catherd-cli 1.5.0 → 2.0.0-beta.20261022113309

package/src/adapters/grok/models.ts

@@ -1,48 +0,0 @@
-import type { DiscoveredModel } from "../backend.ts";
-
-/** A model's efforts and context as the catalog ships them for grok (`on.grok`). */
-export type ShippedGrok = Record<string, { efforts: string[]; context: number | null }>;
-
-export interface GrokModels {
-  /** null when `grok models` printed none of its auth lines */
-  loggedIn: boolean | null;
-  /** how: a Grok login (SuperGrok, X Premium+) or `XAI_API_KEY` */
-  login?: "Grok" | "API key";
-  defaultModel: string | null;
-  models: DiscoveredModel[];
-}
-
-/**
- * `grok models` (research §3.4 [run]): an auth line first ("You are logged in with …", "You are using
- * XAI_API_KEY.", "You are not authenticated."), `Default model: <id>`, then `Available models:` with
- * `  * <id> (default)` or `  - <id>` lines. It lists no efforts: they come from the catalog's `on.grok`
- * (spec 1.3 §5.2), and a model the catalog lacks lists none.
- */
-export function parseGrokModels(text: string, shipped: ShippedGrok = {}): GrokModels {
-  const login = /You are using XAI_API_KEY/.test(text)
-    ? "API key"
-    : /You are logged in with/.test(text)
-      ? "Grok"
-      : undefined;
-  const loggedIn = login ? true : /You are not authenticated/.test(text) ? false : null;
-  const at = text.indexOf("Available models:");
-  const ids =
-    at === -1
-      ? []
-      : text
-          .slice(at)
-          .split("\n")
-          .map((l) => /^\s*[*-]\s+(\S+)/.exec(l)?.[1])
-          .filter((id): id is string => id !== undefined);
-  return {
-    loggedIn,
-    ...(login ? { login } : {}),
-    defaultModel: /Default model:\s*(\S+)/.exec(text)?.[1] ?? null,
-    models: ids.map((id) => ({
-      id,
-      efforts: [...(shipped[id]?.efforts ?? [])],
-      context: shipped[id]?.context ?? null,
-      imageIn: false,
-    })),
-  };
-}

package/src/domain/calibration.ts

@@ -1,132 +0,0 @@
-import type { Dim } from "./catalog.ts";
-import type { SourceId } from "./sources.ts";
-
-/** Spec 1.2 §4.2: a source needs this many rungs shared with the anchor for a dimension. */
-export const MIN_SHARED = 5;
-/** Spec 1.2 §4.2: a fit below this R² is not used. */
-export const MIN_R2 = 0.5;
-
-/** One number a source parser returns: `field` of `source`, and the benchmark it names. */
-export interface FieldRef {
-  source: SourceId;
-  field: string;
-  benchmark: string;
-}
-
-/**
- * Spec 1.2 §4.1: each dimension's anchor, the unit its bars are in, and the sources calibrated onto it.
- * `shipped` is the hand-typed value `catalog/scores.json` carries, published for that rung (every anchor is
- * keyless, spec 1.2 §4.1).
