@vostride/agent-qa-mcp 0.2.2 → 0.2.4

package/dist/index.cjs

@@ -47,13 +47,11 @@ __export(index_exports, {
   AppResourceReadError: () => AppResourceReadError,
   AppResourceUriError: () => AppResourceUriError,
   DEGRADED_OUTPUT_CONTRACTS: () => DEGRADED_OUTPUT_CONTRACTS,
-  JOB_STATUS_TO_MCP_TASK_STATE: () => JOB_STATUS_TO_MCP_TASK_STATE,
   LIVE_LINK_ABSENT_LINE: () => LIVE_LINK_ABSENT_LINE,
   LIVE_LINK_NO_RUN_LINE: () => LIVE_LINK_NO_RUN_LINE,
   MCP_APPS_EXTENSION_ID: () => MCP_APPS_EXTENSION_ID,
   McpProjectionError: () => McpProjectionError,
   UNPROJECTED_OPS: () => UNPROJECTED_OPS,
-  V1_TOOL_MIGRATION_MAP: () => V1_TOOL_MIGRATION_MAP,
   advertisedContracts: () => advertisedContracts,
   appResourceUriFor: () => appResourceUriFor,
   armWithoutDiscriminant: () => armWithoutDiscriminant,
@@ -68,7 +66,6 @@ __export(index_exports, {
   maskedToolResult: () => maskedToolResult,
   negotiatedAppsExtension: () => negotiatedAppsExtension,
   parseAppUri: () => parseAppUri,
-  projectJobAsTask: () => projectJobAsTask,
   registerAppResources: () => registerAppResources,
   renderAppWrapperPage: () => renderAppWrapperPage,
   stripRedundantObjectStamp: () => stripRedundantObjectStamp,
@@ -208,9 +205,7 @@ ${live && !expired ? '<iframe data-app-live-frame sandbox="allow-scripts" referr
   var message = document.querySelector('[data-app-message]');
   var hint = document.querySelector('[data-app-hint]');
 
-  // WHICH RUN, as an attribute rather than as prose. Identity is not run STATE (D-11 forbids the
-  // second, not the first), and it enters through setAttribute from an escaped literal, so a run
-  // id can never become markup no matter what it spells.
+  // The run id enters through setAttribute from an escaped literal, so it never becomes markup.
   root.setAttribute('data-app-run-id', runId);
 
   // The state machine is an ATTRIBUTE plus two textContent writes, exactly as the embed page's is:
@@ -224,25 +219,7 @@ ${live && !expired ? '<iframe data-app-live-frame sandbox="allow-scripts" referr
 
   // ---- The minimal ui/initialize handshake (ext-apps spec shape) -------------------------------
   //
-  // HAND-ROLLED AND DELIBERATELY ISOLATED IN THIS ONE BLOCK. The ext-apps package
-  // declares a peer on the v1 monolith SDK, so importing its app-bridge into production would drag
-  // a second SDK generation in (Pitfall 3) \u2014 and this page has no bundler anyway. RESEARCH
-  // assumption A5 rated the method-name and field spellings MEDIUM (single spec fetch), and plan
-  // 02's coverage entry D9 deferred the adjudication to plan 06.
-  //
-  // PLAN 06 MEASURED IT, AND IT HAD DRIFTED. Against the installed
-  // @modelcontextprotocol/ext-apps@1.7.5's own generated schema, McpUiInitializeRequest.params
-  // requires THREE members: protocolVersion, appInfo and appCapabilities. This block sent only the
-  // first, so a host validating the request against the published schema would have rejected the
-  // handshake outright, and the failure would have looked like a host that simply does not support
-  // Apps. The two missing members are now sent, and ext-apps-constants.test.ts cell (4d) derives
-  // the required list FROM the shipped schema rather than restating it, so the next spec change
-  // reds here instead of on a user's machine.
-  //
-  // IT STILL ASKS FOR NOTHING. appCapabilities is deliberately empty: this document exposes no
-  // tools, requests no display mode and declares no experimental feature (the schema requires no
-  // member of it). No permissions, no re-mint (D-10) \u2014 it announces that this document is ready,
-  // which is all a wrapper that renders no run state of its own has to say.
+  // Hand-rolled: ext-apps' app-bridge peers on the v1 SDK, and this page has no bundler.
   try {
     if (window.parent !== window) {
       window.parent.postMessage({
@@ -259,20 +236,13 @@ ${live && !expired ? '<iframe data-app-live-frame sandbox="allow-scripts" referr
   } catch (e) { /* a host that refuses the message changes nothing about what this page shows */ }
 
   if (mints.length === 0) {
-    // Either D-07's honest terminal/unknown state or D-10's expired one \u2014 both were decided by the
-    // RENDERER and are already in the markup. No src was ever assigned, so there is no blank frame
-    // to mistake for a stalled one, and nothing below this line can move the document off them.
+    // The renderer already wrote the terminal or expired state, and no src was ever assigned.
     return;
   }
 
-  // ---- Reachability, once per ORIGIN (see the header's measured note) ---------------------------
+  // ---- Reachability, once per ORIGIN ------------------------------------------------------------
   //
-  // Memoised deliberately, and ONLY ON SUCCESS. The picker swaps among panes that share one
-  // origin, so after the first ANSWERING pane every swap is served from this map and issues NO
-  // network request at all (D-06/D-10's zero re-mints, zero calls, which the DOM cell counts) \u2014 a
-  // property that rides entirely on caching the true. The catch arm therefore FORGETS the entry
-  // before answering false: a refusal is a fact about one moment, not about the origin, and every
-  // mint on a render shares one origin, so a cached false was total and permanent. See the header.
+  // Only success is cached: every pane shares one origin, so a cached refusal would be permanent.
   var reach = {};
   function reachable(url) {
     var origin;
@@ -288,13 +258,7 @@ ${live && !expired ? '<iframe data-app-live-frame sandbox="allow-scripts" referr
   var attachId = 0;
 
   function attach(mint) {
-    // THE EXPIRED STATE IS TERMINAL, AND THIS IS THE ONE PLACE IT COULD BE LEFT (D-10). The
-    // picker's change handler \u2014 and nothing else \u2014 can reach this function after the one-shot
-    // expiry timer has fired; without this line the next statements would set the connecting state
-    // and assign an aged token over a document that had already told the truth, and no timer would
-    // ever correct it. The identical predicate inside settle() stays where it is: it closes the
-    // OTHER door, a probe or a frame load that was already in flight when the timer fired, so
-    // neither guard makes the other dead.
+    // Expired is terminal; a picker change after the one-shot expiry timer must not leave it.
     if (root.getAttribute('data-app-state') === 'expired') return;
     var mine = (attachId += 1);
     var loaded = false;
@@ -313,7 +277,7 @@ ${live && !expired ? '<iframe data-app-live-frame sandbox="allow-scripts" referr
 
     frame.addEventListener('error', function () { settle('unreachable-origin'); }, { once: true });
     frame.addEventListener('load', function () {
-      // NECESSARY, NOT SUFFICIENT: Chromium fires this for a refused connection too (header note),
+      // NECESSARY, NOT SUFFICIENT: Chromium fires this for a refused connection too,
       // so the probe is what decides \u2014 a frame that loaded on an origin nothing answered for is an
       // error page, and calling that 'live' is the failure this arm exists to prevent.
       loaded = true;
@@ -325,14 +289,11 @@ ${live && !expired ? '<iframe data-app-live-frame sandbox="allow-scripts" referr
       else if (loaded) settle('live');
     });
 
-    // D-11's REQUIRED arm for the origin that never answers at all: a black-holed host fires no
-    // error and never loads, so silence past this bound is itself the signal, named rather than
-    // left as a spinner.
+    // A black-holed origin fires no error and never loads; silence past this bound is the signal.
     setTimeout(function () { settle('unreachable-origin'); }, loadTimeoutMs);
   }
 
-  // D-10: the deadline was computed at RENDER time and arrives as a delta, so the host's own clock
-  // never enters the comparison. When it fires the document says so and stops \u2014 nothing here mints.
