argus-decision-mcp 1.0.0

package/dist/lib/safe-path.js

@@ -0,0 +1,70 @@
+import path from 'path';
+import fs from 'fs';
+/**
+ * Single source of truth for path safety (blueprint §3.4 / addendum M5).
+ *
+ * Every path segment that originates from a tool argument, a ledger id, a
+ * receipt label, or a directory name read off disk MUST pass through
+ * `safeSegment` before it is joined, and every resulting path MUST be checked
+ * with `assertInside`. No inline `..` guards anywhere else — that scatter is
+ * exactly what let the traversal bug survive.
+ */
+// A single path segment: letters, digits, dot, underscore, hyphen.
+// Rejects separators (/ \), '..', '.', percent-encoding, NUL, etc.
+const SEGMENT = /^[A-Za-z0-9._-]+$/;
+export function safeSegment(raw, kind = 'segment') {
+    if (typeof raw !== 'string' || raw.length === 0 || raw.length > 128) {
+        throw new PathSafetyError(`invalid_${kind}`, `${kind} must be a 1-128 char string`);
+    }
+    if (raw === '.' || raw === '..' || !SEGMENT.test(raw)) {
+        throw new PathSafetyError(`invalid_${kind}`, `${kind} must match [A-Za-z0-9._-] and not be '.'/'..'`);
+    }
+    // Defense in depth: reject any percent-encoded or NUL byte that slipped the regex.
+    if (raw.includes('\0') || /%2e/i.test(raw) || /%2f/i.test(raw) || /%5c/i.test(raw)) {
+        throw new PathSafetyError(`invalid_${kind}`, `${kind} contains an encoded separator`);
+    }
+    return raw;
+}
+/**
+ * Resolve `candidate` and assert it is `root` itself or strictly inside `root`.
+ * Uses realpath when the path exists so symlink/junction escapes (Windows) are
+ * caught, falling back to lexical resolution for not-yet-created paths.
+ */
+export function assertInside(root, candidate) {
+    const realRoot = realpathOrResolve(root);
+    const realCand = realpathOrResolve(candidate);
+    const rootWithSep = realRoot.endsWith(path.sep) ? realRoot : realRoot + path.sep;
+    if (realCand !== realRoot && !realCand.startsWith(rootWithSep)) {
+        throw new PathSafetyError('path_escape_blocked', `path escapes root: ${candidate}`);
+    }
+    return realCand;
+}
+function realpathOrResolve(p) {
+    // Resolve the deepest existing ancestor via realpath (so a symlinked/junction
+    // ancestor cannot be used to escape), then re-attach the not-yet-existing
+    // lexical tail.
+    let dir = path.resolve(p);
+    const tail = [];
+    for (let i = 0; i < 4096; i++) {
+        try {
+            const real = fs.realpathSync.native(dir);
+            return tail.length ? path.join(real, ...tail.reverse()) : real;
+        }
+        catch {
+            tail.push(path.basename(dir));
+            const parent = path.dirname(dir);
+            if (parent === dir)
+                break; // reached filesystem root
+            dir = parent;
+        }
+    }
+    return path.resolve(p);
+}
+export class PathSafetyError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = 'PathSafetyError';
+        this.code = code;
+    }
+}

