@wowok/agent-mcp 3.4.0 → 3.4.2

package/dist/schemas/onchain_operations.output.json

@@ -2049,6 +2049,14 @@
                   "const": "transaction",
                   "description": "Discriminator for this result variant. Constraint: always 'transaction'. Example: 'transaction'"
                 },
+                "onchain_state": {
+                  "description": "F-RQ-13A (prescription ⑨): 'committed' = a REAL transaction with a real digest landed successfully. 'absent' = the digest is a dry_run:* simulation — nothing was submitted, nothing is on chain. Present only when the distinction is decidable from this response.",
+                  "type": "string",
+                  "enum": [
+                    "committed",
+                    "absent"
+                  ]
+                },
                 "receive_receipt": {
                   "description": "Receive arrival receipt (M-K3). Present only when the call carried data.receive or data.owner_receive. Read objects_moved: 0 = nothing landed in the wallet despite tx success.",
                   "type": "object",
@@ -3255,6 +3263,92 @@
                     "top_risks"
                   ],
                   "additionalProperties": false
+                },
+                "blueprint_verdict": {
+                  "description": "Creation-time blueprint verdict: business intent + host rich semantics + logic tree composed and run through the full per-host verification battery BEFORE the guard create tx. Present when binding_hint maps to a catalog host; absent when no host is known (add binding_hint to enable).",
+                  "type": "object",
+                  "properties": {
+                    "host": {
+                      "type": "string",
+                      "description": "Catalog host id this guard was verified against (guard-host-context)."
+                    },
+                    "status": {
+                      "type": "string",
+                      "enum": [
+                        "blocked",
+                        "proceed_with_warnings",
+                        "proceed"
+                      ],
+                      "description": "Single authority over create readiness. blocked = structural defect, fix BEFORE create (guards are immutable after create)."
+                    },
+                    "statement": {
+                      "type": "string",
+                      "description": "One authoritative verdict statement naming the finding codes."
+                    },
+                    "findings": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "source": {
+                            "type": "string",
+                            "description": "Which verifier produced the finding (verifyGuardBinding / auditGuardRelies / auditQuoteGuardCandidate / blueprint)."
+                          },
+                          "code": {
+                            "type": "string",
+                            "description": "Stable finding id (e.g. MF_SLOT_IDENTITY_ANCHOR, RC_NO_ORDER_ANCHOR)."
+                          },
+                          "level": {
+                            "type": "string",
+                            "enum": [
+                              "critical",
+                              "warning",
+                              "info"
+                            ]
+                          },
+                          "detail": {
+                            "type": "string"
+                          }
+                        },
+                        "required": [
+                          "source",
+                          "code",
+                          "level",
+                          "detail"
+                        ],
+                        "additionalProperties": false
+                      },
+                      "description": "All findings from the composed verification battery."
+                    },
+                    "host_context": {
+                      "description": "The host rich semantics this guard inherits — inlined so the design dialogue argues from facts, not memory.",
+                      "type": "object",
+                      "properties": {
+                        "signer_subject": {
+                          "type": "string"
+                        },
+                        "order_anchor": {
+                          "type": "string"
+                        },
+                        "identity_obligation": {
+                          "type": "string"
+                        }
+                      },
+                      "required": [
+                        "signer_subject",
+                        "order_anchor",
+                        "identity_obligation"
+                      ],
+                      "additionalProperties": false
+                    }
+                  },
+                  "required": [
+                    "host",
+                    "status",
+                    "statement",
+                    "findings"
+                  ],
+                  "additionalProperties": false
                 }
               },
               "additionalProperties": false
@@ -3650,6 +3744,14 @@
                 "note": {
                   "description": "Additional note.",
                   "type": "string"
+                },
+                "digest": {
+                  "description": "REAL transaction digest of this operation (ddmc4 B-37) — paste into onchain_transaction or a block explorer to audit. Absent under dry-run/simulation.",
+                  "type": "string"
+                },
+                "signer": {
+                  "description": "Signing account's on-chain address — a SEPARATE field from digest ({signer, digest}), never occupying the digest slot.",
+                  "type": "string"
                 }
               },
               "required": [
@@ -3832,7 +3934,7 @@
                               "type": "integer",
                               "minimum": 0,
                               "maximum": 255,
-                              "description": "Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails such as full refunds). SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."
+                              "description": "Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."
                             },
                             "b_submission": {
                               "type": "boolean",
@@ -5290,6 +5392,92 @@
                     "top_risks"
                   ],
                   "additionalProperties": false
+                },
+                "blueprint_verdict": {
+                  "description": "Creation-time blueprint verdict: business intent + host rich semantics + logic tree composed and run through the full per-host verification battery BEFORE the guard create tx. Present when binding_hint maps to a catalog host; absent when no host is known (add binding_hint to enable).",
+                  "type": "object",
+                  "properties": {
+                    "host": {
+                      "type": "string",
+                      "description": "Catalog host id this guard was verified against (guard-host-context)."
