ai-capability-framework 1.0.0-rc.3 → 1.0.0

package/docs/runtime.md

@@ -1,8 +1,8 @@
 # Runtime Contracts
 
 AICF Runtime is an additive TypeScript subpath for host applications that want
-deterministic runtime context, capability routing, policy brokering, handler
-execution, action lifecycle control, and model-safe tool result envelopes.
+deterministic runtime context, capability routing, policy brokering, handler execution,
+action lifecycle control, and model-safe tool result envelopes.
 
 Import runtime APIs from:
 
@@ -14,22 +14,20 @@ import {
 } from "ai-capability-framework/runtime";
 ```
 
-The runtime subpath does not call models, depend on provider SDKs, or expose
-commit through model tool execution. It can execute host-provided read and
-prepare handlers, and it can commit only through the lifecycle manager after a
-stored prepared action, approval, and idempotency checks. Host applications still
-own real auth, payment/account state, durable storage, approval workflows, audit
-retention, and provider calls.
+The runtime subpath does not call models, depend on provider SDKs, or expose commit
+through model tool execution. It can execute host-provided read and prepare handlers,
+and it can commit only through the lifecycle manager after a stored prepared action,
+approval, and idempotency checks. Host applications still own real auth, payment/account
+state, durable storage, approval workflows, audit retention, and provider calls.
 
-Optional runtime controls live in `ai-capability-framework/controls`. A host can
-pass a controls evaluator into routing, execution, lifecycle, or provider
-runtime calls to apply kill switches, read-only mode, force approval, circuit
-breakers, and per-run budgets. The reference stores are in-memory/local only.
+Optional runtime controls live in `ai-capability-framework/controls`. A host can pass a
+controls evaluator into routing, execution, lifecycle, or provider runtime calls to
+apply kill switches, read-only mode, force approval, circuit breakers, and per-run
+budgets. The reference stores are in-memory/local only.
 
-The optional OpenAI Responses runtime lives in
-`ai-capability-framework/openai`, not this runtime subpath. It uses these
-runtime contracts to run a bounded non-streaming model/tool loop with
-caller-provided OpenAI-compatible clients.
+The optional OpenAI Responses runtime lives in `ai-capability-framework/openai`, not
+this runtime subpath. It uses these runtime contracts to run a bounded non-streaming
+model/tool loop with caller-provided OpenAI-compatible clients.
 
 For a concrete support/refund flow that shows routing, tool export, validation,
 approval-required prepare, and host-controlled commit, read the
@@ -37,13 +35,13 @@ approval-required prepare, and host-controlled commit, read the
 
 ## Runtime Context
 
-Runtime decisions use an `AicfRuntimeContext` with run and request IDs,
-environment, subject identity, account and tenant identity, workflow hints,
-autonomy and risk limits, host facts, and metadata.
+Runtime decisions use an `AicfRuntimeContext` with run and request IDs, environment,
+subject identity, account and tenant identity, workflow hints, autonomy and risk limits,
+host facts, and metadata.
 
-Production contexts must include user, account, tenant, run, and request
-identifiers. Missing required identity or request fields fail safely before
-policy or routing decisions continue.
+Production contexts must include user, account, tenant, run, and request identifiers.
+Missing required identity or request fields fail safely before policy or routing
+decisions continue.
 
 Use `AicfAuthPlatformAdapter` to connect AICF to a host auth/account platform.
 `StaticAuthPlatformAdapter` is provided only for tests and examples.
@@ -54,109 +52,108 @@ Use `AicfAuthPlatformAdapter` to connect AICF to a host auth/account platform.
 context items into deterministic `modelContextText`.
 
 The builder labels user text as untrusted, includes approved application context
-separately, applies `DefaultRedactionPolicy` before formatting, enforces max item
-and character budgets, and rejects raw attachment contents.
+separately, applies `DefaultRedactionPolicy` before formatting, enforces max item and
+character budgets, and rejects raw attachment contents.
 
-Default redaction removes values under obviously sensitive keys such as
-passwords, tokens, secrets, API keys, cookies, sessions, card numbers, CVV
-values, and private keys. It intentionally does not claim broad PII detection.
+Default redaction removes values under obviously sensitive keys such as passwords,
+tokens, secrets, API keys, cookies, sessions, card numbers, CVV values, and private