+  // The deadline arrives as a delta from render time, so the host's own clock never enters it.
   if (expiresInMs > 0) {
     setTimeout(function () {
       attachId += 1;
@@ -348,8 +309,7 @@ ${live && !expired ? '<iframe data-app-live-frame sandbox="allow-scripts" referr
     }, expiresInMs);
   }
 
-  // D-06/D-10: the picker swaps among tokens ALREADY minted for this render. It never mints, and
-  // there is no bridge here that could ask anyone to \u2014 a fresh watch call is what re-mints.
+  // The picker swaps among tokens minted for this render; only a fresh watch call re-mints.
   for (var i = 0; i < mints.length; i += 1) {
     var option = document.createElement('option');
     option.value = String(i);
@@ -534,74 +494,7 @@ function createAppResourceReadHandler(deps) {
           uri: `${APP_URI_PREFIX}${runId}`,
           mimeType: APP_RESOURCE_MIME_TYPE,
           text: html,
-          // The host's default is `frame-src 'none'`, so an App that names no frame domain paints
-          // a BLOCKED inner frame — the blank pane criterion 2 forbids (Pitfall 1). The allowed
-          // origin is the minted link's OWN origin rather than a separately configured one, so the
-          // allow can never be broader than the document needs (T-408-05). `frameDomain` is the ONE
-          // distinct origin `frameOrigins` above resolved over EVERY mint (IN-02) — not `mints[0]`'s,
-          // which was the same answer only by a fact held in another package.
-          //
-          // TWO ABSENCES, NOT ONE (corrected 2026-09-01, 408 gap round; `408-VERIFICATION.md` W-4 /
-          // `408-REVIEW.md` WR-03). This comment used to read "with no mints there is no inner
-          // frame, and the block is omitted rather than emitted empty", which describes only the
-          // FIRST of two conditions that both reach `frameDomain === undefined`. They are different
-          // questions with different served documents, and collapsing them told a reader about a
-          // state the code does not produce:
-          //   - `mints.length` asks whether there is anything to render at all. Zero mints means
-          //     `runLive` is `false`, the wrapper emits no `<iframe data-app-live-frame>`, and the
-          //     omitted `csp` block allows nothing because nothing needs allowing. Honest.
-          //   - `frameOrigins[0]` is the SEPARATE question of whether any surviving mint yielded a
-          //     parseable origin to put in `_meta.ui.csp`. With `mints.length > 0` and every
-          //     `originOf(mint.liveUrl)` answering `undefined`, `runLive` is `true` — the document
-          //     DOES emit the iframe and DOES assign `frame.src` — while the `csp` block is omitted,
-          //     so a conformant host falls back to `frame-src 'none'` and the pane is blocked and
-          //     blank. Not honest, and the sentence above never mentioned it.
-          //   WHY NO SHIPPED PORT REACHES IT: `runs.liveurl` would have to answer a `liveUrl` that
-          //   is not a parseable URL, and no shipped port does. The verifier measured this as
-          //   unreachable and classified W-4 as a documentation finding rather than a gap; the
-          //   wrapper's probe/timeout arm would in any case settle `unreachable-origin` with the
-          //   permanent link rather than leave a blank pane under a progress claim, so SC2 survives
-          //   even on the unreachable path.
-          //
-          // THE INVARIANT IS UNASSERTED, AND THAT IS A DATED DEFERRAL RATHER THAN A SILENCE
-          // (2026-09-01, 408 gap round). "Every mint that survives into `runLive` has a nameable
-          // origin" is asserted nowhere today — not here, not in `renderAppWrapperPage`, not in a
-          // cell. It is the natural candidate and it is NOT taken in this round, because this round
-          // is a gap-closure round whose whole reported gap is documentation integrity.
-          //   THE RULE THAT MAKES THAT CONSISTENT, because the neighbouring round looks
-          //   contradictory and a reader is entitled to it: THIS ROUND CHANGES WHAT THE SYSTEM
-          //   SAYS, NEVER WHAT IT DOES. 408-16 task 1 does edit a runtime file — `config.ts` — but
-          //   it only adds words to an error that was already being thrown on exactly the inputs it
-          //   was already thrown on; no parse outcome moves in either direction and no input that
-          //   succeeded now fails. Asserting the invariant here would add a NEW failure mode to a
-          //   path that currently succeeds. Operator-facing error prose is in scope because it is
-          //   prose; a new runtime invariant is out of scope because it is behaviour. That is the
-          //   whole distinction, and it is what makes W-2 closable in this round and W-4's
-          //   invariant half not.
-          //
-          // AND THE NEW PROSE CENSUS DOES NOT COVER THIS, which is the question the gap brief asks
-          // by name. `__tests__/withdrawn-claim-census.test.ts` gates ONE withdrawn security claim
-          // about the token channel, keyed on a channel cue bound to an exclusivity cue; W-4 is a
-          // different species — a comment that CONFLATES two conditions rather than one that
-          // over-claims a control — and widening that census to "any comment that conflates two
-          // conditions" is not mechanizable, and a vocabulary that tried would red on honest prose,
-          // which this round's own prohibition forbids.
-          //
-          // `connectDomains` NAMES THE SAME ONE ORIGIN, AND IT IS NOT OPTIONAL (408 plan 06 Task 2,
-          // MEASURED 2026-08-31). ext-apps' shipped schema documents `connectDomains` as mapping to
-          // `connect-src` with "empty or omitted -> no network connections (secure default)", and
-          // 408-02 D-H gave this wrapper a no-cors probe of the frame's origin — because Chromium
-          // fires `load` for a REFUSED connection, so `load` alone would label an error page `live`.
-          // With only `frameDomains` declared, a conformant host serves the App under
-          // `connect-src 'none'`, the probe is blocked before it leaves the document, and the
-          // wrapper settles in `unreachable-origin` for a live view that is perfectly reachable —
-          // measured in `app-host-harness.test.ts`, with Chromium naming the directive in its own
-          // console. That is not a blank frame, but it is a lie with a sentence attached, which is
-          // worse: it tells a person to go somewhere else while the pixels are right there.
-          //
-          // It is exactly as narrow as the frame allowance — the same single minted origin, never a
-          // wildcard and never a second configured value — so the App can reach the one host it
-          // embeds and nothing else.
+          // Hosts default `frame-src` and `connect-src` to none; allow the minted origin in both.
           ...frameDomain === void 0 ? {} : {
             _meta: {
               ui: { csp: { frameDomains: [frameDomain], connectDomains: [frameDomain] } }
@@ -637,11 +530,7 @@ function registerAppResources(server, deps) {
   });
   server.registerResource(
     APP_RESOURCE_NAME,
-    // `list: undefined` is REQUIRED to be spelled out by the SDK, and here the explicit absence is
-    // load-bearing rather than merely honest: an unlisted template cannot be reached by
-    // enumeration, so no model walking `resources/list` can discover an address whose read mints a
-    // credential (Pitfall 2). Enumerating every watchable run is a listing this surface does not
-    // offer, and this is the line that says so.
+    // Unlisted, so no model walking `resources/list` finds an address whose read mints a token.
     new import_server.ResourceTemplate(APP_RESOURCE_URI_TEMPLATE, { list: void 0 }),
     {
       title: APP_RESOURCE_TITLE,
@@ -671,8 +560,7 @@ function compositionOf(projection) {
 }
 var AGENT_QA_OP_CONTRACTS = Object.freeze({
   "runs.mark": Object.freeze({ input: import_agent_qa_schema2.RunsMarkInputSchema, output: import_agent_qa_schema2.RunsMarkOutcomeSchema }),
-  // 2026-09-15, 423-21 D-18: the feedback reads keep their ops' own strict contracts. The preview
-  // takes runs.mark's exact input and answers the read-only plan result.
+  // The preview takes `runs.mark`'s exact input and answers the read-only plan result.