+                    },
+                    "status": {
+                      "type": "string",
+                      "enum": [
+                        "blocked",
+                        "proceed_with_warnings",
+                        "proceed"
+                      ],
+                      "description": "Single authority over create readiness. blocked = structural defect, fix BEFORE create (guards are immutable after create)."
+                    },
+                    "statement": {
+                      "type": "string",
+                      "description": "One authoritative verdict statement naming the finding codes."
+                    },
+                    "findings": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "source": {
+                            "type": "string",
+                            "description": "Which verifier produced the finding (verifyGuardBinding / auditGuardRelies / auditQuoteGuardCandidate / blueprint)."
+                          },
+                          "code": {
+                            "type": "string",
+                            "description": "Stable finding id (e.g. MF_SLOT_IDENTITY_ANCHOR, RC_NO_ORDER_ANCHOR)."
+                          },
+                          "level": {
+                            "type": "string",
+                            "enum": [
+                              "critical",
+                              "warning",
+                              "info"
+                            ]
+                          },
+                          "detail": {
+                            "type": "string"
+                          }
+                        },
+                        "required": [
+                          "source",
+                          "code",
+                          "level",
+                          "detail"
+                        ],
+                        "additionalProperties": false
+                      },
+                      "description": "All findings from the composed verification battery."
+                    },
+                    "host_context": {
+                      "description": "The host rich semantics this guard inherits — inlined so the design dialogue argues from facts, not memory.",
+                      "type": "object",
+                      "properties": {
+                        "signer_subject": {
+                          "type": "string"
+                        },
+                        "order_anchor": {
+                          "type": "string"
+                        },
+                        "identity_obligation": {
+                          "type": "string"
+                        }
+                      },
+                      "required": [
+                        "signer_subject",
+                        "order_anchor",
+                        "identity_obligation"
+                      ],
+                      "additionalProperties": false
+                    }
+                  },
+                  "required": [
+                    "host",
+                    "status",
+                    "statement",
+                    "findings"
+                  ],
+                  "additionalProperties": false
                 }
               },
               "additionalProperties": false
@@ -5685,6 +5873,14 @@
                 "note": {
                   "description": "Additional note.",
                   "type": "string"
+                },
+                "digest": {
+                  "description": "REAL transaction digest of this operation (ddmc4 B-37) — paste into onchain_transaction or a block explorer to audit. Absent under dry-run/simulation.",
+                  "type": "string"
+                },
+                "signer": {
+                  "description": "Signing account's on-chain address — a SEPARATE field from digest ({signer, digest}), never occupying the digest slot.",
+                  "type": "string"
                 }
               },
               "required": [
@@ -5893,6 +6089,24 @@
               "type": "string",
               "const": "unknown"
             },
+            "onchain_state": {
+              "description": "F-RQ-13A (rq-tn-261030-8693be, prescription ⑨): three-state verdict on what this invocation did to on-chain state. 'committed' = the transaction is on chain (executed, real digest). 'absent' = DETERMINISTICALLY no effect — the call never reached signing (local/pre-flight failure), the Move abort atomically reverted (committed_digest present), or this was a dry-run/simulation; after fixing the cause a resubmission is safe. 'unknown' = the request may have committed and the response was lost (submission_unknown / transport_unavailable / network_error classes) — VERIFY first (onchain_events for the sender / query the expected object / onchain_transaction for any reported digest) before any retry; a blind retry double-purchases (live mainnet ghost orders). Read this field BEFORE result.retryable: retryable describes transport mechanics, onchain_state describes the chain.",
+              "type": "string",
+              "enum": [
+                "committed",
+                "absent",
+                "unknown"
+              ]
+            },
+            "refused": {
+              "description": "h1w9 F-07 (platform-refusal machine contract): true ONLY when the platform itself refused BEFORE any transaction was submitted — a local policy/decision gate, never a chain failure or a transport loss. The refusal reason is error_code; recovery guidance is recovery_hint. A scoring harness MUST read refused=true as 'the platform blocked the action' — never as a successful pass-through and never as an on-chain abort (no gas was spent, nothing to verify).",
+              "type": "boolean"
+            },
+            "tx_submitted": {
+              "description": "h1w9 F-07 companion of refused: EXPLICIT false (never inferred from absence — a missing field is ambiguous with legacy responses). This invocation submitted no transaction. Present ONLY alongside refused=true; a submission whose outcome is unknown uses submission_state instead, and a submitted-but-aborted tx carries committed_digest/onchain_state.",
+              "type": "boolean",
+              "const": false
+            },