+keys. It intentionally does not claim broad PII detection.
 
 For provider-boundary and trace-boundary trust labels, taint metadata, data
 classifications, and retention checks, use the optional
-`ai-capability-framework/security` subpath. Runtime context items can be mapped
-to security context segments without changing existing runtime behavior.
+`ai-capability-framework/security` subpath. Runtime context items can be mapped to
+security context segments without changing existing runtime behavior.
 
-For host-owned memory or user preferences, use
-`ai-capability-framework/memory` before adding memory summaries to host context.
-It filters by use case, scope, consent, expiry, and sensitivity, then converts
-allowed records to runtime context items. It does not retrieve or store memory.
+For host-owned memory or user preferences, use `ai-capability-framework/memory` before
+adding memory summaries to host context. It filters by use case, scope, consent, expiry,
+and sensitivity, then converts allowed records to runtime context items. It does not
+retrieve or store memory.
 
 ## Capability Router
 
-`DefaultCapabilityRouter` builds a compact runtime capability slice without
-calling a model or embedding service.
+`DefaultCapabilityRouter` builds a compact runtime capability slice without calling a
+model or embedding service.
 
-It filters deterministically by capability status, risk ceiling, permissions,
-required user/tenant context, explicit include/exclude lists, domain, capability
-type, and restricted side effects. Commit, external-send, money-moving,
-permission-changing, destructive, and workflow-triggering capabilities are not
-exposed by default.
+It filters deterministically by capability status, risk ceiling, permissions, required
+user/tenant context, explicit include/exclude lists, domain, capability type, and
+restricted side effects. Commit, external-send, money-moving, permission-changing,
+destructive, and workflow-triggering capabilities are not exposed by default.
 
-The router scores remaining capabilities with lexical matching over public
-capability metadata and workflow hints, then sorts by score, risk, and
-capability ID. Model-facing slices expose only `select` and `prepare`
-operations.
+The router scores remaining capabilities with lexical matching over public capability
+metadata and workflow hints, then sorts by score, risk, and capability ID. Model-facing
+slices expose only `select` and `prepare` operations.
 
-When controls are supplied, routing excludes denied capabilities and capabilities
-that are incompatible with active read-only controls.
+When controls are supplied, routing excludes denied capabilities and capabilities that
+are incompatible with active read-only controls.
 
-Use `formatCapabilitySliceForModel()` to render concise model-facing capability
-guidance without private diagnostics, internal policy rules, or full output
-schemas.
+Use `formatCapabilitySliceForModel()` to render concise model-facing capability guidance
+without private diagnostics, internal policy rules, or full output schemas.
 
 ## Policy Broker
 
-`DefaultPolicyBroker` wraps the Core `decideCapability()` control plane and adds
-runtime context checks. It fails closed for missing identity, missing
-permissions, risk/autonomy violations, rejected or expired approvals, missing
-idempotency, and thrown host policy hooks.
+`DefaultPolicyBroker` wraps the Core `decideCapability()` control plane and adds runtime
+context checks. It fails closed for missing identity, missing permissions, risk/autonomy
+violations, rejected or expired approvals, missing idempotency, and thrown host policy
+hooks.
 
-Host policy hooks may make a decision stricter by denying or requiring approval.
-They cannot override an AICF denial into an allowed decision.
+Host policy hooks may make a decision stricter by denying or requiring approval. They
+cannot override an AICF denial into an allowed decision.
 
 ## Handler Registry And Executor
 
-`AicfHandlerRegistry` stores host-provided capability handlers. Duplicate
-handler IDs fail during registration, and optional manifest-registry validation
-rejects handlers for unknown capabilities.
+`AicfHandlerRegistry` stores host-provided capability handlers. Duplicate handler IDs
+fail during registration, and optional manifest-registry validation rejects handlers for
+unknown capabilities.
 
 `AicfToolExecutor` executes `read` and `prepare` requests only. It validates the
-capability, lifecycle, input schema, policy, and handler presence before calling
-a handler. Handler output is validated against the capability `output_schema`.
-Missing handlers return safe unavailable envelopes by default.
