@zeroroot-ai/zerocool 0.7.0 → 0.9.0

package/dist/dispatch.d.ts

@@ -262,7 +262,8 @@ export declare function runSourceAnalysisDispatch(ctx: DispatchContext, deps?: D
  *   `gitlab.url`           instance base url; defaults to gitlab.com
  *   `gitlab.ref`           branch to watch; defaults to `main`
  *   `gitlab.credential`    tenant secret holding the project access token
- *   `repository.url`       clone url handed to each Scan mission
+ *   `repository.url`       clone url the Scan mission checks out (required)
+ *   `image.ref`            the image the pipeline published, by digest (required)
  *   `target.id`            the registered target each Scan mission binds to
  *   `watch.interval_ms`    poll cadence; defaults to 30s
  */

package/dist/dispatch.js

@@ -342,7 +342,8 @@ export async function runSourceAnalysisDispatch(ctx, deps = {}) {
  *   `gitlab.url`           instance base url; defaults to gitlab.com
  *   `gitlab.ref`           branch to watch; defaults to `main`
  *   `gitlab.credential`    tenant secret holding the project access token
- *   `repository.url`       clone url handed to each Scan mission
+ *   `repository.url`       clone url the Scan mission checks out (required)
+ *   `image.ref`            the image the pipeline published, by digest (required)
  *   `target.id`            the registered target each Scan mission binds to
  *   `watch.interval_ms`    poll cadence; defaults to 30s
  */
@@ -353,6 +354,8 @@ export async function runWatchDispatch(ctx, deps = {}) {
     const ref = ctx.taskContext["gitlab.ref"] || DEFAULT_REF;
     const targetId = ctx.taskContext["target.id"] || "";
     const credentialName = ctx.taskContext["gitlab.credential"] || "gitlab-token";
+    const repositoryUrl = ctx.taskContext["repository.url"] || "";
+    const imageRef = ctx.taskContext["image.ref"] || "";
     if (!application) {
         throw new Error("watch: the mission node set no `application` in the task context. The watch keys its " +
             "checkpoints and its Scan missions by Application; without one it cannot tell its own " +
@@ -362,6 +365,23 @@ export async function runWatchDispatch(ctx, deps = {}) {
         throw new Error("watch: the mission node set no `gitlab.project` in the task context, so there is no " +
             "project to poll.");
     }
+    // Checked here, not at the first trigger. The checked-in Scan mission requires
+    // all seven of its parameters — CUE refuses an incomplete render rather than
+    // substituting an empty string — so a watch missing one is already broken. It
+    // would otherwise poll cleanly for hours and fail on the first pipeline, at
+    // which point the failure looks like the pipeline's fault rather than the
+    // watch's configuration.
+    if (!w.scans) {
+        const missing = [
+            ...(repositoryUrl ? [] : ["repository.url"]),
+            ...(imageRef ? [] : ["image.ref"]),
+        ];
+        if (missing.length > 0) {
+            throw new Error(`watch: the mission node set no ${missing.join(" and no ")} in the task context. The ` +
+                "checked-in Scan mission requires every one of its seven parameters, so a Scan " +
+                "originated without these would be refused rather than run.");
+        }
+    }
     // A harness is opened unless every seam that would use one was injected.
     const needsHarness = !w.gitlab || !w.checkpoints || !w.scans || !w.credential;
     const opened = needsHarness && !deps.harness;
@@ -380,11 +400,7 @@ export async function runWatchDispatch(ctx, deps = {}) {
         const scans = w.scans ??
             harnessScanLauncher(harness, {
                 targetId,
-                inputs: {
-                    application,
-                    repositoryUrl: ctx.taskContext["repository.url"] || "",
-                    ...(ctx.taskContext["image.ref"] ? { imageRef: ctx.taskContext["image.ref"] } : {}),
-                },
+                inputs: { application, repositoryUrl, imageRef },
             });
         const intervalMs = Number(ctx.taskContext["watch.interval_ms"] || Number.NaN);
         const summary = await runWatchLoop({

