@theronap/cortex-mcp 0.9.78 → 0.9.80

package/lib/server.mjs

@@ -11,6 +11,7 @@ import { runSendImessage } from './imessage_send.mjs'
 import { formatGrepHits } from './grep_cli.mjs'
 import { renderTriage } from './red_link_triage.mjs'
 import { runCodeGraphQuery } from './code_graph_cli.mjs'
+import { renderTimelineClaimReceipt } from './timeline_claim_receipt.mjs'
 
 // Reactive red-link triage (Mechanism 2). On a read_page miss, ask the server whether the name is a
 // tracked wanted page, whether a bare node exists for it, and whether it's a deliberately demoted page,
@@ -299,8 +300,12 @@ export async function runServer(version) {
         const body = await res.text()
         throw new Error(classify(res.status, res.headers.get('content-type'), body, res.headers.get('x-vercel-id')).message)
       }
-      const { threads, records } = await res.json()
-      if (!threads?.length && !records?.length) return { content: [{ type: 'text', text: 'Nothing in the backlog — everything captured so far has been claimed.' }] }
+      const { threads, records, claim } = await res.json()
+      const receipt = renderTimelineClaimReceipt(claim)
+      if (!threads?.length && !records?.length) {
+        const empty = 'Nothing in the backlog — everything captured so far has been claimed.'
+        return { content: [{ type: 'text', text: receipt ? `${empty}\n\n${receipt}` : empty }] }
+      }
 
       const sections = []
 
@@ -329,10 +334,47 @@ export async function runServer(version) {
         sections.push(`Unclaimed records (${records.length}) from other sources — newest first:\n${lines.join('\n')}`)
       }
 
+      if (receipt) sections.push(receipt)
       return { content: [{ type: 'text', text: sections.join('\n\n') }] }
     },
   )
 
+  // Read-only evidence status for the Gate 4 live trial. This MUST remain an aggregate query: a
+  // monitor needs to know whether enough sessions have exercised the loop, not who they were or what
+  // work they handled. In particular, it must never call timeline_pull as a shortcut, since that would
+  // manufacture the evidence it claims to observe.
+  server.registerTool(
+    'gate4_status',
+    {
+      title: 'Gate 4 live-evidence status',
+      description: 'Read the aggregate, rolling-window status of the Gate 4 trial. This does not claim, attribute, resolve, or expose captured work. It reports machine-observable session, attribution, and recovery counts; a human still confirms that the qualifying sessions were normal work.',
+      inputSchema: {
+        days: z.number().optional().describe('rolling observation window in days (default 14; capped at 30)'),
+      },
+    },
+    async ({ days }) => {
+      const qs = typeof days === 'number' ? `?days=${encodeURIComponent(String(days))}` : ''
+      const res = await fetchCortex(`${BASE}/api/timeline/observation${qs}`, { headers: { Authorization: `Bearer ${TOKEN}` } })
+      if (!res.ok) {
+        const body = await res.text()
+        throw new Error(classify(res.status, res.headers.get('content-type'), body, res.headers.get('x-vercel-id')).message)
+      }
+      const s = await res.json()
+      const machine = s.machineEvidencePassed ? 'MET' : 'NOT YET MET'
+      return {
+        content: [{ type: 'text', text:
+          `Gate 4 evidence, last ${s.window?.days ?? 14} days\n` +
+          `- session claims: ${s.sessionCount ?? 0}/3\n` +
+          `- session-attributed completions: ${s.attributedDone ?? 0} (need 1+)\n` +
+          `- expiry recoveries: ${s.recoveredClaims ?? 0} (need 1+)\n` +
+          `- anonymous session claims: ${s.anonymousSessionClaims ?? 0} (need 0)\n` +
+          `- non-session rows in window (reported, excluded): ${s.nonSessionClaims ?? 0}\n\n` +
+          `Machine evidence: ${machine}. Human attestation remains required: qualifying sessions must be normal work, not a staged demo.`,
+        }],
+      }
+    },
+  )
+
   server.registerTool(
     'search_org',
     {

package/lib/timeline_claim_receipt.mjs

@@ -0,0 +1,25 @@
+// Render the route's claim envelope rather than inferring success from the rows it returned. A pull
+// without this receipt is the exact failure mode Gate 4 is trying to rule out: work can be leased (or
+// not leased) invisibly, and a reader has no way to distinguish the two.
+export function renderTimelineClaimReceipt(claim) {
+  if (!claim || typeof claim !== 'object' || Array.isArray(claim)) return ''
+
+  if (claim.active !== true) {
+    if (claim.reason === 'session_key_required') {
+      return 'Viewing only — no session key was supplied, so no work was leased or attributed.'
+    }
+    if (claim.reason === 'disabled') return 'Viewing only — claiming was disabled, so no work was leased or attributed.'
+    return ''
+  }
+
+  const leased = Number(claim.leased)
+  const count = Number.isFinite(leased) && leased >= 0 ? Math.trunc(leased) : null
+  const expiry = typeof claim.leasedUntil === 'string' && claim.leasedUntil ? claim.leasedUntil : null
+
+  if (count === null) return 'Claim receipt: this session requested work; the server did not return a valid lease count.'
+  if (count === 0) return 'Claim receipt: no work was leased to this session.'
+
+  const noun = count === 1 ? 'record' : 'records'
+  return `Claim receipt: ${count} ${noun} leased to this session${expiry ? ` until ${expiry}` : ''}. ` +
+    'Attribute only email threads you genuinely recognize; leave unknown work unjudged.'
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theronap/cortex-mcp",
-  "version": "0.9.78",
+  "version": "0.9.80",
   "description": "Connect your AI assistant to Cortex — your org's projects, activity, gaps, and directives, scoped to you.",
   "type": "module",
   "bin": {