+capability, lifecycle, input schema, policy, and handler presence before calling a
+handler. Handler output is validated against the capability `output_schema`. Missing
+handlers return safe unavailable envelopes by default.
 
-The executor rejects `commit` even if a malformed request attempts to pass it.
-Commit is host-controlled through `AicfActionLifecycleManager`.
+The executor rejects `commit` even if a malformed request attempts to pass it. Commit is
+host-controlled through `AicfActionLifecycleManager`.
 
 ## Action Lifecycle And Stores
 
-`AicfActionLifecycleManager` prepares actions, records approvals, and commits
-stored prepared actions. Commit uses stored prepared-action state plus an
-approval decision and idempotency key; it does not use model-provided raw args.
+`AicfActionLifecycleManager` prepares actions, records approvals, and commits stored
+prepared actions. Commit uses stored prepared-action state plus an approval decision and
+idempotency key; it does not use model-provided raw args. Optional verification checks
+committed actions through a registered verify handler. Verification records
+`verificationStatus` separately, so a failed verification does not rewrite a completed
+side effect from `committed` to `failed`.
 
-The package includes in-memory prepared-action, approval, idempotency, and audit
-stores for tests, local demos, and reference implementations. They are not
-production-durable stores.
+The package includes in-memory prepared-action, approval, idempotency, and audit stores
+for tests, local demos, and reference implementations. They are not production-durable
+stores.
 
-Optional AWS reference stores are available from
-`ai-capability-framework/aws` for host applications that want DynamoDB-backed
-prepared actions, approvals, idempotency reservations, and audit summaries.
-They are adapters around the same runtime interfaces; they do not provision AWS
-resources, own auth, or make AWS part of the runtime subpath import.
+Optional AWS reference stores are available from `ai-capability-framework/aws` for host
+applications that want DynamoDB-backed prepared actions, approvals, idempotency
+reservations, and audit summaries. They are adapters around the same runtime interfaces;
+they do not provision AWS resources, own auth, or make AWS part of the runtime subpath
+import.
 
-Audit events are structured summaries for attempts, denials, approval-required
-pauses, successes, and failures. They must not contain raw traces, provider
-payloads, secrets, or customer data.
+Audit events are structured summaries for attempts, denials, approval-required pauses,
+successes, and failures. They must not contain raw traces, provider payloads, secrets,
+or customer data.
 
-For canonical evidence records, pass an optional
-`ai-capability-framework/audit` ledger to `AicfToolExecutor` and
-`AicfActionLifecycleManager`. The ledger writes schema-valid policy decision,
-action, approval, and idempotency records with redacted refs and hashed inputs.
-Without a configured ledger, runtime behavior is unchanged.
+For canonical evidence records, pass an optional `ai-capability-framework/audit` ledger
+to `AicfToolExecutor` and `AicfActionLifecycleManager`. The ledger writes schema-valid
+policy decision, action, approval, and idempotency records with redacted refs and hashed
+inputs. Without a configured ledger, runtime behavior is unchanged.
 
 See [action lifecycle](action-lifecycle.md) for the prepare, approval, commit,
-idempotency, and audit flow. See [policy broker](policy-broker.md) for runtime
-policy evaluation and host hook behavior.
+idempotency, and audit flow. See [policy broker](policy-broker.md) for runtime policy
+evaluation and host hook behavior.
 
 ## Runtime Envelopes
 
-Runtime tool results use `createToolEnvelope()`,
-`toModelSafeToolEnvelope()`, and `serializeToolEnvelopeForModel()`.
+Runtime tool results use `createToolEnvelope()`, `toModelSafeToolEnvelope()`, and
+`serializeToolEnvelopeForModel()`.
 
-Runtime envelopes include run and request IDs, capability ID/version, operation,
-status, optional policy/action summaries, safe user messages, and optional
-diagnostics. Diagnostics are stripped from model-facing output by default and
-are never included for production model output through the default helper.
+Runtime envelopes include run and request IDs, capability ID/version, operation, status,
+optional policy/action summaries, safe user messages, and optional diagnostics.
+Diagnostics are stripped from model-facing output by default and are never included for
+production model output through the default helper.
 
 ## Public Example
 
@@ -167,6 +164,6 @@ npm run build
 node examples/runtime-support-billing/run-mock.mjs
 ```
 