package/dist/findings.d.ts

@@ -1,5 +1,25 @@
-import type { ToolDefinition } from "@opencode-ai/plugin";
 import { type Finding, type GibsonSession, type TaskHarness } from "@zeroroot-ai/sdk";
+/**
+ * Findings — emit what the agent discovers into the tenant World
+ * (zerocool-plugins#7).
+ *
+ * One code path, two backends. With a Gibson session a finding goes to the
+ * tenant graph through `ComponentService.SubmitFinding` under the agent's
+ * COMPONENT identity; standalone it is appended to a local JSONL log. The tool
+ * the model sees is identical either way, so a prompt that works standalone
+ * works on the platform.
+ *
+ * The agent decides what is a finding. Nothing here invents findings from file
+ * edits or message traffic: a `file.edited` event is not a security finding, and
+ * auto-emitting one would fill the tenant graph with noise that a human then has
+ * to triage.
+ *
+ * The `submit_finding` tool the model calls lives in the Gibson MCP server now
+ * (ADR-0008). What is left here is the backend the dispatched task kinds use
+ * when they submit a finding themselves, with no model in the loop:
+ * `source-analysis` triages semgrep candidates, and `dispatch` reports them
+ * under the task grant.
+ */
 export interface FindingsBackend {
     /** Submit a finding; returns the identifier it was recorded under. */
     submit(f: Finding): Promise<string>;
@@ -32,4 +52,3 @@ export interface SessionContext {
  * `agent_name` is fixed to "zerocool" rather than exposed as an argument — a
  * model must not be able to attribute its findings to another agent.
  */
-export declare function submitFindingTool(backend: FindingsBackend, context: SessionContext): ToolDefinition;

package/dist/findings.js

@@ -1,24 +1,6 @@
-import { tool } from "@opencode-ai/plugin";
-import { newFinding, submitFinding, } from "@zeroroot-ai/sdk";
+import { submitFinding, } from "@zeroroot-ai/sdk";
 import { appendFile, mkdir } from "node:fs/promises";
 import { dirname } from "node:path";
-/**
- * Findings — emit what the agent discovers into the tenant World
- * (zerocool-plugins#7).
- *
- * One code path, two backends. With a Gibson session a finding goes to the
- * tenant graph through `ComponentService.SubmitFinding` under the agent's
- * COMPONENT identity; standalone it is appended to a local JSONL log. The tool
- * the model sees is identical either way, so a prompt that works standalone
- * works on the platform.
- *
- * The agent decides what is a finding. Nothing here invents findings from file
- * edits or message traffic: a `file.edited` event is not a security finding, and
- * auto-emitting one would fill the tenant graph with noise that a human then has
- * to triage. The `event` hook only tracks session context used to stamp findings
- * with provenance.
- */
-const SEVERITIES = ["critical", "high", "medium", "low", "info"];
 /** Platform backend — findings land in the tenant knowledge graph. */
 export function gibsonFindingsBackend(session) {
     return {
@@ -82,64 +64,3 @@ export function localFindingsBackend(path) {
  * `agent_name` is fixed to "zerocool" rather than exposed as an argument — a
  * model must not be able to attribute its findings to another agent.
  */
-export function submitFindingTool(backend, context) {
-    const z = tool.schema;
-    return tool({
-        description: "Record a security finding in the Gibson knowledge graph. Use this when you " +
-            "discover a real vulnerability, misconfiguration or notable security fact about " +
-            "the target or codebase — not for progress updates or general observations.",
-        args: {
-            title: z.string().describe("One-line summary of the finding."),
-            description: z.string().describe("What the issue is, where it is, and why it matters."),
-            category: z
-                .string()
-                .describe('Type of issue, e.g. "injection", "auth", "secrets-exposure", "misconfiguration".'),
-            severity: z.enum(SEVERITIES).describe("Impact level of the finding."),
-            confidence: z
-                .number()
-                .min(0)
-                .max(1)
-                .optional()
-                .describe("How certain you are, from 0 to 1. Defaults to 1."),
-            evidence: z
-                .string()
-                .optional()
-                .describe("Supporting evidence — a code excerpt, request/response, or log line."),
-            remediation: z.string().optional().describe("How to fix or mitigate the issue."),
-            target_id: z.string().optional().describe("Identifier of the affected target or component."),
-            tags: z.array(z.string()).optional().describe("Labels for filtering."),
-        },
-        async execute(args, ctx) {
-            const finding = newFinding({
-                title: args.title,
-                description: args.description,
-                category: args.category,
-                severity: args.severity,
-                confidence: args.confidence,
-                missionID: context.sessionID ?? ctx.sessionID,
-                agentName: "zerocool",
-                ...(args.remediation ? { remediation: args.remediation } : {}),
-                ...(args.target_id ? { targetID: args.target_id } : {}),
-                ...(args.tags ? { tags: args.tags } : {}),
-                ...(args.evidence
-                    ? {
-                        evidence: [
-                            {
-                                type: "text",
-                                title: "evidence",
-                                content: args.evidence,
-                                timestamp: new Date().toISOString(),
-                            },
-                        ],
-                    }
-                    : {}),
-            });
-            const id = await backend.submit(finding);
-            return {
-                title: `${args.severity}: ${args.title}`,
-                output: `Recorded finding ${id} in ${backend.describe()}.`,
-                metadata: { finding_id: id, severity: args.severity, category: args.category },
-            };
-        },
-    });
-}

