.stringify({ kind, name, pages, reason, change_kind, ...(brain ? { brain } : {}), ...(identity_claim_ack ? { identity_claim_ack: true } : {}) }),
         })
       } catch (e) {
         return toolError(`Could not author "${name}": ${e.message}`)
@@ -2935,6 +2980,23 @@ export async function runServer(version) {
             `\n\nRe-run author with brain:"<name>" — choose by what each brain HOLDS, not by its name.`,
           )
         }
+        // IDENTITY-CLAIM REFUSAL — carries the identifiers and the three ways out. classify() would
+        // flatten this to "409", which is the one failure mode that must NOT be generic: an agent that
+        // cannot see WHICH address it tried to publish, or that a private alternative exists, will
+        // simply re-send with the ack. The refusal has to teach, or it just trains the bypass.
+        if (err?.error === 'identity_claim_unacked') {
+          const claims = Array.isArray(err.claims) ? err.claims.join(', ') : ''
+          return toolError(
+            `Refused — NOTHING was written to "${name}".` +
+            `\n\nThis write puts ${claims ? `${claims} ` : 'an identity identifier '}into the page BODY at the ${err.tier} tier.` +
+            ` A body claim is page TEXT governed by that tier — it is NOT the private, claimant-read` +
+            ` routing claim — so everyone who can read this page can read the address or phone number.` +
+            `\n\nPick one:` +
+            `\n  • the subject is publishing their OWN contact detail → re-send with identity_claim_ack: true` +
+            `\n  • it belongs on the page but not to everyone → put it in a confidential section` +
+            `\n  • you just want your own records to join here → set_routing_identifier (private to you)`,
+          )
+        }
         const d = classify(res.status, res.headers.get('content-type'), raw, res.headers.get('x-vercel-id'))
         return toolError(`Could not author "${name}": ${d.message}`)
       }
@@ -2975,8 +3037,19 @@ export async function runServer(version) {
           ` STATUS ("X is live", "Y is not merged"), add the date inline with edit_page while you still` +
           ` hold the context. The write already landed; this is advisory.`
         : ''
+      // PARTIAL-WRITE REFUSAL. A multi-tier call where one tier landed and another was gated returns
+      // 200 (per the route's mixed-outcome rule), so the 409 branch never runs and the refusal would
+      // ride silently in `skipped` — which this success path does not print. That is the exact
+      // computed-but-never-printed failure the KWA-26 note below is about, and a privacy refusal is
+      // the worst thing to lose it on: the agent would read "Authored" and believe the claim landed.
+      const identityRefused = Array.isArray(out?.identityClaimTiers) && out.identityClaimTiers.length
+        ? `\n⚠ REFUSED at ${out.identityClaimTiers.map((t) => `${t.tier} (${t.claims.join(', ')})`).join('; ')}` +
+          ` — that tier was NOT written. A body claim is page text at that tier, readable by everyone who` +
+          ` can read the page. Re-send with identity_claim_ack: true only if the subject is publishing` +
+          ` their own contact detail; otherwise use a confidential section or set_routing_identifier.`
+        : ''
       const verb = out?.created ? 'Created + authored' : 'Authored'
-      const note = out?.built ? `${verb} "${name}" (${out.built} tier${out.built === 1 ? '' : 's'}). Links: ${blue} resolved, ${retired} retired, ${red} red.${corrections}${retiredList}${redList}${stamps}${undated}`
+      const note = out?.built ? `${verb} "${name}" (${out.built} tier${out.built === 1 ? '' : 's'}). Links: ${blue} resolved, ${retired} retired, ${red} red.${corrections}${retiredList}${redList}${stamps}${undated}${identityRefused}`
         : `No change to "${name}"${out?.skipped?.length ? ` (${out.skipped.join(', ')})` : ''}.${corrections}`
       return { content: [{ type: 'text', text: note }] }
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theronap/agnoclast-mcp",
-  "version": "0.9.99",
+  "version": "0.9.102",
   "description": "Connect your AI assistant to Cortex — your org's projects, activity, gaps, and directives, scoped to you.",
   "type": "module",
   "bin": {