package/dist/lib/spine.js

@@ -0,0 +1,79 @@
+/**
+ * Single source of truth for the Argus spine (blueprint §3.6 + addendum G/K).
+ *
+ * The spine is enforced by STRUCTURE, not prose: there is no verdict tool,
+ * settle hard-errors without a prior seal, malformed seals are refused. The
+ * little prose that remains (restraint framing, crux rules) lives ONLY here so
+ * the three surfaces (webapp / plugin / mcp) cannot drift. The MCP server
+ * `instructions` field and any prompt text are rendered from this object — they
+ * are never re-typed elsewhere.
+ */
+/**
+ * The closed set of follow-up actions a tool may suggest. There is, by
+ * construction, no 'verdict' / 'recommend' / 'decide' / 'advise' member — a
+ * verdict cannot be expressed as a next action because the type cannot name it.
+ * The drift-guard test asserts this list contains no judgment verb.
+ */
+export const NEXT_ACTIONS = [
+    'argus_open_decision',
+    'argus_seal',
+    'argus_settle',
+    'argus_check_in',
+    'argus_recall',
+    'argus_config',
+    'skip',
+    'leave_as_is',
+    'stop',
+];
+/** Verbs that must never appear in a tool name or a next-action (drift-guard). */
+export const FORBIDDEN_VERDICT_VERBS = [
+    'verdict',
+    'recommend',
+    'decide',
+    'advise',
+    'grade',
+    'score',
+    'judge',
+    'rank',
+];
+/**
+ * The schema keys that, if present on `argus_open_decision`'s output, would let
+ * a fork or a lean be expressed. The drift-guard test asserts their ABSENCE.
+ */
+export const FORBIDDEN_FORK_KEYS = ['options', 'poles', 'lean', 'tilt', 'recommendation'];
+/**
+ * Server `instructions` string returned at `initialize` (addendum G). This is
+ * the one spec-sanctioned, host-universal place for spine bias — loaded once on
+ * connect, before any tool call. It is RESTRAINT FRAMING, not a pasted
+ * system-prompt: it tells the model what Argus refuses, not how to think.
+ */
+export const SERVER_INSTRUCTIONS = [
+    'Argus records decisions; it does not judge them.',
+    '',
+    'When the user calls a tool, honor these invariants:',
+    '- Never deliver a verdict on the user\'s decision (no "you were right/wrong", no "the stronger case is X", no disclaimed lean). There is no verdict tool because there is no verdict to give.',
+    '- Surface at most ONE neutral crux question — phrased as a question, never a two-pole fork, never a recommendation. On a flat, low-stakes, reversible, or already-closed decision, prefer restraint ("leave it as is") over manufacturing a question.',
+    '- A prediction is the user\'s. Seal it with a falsifiable predicate and a check-by date; at that date, record what reality did. Never infer the outcome — ask, and record what the user says.',
+    '- Authorship is honest: a sentence the user wrote is theirs; a sentence Argus surfaced is tagged ai_surfaced. Never relabel an Argus-drafted line as the user\'s.',
+    '- A consequential decision rests on premises. Record them (argus_premises) before sealing; the user corrects what you drafted — their edit is part of the record. Re-check a load-bearing external fact against reality (argus_recheck, with provenance); when it changed, say so and return the handle — whether to revisit is the user\'s call. On trivial decisions, skip premises entirely.',
+    '- When opening a decision similar to past ones, pass their ids as related_to — history is frequency, never a verdict.',
+    '- When the user names which premise broke at settle time, pass broken_premise_ref — never infer it.',
+    '- At the start of a session, call argus_check_in once when an .argus ledger exists — it reports what is due and stops.',
+    '',
+    'Argus surfaces one question and names any faint lean as a known limit. It does not claim to be free of judgment — that is an asymptote, not a promise.',
+].join('\n');
+/** The schema version stamped on every persisted record (addendum N1). */
+export const SCHEMA_VERSION = 1;
+/**
+ * Invariants the drift-guard test pins. If any surface diverges, CI fails.
+ * (Mirrors the CLAUDE.md "single source of truth for prompts" rule.)
+ */
+export const SPINE_INVARIANTS = {
+    nextActions: NEXT_ACTIONS,
+    forbiddenVerdictVerbs: FORBIDDEN_VERDICT_VERBS,
+    forbiddenForkKeys: FORBIDDEN_FORK_KEYS,
+    serverInstructions: SERVER_INSTRUCTIONS,
+    schemaVersion: SCHEMA_VERSION,
+    /** Every settled receipt asserts this literal — reality settles, the model never grades. */
+    aiVerdict: null,
+};