             "submission_verification": {
               "description": "F-BS-14/39/63 (harness batch-31, idempotency-key support, structured half): present ONLY when error_code is 'submission_unknown' — the machine-readable verification kit for the unknown outcome. Carries the sender, the time window to query, and any known digests, so verification needs no re-derivation from the call's arguments. Prose guidance lives in result.recovery_hint; this block is the structured counterpart.",
               "type": "object",
@@ -5915,6 +6129,10 @@
                     "type": "string"
                   },
                   "description": "Transport-reported transaction digests, when the error carried one (e.g. TransactionCommitUnknownError). Verify THESE FIRST via onchain_transaction — a direct digest lookup is cheaper and more decisive than any object hunt: executed → adopt; failure status → final (bytes consumed, fix the cause); unresolvable → nothing landed, resubmit is safe. Example: ['5fJgk…']"
+                },
+                "idempotency_key": {
+                  "description": "F-RQ-13A (prescription ⑨): the caller-declared idempotency_key of the unknown-outcome call, echoed so the retry decision can name it. The same key will be HELD by the dispatch gate until the key ages out or a deterministic failure clears it — after verifying the outcome absent, retry with a NEW key (the verified retry is a new attempt).",
+                  "type": "string"
                 }
               },
               "required": [
@@ -6792,6 +7010,92 @@
                     "top_risks"
                   ],
                   "additionalProperties": false
+                },
+                "blueprint_verdict": {
+                  "description": "Creation-time blueprint verdict: business intent + host rich semantics + logic tree composed and run through the full per-host verification battery BEFORE the guard create tx. Present when binding_hint maps to a catalog host; absent when no host is known (add binding_hint to enable).",
+                  "type": "object",
+                  "properties": {
+                    "host": {
+                      "type": "string",
+                      "description": "Catalog host id this guard was verified against (guard-host-context)."
+                    },
+                    "status": {
+                      "type": "string",
+                      "enum": [
+                        "blocked",
+                        "proceed_with_warnings",
+                        "proceed"
+                      ],
+                      "description": "Single authority over create readiness. blocked = structural defect, fix BEFORE create (guards are immutable after create)."
+                    },
+                    "statement": {
+                      "type": "string",
+                      "description": "One authoritative verdict statement naming the finding codes."
+                    },
+                    "findings": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "source": {
+                            "type": "string",
+                            "description": "Which verifier produced the finding (verifyGuardBinding / auditGuardRelies / auditQuoteGuardCandidate / blueprint)."
+                          },
+                          "code": {
+                            "type": "string",
+                            "description": "Stable finding id (e.g. MF_SLOT_IDENTITY_ANCHOR, RC_NO_ORDER_ANCHOR)."
+                          },
+                          "level": {
+                            "type": "string",
+                            "enum": [
+                              "critical",
+                              "warning",
+                              "info"
+                            ]
+                          },
+                          "detail": {
+                            "type": "string"
+                          }
+                        },
+                        "required": [
+                          "source",
+                          "code",
+                          "level",
+                          "detail"
+                        ],
+                        "additionalProperties": false
+                      },
+                      "description": "All findings from the composed verification battery."
+                    },
+                    "host_context": {
+                      "description": "The host rich semantics this guard inherits — inlined so the design dialogue argues from facts, not memory.",
+                      "type": "object",
+                      "properties": {
+                        "signer_subject": {
+                          "type": "string"
+                        },
+                        "order_anchor": {
+                          "type": "string"
+                        },
+                        "identity_obligation": {
+                          "type": "string"
+                        }
+                      },
+                      "required": [
+                        "signer_subject",
+                        "order_anchor",
+                        "identity_obligation"
+                      ],
+                      "additionalProperties": false
+                    }
+                  },
+                  "required": [
+                    "host",
+                    "status",
+                    "statement",
+                    "findings"
+                  ],
+                  "additionalProperties": false
                 }
               },
               "additionalProperties": false
@@ -7187,6 +7491,14 @@
                 "note": {
                   "description": "Additional note.",
                   "type": "string"
+                },
+                "digest": {
+                  "description": "REAL transaction digest of this operation (ddmc4 B-37) — paste into onchain_transaction or a block explorer to audit. Absent under dry-run/simulation.",
+                  "type": "string"
+                },
+                "signer": {
+                  "description": "Signing account's on-chain address — a SEPARATE field from digest ({signer, digest}), never occupying the digest slot.",
+                  "type": "string"
                 }
               },
               "required": [