agentic-orchestrator 0.1.0

package/dist/apps/control-plane/core/response.js

@@ -0,0 +1,34 @@
+import { ERROR_CODES } from './error-codes.js';
+export function ok(data = {}, evidence) {
+    const response = { ok: true, data };
+    if (evidence) {
+        response.evidence = evidence;
+    }
+    return response;
+}
+export function fail(code, message, details = {}, evidence) {
+    const normalizedCode = Object.values(ERROR_CODES).includes(code)
+        ? code
+        : ERROR_CODES.INTERNAL_ERROR;
+    const response = {
+        ok: false,
+        error: {
+            code: normalizedCode,
+            message,
+            details
+        }
+    };
+    if (evidence) {
+        response.evidence = evidence;
+    }
+    return response;
+}
+export function withSuggestedActions(details, actions = []) {
+    return {
+        ...details,
+        retryable: details.retryable ?? false,
+        requires_human: details.requires_human ?? false,
+        suggested_next_actions: actions
+    };
+}
+//# sourceMappingURL=response.js.map

package/dist/apps/control-plane/core/response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"response.js","sourceRoot":"","sources":["../../../../apps/control-plane/src/core/response.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAkB,MAAM,kBAAkB,CAAC;AAoB/D,MAAM,UAAU,EAAE,CAA8B,OAAU,EAAO,EAAE,QAAkC;IACnG,MAAM,QAAQ,GAAkB,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACnD,IAAI,QAAQ,EAAE,CAAC;QACb,QAAQ,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC/B,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,IAAI,CAClB,IAAY,EACZ,OAAe,EACf,UAAmC,EAAE,EACrC,QAAkC;IAElC,MAAM,cAAc,GAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAc,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC5E,CAAC,CAAE,IAAkB;QACrB,CAAC,CAAC,WAAW,CAAC,cAAc,CAAC;IAC/B,MAAM,QAAQ,GAAiB;QAC7B,EAAE,EAAE,KAAK;QACT,KAAK,EAAE;YACL,IAAI,EAAE,cAAc;YACpB,OAAO;YACP,OAAO;SACR;KACF,CAAC;IACF,IAAI,QAAQ,EAAE,CAAC;QACb,QAAQ,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC/B,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,OAAgC,EAChC,UAAoB,EAAE;IAEtB,OAAO;QACL,GAAG,OAAO;QACV,SAAS,EAAG,OAAO,CAAC,SAAiC,IAAI,KAAK;QAC9D,cAAc,EAAG,OAAO,CAAC,cAAsC,IAAI,KAAK;QACxE,sBAAsB,EAAE,OAAO;KAChC,CAAC;AACJ,CAAC"}

package/dist/apps/control-plane/core/runtime-sessions.d.ts

@@ -0,0 +1,19 @@
+export interface RuntimeFeatureSessions {
+    planner_session_id: string;
+    builder_session_id: string;
+    qa_session_id: string;
+}
+export interface RuntimeSessionsSnapshot {
+    run_id: string;
+    orchestrator_session_id: string;
+    provider: string;
+    model: string;
+    provider_config_ref_hash: string;
+    owner_instance_id: string;
+    lease_id: string;
+    started_at: string;
+    last_heartbeat_at: string;
+    lease_expires_at: string;
+    orchestrator_epoch?: number;
+    feature_sessions?: Record<string, RuntimeFeatureSessions>;
+}

package/dist/apps/control-plane/core/runtime-sessions.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=runtime-sessions.js.map

package/dist/apps/control-plane/core/runtime-sessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-sessions.js","sourceRoot":"","sources":["../../../../apps/control-plane/src/core/runtime-sessions.ts"],"names":[],"mappings":""}

package/dist/apps/control-plane/core/schemas.d.ts

@@ -0,0 +1,23 @@
+import type { ErrorObject, ValidateFunction } from 'ajv';
+export type SchemaId = string;
+export interface ValidationResult {
+    valid: boolean;
+    errors: ErrorObject[];
+}
+export interface SchemaValidator {
+    validate(name: SchemaId, payload: unknown): Promise<ValidationResult>;
+}
+export declare class SchemaRegistry implements SchemaValidator {
+    readonly repoRoot: string;
+    private readonly ajv;
+    private readonly validators;
+    constructor(repoRoot: string);
+    schemaPath(name: SchemaId): string;
+    loadSchema(name: SchemaId): Promise<ValidateFunction>;
+    validate(name: SchemaId, payload: unknown): Promise<ValidationResult>;
+}
+export declare function loadYamlFile<T = unknown>(filePath: string): Promise<T>;
+export declare function loadAndValidateYaml<T = unknown>(schemaRegistry: SchemaValidator, schemaName: SchemaId, yamlPath: string): Promise<{
+    parsed: T;
+    validation: ValidationResult;
+}>;