package/dist/lib/state-machine.js

@@ -0,0 +1,80 @@
+import { asDate } from './resolve-today.js';
+export function deriveState(entry, today) {
+    if (!entry)
+        return 'absent';
+    switch (entry.status) {
+        case 'candidate': return 'opened';
+        case 'settled': return 'settled';
+        case 'dismissed': return 'dismissed';
+        case 'sealed': {
+            const d = asDate(entry.check_by);
+            return d && d <= today ? 'due' : 'sealed';
+        }
+        default: return 'absent';
+    }
+}
+/** Which events each state accepts. `harvest` from `absent` opens; re-harvest is an idempotent no-op handled by the caller. */
+const ALLOWED = {
+    // premise_* NEVER self-creates (unlike seal's B1) — a premise belongs to a
+    // decision's narrative, so absent refuses it (plan v5 §6.2).
+    absent: new Set(['harvest', 'seal', 'settle']), // seal/settle self-create (B1); settle then still needs a seal (see guard)
+    opened: new Set(['seal', 'amend', 'dismiss', 'premise_add', 'premise_amend', 'premise_recheck', 'premise_resolve']),
+    sealed: new Set(['amend', 'dismiss', 'settle', 'premise_add', 'premise_amend', 'premise_recheck', 'premise_resolve']),
+    // due: no premise_add (retroactive premise-planting rigs calibration) and no
+    // premise_amend (retiring the premise that's about to be proven wrong is the
+    // goalpost guard one level down) — recheck/resolve stay open (plan v5 §6.2).
+    due: new Set(['dismiss', 'settle', 'premise_recheck', 'premise_resolve']), // no amend once due — goalpost guard (m4)
+    settled: new Set([]), // terminal — no reopen (mirror clause)
+    dismissed: new Set([]), // terminal
+};
+export class GuardError extends Error {
+    code;
+    recovery;
+    constructor(code, message, recovery) {
+        super(message);
+        this.name = 'GuardError';
+        this.code = code;
+        this.recovery = recovery;
+    }
+}
+/**
+ * Throw if `event` is illegal from the decision's current derived state.
+ * Encodes the spine's structural refusals:
+ *  - settle without a prior seal  → NO_PRIOR_SEAL
+ *  - settle an already-settled    → ALREADY_SETTLED
+ *  - amend after check_by (due)    → GOALPOST_MOVED
+ *  - any event on a closed decision → DECISION_CLOSED
+ */
+export function guardTransition(current, event) {
+    // settle is special: it must have a real seal behind it, not a self-created shell.
+    if (event === 'settle') {
+        if (current === 'opened' || current === 'absent') {
+            throw new GuardError('NO_PRIOR_SEAL', 'Cannot settle a decision that was never sealed.', 'Call argus_seal with a falsifiable predicate and a check-by date first. ' +
+                "(If this id came from argus_sync and starts with 'mcp_', use the id without that prefix — see the receipt's local_id; a web-sealed prediction settles in the web app, not here.)");
+        }
+        if (current === 'settled') {
+            throw new GuardError('ALREADY_SETTLED', 'This decision is already settled (append-only — no re-judging).', 'Use argus_recall to read the receipt.');
+        }
+        if (current === 'dismissed') {
+            throw new GuardError('DECISION_CLOSED', 'This decision was dismissed.', 'Open a new decision if reality changed.');
+        }
+        return; // sealed | due → settle OK
+    }
+    if (event === 'amend' && current === 'due') {
+        throw new GuardError('GOALPOST_MOVED', 'Cannot move the check-by date once it has arrived.', 'Settle the decision against reality instead.');
+    }
+    // Premise writes lock once the check-by has arrived: adding a premise after
+    // the fact plants retroactive support, and editing/retiring one right before
+    // settlement is the goalpost guard one level down (plan v5 §6.2).
+    if ((event === 'premise_add' || event === 'premise_amend') && current === 'due') {
+        throw new GuardError('PREMISE_LOCKED', 'Premises are locked once the check-by date has arrived.', 'Settle the decision against reality first (argus_settle); the premise record stays as it was when you committed.');
+    }
+    if ((current === 'settled' || current === 'dismissed')) {
+        throw new GuardError('DECISION_CLOSED', `This decision is ${current}; it cannot accept a ${event}.`, 'Open a new decision instead — closed decisions are not reopened.');
+    }
+    if (!ALLOWED[current].has(event)) {
+        throw new GuardError('ILLEGAL_TRANSITION', `A '${event}' is not allowed from state '${current}'.`, event === 'seal' || event.startsWith('premise_')
+            ? 'Open the decision first with argus_open_decision.'
+            : undefined);
+    }
+}