-It loads the support manifests, routes read and prepare capabilities, executes a
-ticket read, prepares a refund case that requires approval, records a host
-approval, and commits only through `AicfActionLifecycleManager`.
+It loads the support manifests, routes read and prepare capabilities, executes a ticket
+read, prepares a refund case that requires approval, records a host approval, and
+commits only through `AicfActionLifecycleManager`.

package/docs/security/overview.md

@@ -1,7 +1,7 @@
 # Security Overview
 
-AICF security features help keep model-accessible capabilities constrained,
-validated, and reviewable.
+AICF security features help keep model-accessible capabilities constrained, validated,
+and reviewable.
 
 Key guides:
 
@@ -10,5 +10,5 @@ Key guides:
 - [Governed memory](../memory.md)
 - [Content provenance hooks](../provenance.md)
 
-AICF does not replace host DLP, auth, privacy review, incident response, or
-security operations.
+AICF does not replace host DLP, auth, privacy review, incident response, or security
+operations.

package/docs/security/security-packs.md

@@ -1,13 +1,13 @@
 # Capability-Aware Security Packs
 
-Security packs are public-safe test templates for common AI capability risks.
-They help teams generate deterministic eval cases and Promptfoo red-team
-configs from the capabilities already described in AICF manifests.
+Security packs are public-safe test templates for common AI capability risks. They help
+teams generate deterministic eval cases and Promptfoo red-team configs from the
+capabilities already described in AICF manifests.
 
-Security packs are implementation aids only. They are not certification,
-compliance attestation, legal advice, an audit opinion, or a security guarantee.
-Host applications own real red-team execution, evidence retention, policy
-review, incident response, and production controls.
+Security packs are implementation aids only. They are not certification, compliance
+attestation, legal advice, an audit opinion, or a security guarantee. Host applications
+own real red-team execution, evidence retention, policy review, incident response, and
+production controls.
 
 ## What They Cover
 
@@ -29,8 +29,8 @@ The built-in catalog includes packs for:
 - retrieval poisoning
 - memory scope violation
 
-The catalog lives in public YAML files under `security-packs/`. The TypeScript
-API exposes the same catalog from:
+The catalog lives in public YAML files under `security-packs/`. The TypeScript API
+exposes the same catalog from:
 
 ```ts
 import {
@@ -71,15 +71,14 @@ Waivers must include `pack_id`, `reason`, `reviewer`, and `reviewed_at`.
 
 `assessSecurityPackCoverage()` recommends packs from manifest metadata:
 
-- high and critical risk capabilities require assigned/generated packs or a
-  waiver;
-- money movement, commit, irreversible, external-message, workflow,
-  permission-changing, tenant-scoped, retrieval, memory, MCP, and
-  provider-exposed capabilities receive additional recommendations;
+- high and critical risk capabilities require assigned/generated packs or a waiver;
+- money movement, commit, irreversible, external-message, workflow, permission-changing,
+  tenant-scoped, retrieval, memory, MCP, and provider-exposed capabilities receive
+  additional recommendations;
 - missing required packs are reported as coverage failures.
 
-The coverage report is deterministic and local. It does not inspect raw traces,
-call providers, or infer production security posture.
+The coverage report is deterministic and local. It does not inspect raw traces, call
+providers, or infer production security posture.
 
 ## Generate Cases
 
@@ -91,9 +90,9 @@ aicf security generate examples \
   --out ./security-cases.approval-bypass.yaml
 ```
 
-The output is a synthetic case suite. Case text uses public capability IDs and
-generic prompts only; it does not include raw prompts, provider payloads,
-credentials, customer records, or private diagnostics.
+The output is a synthetic case suite. Case text uses public capability IDs and generic
+prompts only; it does not include raw prompts, provider payloads, credentials, customer
+records, or private diagnostics.
 