package/dist/apps/control-plane/core/schemas.js

@@ -0,0 +1,80 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import YAML from 'yaml';
+import Ajv2020Import from 'ajv/dist/2020.js';
+const RFC3339_DATE_TIME = /^(\d{4})-(\d{2})-(\d{2})T([0-2]\d):([0-5]\d):([0-5]\d)(\.\d{1,9})?(Z|([+-])([0-2]\d):([0-5]\d))$/;
+function isStrictRfc3339DateTime(value) {
+    if (typeof value !== 'string') {
+        return false;
+    }
+    const match = RFC3339_DATE_TIME.exec(value);
+    if (!match) {
+        return false;
+    }
+    const year = Number(match[1]);
+    const month = Number(match[2]);
+    const day = Number(match[3]);
+    const hour = Number(match[4]);
+    const minute = Number(match[5]);
+    const second = Number(match[6]);
+    const offsetHour = Number(match[10] ?? 0);
+    const offsetMinute = Number(match[11] ?? 0);
+    if (month < 1 || month > 12) {
+        return false;
+    }
+    const daysInMonth = new Date(Date.UTC(year, month, 0)).getUTCDate();
+    if (day < 1 || day > daysInMonth) {
+        return false;
+    }
+    if (hour > 23 || minute > 59 || second > 59) {
+        return false;
+    }
+    if (offsetHour > 23 || offsetMinute > 59) {
+        return false;
+    }
+    return !Number.isNaN(Date.parse(value));
+}
+export class SchemaRegistry {
+    repoRoot;
+    ajv;
+    validators;
+    constructor(repoRoot) {
+        this.repoRoot = repoRoot;
+        const Ajv2020Ctor = Ajv2020Import;
+        this.ajv = new Ajv2020Ctor({ allErrors: true, strict: false });
+        this.ajv.addFormat?.('date-time', {
+            type: 'string',
+            validate: isStrictRfc3339DateTime
+        });
+        this.validators = new Map();
+    }
+    schemaPath(name) {
+        return path.join(this.repoRoot, 'agentic', 'orchestrator', 'schemas', name);
+    }
+    async loadSchema(name) {
+        const filePath = this.schemaPath(name);
+        const schemaText = await fs.readFile(filePath, 'utf8');
+        const schema = JSON.parse(schemaText);
+        const validator = this.ajv.compile(schema);
+        this.validators.set(name, validator);
+        return validator;
+    }
+    async validate(name, payload) {
+        const validator = this.validators.get(name) ?? (await this.loadSchema(name));
+        const valid = validator(payload);
+        return {
+            valid: Boolean(valid),
+            errors: valid ? [] : ((validator.errors ?? []))
+        };
+    }
+}
+export async function loadYamlFile(filePath) {
+    const raw = await fs.readFile(filePath, 'utf8');
+    return YAML.parse(raw);
+}
+export async function loadAndValidateYaml(schemaRegistry, schemaName, yamlPath) {
+    const parsed = await loadYamlFile(yamlPath);
+    const validation = await schemaRegistry.validate(schemaName, parsed);
+    return { parsed, validation };
+}
+//# sourceMappingURL=schemas.js.map

package/dist/apps/control-plane/core/schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../../../apps/control-plane/src/core/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,aAAa,MAAM,kBAAkB,CAAC;AA2B7C,MAAM,iBAAiB,GACrB,kGAAkG,CAAC;AAErG,SAAS,uBAAuB,CAAC,KAAa;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAChC,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1C,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAE5C,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,EAAE,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;IACpE,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,WAAW,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,IAAI,GAAG,EAAE,IAAI,MAAM,GAAG,EAAE,IAAI,MAAM,GAAG,EAAE,EAAE,CAAC;QAC5C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,UAAU,GAAG,EAAE,IAAI,YAAY,GAAG,EAAE,EAAE,CAAC;QACzC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,OAAO,cAAc;IAChB,QAAQ,CAAS;IACT,GAAG,CAAU;IACb,UAAU,CAAkC;IAE7D,YAAY,QAAgB;QAC1B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,MAAM,WAAW,GAAG,aAA8E,CAAC;QACnG,IAAI,CAAC,GAAG,GAAG,IAAI,WAAW,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/D,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,WAAW,EAAE;YAChC,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,uBAAuB;SAClC,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,GAAG,IAAI,GAAG,EAAE,CAAC;IAC9B,CAAC;IAED,UAAU,CAAC,IAAc;QACvB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAC9E,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,IAAc;QAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAc,CAAC;QACnD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACrC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAc,EAAE,OAAgB;QAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7E,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QACjC,OAAO;YACL,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC;YACrB,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;SAChD,CAAC;IACJ,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAc,QAAgB;IAC9D,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAChD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAM,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,cAA+B,EAC/B,UAAoB,EACpB,QAAgB;IAEhB,MAAM,MAAM,GAAG,MAAM,YAAY,CAAI,QAAQ,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACrE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAChC,CAAC"}