- */
-export const DIM_SOURCES: Record<Dim, { anchor: FieldRef | "shipped"; others: FieldRef[] }> = {
-  repo_code: {
-    anchor: "shipped",
-    others: [
-      {
-        source: "artificial-analysis",
-        field: "livecodebench",
-        benchmark: "LiveCodeBench (Artificial Analysis)",
-      },
-      { source: "artificial-analysis", field: "scicode", benchmark: "SciCode (Artificial Analysis)" },
-      {
-        source: "artificial-analysis",
-        field: "artificial_analysis_coding_index",
-        benchmark: "Artificial Analysis Coding Index",
-      },
-      { source: "epoch", field: "frontiercode", benchmark: "FrontierCode (Epoch AI)" },
-      // spec 1.5 plan 24: per model and effort, it scores a new release the day it ships (the identity run's
-      // GPT-6.1 Sol: medium 47.8, about Astra low)
-      {
-        source: "artificial-analysis",
-        field: "artificial_analysis_intelligence_index",
-        benchmark: "Artificial Analysis Intelligence Index",
-      },
-    ],
-  },
-  // plan 14 Ruling C-2: the vendors' Terminal-Bench 4.0 values, not Epoch's Terminal-Bench 2.0, which shares
-  // no rung with them; Epoch is fitted onto them once it covers five of their rungs
-  terminal: {
-    anchor: "shipped",
-    others: [
-      { source: "epoch", field: "terminalbench", benchmark: "Terminal-Bench (Epoch AI)" },
-      {
-        source: "artificial-analysis",
-        field: "terminalbench_v2_1",
-        benchmark: "Terminal-Bench 2.1 (Artificial Analysis)",
-      },
-    ],
-  },
-  honesty: {
-    anchor: "shipped",
-    others: [
-      { source: "vectara", field: "factual_consistency", benchmark: "Vectara factual consistency rate" },
-      { source: "arena", field: "agent_tool_hallucination", benchmark: "Arena agent tool hallucination" },
-    ],
-  },
-  agentic: {
-    anchor: { source: "arena", field: "agent", benchmark: "Arena agent, net improvement" },
-    others: [
-      { source: "arena", field: "agent_task_outcome_explicit", benchmark: "Arena agent task outcome" },
-      { source: "arena", field: "agent_bash_recovery_steps", benchmark: "Arena agent bash recovery" },
-      { source: "artificial-analysis", field: "tau2", benchmark: "tau2-bench (Artificial Analysis)" },
-    ],
-  },
-  steer: {
-    anchor: { source: "arena", field: "agent_steerability", benchmark: "Arena agent steerability" },
-    others: [],
-  },
-  frontend: {
-    anchor: { source: "arena", field: "webdev", benchmark: "Arena WebDev rating" },
-    others: [{ source: "epoch", field: "webdev", benchmark: "WebDev Arena (Epoch AI)" }],
-  },
-};
-
-export interface LineFit {
-  a: number;
-  b: number;
-  r2: number;
-  n: number;
-}
-
-/** Least squares `anchor = a·x + b` over `[x, anchor]` pairs; null with fewer than 2 pairs or no spread in x. */
-export function fitLine(pairs: readonly (readonly [number, number])[]): LineFit | null {
-  const n = pairs.length;
-  if (n < 2) return null;
-  const mx = pairs.reduce((s, [x]) => s + x, 0) / n;
-  const my = pairs.reduce((s, [, y]) => s + y, 0) / n;
-  let sxx = 0;
-  let sxy = 0;
-  let syy = 0;
-  for (const [x, y] of pairs) {
-    sxx += (x - mx) ** 2;
-    sxy += (x - mx) * (y - my);
-    syy += (y - my) ** 2;
-  }
-  if (sxx === 0) return null;
-  const a = sxy / sxx;
-  const b = my - a * mx;
-  const res = pairs.reduce((s, [x, y]) => s + (y - (a * x + b)) ** 2, 0);
-  return { a, b, r2: syy === 0 ? 0 : 1 - res / syy, n };
-}
-
-/**
- * Spec 1.2 §4.2: the fit of `other` onto `anchor` over the keys both hold, and whether it may be used: at
- * least MIN_SHARED shared rungs and an R² of at least MIN_R2. `why` says why not.