package/dist/index.d.ts

@@ -20,11 +20,17 @@ import type { Plugin } from "@opencode-ai/plugin";
  *   - checks in as a Gibson component (Capability Grant + RegisterComponent + heartbeat),
  *   - starts a local OpenAI-compatible shim over the harness,
  *   - auto-registers a zero-config `gibson` provider via the `config` hook (#6),
- *   - emits findings into the tenant World (#7),
- *   - reads the tenant knowledge graph (#8),
- *   - exposes Gibson tools and plugins as opencode tools (#9),
- *   - delegates to other agents and drives missions (#10),
- *   - enrolls produced artifacts into the fleet (#11).
+ *   - reads the tenant knowledge graph and injects an ambient block (#8).
+ *
+ * THE TOOLS ARE NOT HERE. Every Gibson tool — findings, knowledge, delegation,
+ * componentize, and one per RPC of every SDK service — comes from the Gibson
+ * MCP server, which this plugin registers in opencode's own `mcp` block
+ * (ADR-0008). opencode spawns it, so the tools reach the model the same way
+ * they reach Claude Code, Cursor and the rest, and a new SDK release adds
+ * tools with no change here.
+ *
+ * What is left is what only a plugin can do: the model provider, the ambient
+ * knowledge injection, and the session id.
  *
  * The plugin fails open throughout. A coding agent that cannot reach its
  * platform must still be a working coding agent, so every platform failure