   "runs.marks.history": Object.freeze({
     input: import_agent_qa_schema2.RunsMarksHistoryInputSchema,
     output: import_agent_qa_schema2.RunsMarksHistoryResultSchema
@@ -722,7 +610,6 @@ var AGENT_QA_OP_CONTRACTS = Object.freeze({
     input: import_agent_qa_schema2.ConfigProjectScaffoldInputSchema,
     output: import_agent_qa_schema2.ConfigChangeOutputSchema
   }),
-  // 2026-09-30 (432-12 D-05): the three knowledge changes answer what they applied.
   "knowledge.accept": Object.freeze({
     input: import_agent_qa_schema2.KnowledgeAcceptChangeInputSchema,
     output: import_agent_qa_schema2.KnowledgeChangeOutputSchema
@@ -743,8 +630,7 @@ var AGENT_QA_OP_CONTRACTS = Object.freeze({
     input: import_agent_qa_schema2.EntitiesGetInputSchema,
     output: import_agent_qa_schema2.EntityCardSchema
   }),
-  // 2026-09-28 (431-03, D-03/D-07): the canonical list contract — `RunsListOutputSchema` as the
-  // validator, the same object `runs.list` enforces with, plus its explicit output document.
+  // `RunsListOutputSchema` is the same validator `runs.list` enforces with.
   "runs.list": Object.freeze({
     input: import_agent_qa_schema2.RunsListInputSchema,
     output: import_agent_qa_schema2.RunsListOutputContract
@@ -753,8 +639,7 @@ var AGENT_QA_OP_CONTRACTS = Object.freeze({
     input: import_agent_qa_schema2.RunsDigestInputSchema,
     output: import_agent_qa_schema2.RunDigestSchema
   }),
-  // 2026-09-28 (431-04 D-04/D-05/D-07): the eight reads keep their ops' own contracts. The
-  // evidence arms use the canonical output contracts, whose validators are the runtime schemas.
+  // The evidence arms use the canonical output contracts, whose validators are the runtime schemas.
   "knowledge.bundles.list": Object.freeze({
     input: import_agent_qa_schema2.KnowledgeBundlesListInputSchema,
     output: import_agent_qa_schema2.KnowledgeBundlesListOutputSchema
@@ -808,11 +693,9 @@ var AGENT_QA_TOOL_PROJECTIONS = Object.freeze([
     name: "agent_qa_start_run",
     ops: Object.freeze(["runs.start"]),
     kind: "workflow",
-    // 408 D-05: a run starts and is immediately watchable. The ack carries the runId, so the
-    // per-call reference is derived from the OUTPUT.
+    // The ack carries the run id, so the per-call reference comes from the output.
     ui: Object.freeze({ resource: "live-run", runIdFrom: "output" })
   }),
-  // 2026-09-30 (432-12 D-05): the config change tool writes in the call. The undo arm is gone.
   Object.freeze({
     name: "agent_qa_change_config",
     ops: Object.freeze([
@@ -826,8 +709,7 @@ var AGENT_QA_TOOL_PROJECTIONS = Object.freeze([
     kind: "workflow",
     discriminant: import_agent_qa_schema2.TOOL_FOLD_DISCRIMINANT
   }),
-  // 2026-09-30 (432-12 D-05/D-09): accept, reject and forget apply in the call. Forget is the
-  // explicit removal; a wrong record is otherwise corrected by new feedback.
+  // Forget is the explicit removal; a wrong record is otherwise corrected by new feedback.
   Object.freeze({
     name: "agent_qa_change_knowledge",
     ops: Object.freeze([
@@ -843,9 +725,7 @@ var AGENT_QA_TOOL_PROJECTIONS = Object.freeze([
     ops: Object.freeze(["runs.mark"]),
     kind: "apply"
   }),
-  // 2026-09-15, 423-21 D-18: marks history and the mark consequence preview beside the mark
-  // writer. Both are read projections with no apply envelope, so `agent_qa_mark_run` stays the
-  // only door that lands a mark.
+  // Both are reads, so `agent_qa_mark_run` stays the only door that lands a mark.
   Object.freeze({
     name: "agent_qa_get_run_marks",
     ops: Object.freeze(["runs.marks.history"]),
@@ -861,7 +741,7 @@ var AGENT_QA_TOOL_PROJECTIONS = Object.freeze([
     ops: Object.freeze(["knowledge.gates.list"]),
     kind: "read"
   }),
-  // 2026-09-28, 431 D-04: the knowledge reads, named one-to-one with their CLI verbs.
+  // The knowledge reads, named one-to-one with their CLI verbs.
   Object.freeze({
     name: "agent_qa_list_knowledge_bundles",
     ops: Object.freeze(["knowledge.bundles.list"]),
@@ -901,14 +781,10 @@ var AGENT_QA_TOOL_PROJECTIONS = Object.freeze([
     name: "agent_qa_get_run_digest",
     ops: Object.freeze(["runs.digest"]),
     kind: "read",
-    // 408 D-05/D-07: the watch/status read, and therefore the LATE-ATTACH door — a run started
-    // from the CLI, from CI or from the dashboard is watchable through it exactly as an
-    // MCP-started one is, because a viewer attaches and never owns. Its runId is on the INPUT.
+    // The late-attach door: a viewer attaches to any run, so the run id comes from the input.
     ui: Object.freeze({ resource: "live-run", runIdFrom: "input" })
   }),
-  // 2026-09-28, 431 D-05/D-06/D-07: one completed run's whole reads. The overview is the map, run
-  // knowledge the whole used-and-learned projection unchanged, and evidence one addressed document
-  // or blob. All three carry the result-size hint.
+  // A completed run's whole reads, each carrying the result-size hint.
   Object.freeze({
     name: "agent_qa_get_run_overview",
     ops: Object.freeze(["runs.overview"]),
@@ -942,8 +818,7 @@ var AGENT_QA_COMPOSED_CONTRACTS = Object.freeze({
     input: import_agent_qa_schema2.KnowledgeChangeFoldInputSchema,
     output: import_agent_qa_schema2.KnowledgeChangeFoldOutputSchema
   }),
-  // 2026-09-28 (431-04 D-07): the evidence fold, composed in the schema package from both arms'
-  // canonical contracts and routed by full op id.
+  // Composed in the schema package from both arms' canonical contracts, routed by full op id.
   agent_qa_get_run_evidence: Object.freeze({
     input: import_agent_qa_schema2.RunsEvidenceFoldInputSchema,
     output: import_agent_qa_schema2.RunsEvidenceFoldOutputContract
@@ -960,163 +835,72 @@ function advertisedContracts(projection) {
   return only === void 0 ? void 0 : AGENT_QA_OP_CONTRACTS[only];
 }
 var DEGRADED_OUTPUT_CONTRACTS = Object.freeze([
-  // 397 DISPOSITION (2026-08-16 · D-20): keep-degraded. `agent_qa_start_run` advertises no
-  // `outputSchema` and keeps it that way. The cause is a property of the CONTRACT, not of this
-  // surface — a branded run id is `z.string().transform(asRunId)`, and the converter refuses a
-  // transform because there is no true JSON-Schema for "and then this function runs". The two ways
-  // out are both worse: advertising the input-mode document is the second-recipe lie D-16 forbids,
-  // and un-branding the id to please a converter would spend a type-safety property of the whole
-  // codebase on one surface's listing. 397 rules the degradation ADJUDICATED and CLOSED rather than
-  // pending; re-opening it means changing the contract, which is a golden-diff-visible act. The
-  // absence itself is not re-pinned here — `projection.ts` probes the conversion both ways and the
-  // shipped projection suite owns that fact (RESEARCH Pitfall 9); the conformance suite asserts
-  // only the join.
+  // The branded run id is a transform; un-branding it would trade type safety for one listing.