- */
-export function calibrate(
-  anchor: ReadonlyMap<string, number>,
-  other: ReadonlyMap<string, number>,
-): { fit: LineFit | null; n: number; used: boolean; why?: string } {
-  const pairs: [number, number][] = [];
-  for (const [k, x] of other) {
-    const y = anchor.get(k);
-    if (y !== undefined) pairs.push([x, y]);
-  }
-  const n = pairs.length;
-  if (n < MIN_SHARED)
-    return { fit: null, n, used: false, why: `${n} shared rungs; a fit needs ${MIN_SHARED}` };
-  const fit = fitLine(pairs);
-  if (!fit) return { fit: null, n, used: false, why: "the source gives every shared rung the same value" };
-  if (fit.r2 < MIN_R2) return { fit, n, used: false, why: `R² ${fit.r2.toFixed(2)} is below ${MIN_R2}` };
-  return { fit, n, used: true };
-}

package/src/domain/sources.ts

@@ -1,144 +0,0 @@
-import { z } from "zod";
-import { DIMS, type Family, FamilyFactsSchema, ScoreSchema } from "./catalog.ts";
-
-/** Spec 1.2 §3.1: the sources `catherd catalog sync` reads, one cache file each in `<data>/sources/`. */
-export const SOURCE_IDS = [
-  "models-dev",
-  "openrouter-models",
-  "openrouter-endpoints",
-  "litellm",
-  "arena",
-  "vectara",
-  "epoch",
-  "artificial-analysis",
-] as const;
-export type SourceId = (typeof SOURCE_IDS)[number];
-
-/** `catalog/sources.json`: each source with its license and attribution line, the id aliases, default efforts. */
-export const SourcesFileSchema = z.looseObject({
-  schema: z.literal(1),
-  version: z.string(),
-  sources: z.array(
-    z.object({
-      id: z.enum(SOURCE_IDS),
-      name: z.string(),
-      url: z.url(),
-      license: z.string(),
-      attribution: z.string(),
-      keyed: z.boolean(),
-    }),
-  ),
-  /** a source's irregular model id → the catalog's id (spec 1.2 §3.4) */
-  aliases: z.record(z.string(), z.string()),
-  /** family id → the effort a source that names none means; a family not listed means `high` */
-  defaultEffort: z.record(z.string(), z.string()),
-});
-export type SourcesFile = z.infer<typeof SourcesFileSchema>;
-
-/** Effort words as catherd writes them, weakest first; a source's spelling (`xHigh`, `MAX`) is folded onto these. */
-export const EFFORT_ORDER = ["none", "minimal", "low", "medium", "high", "xhigh", "max", "ultra"] as const;
-
-/** `s` as a catherd effort word (`xHigh` → `xhigh`), or null when it is not one. */
-export function effortWord(s: string): string | null {
-  const w = s.trim().toLowerCase();
-  return (EFFORT_ORDER as readonly string[]).includes(w) ? w : null;
-}
-
-/**
- * Spec 1.2 §3.4: a source's model id in catherd's form: without a `vendor/` prefix, lower case, and each run
- * of dots and blanks as one `-` (`openai/gpt-5.6-sol` and `GPT 5.6 Sol` → `gpt-5-6-sol`).