package/dist/index.js

@@ -2,12 +2,9 @@ import { connectGibson, startCompletionsShim } from "@zeroroot-ai/sdk";
 import { existsSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { componentizeTool, enrollComponentTool } from "./componentize.js";
-import { delegationTools } from "./delegate.js";
-import { buildGibsonTools } from "./gibson-tools.js";
-import { ambientKnowledge, recallTool } from "./knowledge.js";
+import { ambientKnowledge } from "./knowledge.js";
 import { selectKnowledgeSource } from "./knowledge-source.js";
-import { gibsonFindingsBackend, localFindingsBackend, submitFindingTool, } from "./findings.js";
+import { gibsonMcpServer } from "./mcp-config.js";
 /**
  * @zeroroot-ai/zerocool — the main Gibson plugin.
  *
@@ -29,11 +26,17 @@ import { gibsonFindingsBackend, localFindingsBackend, submitFindingTool, } from
  *   - checks in as a Gibson component (Capability Grant + RegisterComponent + heartbeat),
  *   - starts a local OpenAI-compatible shim over the harness,
  *   - auto-registers a zero-config `gibson` provider via the `config` hook (#6),
- *   - emits findings into the tenant World (#7),
- *   - reads the tenant knowledge graph (#8),
- *   - exposes Gibson tools and plugins as opencode tools (#9),
- *   - delegates to other agents and drives missions (#10),
- *   - enrolls produced artifacts into the fleet (#11).
+ *   - reads the tenant knowledge graph and injects an ambient block (#8).
+ *
+ * THE TOOLS ARE NOT HERE. Every Gibson tool — findings, knowledge, delegation,
+ * componentize, and one per RPC of every SDK service — comes from the Gibson
+ * MCP server, which this plugin registers in opencode's own `mcp` block
+ * (ADR-0008). opencode spawns it, so the tools reach the model the same way
+ * they reach Claude Code, Cursor and the rest, and a new SDK release adds
+ * tools with no change here.
+ *
+ * What is left is what only a plugin can do: the model provider, the ambient
+ * knowledge injection, and the session id.
  *
  * The plugin fails open throughout. A coding agent that cannot reach its
  * platform must still be a working coding agent, so every platform failure
@@ -57,12 +60,11 @@ export const GibsonPlugin = async () => {
     // the operator to keep a spent credential in their environment forever.
     const checkedIn = existsSync(hostKeyPath);
     const bootstrapToken = checkedIn ? undefined : process.env.GIBSON_BOOTSTRAP_TOKEN;
-    // Standalone: findings go to a local log, and componentize still works —
-    // producing a manifest needs no platform.
-    const standaloneTools = () => ({
-        submit_finding: submitFindingTool(localFindingsBackend(process.env.ZEROCOOL_FINDINGS_LOG ?? join(homedir(), ".zerocool", "findings.jsonl")), context),
-        gibson_componentize: componentizeTool(),
-    });
+    // Standalone: the MCP server still runs. It decides its own posture from
+    // what is present, reports it through gibson_status, and offers the tools
+    // that need no platform. A coding agent that cannot reach Gibson is still a
+    // working coding agent.
+    const standalone = () => ({ config: async (config) => addMcpServer(config) });
     // Standalone unless we can authenticate: a platform URL plus either a token
     // for the first check-in or an already-registered host key.
     if (!platformURL || (!bootstrapToken && !checkedIn)) {
@@ -72,7 +74,7 @@ export const GibsonPlugin = async () => {
                 "GIBSON_BOOTSTRAP_TOKEN=<one-time token>. After that the host key at " +
                 `${hostKeyPath} is enough — you can drop the token.`);
         }
-        return { tool: standaloneTools() };
+        return standalone();
     }
     let session;
     let shim;
@@ -102,34 +104,19 @@ export const GibsonPlugin = async () => {
         // Fail open to standalone: a coding agent must still work if the platform is unreachable.
         console.error(`[zerocool] Gibson connect failed; continuing standalone: ${e.message}`);
         await shim?.close();
-        return { tool: standaloneTools() };
+        return standalone();
     }
     const shimUrl = shim.url;
     const live = session;
-    // Tool discovery runs once at load — opencode reads the `tool` hook as a
-    // static object, so a tool registered mid-session would never reach the model.
     // Which grant this process reads the knowledge graph with. A dispatched run
     // reads as the TASK; an interactive one keeps the component grant. Chosen once
     // here so nothing downstream has to ask.
     const { knowledge, scope: knowledgeScope } = selectKnowledgeSource(live);
     console.error(`[zerocool] knowledge reads use the ${knowledgeScope} grant`);
-    const gibson = await buildGibsonTools(live);
-    if (gibson.note)
-        console.error(`[zerocool] Gibson tool discovery: ${gibson.note}`);
-    else
-        console.error(`[zerocool] ${gibson.discovered} Gibson tool(s) registered`);
-    const tools = {
-        submit_finding: submitFindingTool(gibsonFindingsBackend(live), context),
-        recall: recallTool(knowledge),
-        gibson_componentize: componentizeTool(),
-        gibson_enroll_component: enrollComponentTool(live),
-        ...gibson.tools,
-        ...delegationTools(live),
-    };
     const injectKnowledge = ambientKnowledge(knowledge, process.env.ZEROCOOL_AMBIENT_QUERY ?? "prior findings and security facts for this codebase");
     return {
-        tool: tools,
-        // Zero-config LLM: inject the Gibson provider at config-load time (#6).
+        // Zero-config LLM, and the one tool surface: inject both at config-load
+        // time (#6, ADR-0008).
         //
         // `shimUrl` is always live here, and that is a type-level guarantee rather
         // than a timing assumption: `Plugin` returns `Promise<Hooks>`, so opencode
@@ -146,13 +133,14 @@ export const GibsonPlugin = async () => {
                     options: { baseURL: shimUrl, apiKey: "gibson" },
                 };
             }
+            addMcpServer(config);
         },
         // Ambient knowledge (#8): one cached GraphRAG lookup per session, injected
         // into the system prompt from the second turn on.
         "experimental.chat.system.transform": injectKnowledge,
-        // Track the session so findings carry provenance (#7). This hook does not
-        // emit findings: a file edit is not a security finding, and inventing one
-        // would fill the tenant graph with noise a human then has to triage.
+        // Track the session id, which the ambient block and any local state key
+        // off. This hook emits nothing: a file edit is not a security finding, and
+        // inventing one would fill the tenant graph with noise a human must triage.
         event: async ({ event }) => {
             const sessionID = event.properties?.sessionID;
             if (sessionID)
@@ -164,4 +152,11 @@ export const GibsonPlugin = async () => {
         },
     };
 };
+/** Register the Gibson MCP server in opencode's own `mcp` block. */
+function addMcpServer(config) {
+    const cfg = config;
+    cfg.mcp = cfg.mcp ?? {};
+    if (!cfg.mcp.gibson)
+        cfg.mcp.gibson = gibsonMcpServer();
+}
 export default GibsonPlugin;