package/dist/lib/surfaces.js

@@ -0,0 +1,106 @@
+import fs from 'fs';
+import { configPath } from './layout.js';
+export function surfaceLocale(argusDir) {
+    if (!argusDir)
+        return 'en';
+    try {
+        const cfg = fs.readFileSync(configPath(argusDir), 'utf8');
+        const m = cfg.match(/^locale:\s*(ko|en)\b/m);
+        if (m)
+            return m[1];
+    }
+    catch { /* no config yet → base voice */ }
+    return 'en';
+}
+export const SURFACES = {
+    en: {
+        checkin: {
+            nothing_due: 'Nothing is due. Nothing to nudge.',
+            account_hint: ' This reads the local ledger only — judgments sealed in your account: argus_sync shows them.',
+            upcoming: (n, days) => ` ${n} coming due within ${days} day(s) — informational, nothing to settle yet.`,
+            due_contracts: (n) => `${n} decision contract(s) past check-by — time to check them against reality (argus_settle).`,
+            anchor_mirror: (days, n, words) => `${days} day(s) since you sealed — ${n} contract(s) past check-by. Your words then: '${words}' All that's left is to record what reality did (argus_settle).`,
+            due_premises: (n) => `${n} premise fact(s) due for a reality re-check (argus_recheck).`,
+            dropped_lines: (n) => ` ${n} ledger line(s) could not be read (possibly a crash artifact). The record is append-only, so the rest is intact — keep a backup of ledger.jsonl.`,
+        },
+        sync: {
+            live_with_due: (total, due) => `${total} live judgment(s) in your account · ${due} past check-by. ` +
+                'Terminal-sealed ones settle here via argus_settle with local_id; web-sealed ones settle in the web dashboard.',
+            live_no_due: (total) => `${total} live judgment(s) in your account. Nothing past its check-by.`,
+            settled_on_web: (n) => ` ${n} already settled on the web — to keep them in this ledger too, record the same outcome with argus_settle.`,
+            truncation: (shown, matched) => `Showing ${shown} of ${matched}. Raise limit or narrow with due_only.`,
+        },
+        seal: {
+            header: 'ARGUS · SEALED',
+            owner_user: 'These words are yours.',
+            owner_ai: 'Argus drafted these words — you have not yet made them yours.',
+            sealed_label: 'Sealed',
+            answers_label: 'Reality answers',
+            days_out: (n) => `(${n} day${n === 1 ? '' : 's'} out)`,
+            closing: [
+                'This stays shut until then. What gets written next is not',
+                'a grade — it is what actually happened.',
+            ],
+            footer: 'argus · anchor down ⚓',
+        },
+        wake: {
+            header: 'ARGUS · WAKE',
+            counts: (total, sealed, settled) => `decisions ${total} · sealed ${sealed} · settled ${settled}`,
+            overdue_group: (n) => `past check-by (${n})`,
+            overdue_hint: '← argus_settle',
+            days_past: (n) => `${n}d past`,
+            waiting_group: (n) => `waiting on reality (${n})`,
+            answer_on: (date) => `due ${date}`,
+            settled_group: (n, held, avoided, partial) => `settled (${n}) — held ${held} · avoided ${avoided} · partial ${partial}`,
+            more: (n) => `… (+${n})`,
+            record_since: (date) => `on record since ${date}`,
+        },
+    },
+    ko: {
+        checkin: {
+            nothing_due: '확인할 차례가 된 것은 없습니다. 조를 것도 없습니다.',
+            account_hint: ' 이건 로컬 원장만 읽습니다 — 계정에 봉인한 판단은 argus_sync로 볼 수 있습니다.',
+            upcoming: (n, days) => ` ${days}일 안에 확인일이 오는 것 ${n}건 — 참고용이고, 아직 정산할 건 아닙니다.`,
+            due_contracts: (n) => `계약 ${n}건이 확인일을 지났습니다 — 현실과 대조할 차례입니다 (argus_settle).`,
+            anchor_mirror: (days, n, words) => `봉인 후 ${days}일 — 계약 ${n}건이 확인일을 지났습니다. 그때 당신은 이렇게 적었습니다: '${words}' 현실이 어떻게 답했는지만 기록하면 됩니다 (argus_settle).`,
+            due_premises: (n) => `전제 사실 ${n}건이 현실 재확인 차례입니다 (argus_recheck).`,
+            dropped_lines: (n) => ` 원장에서 읽지 못한 줄이 ${n}개 있습니다(크래시 흔적일 수 있음). 기록은 append-only라 나머지는 안전합니다 — ledger.jsonl을 백업해 두세요.`,
+        },
+        sync: {
+            live_with_due: (total, due) => `계정에 살아 있는 판단 ${total}개 · 확인할 차례 ${due}개. ` +
+                '이 터미널에서 봉인한 것은 local_id로 argus_settle, 웹에서 봉인한 것은 웹 대시보드에서 정산하세요.',
+            live_no_due: (total) => `계정에 살아 있는 판단 ${total}개. 확인할 차례가 된 것은 없습니다.`,
+            settled_on_web: (n) => ` 웹에서 이미 정산된 것 ${n}건 — 로컬 원장에도 남기려면 argus_settle로 같은 outcome을 기록하세요.`,
+            truncation: (shown, matched) => `${matched}개 중 ${shown}개만 표시. limit을 올리거나 due_only로 좁히세요.`,
+        },
+        seal: {
+            header: 'ARGUS · 봉인',
+            owner_user: '이 문장은 당신의 것입니다.',
+            owner_ai: 'Argus가 초안한 문장입니다 — 아직 당신이 확언하지 않았습니다.',
+            sealed_label: '봉인',
+            answers_label: '현실의 답',
+            days_out: (n) => `(${n}일 뒤)`,
+            closing: [
+                '그날까지 이 봉인은 닫혀 있습니다. 날짜가 오면 여기 기록될',
+                '것은 평가가 아니라 — 실제로 일어난 일입니다.',
+            ],
+            footer: 'argus · 닻 내림 ⚓',
+        },
+        wake: {
+            header: 'ARGUS · 항적',
+            counts: (total, sealed, settled) => `결정 ${total} · 봉인 중 ${sealed} · 정산 ${settled}`,
+            overdue_group: (n) => `확인일 지남 (${n})`,
+            overdue_hint: '← argus_settle',
+            days_past: (n) => `${n}일 경과`,
+            waiting_group: (n) => `현실을 기다리는 중 (${n})`,
+            answer_on: (date) => `답 ${date}`,
+            settled_group: (n, held, avoided, partial) => `정산됨 (${n}) — held ${held} · avoided ${avoided} · partial ${partial}`,
+            more: (n) => `… (+${n})`,
+            record_since: (date) => `기록 시작 ${date} 부터`,
+        },
+    },
+};
+/** Convenience: resolve the dictionary for a dir in one call. */
+export function surfacesFor(argusDir) {
+    return SURFACES[surfaceLocale(argusDir)];
+}