   Object.freeze({
     tool: "agent_qa_start_run",
     opId: "runs.start",
     schema: "RunStartAcknowledgementSchema",
-    measured: "Transforms cannot be represented in JSON Schema",
-    adjudication: "397"
+    measured: "Transforms cannot be represented in JSON Schema"
   })
-  // 2026-09-28 (431-03, D-03/D-07 · research A1): the `agent_qa_list_runs` row is REMOVED, not
-  // re-ruled. Its objection stands — no hand-written array schema is advertised. What changed is the
-  // contract: `runs.list` now declares `RunsListOutputContract`, whose validator is the same
-  // `RunsListOutputSchema` object and whose output document is derived from the runtime schema's
-  // own output conversion. It converts cleanly, so the probe in `projection.ts` would refuse the row.
 ]);
-var UNPROJECTED_ADJUDICATIONS = Object.freeze(["397", "398", "405", "408", "428"]);
+var NOT_MID_FLIGHT_READ = "not a mid-flight workflow read: this surface carries only the reads a workflow needs while it runs";
+var NOT_MID_FLIGHT_WRITE = "not a mid-flight workflow write: this surface carries only the writes a workflow needs while it runs";
 var UNPROJECTED_OPS = Object.freeze([
   Object.freeze({
     opId: "agent.ask",
-    reason: "D-03 (dated 2026-08-15): ask-over-MCP is nested-agent delegation \u2014 trust, token-driven LLM spend, lease interaction and streaming are four separate problems and no MCPS requirement asks for any of them. Deferred as its own seam, not omitted by oversight.",
-    adjudication: "397"
+    reason: "Ask over MCP is nested-agent delegation: a tool call would spend this project's model tokens, take the lease the local host holds and stream through a channel a single `tools/call` round trip has no shape for."
   }),
-  // 2026-10-01 (432-17, D-05): `proposals.accept` and `proposals.reject` (397, requiresHumanOrigin)
-  // are deleted with the inbox and leave the scoping note.
-  // 2026-10-01 (432-18, D-14/D-15): `grants.revoke` (397, requiresHumanOrigin) and `grants.list`
-  // (397, not a mid-flight read) are deleted with the grant ledger and leave the scoping note.
   Object.freeze({
     opId: "runs.get",
-    reason: "not a mid-flight workflow read per D-02 \u2014 the entity door renders a run's card and the digest carries what triage needs; 397 adjudicates",
-    adjudication: "397"
+    reason: "not a mid-flight workflow read: the entity door renders a run's card and the digest carries what triage needs"
   }),
   Object.freeze({
     opId: "runs.events",
-    reason: "not a mid-flight workflow read per D-02, and a stream op besides: a `tools/call` is one round trip and has no shape for a resumable event feed; 397 adjudicates",
-    adjudication: "397"
+    reason: "not a mid-flight workflow read, and a stream besides: a `tools/call` is one round trip and has no shape for a resumable event feed"
   }),
   Object.freeze({
     opId: "runs.postprocessing",
-    reason: "not a mid-flight workflow read per D-02; 397 adjudicates",
-    adjudication: "397"
+    reason: NOT_MID_FLIGHT_READ
   }),
   Object.freeze({
     opId: "runs.detail",
-    reason: "D-03 (dated 2026-08-27, 405-01): not a mid-flight workflow read per D-02 \u2014 this is a COMPLETED run's projected step tree, read by the durable run-detail page, and the entity door already renders a run's card while the digest carries what triage needs. The whole projection of a run is also a large one-shot payload with no shape a `tools/call` round trip wants. Deferred as its own seam, not omitted.",
-    adjudication: "405"
+    reason: "not a mid-flight workflow read: it is a completed run's whole step tree, read by the run-detail page, and a large one-shot payload with no shape a `tools/call` round trip wants"
   }),
   Object.freeze({
     opId: "runs.liveurl",
-    reason: "D-03 (dated 2026-08-25, 403-01): the op MINTS A CREDENTIAL \u2014 a short-lived, view-scoped capability token for a running browser. Whether an agent-origin MCP caller may mint one, and what it may hand it to, is Phase 408's question (the MCP App embed); projecting it here would answer that question by accident. Deferred as its own seam, not omitted. ANSWERED (dated 2026-08-31, 408 D-01): the deferral above is discharged, and the ruling is INTERNAL MINT ONLY. The MCP server invokes this op BY REFERENCE, inside its App-rendering path and nowhere else, and the minted token lands only in the host-rendered HTML of the unlisted `ui://agent-qa/live-run/{runId}` App resource \u2014 never in tool-result text a model reads. Projecting a mint tool stays REJECTED: a live credential in model context is the T-395-R5-10 shape, and masking it would leave a tool that hands back nothing a host could use. The op therefore STAYS unprojected BY RULING rather than by deferral \u2014 answered on the record, never silently reclassified. RE-GROUNDED (dated 2026-09-01, 408 gap round, road `demote`; the full ruling is in `app-resource.ts`'s header). The answer above STANDS and one half of its stated property is corrected rather than deleted. Whether the document this server serves is host-rendered HTML or text a model consumes is a property of the CALLER, not of this server, so the \"never in tool-result text a model reads\" half over-claimed. What this server guarantees is narrower and it is verifiable: it writes the token into exactly one place, the frame src of the document the `ui://` read serves, and that door is reachable by any caller of a composition whose mint is bound (dated 2026-10-01, 432-20/432-21, D-12: the scope gate that once also bounded it is deleted for every caller, and the loopback bind and the Host/Origin guards still bound who can reach it). The op STAYS unprojected on exactly the same footing, and the reason is unchanged and STRONGER rather than weaker: a projected mint tool would put the credential on a channel a model consumes BY DEFAULT, on every call, for every caller, whereas the `ui://` read is an unlisted address a caller must already know and deliberately ask for.",
-    adjudication: "408"
+    reason: "The op MINTS A CREDENTIAL, a short-lived view token for a running browser: the MCP server mints it only inside its App-rendering path and writes it into the frame src of the unlisted `ui://agent-qa/live-run/{runId}` resource, so a mint tool would put the credential on a channel a model reads by default."
   }),
   Object.freeze({
     opId: "editor.liveurl",
-    reason: "D-07 (dated 2026-09-25, 428): the op MINTS A CREDENTIAL \u2014 a view credential for a live EDITOR session, which is private to the dashboard page that owns it; it is reachable only through the dashboard door and never through an MCP tool or the MCP App live-run resource. Projecting it would give an agent a watch carrier for a draft execution, which the owner declined in D-07. Unprojected by ruling, not by deferral.",
-    adjudication: "428"
+    reason: "The op MINTS A CREDENTIAL, a view credential for a live editor session that is private to the dashboard page owning it, so it is reachable only through the dashboard door and never through an MCP tool or the MCP App live-run resource."
   }),
   Object.freeze({
     opId: "config.get",
-    reason: "not a mid-flight workflow read per D-02; 397 adjudicates",
-    adjudication: "397"
+    reason: NOT_MID_FLIGHT_READ
   }),
   Object.freeze({
     opId: "analysis.get",
-    reason: "not a mid-flight workflow read per D-02; 397 adjudicates",
-    adjudication: "397"
+    reason: NOT_MID_FLIGHT_READ
   }),
   Object.freeze({
     opId: "authoring.funnel.get",
-    reason: "not a mid-flight workflow read per D-02; 397 adjudicates",
-    adjudication: "397"
+    reason: NOT_MID_FLIGHT_READ
   }),
   Object.freeze({
     opId: "quarantine.add",
-    reason: "not a mid-flight workflow write per D-02; 397 adjudicates",
-    adjudication: "397"
+    reason: NOT_MID_FLIGHT_WRITE
   }),
   Object.freeze({
     opId: "quarantine.release",
-    reason: "not a mid-flight workflow write per D-02; 397 adjudicates",
-    adjudication: "397"
+    reason: NOT_MID_FLIGHT_WRITE
   }),
   Object.freeze({
     opId: "quarantine.list",
-    reason: "not a mid-flight workflow read per D-02; 397 adjudicates",
-    adjudication: "397"
+    reason: NOT_MID_FLIGHT_READ
   }),
-  // 398 D-09 (dated 2026-08-17): the twentieth entry, and the FIRST op ever dispositioned here that
-  // 397 did not rule on — because it did not exist then. Its exclusion is argued rather than scoped,
-  // which is why it does not take the mid-flight line: `agent.explain` answers "what can you do",
-  // and 397 already ruled the v1 discovery tool NOT a gap on this surface, because the protocol
-  // answers machine discovery itself. Projecting it anyway would be the third answer that ruling
-  // refuses.