package/dist/apps/control-plane/index.d.ts

@@ -0,0 +1,11 @@
+export { AopKernel } from './core/kernel.js';
+export type { AgentsConfigSnapshot } from './core/kernel.js';
+export { SupervisorRuntime } from './supervisor/runtime.js';
+export { resolveProviderSelection, NullWorkerProvider } from './providers/providers.js';
+export type { WorkerProvider, ProviderSelectionResolver } from './providers/providers.js';
+export { createToolingRuntime, resolveToolClient } from './mcp/runtime-factory.js';
+export type { ToolingKernelPort, CreateToolingRuntimeOptions } from './mcp/runtime-factory.js';
+export { InProcessToolClient, McpToolClient, createOperationId } from './mcp/tool-client.js';
+export { TokenAuthVerifier } from './mcp/token-auth-verifier.js';
+export { McpServerAdapter } from './mcp/mcp-server-adapter.js';
+export { TOOL_BEHAVIOR_METADATA, isMutatingTool, toolRequiresOperationId } from './application/tools/tool-metadata.js';

package/dist/apps/control-plane/index.js

@@ -0,0 +1,9 @@
+export { AopKernel } from './core/kernel.js';
+export { SupervisorRuntime } from './supervisor/runtime.js';
+export { resolveProviderSelection, NullWorkerProvider } from './providers/providers.js';
+export { createToolingRuntime, resolveToolClient } from './mcp/runtime-factory.js';
+export { InProcessToolClient, McpToolClient, createOperationId } from './mcp/tool-client.js';
+export { TokenAuthVerifier } from './mcp/token-auth-verifier.js';
+export { McpServerAdapter } from './mcp/mcp-server-adapter.js';
+export { TOOL_BEHAVIOR_METADATA, isMutatingTool, toolRequiresOperationId } from './application/tools/tool-metadata.js';
+//# sourceMappingURL=index.js.map

package/dist/apps/control-plane/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../apps/control-plane/src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EACnB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAKnF,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC7F,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EACL,sBAAsB,EACtB,cAAc,EACd,uBAAuB,EACxB,MAAM,sCAAsC,CAAC"}

package/dist/apps/control-plane/interfaces/cli/bootstrap.d.ts

@@ -0,0 +1,2 @@
+import type { RuntimeContext } from '../../cli/types.js';
+export declare function runCli(argv?: string[], runtime?: RuntimeContext): Promise<number>;