package/dist/knowledge.d.ts

@@ -1,13 +1,4 @@
-import type { ToolDefinition } from "@opencode-ai/plugin";
 import { type KnowledgeSource } from "@zeroroot-ai/sdk";
-export declare function recallTool(knowledge: KnowledgeSource): ToolDefinition;
-/**
- * Per-session ambient knowledge for the system prompt.
- *
- * Returns a transform that injects a short context block once a session has
- * produced one. The lookup is fired once and cached, so a session pays for at
- * most one GraphRAG query no matter how many turns it runs.
- */
 export declare function ambientKnowledge(knowledge: KnowledgeSource, seedQuery: string): (input: {
     sessionID?: string;
 }, output: {

package/dist/knowledge.js

@@ -1,5 +1,4 @@
-import { tool } from "@opencode-ai/plugin";
-import { formatKnowledgeForPrompt, isSeamUnavailable, } from "@zeroroot-ai/sdk";
+import { formatKnowledgeForPrompt, } from "@zeroroot-ai/sdk";
 /**
  * Knowledge — read the tenant graph so the agent sharpens across runs
  * (zerocool-plugins#8).
@@ -22,57 +21,6 @@ import { formatKnowledgeForPrompt, isSeamUnavailable, } from "@zeroroot-ai/sdk";
  */
 /** How many hits the ambient block injects. Kept small — it is prompt overhead. */
 const AMBIENT_LIMIT = 5;
-export function recallTool(knowledge) {
-    const z = tool.schema;
-    return tool({
-        description: "Search this tenant's Gibson knowledge graph for prior findings, targets and " +
-            "security facts recorded by earlier runs. Use it before starting work on an " +
-            "unfamiliar area, or to check whether an issue was already reported.",
-        args: {
-            query: z.string().describe("What to look for, in natural language."),
-            limit: z.number().min(1).max(50).optional().describe("Maximum hits to return. Defaults to 10."),
-            node_types: z
-                .array(z.string())
-                .optional()
-                .describe('Restrict to node types, e.g. ["finding"] or ["host", "technique"].'),
-        },
-        async execute(args) {
-            let hits;
-            try {
-                hits = await knowledge.query({
-                    text: args.query,
-                    topK: args.limit ?? 10,
-                    ...(args.node_types ? { nodeTypes: args.node_types } : {}),
-                });
-            }
-            catch (e) {
-                if (isSeamUnavailable(e)) {
-                    return {
-                        title: "recall unavailable",
-                        output: "The Gibson knowledge graph is not available on this daemon: the GraphRAG " +
-                            "seam is not wired (gibson#1186). Continue without prior context.",
-                    };
-                }
-                throw e;
-            }
-            if (hits.length === 0) {
-                return { title: "no matches", output: `Nothing in the tenant graph matches "${args.query}".` };
-            }
-            return {
-                title: `${hits.length} match${hits.length === 1 ? "" : "es"}`,
-                output: formatKnowledgeForPrompt(hits),
-                metadata: { hit_count: hits.length, node_types: [...new Set(hits.map((h) => h.type))] },
-            };
-        },
-    });
-}
-/**
- * Per-session ambient knowledge for the system prompt.
- *
- * Returns a transform that injects a short context block once a session has
- * produced one. The lookup is fired once and cached, so a session pays for at
- * most one GraphRAG query no matter how many turns it runs.
- */
 export function ambientKnowledge(knowledge, seedQuery) {
     const cache = new Map();
     const inFlight = new Map();