 TypeScript:
 
@@ -103,8 +102,8 @@ const suite = generateSecurityCases(registry, {
 });
 ```
 
-Generated cases can be reviewed and converted into ordinary AICF eval manifests
-or used as host-owned test inputs.
+Generated cases can be reviewed and converted into ordinary AICF eval manifests or used
+as host-owned test inputs.
 
 ## Promptfoo Export
 
@@ -117,8 +116,8 @@ aicf security export-promptfoo examples \
 ```
 
 The generated YAML defaults to the API-key-free `echo` provider and includes a
-placeholder target endpoint. Replace the provider and target in a host-owned
-test environment before running Promptfoo.
+placeholder target endpoint. Replace the provider and target in a host-owned test
+environment before running Promptfoo.
 
 The export includes assertions for:
 
@@ -140,6 +139,5 @@ aicf security generate examples --pack approval_bypass --out ./cases.json --form
 aicf security export-promptfoo examples --out ./promptfooconfig.aicf-security.yaml
 ```
 
-Commands validate manifests first. Unknown pack IDs, invalid manifests, missing
-output paths, and empty generated suites exit nonzero.
-
+Commands validate manifests first. Unknown pack IDs, invalid manifests, missing output
+paths, and empty generated suites exit nonzero.

package/docs/security/trust-taint-redaction.md

@@ -11,52 +11,48 @@ import {
 } from "ai-capability-framework/security";
 ```
 
-It does not replace host DLP, privacy review, auth, policy engines,
-observability systems, or data retention infrastructure. It gives AICF users a
-small public contract for labelling context, keeping untrusted data separate
-from instructions, redacting sensitive classes, and evaluating conservative
-retention defaults.
+It does not replace host DLP, privacy review, auth, policy engines, observability
+systems, or data retention infrastructure. It gives AICF users a small public contract
+for labelling context, keeping untrusted data separate from instructions, redacting
+sensitive classes, and evaluating conservative retention defaults.
 
 ## Trust Segments
 
-`ContextSegment` records what a piece of context is, where it came from, and
-whether it is allowed to carry instructions.
+`ContextSegment` records what a piece of context is, where it came from, and whether it
+is allowed to carry instructions.
 
-Only `system_instruction`, `developer_instruction`, and `app_policy` segments
-may set `instructionsAllowed: true`. User input, uploaded files, retrieved
-documents, tool results, external API results, and model output are data
-segments. They can inform the model or host application, but they are not
-trusted instructions.
+Only `system_instruction`, `developer_instruction`, and `app_policy` segments may set
+`instructionsAllowed: true`. User input, uploaded files, retrieved documents, tool
+results, external API results, and model output are data segments. They can inform the
+model or host application, but they are not trusted instructions.
 
 ## Taint And Provenance
 
-`SourceRef` records public-safe provenance such as source ID, source type,
-trust label, optional URI, content hash, freshness, and retrieval time.
+`SourceRef` records public-safe provenance such as source ID, source type, trust label,
+optional URI, content hash, freshness, and retrieval time.
 
-Generated customer-facing content can use
-`ai-capability-framework/provenance` to create sidecar metadata that references
-these `SourceRef` values. The provenance subpath keeps raw prompts, provider
-payloads, transcripts, secrets, and sensitive source content out of generated
-content metadata.
+Generated customer-facing content can use `ai-capability-framework/provenance` to create
+sidecar metadata that references these `SourceRef` values. The provenance subpath keeps
+raw prompts, provider payloads, transcripts, secrets, and sensitive source content out
+of generated content metadata.
 
-`markTainted()` records that content is not trusted for tool input until the
-host validates it. This is especially important for model output and tool
-results that might contain hostile text such as instructions to ignore policy.
+`markTainted()` records that content is not trusted for tool input until the host
+validates it. This is especially important for model output and tool results that might
+contain hostile text such as instructions to ignore policy.
 
 ## Redaction
 
-`redactForProvider()` applies policy before content crosses a provider
-boundary. `redactForTrace()` applies policy before content enters traces or
-observability sinks.
+`redactForProvider()` applies policy before content crosses a provider boundary.
+`redactForTrace()` applies policy before content enters traces or observability sinks.
 
 Default behavior is conservative:
 
 - `credential_material` is denied.
-- PII, payment, financial, health, legal, and security-sensitive content is
-  redacted from traces.
+- PII, payment, financial, health, legal, and security-sensitive content is redacted
+  from traces.
 - raw prompts, raw provider payloads, and raw traces are denied by default.
-- provider-boundary rules can be scoped by provider ID, capability ID,
-  operation, trust label, data classification, and path.
+- provider-boundary rules can be scoped by provider ID, capability ID, operation, trust
+  label, data classification, and path.
 