package/dist/apps/control-plane/interfaces/cli/bootstrap.js

@@ -0,0 +1,86 @@
+import crypto from 'node:crypto';
+import { AopKernel } from '../../core/kernel.js';
+import { ERROR_CODES } from '../../core/error-codes.js';
+import { createToolingRuntime, resolveToolClient } from '../../mcp/runtime-factory.js';
+import { CliArgumentParser } from '../../cli/cli-argument-parser.js';
+import { printError, printPayload } from '../../cli/io.js';
+import { StatusCommandHandler } from '../../cli/status-command-handler.js';
+import { ResumeCommandHandler } from '../../cli/resume-command-handler.js';
+import { StopCommandHandler } from '../../cli/stop-command-handler.js';
+import { DeleteCommandHandler } from '../../cli/delete-command-handler.js';
+import { RunCommandHandler } from '../../cli/run-command-handler.js';
+const SUPPORTED_COMMANDS = new Set(['run', 'status', 'resume', 'stop', 'delete']);
+export async function runCli(argv = process.argv.slice(2), runtime = { cwd: process.cwd(), env: process.env }) {
+    const parser = new CliArgumentParser();
+    const options = parser.parse(argv);
+    const repoRoot = runtime.cwd;
+    try {
+        if (!SUPPORTED_COMMANDS.has(options.command)) {
+            printError(ERROR_CODES.INVALID_CLI_ARGS, `Unknown command: ${options.command}`, {
+                command: options.command
+            });
+            return 1;
+        }
+        const transport = parser.resolveTransport(options.transport);
+        const runId = `run:${crypto.randomUUID()}`;
+        const kernel = new AopKernel(repoRoot);
+        await kernel.ensureLoaded();
+        const tooling = await createToolingRuntime(repoRoot, kernel);
+        const toolClient = resolveToolClient(transport, tooling);
+        if (options.command === 'status') {
+            const handler = new StatusCommandHandler(toolClient, runId);
+            const payload = await handler.execute();
+            printPayload(payload);
+            return 0;
+        }
+        if (options.command === 'resume') {
+            const handler = new ResumeCommandHandler();
+            const payload = await handler.execute({
+                repoRoot,
+                env: runtime.env,
+                runId,
+                transport,
+                options,
+                kernel,
+                toolClient
+            });
+            printPayload(payload);
+            return 0;
+        }
+        if (options.command === 'stop') {
+            const handler = new StopCommandHandler();
+            const payload = await handler.execute();
+            printPayload(payload);
+            return 0;
+        }
+        if (options.command === 'delete') {
+            const handler = new DeleteCommandHandler(toolClient, runId);
+            const payload = await handler.execute(options);
+            printPayload(payload);
+            return 0;
+        }
+        const handler = new RunCommandHandler();
+        const payload = await handler.execute({
+            repoRoot,
+            env: runtime.env,
+            runId,
+            transport,
+            options,
+            kernel,
+            toolClient
+        });
+        printPayload(payload);
+        return 0;
+    }
+    catch (error) {
+        const typed = error;
+        const code = typed.code || ERROR_CODES.INTERNAL_ERROR;
+        printError(code, typed.message || 'Unhandled CLI error', {
+            ...(typed.details ?? {}),
+            retryable: false,
+            requires_human: true
+        });
+        return 1;
+    }
+}
+//# sourceMappingURL=bootstrap.js.map

package/dist/apps/control-plane/interfaces/cli/bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap.js","sourceRoot":"","sources":["../../../../../apps/control-plane/src/interfaces/cli/bootstrap.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAExD,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACvF,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAC3E,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAC3E,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAGrE,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAElF,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,OAAiB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EACtC,UAA0B,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;IAElE,MAAM,MAAM,GAAG,IAAI,iBAAiB,EAAE,CAAC;IACvC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC;IAE7B,IAAI,CAAC;QACH,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7C,UAAU,CAAC,WAAW,CAAC,gBAAgB,EAAE,oBAAoB,OAAO,CAAC,OAAO,EAAE,EAAE;gBAC9E,OAAO,EAAE,OAAO,CAAC,OAAO;aACzB,CAAC,CAAC;YACH,OAAO,CAAC,CAAC;QACX,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,CAAC,gBAAgB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC7D,MAAM,KAAK,GAAG,OAAO,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;QAE3C,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,MAAM,CAAC,YAAY,EAAE,CAAC;QAE5B,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC7D,MAAM,UAAU,GAAG,iBAAiB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAEzD,IAAI,OAAO,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,IAAI,oBAAoB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YAC5D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;YACxC,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,OAAO,CAAC,CAAC;QACX,CAAC;QAED,IAAI,OAAO,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,IAAI,oBAAoB,EAAE,CAAC;YAC3C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC;gBACpC,QAAQ;gBACR,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,KAAK;gBACL,SAAS;gBACT,OAAO;gBACP,MAAM;gBACN,UAAU;aACX,CAAC,CAAC;YACH,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,OAAO,CAAC,CAAC;QACX,CAAC;QAED,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;YAC/B,MAAM,OAAO,GAAG,IAAI,kBAAkB,EAAE,CAAC;YACzC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;YACxC,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,OAAO,CAAC,CAAC;QACX,CAAC;QAED,IAAI,OAAO,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,IAAI,oBAAoB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YAC5D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC/C,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,OAAO,CAAC,CAAC;QACX,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,iBAAiB,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC;YACpC,QAAQ;YACR,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,KAAK;YACL,SAAS;YACT,OAAO;YACP,MAAM;YACN,UAAU;SACX,CAAC,CAAC;QACH,YAAY,CAAC,OAAO,CAAC,CAAC;QACtB,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,KAAiB,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,WAAW,CAAC,cAAc,CAAC;QACtD,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,IAAI,qBAAqB,EAAE;YACvD,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;YACxB,SAAS,EAAE,KAAK;YAChB,cAAc,EAAE,IAAI;SACrB,CAAC,CAAC;QACH,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC"}