package/dist/lib/validate-crux.js

@@ -0,0 +1,35 @@
+// Directional / recommendation tells. NOTE: the old `i('| w)?d` alternation
+// also matched the bare word "id" ("user id" flagged a neutral question as
+// CRUX_CARRIES_LEAN — 11 P1-3); decomposed to the two real tells.
+const LEAN = /\b(you should|i'd|i would|the (stronger|better|safer|smarter) (case|choice|option|move|bet)|most (teams|people|founders)|the right (call|move|choice)|go with|lean(s)? toward|my (recommendation|advice|take)|honestly,? (i|you)|if i were you)\b/i;
+// Two-pole fork tell ("A or B?" framed as the question).
+const FORK = /\b(a or b|option (a|b|1|2)|either\b.*\bor\b.*\?)/i;
+export function validateCrux(crux) {
+    if (typeof crux !== 'string')
+        return null;
+    const t = crux.trim();
+    if (!t)
+        return null;
+    if (!t.endsWith('?')) {
+        return {
+            code: 'CRUX_NOT_A_QUESTION',
+            message: 'A crux must be phrased as a single neutral question.',
+            recovery: 'End it with "?" and remove any statement of which way to go.',
+        };
+    }
+    if (LEAN.test(t)) {
+        return {
+            code: 'CRUX_CARRIES_LEAN',
+            message: 'The crux carries a directional lean — that is a verdict in disguise.',
+            recovery: 'Name the assumption neutrally as a question; do not say which side is stronger.',
+        };
+    }
+    if (FORK.test(t)) {
+        return {
+            code: 'CRUX_CARRIES_LEAN',
+            message: 'The crux is shaped as a two-pole fork.',
+            recovery: 'Ask the single load-bearing question, not "A or B?".',
+        };
+    }
+    return null;
+}