 ## Retention
 
@@ -69,32 +65,31 @@ Default behavior is conservative:
 - eval dataset retention: `365` days
 - raw content in eval datasets: `false`
 
-`evaluateRetentionPolicy()` returns allow/deny reasons and warnings. Unsafe
-diagnostic raw-content modes must be explicit and should stay out of public
-examples and release artifacts.
+`evaluateRetentionPolicy()` returns allow/deny reasons and warnings. Unsafe diagnostic
+raw-content modes must be explicit and should stay out of public examples and release
+artifacts.
 
 ## Runtime And Observability
 
-Runtime `AicfContextItem` values can be converted into security
-`ContextSegment` values with `contextItemToSegment()`.
+Runtime `AicfContextItem` values can be converted into security `ContextSegment` values
+with `contextItemToSegment()`.
 
 Host-owned memory and preferences can be governed through
-`ai-capability-framework/memory` before they become runtime context. Selected
-memory records convert into `ContextSegment` values with
-`instructionsAllowed: false`, so memory summaries cannot become hidden
-instructions.
+`ai-capability-framework/memory` before they become runtime context. Selected memory
+records convert into `ContextSegment` values with `instructionsAllowed: false`, so
+memory summaries cannot become hidden instructions.
 
-Observability trace sanitization continues to support `contentCapture` modes
-`none`, `metadata`, and `redacted_content`. When trace attributes include
-classification metadata, the security redaction defaults are applied before the
-event is collected or forwarded.
+Observability trace sanitization continues to support `contentCapture` modes `none`,
+`metadata`, and `redacted_content`. When trace attributes include classification
+metadata, the security redaction defaults are applied before the event is collected or
+forwarded.
 
 ## Security Packs
 
-Capability-aware security packs live in
-`ai-capability-framework/security-packs`. They generate public-safe test cases
-and Promptfoo red-team configs for risks such as prompt injection, approval
-bypass, unsafe commit attempts, provider payload exposure, and cross-tenant
-access. They do not replace host security review or runtime redaction policy.
+Capability-aware security packs live in `ai-capability-framework/security-packs`. They
+generate public-safe test cases and Promptfoo red-team configs for risks such as prompt
+injection, approval bypass, unsafe commit attempts, provider payload exposure, and
+cross-tenant access. They do not replace host security review or runtime redaction
+policy.
 
 See [Capability-aware security packs](security-packs.md).

package/docs/semantic-kernel-runtime.md

@@ -1,20 +1,19 @@
 # Semantic Kernel Compatibility
 
-AICF supports Semantic Kernel through compatibility exports, not through a
-native Semantic Kernel runtime package.
+AICF supports Semantic Kernel through compatibility exports, not through a native
+Semantic Kernel runtime package.
 
 The recommended path is MCP: expose a routed AICF capability slice through
-`ai-capability-framework/mcp-server`, then import that MCP server as a Semantic
-Kernel plugin when the host runtime supports MCP plugins.
+`ai-capability-framework/mcp-server`, then import that MCP server as a Semantic Kernel
+plugin when the host runtime supports MCP plugins.
 
-The fallback path is OpenAPI: generate an OpenAPI 3.1 descriptor for a
-host-owned HTTP executor route, then import that descriptor as a Semantic Kernel
-OpenAPI plugin.
+The fallback path is OpenAPI: generate an OpenAPI 3.1 descriptor for a host-owned HTTP
+executor route, then import that descriptor as a Semantic Kernel OpenAPI plugin.
 
 ## Import
 
-Install AICF in hosts that generate Semantic Kernel compatibility metadata. No
-Semantic Kernel npm dependency is required by AICF.
+Install AICF in hosts that generate Semantic Kernel compatibility metadata. No Semantic
+Kernel npm dependency is required by AICF.
 
 ```bash
 npm install ai-capability-framework
@@ -28,27 +27,27 @@ import {
 } from "ai-capability-framework/providers/semantic-kernel";
 ```
 
-This subpath has no Semantic Kernel dependency and performs no model calls,
-handler execution, storage, approval runtime, or side effects.
+This subpath has no Semantic Kernel dependency and performs no model calls, handler
+execution, storage, approval runtime, or side effects.
 