package/dist/apps/control-plane/mcp/kernel-tool-executor.d.ts

@@ -0,0 +1,14 @@
+import { type ToolResponse } from '../core/response.js';
+import type { ToolCatalogEntry, VerifiedActorClaims } from './runtime-types.js';
+export interface ToolExecutionRouterPort {
+    dispatchTool(toolName: string, args: Record<string, unknown>, context: {
+        actorType: string;
+        actorId: string;
+    }): Promise<unknown>;
+    normalizeError(error: unknown): ToolResponse;
+}
+export declare class KernelToolExecutor {
+    readonly router: ToolExecutionRouterPort;
+    constructor(router: ToolExecutionRouterPort);
+    execute(tool: ToolCatalogEntry, args: Record<string, unknown>, claims: VerifiedActorClaims): Promise<ToolResponse>;
+}

package/dist/apps/control-plane/mcp/kernel-tool-executor.js

@@ -0,0 +1,26 @@
+import { ok } from '../core/response.js';
+export class KernelToolExecutor {
+    router;
+    constructor(router) {
+        this.router = router;
+    }
+    async execute(tool, args, claims) {
+        try {
+            const result = (await this.router.dispatchTool(tool.name, args, {
+                actorType: claims.actor_type,
+                actorId: claims.actor_id
+            }));
+            const payload = result.data && typeof result.data === 'object'
+                ? result.data
+                : result;
+            const evidence = result.evidence && typeof result.evidence === 'object'
+                ? result.evidence
+                : undefined;
+            return ok(payload, evidence);
+        }
+        catch (error) {
+            return this.router.normalizeError(error);
+        }
+    }
+}
+//# sourceMappingURL=kernel-tool-executor.js.map

package/dist/apps/control-plane/mcp/kernel-tool-executor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kernel-tool-executor.js","sourceRoot":"","sources":["../../../../apps/control-plane/src/mcp/kernel-tool-executor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAqB,MAAM,qBAAqB,CAAC;AAY5D,MAAM,OAAO,kBAAkB;IACpB,MAAM,CAA0B;IAEzC,YAAY,MAA+B;QACzC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAsB,EAAE,IAA6B,EAAE,MAA2B;QAC9F,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE;gBAC9D,SAAS,EAAE,MAAM,CAAC,UAAU;gBAC5B,OAAO,EAAE,MAAM,CAAC,QAAQ;aACzB,CAAC,CAA4B,CAAC;YAC/B,MAAM,OAAO,GACX,MAAM,CAAC,IAAI,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;gBAC5C,CAAC,CAAE,MAAM,CAAC,IAAgC;gBAC1C,CAAC,CAAC,MAAM,CAAC;YACb,MAAM,QAAQ,GACZ,MAAM,CAAC,QAAQ,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;gBACpD,CAAC,CAAE,MAAM,CAAC,QAAoC;gBAC9C,CAAC,CAAC,SAAS,CAAC;YAChB,OAAO,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;CACF"}

package/dist/apps/control-plane/mcp/mcp-server-adapter.d.ts

@@ -0,0 +1,19 @@
+import type { ToolResponse } from '../core/response.js';
+import type { ToolDescriptor } from './transport-types.js';
+import { type TokenAuthVerifier } from './token-auth-verifier.js';
+import { type ToolRuntime } from './tool-runtime.js';
+interface McpCallRequest {
+    name: string;
+    arguments?: Record<string, unknown>;
+    session_token?: string;
+}
+export declare class McpServerAdapter {
+    readonly authVerifier: TokenAuthVerifier;
+    readonly runtime: ToolRuntime;
+    constructor(runtime: ToolRuntime, authVerifier: TokenAuthVerifier);
+    toolsList(): Promise<{
+        tools: ToolDescriptor[];
+    }>;
+    toolsCall(request: McpCallRequest): Promise<ToolResponse>;
+}
+export {};