   Object.freeze({
     opId: "agent.explain",
-    reason: "D-09 (dated 2026-08-17): the protocol answers machine discovery itself \u2014 `tools/list` plus SEP-2575 `server/discover` \u2014 and 398's `init --agent` manifest answers agent discovery from the committed catalog. This op answers a PERSON asking in prose, which is a third question with a third audience. 397 ruled the v1 discovery TOOL not-a-gap on exactly this reasoning; projecting the op would reinstate it under a new name.",
-    adjudication: "398"
-  })
-  // 2026-09-30 (432-12 D-05): the five pre-432 proposal ops went off the catalogue with their
-  // tools. 2026-10-01 (432-17 D-05): they are deleted from the registry and leave the scoping note.
-]);
-var PROJECTED_RULING_ADDENDA = Object.freeze([
-  Object.freeze({
-    opId: "knowledge.bundles.list",
-    ruledBy: "397",
-    ruling: "not a mid-flight workflow read per D-02; 397 adjudicates",
-    addendum: "D-01/D-04 (dated 2026-09-28, 431-04): projected as `agent_qa_list_knowledge_bundles`. A coding agent in a fresh workspace reads knowledge only through structured channels, so the committed-knowledge reads are served here rather than left to files; this supersedes the 2026-09-14 decision that projected the six safe reads only, whose no-search half stands (D-09)."
-  }),
-  Object.freeze({
-    opId: "knowledge.records.inspect",
-    ruledBy: "397",
-    ruling: "not a mid-flight workflow read per D-02; 397 adjudicates",
-    addendum: "D-01/D-04 (dated 2026-09-28, 431-04): projected as `agent_qa_inspect_knowledge_records`. A coding agent in a fresh workspace reads knowledge only through structured channels, so the committed-knowledge reads are served here rather than left to files; this supersedes the 2026-09-14 decision that projected the six safe reads only, whose no-search half stands (D-09)."
-  }),
-  Object.freeze({
-    opId: "knowledge.records.diff",
-    ruledBy: "397",
-    ruling: "not a mid-flight workflow read per D-02; 397 adjudicates",
-    addendum: "D-01/D-04 (dated 2026-09-28, 431-04): projected as `agent_qa_diff_knowledge_records`. A coding agent in a fresh workspace reads knowledge only through structured channels, so the committed-knowledge reads are served here rather than left to files; this supersedes the 2026-09-14 decision that projected the six safe reads only, whose no-search half stands (D-09)."
-  }),
-  Object.freeze({
-    opId: "knowledge.record.show",
-    ruledBy: "397",
-    ruling: "not a mid-flight workflow read per D-02; 397 adjudicates",
-    addendum: "D-01/D-04 (dated 2026-09-28, 431-04): projected as `agent_qa_show_knowledge_record`. A coding agent in a fresh workspace reads knowledge only through structured channels, so the committed-knowledge reads are served here rather than left to files; this supersedes the 2026-09-14 decision that projected the six safe reads only, whose no-search half stands (D-09)."
-  }),
-  Object.freeze({
-    opId: "knowledge.brief.why",
-    ruledBy: "397",
-    ruling: "not a mid-flight workflow read per D-02; 397 adjudicates",
-    addendum: "D-01/D-04 (dated 2026-09-28, 431-04): projected as `agent_qa_explain_brief`. A coding agent in a fresh workspace reads knowledge only through structured channels, so the committed-knowledge reads are served here rather than left to files; this supersedes the 2026-09-14 decision that projected the six safe reads only, whose no-search half stands (D-09)."
-  }),
-  Object.freeze({
-    opId: "runs.knowledge",
-    ruledBy: "407",
-    ruling: "D-05 (dated 2026-08-29, 407-01): not a mid-flight workflow read per D-02 \u2014 this is a COMPLETED run's used-and-learned projection, read by the durable Knowledge tab, and it is unprojected on exactly the footing its sibling `runs.detail` is. It carries every step's three served brief channels, each one's serve-time retrieval trace and the truncated candidate ledger beside it, so it is a large one-shot payload with no shape a `tools/call` round trip wants \u2014 larger than the step tree, not smaller. A planner mid-flight also has no use for what a FINISHED run was briefed with; the entity door already renders a record's card and the digest carries what triage needs. Deferred as its own seam, not omitted.",
-    addendum: "D-05 (dated 2026-09-28, 431-04): projected as `agent_qa_get_run_knowledge`, answering the whole `runs.knowledge` projection unchanged; the owner declined a step filter. The size objection above is answered in these terms: `agent_qa_get_run_overview` is the entry point that maps a run without bodies, `agent_qa_explain_brief` and `agent_qa_show_knowledge_record` are the drill-down, and the tool carries a 100000-character result-size hint so a host keeps the one-shot answer whole."
-  }),
-  Object.freeze({
-    opId: "runs.evidence",
-    ruledBy: "423",
-    ruling: "D-04 (dated 2026-09-15, 423-21): not a mid-flight workflow read per D-02 \u2014 this is one COMPLETED run step's parsed evidence document (console, network, variables, accessibility or ARIA), read by the dashboard evidence tabs, and it is unprojected on exactly the footing its sibling `runs.detail` is. A network document alone may carry hundreds of records, so it is a large one-shot payload with no shape a `tools/call` round trip wants, and a planner mid-flight has no use for a finished step's captured traffic. The raw SHA bytes stay on `runs.artifact` and the two HTTP doors. Deferred as its own seam, not omitted.",
-    addendum: "D-07 (dated 2026-09-28, 431-04): projected as the `runs.evidence` arm of `agent_qa_get_run_evidence`. A caller asks for ONE step document by the exact address `agent_qa_get_run_overview` supplies, so the answer is one addressed document rather than a run's captured traffic. Masking is unchanged: the op stays on the cold read-scope allowlist. The tool carries the 100000-character result-size hint."
-  }),
-  Object.freeze({
-    opId: "runs.artifact",
-    ruledBy: "405",
-    ruling: "D-12/D-13 (dated 2026-08-27, 405-05): not a mid-flight workflow read per D-02 \u2014 this resolves ONE completed run's content-addressed evidence blob, and its result is a base64 body. A `tools/call` round trip is the wrong carriage for bytes: a conversation cannot render a PNG, and a tool that returned one would spend a context window on a payload no reader can read. The two HTTP doors are its carriage, and 408's embed is the surface that renders it. Deferred as its own seam, not omitted. Phase 424 (dated 2026-09-20): the recording fact rides runs.detail; runs.artifact answers a bounded slice when range is supplied; pulling a whole recording through unary base64 is permitted and not recommended; no recording tool is projected because the MX ceiling of 22 is fully allocated.",
-    addendum: "D-07 (dated 2026-09-28, 431-04): projected as the `runs.artifact` arm of `agent_qa_get_run_evidence`. The blob is addressed by the sha the overview supplies, with no step-to-sha lookup inside the tool, and the rendering objection is answered by the image result arm 431-05 adds. The Phase 424 note that the MX ceiling of 22 was fully allocated is superseded: the ceiling is 24 (D-01)."
+    reason: "The protocol answers machine discovery itself through `tools/list` and SEP-2575 `server/discover`, and `init --agent` answers agent discovery from the committed catalog; this op answers a person asking in prose, which a discovery tool would only restate."