package/dist/mcp-config.d.ts

@@ -0,0 +1,20 @@
+/**
+ * How opencode reaches the Gibson MCP server (ADR-0008, slice A7).
+ *
+ * opencode spawns a local MCP server from its `mcp` block, the same way every
+ * other host does from its own config file. The plugin writes that entry in
+ * the `config` hook, so a user configures nothing.
+ *
+ * The command is the published package, not a path inside this plugin: the
+ * server is shared by every host and released on the SDK train, so pinning it
+ * to whatever this plugin happens to bundle would freeze the tool set.
+ */
+export declare const GIBSON_MCP_PACKAGE = "@zeroroot-ai/gibson-mcp@latest";
+export interface OpencodeMcpLocal {
+    type: "local";
+    command: string[];
+    enabled: boolean;
+    environment?: Record<string, string>;
+}
+/** The `mcp.gibson` entry. `environment` carries nothing secret. */
+export declare function gibsonMcpServer(env?: NodeJS.ProcessEnv): OpencodeMcpLocal;

package/dist/mcp-config.js

@@ -0,0 +1,29 @@
+/**
+ * How opencode reaches the Gibson MCP server (ADR-0008, slice A7).
+ *
+ * opencode spawns a local MCP server from its `mcp` block, the same way every
+ * other host does from its own config file. The plugin writes that entry in
+ * the `config` hook, so a user configures nothing.
+ *
+ * The command is the published package, not a path inside this plugin: the
+ * server is shared by every host and released on the SDK train, so pinning it
+ * to whatever this plugin happens to bundle would freeze the tool set.
+ */
+export const GIBSON_MCP_PACKAGE = "@zeroroot-ai/gibson-mcp@latest";
+/** The `mcp.gibson` entry. `environment` carries nothing secret. */
+export function gibsonMcpServer(env = process.env) {
+    const environment = {};
+    // Addressing only. The server does its own check-in, and a grant is never
+    // written into a config file.
+    for (const name of ["GIBSON_PLATFORM_URL", "GIBSON_DAEMON_URL", "GIBSON_TARGET_ID", "GIBSON_CA_CERT"]) {
+        const value = env[name];
+        if (value)
+            environment[name] = value;
+    }
+    return {
+        type: "local",
+        command: ["npx", "--yes", "--package", GIBSON_MCP_PACKAGE, "gibson-mcp", "--transport", "stdio"],
+        enabled: true,
+        ...(Object.keys(environment).length > 0 ? { environment } : {}),
+    };
+}