package/dist/apps/control-plane/mcp/mcp-server-adapter.js

@@ -0,0 +1,55 @@
+import { ERROR_CODES } from '../core/error-codes.js';
+import { fail } from '../core/response.js';
+function extractActorClaimsFromArgs(args) {
+    const actor_type = typeof args.actor_type === 'string' ? args.actor_type : undefined;
+    const actor_id = typeof args.actor_id === 'string' ? args.actor_id : undefined;
+    return { actor_type, actor_id };
+}
+export class McpServerAdapter {
+    authVerifier;
+    runtime;
+    constructor(runtime, authVerifier) {
+        this.runtime = runtime;
+        this.authVerifier = authVerifier;
+    }
+    async toolsList() {
+        const tools = await this.runtime.listTools();
+        return { tools };
+    }
+    async toolsCall(request) {
+        const args = { ...(request.arguments ?? {}) };
+        try {
+            const claims = this.authVerifier.verifyToken(request.session_token ?? '');
+            const supplied = extractActorClaimsFromArgs(args);
+            if ((supplied.actor_type && supplied.actor_type !== claims.actor_type) || (supplied.actor_id && supplied.actor_id !== claims.actor_id)) {
+                return fail(ERROR_CODES.INVALID_ACTOR_CLAIM, 'actor claim does not match signed token', {
+                    retryable: false,
+                    requires_human: true,
+                    supplied,
+                    token_claims: {
+                        actor_type: claims.actor_type,
+                        actor_id: claims.actor_id
+                    }
+                });
+            }
+            delete args.actor_type;
+            delete args.actor_id;
+            return this.runtime.callTool(request.name, args, claims);
+        }
+        catch (error) {
+            if (typeof error === 'object' &&
+                error !== null &&
+                'normalizedResponse' in error) {
+                return error.normalizedResponse;
+            }
+            const message = typeof error === 'object' && error !== null && 'message' in error
+                ? error.message
+                : undefined;
+            return fail(ERROR_CODES.UNAUTHENTICATED, String(message ?? error), {
+                retryable: false,
+                requires_human: true
+            });
+        }
+    }
+}
+//# sourceMappingURL=mcp-server-adapter.js.map

package/dist/apps/control-plane/mcp/mcp-server-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-server-adapter.js","sourceRoot":"","sources":["../../../../apps/control-plane/src/mcp/mcp-server-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAY3C,SAAS,0BAA0B,CAAC,IAA6B;IAC/D,MAAM,UAAU,GAAG,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IACrF,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/E,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AAClC,CAAC;AAED,MAAM,OAAO,gBAAgB;IAClB,YAAY,CAAoB;IAChC,OAAO,CAAc;IAE9B,YAAY,OAAoB,EAAE,YAA+B;QAC/D,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,SAAS;QACb,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QAC7C,OAAO,EAAE,KAAK,EAAE,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAAuB;QACrC,MAAM,IAAI,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;QAE9C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;YAC1E,MAAM,QAAQ,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC;YAClD,IAAI,CAAC,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvI,OAAO,IAAI,CAAC,WAAW,CAAC,mBAAmB,EAAE,yCAAyC,EAAE;oBACtF,SAAS,EAAE,KAAK;oBAChB,cAAc,EAAE,IAAI;oBACpB,QAAQ;oBACR,YAAY,EAAE;wBACZ,UAAU,EAAE,MAAM,CAAC,UAAU;wBAC7B,QAAQ,EAAE,MAAM,CAAC,QAAQ;qBAC1B;iBACF,CAAC,CAAC;YACL,CAAC;YAED,OAAO,IAAI,CAAC,UAAU,CAAC;YACvB,OAAO,IAAI,CAAC,QAAQ,CAAC;YAErB,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,IACE,OAAO,KAAK,KAAK,QAAQ;gBACzB,KAAK,KAAK,IAAI;gBACd,oBAAoB,IAAI,KAAK,EAC7B,CAAC;gBACD,OAAQ,KAA8C,CAAC,kBAAkB,CAAC;YAC5E,CAAC;YACD,MAAM,OAAO,GACX,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,SAAS,IAAI,KAAK;gBAC/D,CAAC,CAAE,KAA+B,CAAC,OAAO;gBAC1C,CAAC,CAAC,SAAS,CAAC;YAChB,OAAO,IAAI,CAAC,WAAW,CAAC,eAAe,EAAE,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC,EAAE;gBACjE,SAAS,EAAE,KAAK;gBAChB,cAAc,EAAE,IAAI;aACrB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF"}

package/dist/apps/control-plane/mcp/operation-ledger.d.ts

@@ -0,0 +1,21 @@
+import { AopPathLayout } from '../core/path-layout.js';
+import type { ToolResponse } from '../core/response.js';
+export declare class OperationLedger {
+    readonly repoRoot: string;
+    readonly pathLayout: AopPathLayout;
+    constructor(repoRoot: string);
+    get ledgerRoot(): string;
+    ledgerPath(runId: string): string;
+    lockPath(runId: string): string;
+    ensureRunLedger(runId: string): Promise<void>;
+    resolveOperation(runId: string, operationId: string, requestHash: string): Promise<{
+        status: 'new';
+    } | {
+        status: 'replay';
+        response: ToolResponse;
+    } | {
+        status: 'mismatch';
+        existing_hash: string;
+    }>;
+    recordOperation(runId: string, operationId: string, toolName: string, requestHash: string, response: ToolResponse): Promise<void>;
+}