   })
 ]);
 
@@ -1288,248 +1072,6 @@ function decorateRunEvidenceImage(input) {
   };
 }
 
-// src/migration-map.ts
-var V1_TOOL_MIGRATION_MAP = Object.freeze([
-  // 1
-  Object.freeze({
-    v1Name: "agent_qa_discover",
-    arm: "retired",
-    note: "not-a-gap (397, 2026-08-16): the protocol answers discovery itself, so a hand-written catalogue tool beside it would be a second, drifting answer to one question.",
-    route: "`tools/list` (plus SEP-2575 `server/discover`) answers machine discovery; 398's build-time capability catalog, carried by `agent-qa init --agent`, answers the human-facing version."
-  }),
-  // 2
-  Object.freeze({
-    v1Name: "agent_qa_get_config",
-    arm: "retired",
-    note: "A4 adjudication (2026-08-17, phase 398 plan 02): the inventory rules this row `n/a -> projected by 396`, but `config.get` is in UNPROJECTED_OPS after 396 plan 04 \u2014 not a mid-flight workflow read per D-02 \u2014 so there is no live tool to rename to.",
-    route: "no MCP tool reads configuration; the workspace posture an agent needs reaches it through `agent-qa init --agent`'s manifest (398 D-16), by env-ref name and never by value."
-  }),
-  // 3
-  Object.freeze({
-    v1Name: "agent_qa_schema_reference",
-    arm: "retired",
-    note: "not-a-gap (397, 2026-08-16): a served COPY of a contract is exactly the drift that advertising the live contract replaced.",
-    route: "every tool advertises its op's live `inputSchema`/`outputSchema` in `tools/list` (396 D-16), so a caller reads the contract the gate actually validates with; a fold lists its arms' fields as one object, and its `action` field says which fields each action takes."
-  }),
-  // 4
-  Object.freeze({
-    v1Name: "agent_qa_validate_definition",
-    arm: "retired",
-    note: "not-a-gap (397, 2026-08-16): a standalone linter over arbitrary text is a second validator that can disagree with the one that gates writes.",
-    route: "validation reaches a caller as `authoring.draft.verify`'s verdict inside the authoring funnel \u2014 the verify arm of `agent_qa_refine_test`."
-  }),
-  // 5
-  Object.freeze({
-    v1Name: "agent_qa_generate_id",
-    arm: "retired",
-    note: "not-a-gap (397, 2026-08-16): died with the CRUD model. Minting a canonical id on a surface is what 394-11 removed from the CLI, for this same reason.",
-    route: "ids are minted host-side where the entity is written; a caller names what it wants and reads the id back off the entity card `agent_qa_get_entity` returns."
-  }),
-  // 6
-  Object.freeze({
-    v1Name: "agent_qa_validate_id",
-    arm: "retired",
-    note: "not-a-gap (397, 2026-08-16): died with the CRUD model. A standalone validator would be a second answer to a question already answered at every parse point.",
-    route: "the one URI codec (`packages/schema/src/entity/uri.ts`) validates every `agentqa://` reference as it is parsed, including the one `agent_qa_get_entity` resolves."
-  }),
-  // 7
-  Object.freeze({
-    v1Name: "agent_qa_list_tests",
-    arm: "pending",
-    note: "gap (397, 2026-08-16): nothing in the registry enumerates the test corpus \u2014 `entities.resolve` resolves a reference to an entity, which is a different question.",
-    route: "until the owning milestone mints `entities.list`, a known reference resolves through `agent_qa_get_entity`; enumeration has no tool.",
-    owner: "M5 (live view & run invocation)"
-  }),
-  // 8
-  Object.freeze({
-    v1Name: "agent_qa_read_test",
-    arm: "renamed-to",
-    v2Tool: "agent_qa_get_entity",
-    note: "projected by 396 (inventory row 8, 2026-08-16): `entities.get` is D-02's universal entity read, kind TST, behind the one read door."
-  }),
-  // 9
-  Object.freeze({
-    v1Name: "agent_qa_validate_test",
-    arm: "retired",
-    note: "not-a-gap (397, 2026-08-16): row 4's ruling. `authoring.draft.verify` is the only validator, and it validates a draft in the funnel rather than arbitrary text a caller pasted.",
-    route: "the verify arm of `agent_qa_refine_test` returns the same verdict that gates the write."
-  }),
-  // 10
-  Object.freeze({
-    v1Name: "agent_qa_create_test",
-    arm: "renamed-to",
-    v2Tool: "agent_qa_write_test",
-    note: "projected by 396 (inventory row 10, 2026-08-16): `authoring.draft.write` is workflow-coarse and verifies a draft rather than performing v1's blind write, so the input shape differs. Since 2026-10-02 (432-40, D-06) it writes the test file in the call unless a keep-gate rejected the draft."
-  }),
-  // 11
-  Object.freeze({
-    v1Name: "agent_qa_update_test",
-    arm: "renamed-to",
-    v2Tool: "agent_qa_refine_test",
-    note: "projected by 396 (inventory row 11, 2026-08-16): `authoring.draft.edit` is the edit arm of the refine fold, selected by the fold discriminant."
-  }),
-  // 12
-  Object.freeze({
-    v1Name: "agent_qa_delete_test",
-    arm: "retired",
-    note: "not-a-gap (397, 2026-08-16): a rule, not an absence. MCPS-02 forbids a surface delete verb for irreversible deletes.",
-    route: "removing a committed test is a repository edit a person makes and reviews; no surface has a delete door and none is coming."
-  }),
-  // 13
-  Object.freeze({
-    v1Name: "agent_qa_list_suites",
-    arm: "pending",
-    note: `gap (397, 2026-08-16): folded into row 7's verb \u2014 enumerating the corpus answers "which tests exist, and in which files". A suite is a file, so this is not a second registry.`,
-    route: "until `entities.list` lands, suite membership is read from the workspace files themselves; the TST records inside them resolve through `agent_qa_get_entity`.",
-    owner: "M5 (live view & run invocation)"
-  }),
-  // 14
-  Object.freeze({
-    v1Name: "agent_qa_read_suite",
-    arm: "retired",
-    note: "not-a-gap (397, 2026-08-16): there is no suite RECORD to read. `ENTITY_KINDS` has no suite kind and a suite is a committed file addressed by workspace path.",
-    route: "the TST records inside a suite are `agent_qa_get_entity`'s job; the file itself is read from the workspace."
-  }),
-  // 15
-  Object.freeze({
-    v1Name: "agent_qa_validate_suite",
-    arm: "retired",
-    note: "not-a-gap (397, 2026-08-16): row 4's ruling \u2014 one validator, inside the funnel.",
-    route: "the verify arm of `agent_qa_refine_test` validates the draft that joins the suite file."
-  }),
-  // 16
-  Object.freeze({
-    v1Name: "agent_qa_create_suite",
-    arm: "retired",
-    note: "not-a-gap (397, 2026-08-16): a suite is a committed file the authoring funnel writes. A blind create is the v1 write the verified authoring funnel replaced (re-spelled 2026-10-02, 432-40, D-06: the funnel writes in the call).",
-    route: "`agent_qa_write_test` names the suite file a draft joins and writes it in the call, unless a keep-gate rejected the draft."
-  }),
-  // 17
-  Object.freeze({
-    v1Name: "agent_qa_update_suite",
-    arm: "retired",
-    note: "not-a-gap (397, 2026-08-16): row 16's ruling, through the edit arm instead of the write (re-spelled 2026-10-02, 432-40, D-06: the edit lands in the call).",
-    route: "`agent_qa_refine_test` edits the written test; the suite file changes in the call."
-  }),
-  // 18
-  Object.freeze({
-    v1Name: "agent_qa_delete_suite",
-    arm: "retired",
-    note: "not-a-gap (397, 2026-08-16): row 12's MCPS-02 rule, applied to the file rather than the record.",
-    route: "removing a suite file is a repository edit a person makes and reviews; no surface door exists."