-Minimal usage is either: expose a routed AICF MCP server and import it as a
-Semantic Kernel MCP plugin, or generate OpenAPI metadata for a host-owned
-executor route and import that descriptor as an OpenAPI plugin.
+Minimal usage is either: expose a routed AICF MCP server and import it as a Semantic
+Kernel MCP plugin, or generate OpenAPI metadata for a host-owned executor route and
+import that descriptor as an OpenAPI plugin.
 
 ## MCP Path
 
-Use `AicfMcpServer` to list and call routed read/prepare capabilities through
-the AICF runtime. Semantic Kernel imports the host MCP server; AICF remains the
-policy, validation, lifecycle, approval, idempotency, and envelope authority.
+Use `AicfMcpServer` to list and call routed read/prepare capabilities through the AICF
+runtime. Semantic Kernel imports the host MCP server; AICF remains the policy,
+validation, lifecycle, approval, idempotency, and envelope authority.
 
-Do not expose commit capabilities through MCP. Commit remains host-controlled
-through `AicfActionLifecycleManager` after a stored prepared action, approval,
-and idempotency check.
+Do not expose commit capabilities through MCP. Commit remains host-controlled through
+`AicfActionLifecycleManager` after a stored prepared action, approval, and idempotency
+check.
 
 ## OpenAPI Export
 
-`exportSemanticKernelOpenApiPlugin()` returns a descriptor-only OpenAPI 3.1
-document. It creates one operation per exported read/prepare capability:
+`exportSemanticKernelOpenApiPlugin()` returns a descriptor-only OpenAPI 3.1 document. It
+creates one operation per exported read/prepare capability:
 
 ```text
 POST /aicf/capabilities/{providerToolName}/execute
@@ -57,33 +56,32 @@ POST /aicf/capabilities/{providerToolName}/execute
 Each request body contains:
 
 - `args`: the capability input object;
-- `runtime_context_ref`: an opaque host reference used to resolve authenticated
-  runtime context server-side.
+- `runtime_context_ref`: an opaque host reference used to resolve authenticated runtime
+  context server-side.
 
-The generated document intentionally does not expose auth, permission, tenant,
-account, approval, idempotency, or audit internals. The host executor route must
-resolve those values and enforce them before invoking AICF runtime objects.
+The generated document intentionally does not expose auth, permission, tenant, account,
+approval, idempotency, or audit internals. The host executor route must resolve those
+values and enforce them before invoking AICF runtime objects.
 
 ## Plugin Metadata
 
-`exportSemanticKernelPluginMetadata()` returns a small metadata object with the
-plugin name, function summaries, MCP recommendation, OpenAPI import hints, and
-warnings for automatic invocation.
+`exportSemanticKernelPluginMetadata()` returns a small metadata object with the plugin
+name, function summaries, MCP recommendation, OpenAPI import hints, and warnings for
+automatic invocation.
 
 ## Boundary
 
-- AICF does not import `semantic-kernel` or an unofficial TypeScript Semantic
-  Kernel runtime.
+- AICF does not import `semantic-kernel` or an unofficial TypeScript Semantic Kernel
+  runtime.
 - AICF does not start an HTTP server for the generated OpenAPI descriptor.
 - AICF does not call models or provider SDKs in this subpath.
 - AICF does not expose commit capabilities to Semantic Kernel.
-- Host applications own auth, account and tenant authority, approvals,
-  idempotency, side effects, and audit persistence.
+- Host applications own auth, account and tenant authority, approvals, idempotency, side
+  effects, and audit persistence.
 - Treat approval-required envelopes as pauses, not completed actions.
 
-Known limitations: no native Semantic Kernel runtime, no hosted HTTP executor,
-no model calls, no production auth, no approval UI, and no model-exposed commit
-path.
+Known limitations: no native Semantic Kernel runtime, no hosted HTTP executor, no model
+calls, no production auth, no approval UI, and no model-exposed commit path.
 
 ## Checks