- */
-export function normalizeId(id: string): string {
-  return id
-    .slice(id.lastIndexOf("/") + 1)
-    .trim()
-    .toLowerCase()
-    .replace(/[\s.]+/g, "-")
-    .replace(/-+/g, "-");
-}
-
-/** A parser's `rung`: `<source's model id>#<effort>`, or the bare id when the source names no effort. */
-export function splitSourceRung(rung: string): { id: string; effort: string | null } {
-  const hash = rung.lastIndexOf("#");
-  return hash < 0 ? { id: rung, effort: null } : { id: rung.slice(0, hash), effort: rung.slice(hash + 1) };
-}
-
-export interface IdMapper {
-  /** the id pairs are keyed by: normalized, then through the alias table */
-  key(id: string): string;
-  /** the catalog family a source id names, directly, by a backend's own id or through an alias; never guessed */
-  family(id: string): Family | null;
-}
-
-/** Spec 1.2 §3.4: matches a source's ids to the catalog's families. */
-export function idMapper(families: Family[], aliases: Record<string, string>): IdMapper {
-  const alias = new Map(Object.entries(aliases).map(([from, to]) => [normalizeId(from), normalizeId(to)]));
-  const byKey = new Map<string, Family>();
-  for (const f of families) {
-    for (const on of Object.values(f.on)) if (on) byKey.set(normalizeId(on.id), f);
-    byKey.set(normalizeId(f.id), f);
-  }
-  const key = (id: string) => {
-    const n = normalizeId(id);
-    return alias.get(n) ?? n;
-  };
-  return { key, family: (id) => byKey.get(key(id)) ?? null };
-}
-
-/** Spec 1.2 §3.4: the effort a source that names none means for `family`. */
-export const defaultEffortOf = (sources: SourcesFile, family: Family): string =>
-  sources.defaultEffort[family.id] ?? "high";
-
-const order = (e: string) => (EFFORT_ORDER as readonly string[]).indexOf(e);
-
-/** Every effort the family offers on any backend, weakest first (spec 1.2 §4.3 `adjacent`). */
-export function familyEfforts(f: Family): string[] {
-  const all = new Set<string>();
-  for (const on of Object.values(f.on)) for (const e of on?.efforts ?? []) all.add(e);
-  return [...all].filter((e) => order(e) >= 0).sort((a, b) => order(a) - order(b));
-}
-
-/** Spec 1.2 §4.2: one source's fit onto a dimension's anchor, used or not, and why not. */
-export const FitRowSchema = z.object({
-  dim: z.enum(DIMS),
-  source: z.string(),
-  field: z.string(),
-  n: z.number().int(),
-  a: z.number().nullable(),
-  b: z.number().nullable(),
-  r2: z.number().nullable(),
-  used: z.boolean(),
-  why: z.string().optional(),
-});
-export type FitRow = z.infer<typeof FitRowSchema>;
-
-/**
- * `<data>/sources/derived.json`: what a sync made of the cached answers. `scores` are the synced values the
- * catalog layers over the shipped ones (`measured`, `calibrated`, `adjacent`), `facts` each family's facts,
- * `unmatched` each source's ids no family matched (never guessed), `warnings` the cross-checks that failed.
- */
-export const DerivedSchema = z.looseObject({
-  schema: z.literal(1),
-  builtAt: z.iso.datetime(),
-  scores: z.array(ScoreSchema),
-  facts: z.record(z.string(), FamilyFactsSchema),
-  fits: z.array(FitRowSchema),
-  unmatched: z.record(z.string(), z.array(z.string())),
-  warnings: z.array(z.string()),
-  /** canonical rung → the Artificial Analysis stand-in features (spec 1.2 §6.3); a file before plan 14 has none */
-  features: z.record(z.string(), z.record(z.string(), z.number())).default({}),
-});
-export type Derived = z.infer<typeof DerivedSchema>;
-
-/** The effort of `have` nearest `target` (the weaker one on a tie); null when `have` holds no effort word. */
-export function nearestEffort(target: string, have: string[]): string | null {
-  const t = order(target);
-  let best: string | null = null;
-  for (const e of have) {
-    const i = order(e);
-    if (i < 0 || t < 0) continue;
-    const b = best === null ? Number.POSITIVE_INFINITY : Math.abs(order(best) - t);
-    if (Math.abs(i - t) < b || (Math.abs(i - t) === b && i < order(best as string))) best = e;
-  }
-  return best;
-}

package/src/entry/mcp/dispatch-tools.ts

@@ -1,52 +0,0 @@
-import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { z } from "zod";
-import { ID_PATTERN } from "../../domain/ids.ts";
-import { ROLES } from "../../domain/roles.ts";