-  }),
-  // 19
-  Object.freeze({
-    v1Name: "agent_qa_list_hooks",
-    arm: "pending",
-    note: "gap (397, 2026-08-16, corrected the same day): the 396 reason overstated `config.get`, which projects the resolved CONFIG's leaves; hook definitions live in the separate `workspace.hooksFile`, so no registered op reads them today.",
-    route: "until the owning milestone re-opens the hook execution model, hooks are read from `workspace.hooksFile` in the workspace; no tool enumerates them.",
-    owner: "M7 (skills layer)"
-  }),
-  // 20
-  Object.freeze({
-    v1Name: "agent_qa_read_hook",
-    arm: "pending",
-    note: "gap (397, 2026-08-16): with row 19, ONE hook-read verb and not two. What `config.get` shows is `workspace.hooksFile` \u2014 the path, not the hooks.",
-    route: "until that verb lands, a single hook is read from the hooks file itself; no tool projects it.",
-    owner: "M7 (skills layer)"
-  }),
-  // 21
-  Object.freeze({
-    v1Name: "agent_qa_create_hook",
-    arm: "renamed-to",
-    v2Tool: "agent_qa_change_config",
-    note: "projected by 396 (inventory row 21, 2026-08-16): `config.hook.add` is an arm of the config fold. Since 2026-09-30 (432-12, D-05) the fold is `agent_qa_change_config` and the hook is written in the call, with the files it changed on the answer."
-  }),
-  // 22
-  Object.freeze({
-    v1Name: "agent_qa_update_hook",
-    arm: "pending",
-    note: "gap (397, 2026-08-16): `config.field.set` reaches any schema-addressable CONFIG path and the hooks file is not one, so an existing hook has no edit verb. Minting one now would pin an edit shape to a contract the owning milestone revisits.",
-    route: "adding a hook goes through `agent_qa_change_config`; editing an existing one is a hooks-file edit a person makes until the owner rules on the verb.",
-    owner: "M7 (skills layer)"
-  }),
-  // 23
-  Object.freeze({
-    v1Name: "agent_qa_delete_hook",
-    arm: "retired",
-    note: "not-a-gap (397, 2026-08-16): row 12's MCPS-02 rule.",
-    route: "removing a hook is an edit to the hooks file that a person makes and reviews."
-  }),
-  // 24
-  Object.freeze({
-    v1Name: "agent_qa_run_hook",
-    arm: "retired",
-    note: `not-a-gap (397, 2026-08-16): a hook's whole contract is "runs at this lifecycle point". Invoking one by name from a surface is arbitrary script execution decoupled from the lifecycle that gives it meaning \u2014 the private-power shape M4 abolished.`,
-    route: "hooks run at their declared lifecycle points during a run started by `agent_qa_start_run`; nothing invokes one out of band."
-  }),
-  // 25
-  Object.freeze({
-    v1Name: "agent_qa_enqueue_test_run",
-    arm: "renamed-to",
-    v2Tool: "agent_qa_start_run",
-    note: "projected by 396 (inventory row 25, 2026-08-16): `runs.start` is workflow-coarse, and the test scope is an argument rather than a tool of its own."
-  }),
-  // 26
-  Object.freeze({
-    v1Name: "agent_qa_enqueue_suite_run",
-    arm: "renamed-to",
-    v2Tool: "agent_qa_start_run",
-    note: "projected by 396 (inventory row 26, 2026-08-16): the SAME op as row 25 at suite scope, which is why D-01 allows one tool over both."
-  }),
-  // 27
-  Object.freeze({
-    v1Name: "agent_qa_get_run",
-    arm: "retired",
-    note: "A4 adjudication (2026-08-17, phase 398 plan 02): the inventory rules this row `n/a -> projected by 396`, but `runs.get` is in UNPROJECTED_OPS after 396 plan 04 \u2014 not a mid-flight workflow read per D-02 \u2014 so there is no live tool to rename to.",
-    route: "the entity door renders a run's card: `agent_qa_get_entity` on the run reference. `agent_qa_list_runs` enumerates recent runs."
-  }),
-  // 28
-  Object.freeze({
-    v1Name: "agent_qa_get_run_steps",
-    arm: "retired",
-    note: "A4 adjudication (2026-08-17, phase 398 plan 02): ruled `n/a -> projected by 396` against `runs.get`/`runs.events`, both of which are in UNPROJECTED_OPS \u2014 `runs.events` is a stream op besides, and a `tools/call` is one round trip with no shape for a resumable feed.",
-    route: "`agent_qa_get_run_digest` carries what triage needs from a run, including its steps' outcome; the run's card comes from `agent_qa_get_entity`."
-  }),
-  // 29
-  Object.freeze({
-    v1Name: "agent_qa_get_run_logs",
-    arm: "retired",
-    note: "A4 adjudication (2026-08-17, phase 398 plan 02): ruled `n/a -> projected by 396` against `runs.events`, which is in UNPROJECTED_OPS as a stream op with no single-round-trip shape.",
-    route: "`agent_qa_get_run_digest` carries the triage-relevant remainder of a run; the full event feed is read from the run artifacts on disk, not over this surface."
-  }),
-  // 30
-  Object.freeze({
-    v1Name: "agent_qa_get_run_execution_logs",
-    arm: "retired",
-    note: "A4 adjudication (2026-08-17, phase 398 plan 02): row 29's reading \u2014 `runs.events` is unprojected, so the second logs alias has no live tool either.",
-    route: "`agent_qa_get_run_digest` for triage; execution logs live in the run's artifacts on disk."
-  }),
-  // 31
-  Object.freeze({
-    v1Name: "agent_qa_get_run_artifact",
-    arm: "pending",
-    note: "gap (397, 2026-08-16): artifact bytes over a tool result is a disclosure surface nobody has scoped, so the read is routed WITH that scoping rather than minted without it \u2014 an artifact read without it is the gap made worse.",
-    route: "until the owning milestone ships artifact resolution, artifacts are read from the run directory on disk; `agent_qa_get_run_digest` names what a run produced.",
-    owner: "M5 (artifact resolution route)"
-  }),
-  // 32
-  Object.freeze({
-    v1Name: "agent_qa_cancel_run",
-    arm: "pending",
-    note: "gap (397, 2026-08-16): ruled a REAL gap as `runs.cancel` and routed to its owner rather than minted in 397, because D-17 binds the adjudicator too.",
-    route: "until `runs.cancel` lands, a run is stopped by the host that started it; this surface starts runs through `agent_qa_start_run` and cannot stop one.",
-    owner: "M5 (live-view control arbiter)"
-  }),
-  // 33
-  Object.freeze({
-    v1Name: "agent_qa_classify_failure",
-    arm: "retired",
-    note: "not-a-gap (397, 2026-08-16): classification on demand over dashboard-fetched data is the private data path M4 abolished, not a capability that went missing.",
-    route: "`analysis.get` reads the verdict the `analyze-run` job produced; over this surface the triage answer is `agent_qa_get_run_digest`."
-  })
-]);
-
 // src/projection.ts
 var JSON_SCHEMA_CONVERSION_TARGET = "draft-2020-12";
 function isReadOnly(specs) {
@@ -1609,19 +1151,7 @@ function toRegisterToolConfig(projection, specs, advertised, maskText) {
     inputSchema,
     ...outputSchema === void 0 ? {} : { outputSchema },
     annotations: deriveAnnotations(specs),
-    // 408 D-05: the App reference, DERIVED from the projection's own carrier declaration by the
-    // same pipeline that derives the annotations above — never a pair of tool names written here.
-    // The conditional spread is the house absent-field rule: a non-carrier's config has no `_meta`
-    // key at all.
-    //
-    // NOT MASKED, and it joins the two exemptions the header names for their reason rather than by
-    // analogy. `resourceUri` is the address constant this package publishes — a declared literal in
-    // this repository's own source, exactly like the `title` above it — and a masker that rewrote
-    // it would point every host at an address the resource codec refuses, which is the tool-rename
-    // failure with a URI scheme attached. Nothing interpolated into it comes from a caller, from
-    // storage or from a resolved value; the run id never appears here, because this is the
-    // TEMPLATE and a per-call reference is composed downstream. The result-size hint (431 D-05) is
-    // a declared constant too, and rides the same record (`listingMeta`).