package/dist/watch.d.ts

@@ -156,48 +156,40 @@ export declare function parseCheckpoint(text: string): {
 export declare function worldCheckpoints(harness: TaskHarness, application: string): WatchCheckpoints;
 /** The recall text for an application's checkpoints. Exported so a test names it once. */
 export declare function checkpointQueryText(application: string): string;
+/**
+ * The name of the checked-in Scan mission in gibson's mission catalog.
+ *
+ * One file in `internal/platform/missioncatalog/missions/` is one mission,
+ * named for its file: `scan.cue` is `"scan"`.
+ */
+export declare const SCAN_CATALOG_MISSION = "scan";
 /** What a Scan mission needs to know about the pipeline that triggered it. */
 export interface ScanMissionInputs {
     application: string;
     pipeline: Pipeline;
     /** The project's clone url, so the Scan mission knows what to check out. */
     repositoryUrl: string;
-    /** The image the pipeline built, when the watch was told how to name it. */
-    imageRef?: string;
-    /** The registered target the runtime scans are allowed to reach. */
-    targetId?: string;
+    /** The image the pipeline published, by digest. */
+    imageRef: string;
 }
 /**
- * The Scan mission definition, as canonical proto JSON.
- *
- * STILL BUILT HERE, AND IT SHOULD NOT BE. gibson#1685 landed the Scan mission
- * as a checked-in definition in gibson's `missioncatalog`, and ADR-0018 makes
- * that copy authoritative: this function is meant to become a mission name plus
- * seven parameters, not a second description of the same graph.
- *
- * It cannot yet. `missioncatalog.Render` has no production caller, and
- * `CreateMission` carries only `mission_definition_json` — there is no field
- * naming a checked-in mission and none carrying its parameters, so an agent has
- * no way to ask for the catalog's copy. That is gibson#1688. Until it lands the
- * only way to originate a Scan is to send a graph, so this one stays, with the
- * shape the catalog definition expects: everything the fan-out needs is carried
- * in the node's task context, and the swap is this function's body alone.
- *
- * The definition is built as protojson by hand rather than through the
- * generated schema because the SDK's package exports only its index, and the
- * mission schema is not re-exported from it.
+ * The seven parameters the checked-in Scan mission is rendered with.
+ *
+ * These names are the catalog's, not ours: `missioncatalog.Params.fields()` is
+ * the one declaration of them, and the daemon REFUSES an unrecognised key
+ * rather than ignoring it. That refusal is the smuggling defence — `Params` has
+ * no target or host field, so the runtime target binds from the mission's
+ * `target_id` alone and a caller cannot point a scan at a host the tenant never
+ * registered. A key renamed here without renaming it there fails loudly at the
+ * next launch, which is the intended outcome.
+ *
+ * Every one is required. CUE refuses an incomplete render rather than
+ * substituting an empty string, so a missing commit fails instead of scanning
+ * HEAD and a missing image fails instead of scanning nothing.
  */
-export declare function scanMissionDefinition(inputs: ScanMissionInputs): unknown;
+export declare function scanCatalogParams(inputs: ScanMissionInputs): Record<string, string>;
 /** The child mission's name, which is also how a person finds it in the dashboard. */
 export declare function scanMissionName(inputs: ScanMissionInputs): string;
-/**
- * Render a string map as `map<string, gibson.common.v1.TypedValue>` in
- * protojson. Every value the loop passes is a string, so every entry is a
- * `stringValue`.
- */
-export declare function typedContext(ctx: Record<string, string>): Record<string, {
-    stringValue: string;
-}>;
 export interface HarnessScanLauncherOptions {
     /** Everything but the pipeline, which the launcher fills in per trigger. */
     inputs: Omit<ScanMissionInputs, "pipeline">;
@@ -205,8 +197,6 @@ export interface HarnessScanLauncherOptions {
     targetId: string;
     /** Ceiling on one Scan. Defaults to {@link DEFAULT_SCAN_TIMEOUT_MS}. */
     scanTimeoutMs?: number;
-    /** Override the definition, so gibson#1660 can supply the real one. */
-    definition?: (inputs: ScanMissionInputs) => unknown;
 }
 /**
  * A {@link ScanLauncher} over the harness callbacks, on the dispatch grant.
@@ -215,5 +205,29 @@ export interface HarnessScanLauncherOptions {
  * daemon resolves the parent from this harness, so the Scan mission is a child
  * of the watch mission and inherits its tenant. Nothing in the request names a
  * parent, a tenant or an originator, so nothing here can widen them.
+ *
+ * THE MISSION IS NAMED, NOT BUILT (ADR-0018, gibson#1688). The Scan mission is
+ * checked into gibson's `missioncatalog` and that copy is authoritative; this
+ * launcher sends its name and seven parameters. It used to build its own graph,
+ * because `CreateMission` had no way to ask for the catalog's copy — two
+ * descriptions of one mission, which is the parallel definition ADR-0027
+ * forbids. There is no fallback to the old path: a definition that only one of
+ * the two knew about is the drift the single copy exists to prevent.
+ *
+ * The request goes through the SDK's `buildCreateMissionRequest` rather than
+ * being assembled here, because that builder normalises the one trap in this
+ * call. `JSON.stringify(undefined)` encodes to zero bytes but
+ * `JSON.stringify(null)` encodes to the four-byte string `"null"`, so a graph
+ * field filled in unconditionally puts a non-empty body on the wire beside the
+ * catalog name; the daemon refuses the pair, and the failure reads as "the
+ * catalog path does not work" rather than "you passed a null definition".
+ *
+ * The response is then sent by hand rather than through `createTaskMission`,
+ * for one reason: `CreateMissionResponse` carries an in-band `error`, and the
+ * daemon puts its most useful refusals there — an unknown parameter key naming
+ * the key and listing the known set, or every missing parameter reported at
+ * once. `createTaskMission` reads only `mission`, so those would surface as
+ * "returned no mission" and the operator would lose the sentence that says what
+ * to fix.
  */
 export declare function harnessScanLauncher(harness: TaskHarness, opts: HarnessScanLauncherOptions): ScanLauncher;