-import { cancel, dispatch } from "../../services/dispatch-service.ts";
-import { peek } from "../../services/peek.ts";
-import type { Deps } from "../../services/ports.ts";
-import { handle } from "./result.ts";
-
-export function registerDispatchTools(server: McpServer, deps: Deps): void {
-  server.registerTool(
-    "dispatch",
-    {
-      description:
-        "Start one role on a process backend (codex, claude-code, opencode) and return at launch, in about a second, with { dispatched: { name, role, rung, dispatchId, admittedAt }, hints }; the role runs on. When it finishes, catherd sends this session a <cross-session-message from-name=\"catherd\"> naming the run, the role and its status, and result(run, name) reads the record. Dispatch every independent role one after another, then end your turn. The brief is the text itself; dispatch appends the role's reply contract (reply length and the STATUS line), so do not write it. With lane, the lane file's Owns: paths guard against overlapping lanes, a lane not yet routed is routed first (a rung off its routed ladder starts at the routed rung, with a hint), and rung may be left out: the lane runs at its current rung (its route, or the rung its last climb gave). Without lane, rung is required (route(run, role) gives it), and the choice is recorded in routes.jsonl. thread resumes that role's thread for its own fix round: the thread its catherd message names, or \"latest\" for the name's last thread; a thread the name never ran on in this run is refused (E_ADMIT_THREAD). Refused with a structured error (E_ADMIT_*, E_RUN_BUDGET, E_BACKEND_*) before anything starts. Call it from the main thread.",
-      inputSchema: {
-        run: z.string(),
-        role: z.enum(ROLES),
-        name: z.string().regex(ID_PATTERN),
-        brief: z.string().min(1),
-        rung: z.string().min(3).optional(),
-        thread: z.string().optional(),
-        lane: z.string().regex(ID_PATTERN).optional(),
-        next: z.string().optional(),
-      },
-    },
-    (a) => handle(() => dispatch(deps, a)),
-  );
-
-  server.registerTool(
-    "peek",
-    {
-      description:
-        "A look at the runs, without waiting: with run, that run (and this session becomes its owner); without, every run this session owns, else the newest. Per run, first the open owner questions, which are the owner's questions: push them to the owner, relay the owner's answer with answer(run, milestone, answer), and go on with the work that does not depend on them. Then each live role with its rung, seconds since it started and its last event (the last command, file edit or message line); every finished record not yet read, as the first line of catherd's message; the latest native Claude run; the run's next step; protocol, the milestone loop's next step and its six-line checklist; and verifier, the verifier's latest gate step. name narrows it to one role. It never marks a record read: result(run, name) does. Call it when the user asks how it is going, when a decision needs the other roles' state, or once after run_start on a resumed run; never in a loop. actionable is false, with its reason, when nothing is yours to do (only roles are live on the step, or the owner's answer comes first): end the turn with no tool call, and the next catherd message wakes you.",
-      inputSchema: {
-        run: z.string().optional(),
-        name: z.string().regex(ID_PATTERN).optional(),
-      },
-    },
-    (a) => handle(() => peek(deps, a)),
-  );
-
-  server.registerTool(
-    "cancel",
-    {
-      description:
-        "Stop a live dispatch (interrupt, then SIGTERM, then SIGKILL) and return its record, marked cancelled and read, and hints.",
-      inputSchema: { run: z.string(), name: z.string().regex(ID_PATTERN) },
-    },
-    (a) => handle(() => cancel(deps, a.run, a.name, { read: true })),
-  );
-}

package/src/entry/mcp/lane-tools.ts

@@ -1,131 +0,0 @@
-import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { z } from "zod";
-import { ID_PATTERN } from "../../domain/ids.ts";
-import { ROLES } from "../../domain/roles.ts";
-import { CatherdError } from "../../domain/errors.ts";
-import { CLIMB_REASONS } from "../../domain/route.ts";
-import { LANE_FIELDS, type LaneField, laneSet, ownsAdd } from "../../services/lane-edit.ts";