+    // Not masked: `resourceUri` is a declared constant, and masking it would break the address.
     ...meta === void 0 ? {} : { _meta: meta }
   };
 }
@@ -1905,67 +1435,6 @@ function createProjectionHandler(projection, invoke, maskText, liveLink) {
     }
   };
 }
-var TOOLS_CALL_METHOD = "tools/call";
-function callToolName(request) {
-  if (typeof request !== "object" || request === null) return void 0;
-  const params = request.params;
-  if (typeof params !== "object" || params === null) return void 0;
-  const name = params.name;
-  return typeof name === "string" ? name : void 0;
-}
-function v1MigrationEntryFor(toolName) {
-  return V1_TOOL_MIGRATION_MAP.find((entry) => entry.v1Name === toolName);
-}
-function v1RedirectFor(toolName, registered) {
-  if (registered.has(toolName)) return void 0;
-  return v1MigrationEntryFor(toolName);
-}
-function v1InputShapeNote(projection) {
-  switch (compositionOf(projection)) {
-    case "single":
-      return "it takes one input object";
-    case "union":
-      return `set \`${projection.discriminant}\` to one of ${projection.ops.map((op) => `\`${op}\``).join(", ")} and pass that arm's own fields`;
-    case "pipeline":
-      return "it takes one entity reference and answers the card that reference resolves to";
-  }
-}
-function v1RedirectMessage(entry, visibleTarget) {
-  const opening = `\`${entry.v1Name}\` is a retired agent-qa v1 tool name and is not served.`;
-  if (entry.arm === "renamed-to") {
-    if (visibleTarget === void 0) {
-      return `${opening} Call \`tools/list\` for the tools you may call on this server, and \`agent-qa init --agent\` for this workspace's capability manifest, which carries the v1 tool-name migration map.`;
-    }
-    return `${opening} The capability it named is now \`${visibleTarget.name}\`. ${entry.note} Its input shape is not v1's \u2014 ${v1InputShapeNote(visibleTarget)}; \`tools/list\` advertises the contract the call is validated against.`;
-  }
-  if (entry.arm === "pending") {
-    const owned = entry.owner === void 0 ? "" : ` The capability it named is a known gap owned by ${entry.owner}.`;
-    const until = entry.route === void 0 ? "" : ` Until then: ${entry.route}`;
-    return `${opening}${owned} ${entry.note}${until}`;
-  }
-  return `${opening} ${entry.note}${entry.route === void 0 ? "" : ` Instead: ${entry.route}`}`;
-}
-function installV1NameRedirect(server, deps) {
-  const dispatch = server.server;
-  const sdkHandler = dispatch._requestHandlers?.get(TOOLS_CALL_METHOD);
-  if (typeof sdkHandler !== "function") {
-    throw new McpProjectionError(
-      TOOLS_CALL_METHOD,
-      "has no installed request handler to wrap; the SDK no longer registers tool dispatch where this package reads it, so the retired-v1-name redirect cannot be placed"
-    );
-  }
-  dispatch.removeRequestHandler(TOOLS_CALL_METHOD);
-  dispatch.setRequestHandler(TOOLS_CALL_METHOD, (request, ctx) => {
-    const name = callToolName(request);
-    const entry = name === void 0 ? void 0 : v1RedirectFor(name, deps.registered);
-    if (entry === void 0) return sdkHandler(request, ctx);
-    const target = entry.arm === "renamed-to" && entry.v2Tool !== void 0 && deps.registered.has(entry.v2Tool) ? AGENT_QA_TOOL_PROJECTIONS.find((projection) => projection.name === entry.v2Tool) : void 0;
-    throw new import_server3.ProtocolError(
-      import_server3.ProtocolErrorCode.InvalidParams,
-      deps.maskText(v1RedirectMessage(entry, target))
-    );
-  });
-}
 function buildAgentQaMcpServer(deps) {
   const server = new import_server3.McpServer(
     { name: "agent-qa", version: AGENT_QA_MCP_SERVER_VERSION },
@@ -1973,15 +1442,10 @@ function buildAgentQaMcpServer(deps) {
       capabilities: {
         tools: {},
         resources: {},
-        // 408 D-04: the official MCP Apps extension, ADVERTISED rather than assumed. Extensions are
-        // bilateral opt-in — a client declares support in the `io.modelcontextprotocol/
-        // clientCapabilities` envelope it sends on every request, and reads the server's set back
-        // from discovery — so a server that renders App HTML without naming the extension here is
-        // one no host will ever ask for it. The value is an empty record because this extension
-        // carries no server-side options; what it says is that this endpoint speaks it at all.
+        // Extensions are bilateral opt-in: a host asks only for an App the server advertises.
         extensions: { [MCP_APPS_EXTENSION_ID]: {} }
       },
-      // 433-33 (G-433-9): init's pointer, on the one channel every MCP host receives.
+      // Instructions reach every MCP host, so init's pointer goes here.
       instructions: AGENT_QA_MCP_INSTRUCTIONS
     }
   );
@@ -2031,7 +1495,6 @@ function buildAgentQaMcpServer(deps) {
       createProjectionHandler(projection, invoke, deps.maskText, deps.liveLink)
     );
   }
-  installV1NameRedirect(server, { registered, maskText: deps.maskText });
   registerEntityResources(server, {
     registry: deps.registry,
     caller: deps.caller,
@@ -2041,8 +1504,7 @@ function buildAgentQaMcpServer(deps) {
     registry: deps.registry,
     caller: deps.caller,
     maskText: deps.maskText,
-    // 408 plan 03 (D-08): the SAME supplier the carrier decoration reads, so the anchor inside the
-    // App document and the line beside a tool result name one page for one run.
+    // The same supplier the carrier decoration reads, so both name one page for one run.
     ...deps.liveLink === void 0 ? {} : { liveLink: deps.liveLink }
   });
   return server;
@@ -2125,28 +1587,6 @@ function withoutLegacyResultWrap(document) {
   if (typeof natural !== "object" || natural === null || natural.type === "object") return wrapper;
   return natural;
 }
-
-// src/task-seam.ts
-var JOB_STATUS_TO_MCP_TASK_STATE = {
-  // The four checkpoint boundaries. One answer, four times, on purpose.
-  queued: "working",
-  authored: "working",
-  bundling: "working",
-  committing: "working",
-  // The three terminal states, kept apart.
-  done: "completed",
-  failed: "failed",
-  cancelled: "cancelled"
-};
-function projectJobAsTask(job) {
-  return {
-    taskId: job.id,
-    status: JOB_STATUS_TO_MCP_TASK_STATE[job.status],
-    statusMessage: job.summary,
-    createdAt: job.createdAt,
-    lastUpdatedAt: job.updatedAt
-  };
-}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AGENT_QA_COMPOSED_CONTRACTS,
@@ -2176,13 +1616,11 @@ function projectJobAsTask(job) {
   AppResourceReadError,
   AppResourceUriError,
   DEGRADED_OUTPUT_CONTRACTS,
-  JOB_STATUS_TO_MCP_TASK_STATE,
   LIVE_LINK_ABSENT_LINE,
   LIVE_LINK_NO_RUN_LINE,
   MCP_APPS_EXTENSION_ID,
   McpProjectionError,
   UNPROJECTED_OPS,
-  V1_TOOL_MIGRATION_MAP,
   advertisedContracts,
   appResourceUriFor,
   armWithoutDiscriminant,
@@ -2197,7 +1635,6 @@ function projectJobAsTask(job) {
   maskedToolResult,
   negotiatedAppsExtension,
   parseAppUri,
-  projectJobAsTask,
   registerAppResources,
   renderAppWrapperPage,
   stripRedundantObjectStamp,