package/dist/lib/validate-seal.js

@@ -0,0 +1,48 @@
+import { asDate } from './resolve-today.js';
+// Obvious non-falsifiable vibes. Weak/advisory only.
+const VIBE = /\b(go well|be fine|be good|be great|work out|feel right|be successful|do better|improve somehow)\b/i;
+// Korean vibe-predicates (12 P1-4): "잘 될 것 같다 아마도" sealed — and was
+// congratulated — because the list was English-only. Same weak/advisory status;
+// no \b (word boundaries don't work for Hangul). NOT a hard gate (§5-14).
+const VIBE_KO = /(잘\s*될|잘\s*풀릴|괜찮을|좋아질|나아질)\s*(것|거)\s*(같|이)|아마도|어떻게든\s*(될|되)/;
+export function validateSeal(predicate, checkBy, today) {
+    if (typeof predicate !== 'string' || predicate.trim().length < 8) {
+        return {
+            code: 'EMPTY_PREDICATE',
+            message: 'A seal needs a checkable statement (at least 8 characters).',
+            recovery: 'Write a prediction reality can mark true or false, e.g. "cutover downtime < 5 min".',
+        };
+    }
+    const date = asDate(checkBy);
+    if (!date) {
+        return {
+            code: 'BAD_CHECK_BY',
+            message: 'check_by must be a real date in YYYY-MM-DD form.',
+            recovery: 'Pick the date when reality will answer, e.g. "2026-09-01".',
+        };
+    }
+    if (date <= today) {
+        return {
+            code: 'BAD_CHECK_BY',
+            message: `check_by (${date}) must be in the future (today is ${today}).`,
+            recovery: 'Pick a future date — the check-by is when you will come back to settle.',
+        };
+    }
+    if (VIBE_KO.test(predicate)) {
+        return {
+            code: 'NOT_FALSIFIABLE',
+            message: '이건 기분이지 확인 가능한 예측이 아닙니다.',
+            recovery: '숫자·임계값·관찰 가능한 사건으로 다시 적어주세요. (휴리스틱 — 놓칠 수 있음)',
+            weak: true,
+        };
+    }
+    if (VIBE.test(predicate)) {
+        return {
+            code: 'NOT_FALSIFIABLE',
+            message: 'This reads like a vibe, not a checkable prediction.',
+            recovery: 'Re-state it with a number, threshold, or observable event. (Heuristic — may miss cases.)',
+            weak: true,
+        };
+    }
+    return null;
+}

package/dist/prompts.js

@@ -0,0 +1,72 @@
+import { BIND_DISCIPLINE, SETTLE_DISCIPLINE, REFRAME_DISCIPLINE, REVIEW_DISCIPLINE } from './lib/discipline.js';
+import { resolveArgusDirForResource } from './lib/argus-dir.js';
+import { resolveToday } from './lib/resolve-today.js';
+import { replayLedger, bearingContracts } from './lib/ledger-replay.js';
+import { duePremises, groupDuePremises } from './lib/premises.js';
+/**
+ * MCP Prompts (blueprint §4.2). The discipline shipped as user-triggered
+ * rituals instead of a pasted system prompt. /argus-settle reads the due
+ * contracts at GetPrompt time and bakes them into the message so the model
+ * settles against the real ledger.
+ */
+export const PROMPTS = [
+    { name: 'argus-bind', title: 'Argus: bind a decision', description: 'Run the fire-gate → one neutral question → seal a falsifiable bet ritual.', arguments: [{ name: 'decision', description: 'The decision you are facing.', required: false }] },
+    { name: 'argus-settle', title: 'Argus: settle against reality', description: 'Check decisions whose check-by date has arrived against what actually happened.', arguments: [] },
+    { name: 'argus-reframe', title: 'Argus: reframe the question', description: 'Surface the hidden assumptions in your question before you ask the AI.', arguments: [{ name: 'question', description: 'The question or problem to sharpen.', required: false }] },