package/dist/apps/control-plane/mcp/operation-ledger.js

@@ -0,0 +1,75 @@
+import path from 'node:path';
+import { atomicWriteJson, ensureDir, readJson, withFileLock, nowIso } from '../core/fs.js';
+import { AopPathLayout } from '../core/path-layout.js';
+export class OperationLedger {
+    repoRoot;
+    pathLayout;
+    constructor(repoRoot) {
+        this.repoRoot = repoRoot;
+        this.pathLayout = new AopPathLayout(repoRoot);
+    }
+    get ledgerRoot() {
+        return this.pathLayout.operationLedgerRoot;
+    }
+    ledgerPath(runId) {
+        return path.join(this.ledgerRoot, `${runId}.json`);
+    }
+    lockPath(runId) {
+        return path.join(this.ledgerRoot, `${runId}.lock`);
+    }
+    async ensureRunLedger(runId) {
+        await ensureDir(this.ledgerRoot);
+        const existing = await readJson(this.ledgerPath(runId), null);
+        if (!existing) {
+            await atomicWriteJson(this.ledgerPath(runId), {
+                run_id: runId,
+                updated_at: nowIso(),
+                operations: {}
+            });
+        }
+    }
+    async resolveOperation(runId, operationId, requestHash) {
+        await this.ensureRunLedger(runId);
+        return await withFileLock(this.lockPath(runId), async () => {
+            const ledger = await readJson(this.ledgerPath(runId), null);
+            const operations = ledger?.operations ?? {};
+            const existing = operations[operationId];
+            if (!existing) {
+                return { status: 'new' };
+            }
+            if (existing.request_hash !== requestHash) {
+                return {
+                    status: 'mismatch',
+                    existing_hash: existing.request_hash
+                };
+            }
+            return {
+                status: 'replay',
+                response: existing.response
+            };
+        });
+    }
+    async recordOperation(runId, operationId, toolName, requestHash, response) {
+        await this.ensureRunLedger(runId);
+        await withFileLock(this.lockPath(runId), async () => {
+            const ledger = (await readJson(this.ledgerPath(runId), null)) ?? {
+                run_id: runId,
+                updated_at: nowIso(),
+                operations: {}
+            };
+            const now = nowIso();
+            const existing = ledger.operations[operationId];
+            ledger.operations[operationId] = {
+                operation_id: operationId,
+                tool_name: toolName,
+                request_hash: requestHash,
+                response,
+                created_at: existing?.created_at ?? now,
+                updated_at: now
+            };
+            ledger.updated_at = now;
+            await atomicWriteJson(this.ledgerPath(runId), ledger);
+        });
+    }
+}
+//# sourceMappingURL=operation-ledger.js.map

package/dist/apps/control-plane/mcp/operation-ledger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"operation-ledger.js","sourceRoot":"","sources":["../../../../apps/control-plane/src/mcp/operation-ledger.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC3F,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAkBvD,MAAM,OAAO,eAAe;IACjB,QAAQ,CAAS;IACjB,UAAU,CAAgB;IAEnC,YAAY,QAAgB;QAC1B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,UAAU,GAAG,IAAI,aAAa,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC;IAC7C,CAAC;IAED,UAAU,CAAC,KAAa;QACtB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,KAAK,OAAO,CAAC,CAAC;IACrD,CAAC;IAED,QAAQ,CAAC,KAAa;QACpB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,KAAK,OAAO,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAAa;QACjC,MAAM,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAa,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;QAC1E,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE;gBAC5C,MAAM,EAAE,KAAK;gBACb,UAAU,EAAE,MAAM,EAAE;gBACpB,UAAU,EAAE,EAAE;aACD,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,gBAAgB,CACpB,KAAa,EACb,WAAmB,EACnB,WAAmB;QAEnB,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAElC,OAAO,MAAM,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,IAAI,EAAE;YACzD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAa,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;YACxE,MAAM,UAAU,GAAG,MAAM,EAAE,UAAU,IAAI,EAAE,CAAC;YAC5C,MAAM,QAAQ,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;YACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,IAAI,QAAQ,CAAC,YAAY,KAAK,WAAW,EAAE,CAAC;gBAC1C,OAAO;oBACL,MAAM,EAAE,UAAU;oBAClB,aAAa,EAAE,QAAQ,CAAC,YAAY;iBACrC,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;aAC5B,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAAa,EAAE,WAAmB,EAAE,QAAgB,EAAE,WAAmB,EAAE,QAAsB;QACrH,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAElC,MAAM,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,IAAI,EAAE;YAClD,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAa,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI;gBAC3E,MAAM,EAAE,KAAK;gBACb,UAAU,EAAE,MAAM,EAAE;gBACpB,UAAU,EAAE,EAAE;aACf,CAAC;YAEF,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;YACrB,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YAChD,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,GAAG;gBAC/B,YAAY,EAAE,WAAW;gBACzB,SAAS,EAAE,QAAQ;gBACnB,YAAY,EAAE,WAAW;gBACzB,QAAQ;gBACR,UAAU,EAAE,QAAQ,EAAE,UAAU,IAAI,GAAG;gBACvC,UAAU,EAAE,GAAG;aAChB,CAAC;YACF,MAAM,CAAC,UAAU,GAAG,GAAG,CAAC;YAExB,MAAM,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/apps/control-plane/mcp/protocol-contract.d.ts