+    { name: 'argus-review', title: 'Argus: review a document', description: 'Review an existing strategy memo / PRD / deck text / AI answer for judgment risk, anchored to the source.', arguments: [{ name: 'file_path', description: 'Path to a .md/.txt document to review (optional).', required: false }] },
+];
+export function listPrompts() {
+    return { prompts: PROMPTS.map((p) => ({ name: p.name, title: p.title, description: p.description, arguments: p.arguments })) };
+}
+function userText(text) {
+    return { role: 'user', content: { type: 'text', text } };
+}
+export function getPrompt(name, args) {
+    if (name === 'argus-bind') {
+        const decision = args?.['decision'];
+        return {
+            description: 'Argus bind ritual',
+            messages: [userText(BIND_DISCIPLINE + (decision ? `\n\nThe decision: ${decision}` : ''))],
+        };
+    }
+    if (name === 'argus-reframe') {
+        const question = args?.['question'];
+        return {
+            description: 'Argus reframe lens',
+            messages: [userText(REFRAME_DISCIPLINE + (question ? `\n\nThe question: ${question}` : ''))],
+        };
+    }
+    if (name === 'argus-review') {
+        const filePath = args?.['file_path'];
+        return {
+            description: 'Argus review ritual',
+            messages: [userText(REVIEW_DISCIPLINE + (filePath ? `\n\nThe document: ${filePath}` : ''))],
+        };
+    }
+    if (name === 'argus-settle') {
+        const dir = resolveArgusDirForResource();
+        let context = '';
+        if (dir) {
+            const today = resolveToday({});
+            const l = replayLedger(dir, today);
+            const seeds = bearingContracts(dir, today, l);
+            const due = [
+                ...l.overdue.map((c) => ({ id: c.id, predicate: c.text, check_by: c.date })),
+                ...seeds.filter((s) => !l.contracts.has(s.id)).map((s) => ({ id: s.id, predicate: s.predicate, check_by: s.check_by })),
+            ];
+            context = due.length
+                ? '\n\nDue now:\n' + due.map((d) => `- [${d.id}] "${d.predicate}" (check-by ${d.check_by})`).join('\n')
+                : '\n\nNothing is due right now.';
+            // Living premises (plan v5 §0.6-U2): the settle ritual also covers the
+            // facts open decisions rest on — the recheck choreography lives HERE:
+            // research the current fact, then record it with provenance.
+            const premGroups = groupDuePremises(duePremises(l));
+            if (premGroups.length > 0) {
+                context += '\n\nPremises due for a reality re-check — for each: research the CURRENT fact (a web search, or ask the user), then call argus_recheck with the finding, an explicit numeric_value when the fact is a number, and its source (url | user_stated | host_reported):\n'
+                    + premGroups.slice(0, 5).map((g) => `- "${g.text}" — under: ${g.premises.map((p) => `[${p.decision_id}] P${p.ordinal}`).join(', ')}${g.premises.length > 1 ? ' (one fact — re-check once with apply_to_matching)' : ''}`).join('\n');
+            }
+        }
+        return { description: 'Argus settle ritual', messages: [userText(SETTLE_DISCIPLINE + context)] };
+    }
+    return { description: 'unknown prompt', messages: [userText(`Unknown prompt: ${name}`)] };
+}

package/dist/resources.js

@@ -0,0 +1,122 @@
+import { resolveArgusDirForResource } from './lib/argus-dir.js';
+import { resolveToday } from './lib/resolve-today.js';
+import { replayLedger, bearingContracts } from './lib/ledger-replay.js';
+import { readReceipt } from './lib/receipt.js';
+import { safeSegment } from './lib/safe-path.js';
+import { logDebug } from './lib/log.js';
+import { duePremises, groupDuePremises, isMonitored, isDueForRecheck } from './lib/premises.js';
+/**
+ * MCP Resources (blueprint §4.3). Read-only context the host can auto-inject —
+ * the ledger, the due contracts, a receipt, the current bearing. They are
+ * resources (not read-tools) because they are app-injected context, and being
+ * read-only is itself the proof that the reading surface cannot write a verdict.
+ *
+ * No per-call argument channel exists, so the dir is resolved from ARGUS_DIR.
+ * When unbound, every resource degrades cleanly to an {unbound} payload rather
+ * than throwing.
+ */
+const JSON_MIME = 'application/json';
+export const STATIC_RESOURCES = [
+    { uri: 'argus://ledger', name: 'Argus ledger', description: 'Full replayed state of all decisions (stats, contracts, integrity).', mimeType: JSON_MIME },
+    { uri: 'argus://contracts/due', name: 'Due contracts', description: 'Decision contracts past their check-by date — the return-loop context.', mimeType: JSON_MIME },
+    { uri: 'argus://bearing/current', name: 'Current bearing', description: 'Open (sealed, not yet settled) decisions.', mimeType: JSON_MIME },
+    { uri: 'argus://premises/due', name: 'Premises due for a re-check', description: 'Monitored premises of sealed decisions whose facts should be re-checked against reality (grouped: the same fact under several decisions is one re-check) — the living-premises return-loop context.', mimeType: JSON_MIME },
+];
+export const RESOURCE_TEMPLATES = [
+    { uriTemplate: 'argus://receipts/{id}', name: 'Judgment Receipt', description: 'The receipt for one decision id.', mimeType: JSON_MIME },
+    { uriTemplate: 'argus://premises/{id}', name: 'Decision premises', description: 'The tracked premises (facts + open questions) of one decision id, with provenance and staleness.', mimeType: JSON_MIME },
+];
+function unbound(uri) {
+    return { uri, mimeType: JSON_MIME, text: JSON.stringify({ unbound: true, hint: 'Set the ARGUS_DIR env var (or call argus_init with an absolute argus_dir) so resources can resolve a project.' }) };
+}
+export function listResources() {
+    return { resources: STATIC_RESOURCES.map((r) => ({ ...r })) };
+}
+export function listResourceTemplates() {
+    return { resourceTemplates: RESOURCE_TEMPLATES.map((r) => ({ ...r })) };
+}
+export function readResource(uri) {
+    const dir = resolveArgusDirForResource();
+    if (!dir) {
+        logDebug(`resource ${uri} requested while unbound`);
+        return { contents: [unbound(uri)] };
+    }
+    const today = resolveToday({});
+    const payload = computePayload(uri, dir, today);
+    return { contents: [{ uri, mimeType: JSON_MIME, text: JSON.stringify(payload, null, 2) }] };
+}
+function computePayload(uri, dir, today) {
+    if (uri === 'argus://ledger') {
+        const l = replayLedger(dir, today);
+        return {
+            today,
+            stats: l.stats,
+            integrity: l.integrity,
+            contracts: [...l.contracts.values()].map((c) => ({ id: c.id, status: c.status, predicate: c.predicate, check_by: c.check_by, outcome: c.outcome })),
+        };
+    }
+    if (uri === 'argus://contracts/due') {
+        const l = replayLedger(dir, today);
+        const seeds = bearingContracts(dir, today, l);
+        const due = [
+            ...l.overdue.map((c) => ({ id: c.id, predicate: c.text, check_by: c.date, source: 'ledger' })),
+            ...seeds.filter((s) => !l.contracts.has(s.id)).map((s) => ({ id: s.id, predicate: s.predicate, check_by: s.check_by, source: 'bearing' })),
+        ];
+        return { today, due, due_count: due.length, next_action: due.length ? 'argus_settle' : null };
+    }
+    if (uri === 'argus://bearing/current') {
+        const l = replayLedger(dir, today);
+        const open = [...l.contracts.values()].filter((c) => c.status === 'sealed').map((c) => ({ id: c.id, predicate: c.predicate, check_by: c.check_by }));
+        return { today, open };
+    }
+    if (uri === 'argus://premises/due') {
+        const l = replayLedger(dir, today);
+        const groups = groupDuePremises(duePremises(l));
+        const TOP = 5; // power-user cap (plan v5 P5) — counts stay honest
+        return {
+            today,
+            groups: groups.slice(0, TOP).map((g) => ({
+                fact: g.text,
+                decisions: g.premises.map((p) => ({ decision_id: p.decision_id, decision: p.decision_text, ref: `P${p.ordinal}`, staleness: p.days_stale === null ? 'never re-checked' : `${p.days_stale}d` })),
+            })),
+            group_count: groups.length,
+            has_more: groups.length > TOP,
+            next_action: groups.length ? 'argus_recheck' : null,
+        };
+    }
+    const pm = uri.match(/^argus:\/\/premises\/(.+)$/);
+    if (pm && pm[1] !== 'due') {
+        let id;
+        try {
+            id = safeSegment(decodeURIComponent(pm[1]), 'id');
+        }
+        catch {
+            return { error: 'invalid_id' };
+        }
+        const l = replayLedger(dir, today);
+        const list = l.contracts.get(id)?.premises ?? [];
+        return {
+            id, today,
+            premises: list.map((p) => ({
+                ref: `P${p.ordinal}`, kind: p.kind, text: p.text, status: p.status,
+                source: p.source, ...(p.ai_original && p.ai_original !== p.text ? { ai_original: p.ai_original } : {}),
+                monitored: isMonitored(p), due_for_recheck: isDueForRecheck(p, today),
+                last_checked: p.last_recheck?.ts?.slice(0, 10) ?? null,
+                ...(p.resolved_decision ? { resolved_decision: p.resolved_decision } : {}),
+            })),
+        };
+    }
+    const m = uri.match(/^argus:\/\/receipts\/(.+)$/);
+    if (m) {
+        let id;
+        try {
+            id = safeSegment(decodeURIComponent(m[1]), 'id');
+        }
+        catch {
+            return { error: 'invalid_id' };
+        }
+        const r = readReceipt(dir, id);
+        return r ?? { error: 'not_found', id };
+    }
+    return { error: 'unknown_resource', uri };
+}