@@ -0,0 +1,8 @@
+export declare const MCP_PROTOCOL_PIN: {
+    readonly mcp_protocol_version: "2025-11-05";
+    readonly sdk: {
+        readonly package: "@modelcontextprotocol/sdk";
+        readonly version: "1.18.0";
+    };
+};
+export declare const REQUIRED_MCP_TRANSPORTS: readonly ["stdio"];

package/dist/apps/control-plane/mcp/protocol-contract.js

@@ -0,0 +1,9 @@
+export const MCP_PROTOCOL_PIN = {
+    mcp_protocol_version: '2025-11-05',
+    sdk: {
+        package: '@modelcontextprotocol/sdk',
+        version: '1.18.0'
+    }
+};
+export const REQUIRED_MCP_TRANSPORTS = ['stdio'];
+//# sourceMappingURL=protocol-contract.js.map

package/dist/apps/control-plane/mcp/protocol-contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol-contract.js","sourceRoot":"","sources":["../../../../apps/control-plane/src/mcp/protocol-contract.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,oBAAoB,EAAE,YAAY;IAClC,GAAG,EAAE;QACH,OAAO,EAAE,2BAA2B;QACpC,OAAO,EAAE,QAAQ;KAClB;CACO,CAAC;AAEX,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,OAAO,CAAU,CAAC"}

package/dist/apps/control-plane/mcp/runtime-factory.d.ts

@@ -0,0 +1,38 @@
+import { OperationLedger } from './operation-ledger.js';
+import { KernelToolExecutor, type ToolExecutionRouterPort } from './kernel-tool-executor.js';
+import { McpServerAdapter } from './mcp-server-adapter.js';
+import { TokenAuthVerifier } from './token-auth-verifier.js';
+import { ToolAuthorizer } from './tool-authorizer.js';
+import { ToolContractValidator } from './tool-contract-validator.js';
+import { InProcessToolClient, McpToolClient, type ToolClient } from './tool-client.js';
+import { ToolRegistryLoader } from './tool-registry-loader.js';
+import { ToolRuntime } from './tool-runtime.js';
+export interface ToolingKernelPort extends ToolExecutionRouterPort {
+    getRbacPolicy(): Record<string, string[]>;
+}
+export interface CreateToolingRuntimeOptions {
+    generateToolsMarkdown?: boolean;
+}
+export interface ToolingRuntime {
+    loader: ToolRegistryLoader;
+    registry: Awaited<ReturnType<ToolRegistryLoader['load']>>;
+    validator: ToolContractValidator;
+    authorizer: ToolAuthorizer;
+    ledger: OperationLedger;
+    executor: KernelToolExecutor;
+    runtime: ToolRuntime;
+    authVerifier: TokenAuthVerifier;
+    mcpAdapter: McpServerAdapter;
+    inProcessClient: InProcessToolClient;
+    mcpClient: McpToolClient;
+}
+export declare class ToolingRuntimeComposer {
+    private readonly repoRoot;
+    private readonly kernel;
+    private readonly options;
+    constructor(repoRoot: string, kernel: ToolingKernelPort, options?: CreateToolingRuntimeOptions);
+    compose(): Promise<ToolingRuntime>;
+    private generateToolsMarkdownIfEnabled;
+}
+export declare function createToolingRuntime(repoRoot: string, kernel: ToolingKernelPort, options?: CreateToolingRuntimeOptions): Promise<ToolingRuntime>;
+export declare function resolveToolClient(transport: 'inprocess' | 'mcp', tooling: ToolingRuntime): ToolClient;