-import { ask, climb, LAND_SKIPS, land, route, routeLanes } from "../../services/lane-service.ts";
-import type { Deps } from "../../services/ports.ts";
-import { preflight } from "../../services/preflight.ts";
-import { handle } from "./result.ts";
-
-export function registerLaneTools(server: McpServer, deps: Deps): void {
-  server.registerTool(
-    "route",
-    {
-      description:
-        "The rung for a lane (from the lane file's Kind/Difficulty lines when it declares both, else Jev, else the profile default), or with lanes (several lane files) for each of them in one call, Jev asked about all at once ({ routes: [...] }, in order), or, without a lane file, a role's default rung, with the ladder above it: only rungs at least as strong as the start. Rungs are backend:model#effort; a claude: rung comes with the agent to run it as. Returns rung, ladder, backend, agent and why: one line naming the decision, where Jev disagreed with the lane's header, when no rung clears the bar (and the closest), and when a tie between quotas decided. Every decision, with its provenance (each threshold, the value used, its source and date, the rung's cost and run evidence), is written to the run's routes.jsonl. A lane whose Kind: or Difficulty: the catalog does not know is refused with E_LANE_INVALID.",
-      inputSchema: {
-        run: z.string(),
-        lane_file: z.string().optional(),
-        lanes: z.array(z.string()).min(1).optional(),
-        role: z.enum(ROLES).default("worker"),
-      },
-    },
-    (a) =>
-      handle(async () => {
-        if (a.lanes && a.lane_file !== undefined)
-          throw new CatherdError("E_INPUT_INVALID", "route takes lane_file or lanes, not both", {
-            fix: "pass every lane file in lanes",
-          });
-        return a.lanes
-          ? { routes: await routeLanes(deps, { run: a.run, laneFiles: a.lanes, role: a.role }) }
-          : route(deps, { run: a.run, laneFile: a.lane_file, role: a.role });
-      }),
-  );
-
-  const lane = z.string().regex(ID_PATTERN);
-  server.registerTool(
-    "lane_set",
-    {
-      description:
-        "Set one header line of a lane file (owns, fast_check, kind, difficulty, after, allow), validated as write_run_file validates a lane: an unknown Kind or Difficulty, an Owns path outside the repo, or a malformed After:/Allow: is refused with E_LANE_INVALID, and an Owns that a running lane holds with E_ADMIT_OVERLAP. after names lanes that must finish first; allow lists path or path:line hits the lane's absence check may report. Returns the line and the header as it now reads. Orchestrator only.",
-      inputSchema: {
-        run: z.string(),
-        lane,
-        field: z.enum(Object.keys(LANE_FIELDS) as [LaneField, ...LaneField[]]),
-        value: z.string(),
-      },
-    },
-    (a) => handle(() => laneSet(deps, a)),
-  );
-
-  server.registerTool(
-    "owns_add",
-    {
-      description:
-        "Grow a lane's Owns mid-lane, with why (kept in the lane file): a running lane that owns one of the paths refuses it with E_ADMIT_OVERLAP; another lane file that lists one comes back as a hint. A dispatch of the lane still running is held to the new list when it finishes, so its edits there are not violations. Orchestrator only.",
-      inputSchema: {
-        run: z.string(),
-        lane,
-        paths: z.array(z.string().min(1)).min(1).max(100),
-        why: z.string().min(1),
-      },
-    },
-    (a) => handle(() => ownsAdd(deps, a)),
-  );
-
-  server.registerTool(
-    "preflight",
-    {
-      description:
-        "Run each lane's fast check once, on the base tree, behind the heavy-command lock, with a 120 s timeout, in the user's login environment plus the repo's gate environment (catherd knowledge env). By default only the lanes of milestones not landed yet; milestone names one. Each lane is pass, fails-as-expected, skipped (it checks a file the lane creates, or a pnpm filter that matches no package yet), cannot-start (a missing command, a timeout, or an environment error: no Docker, DNS, a denied permission; its note says which) or lock-busy (no heavy slot came free within 60 s: run it again); only cannot-start blocks. warnings names each lane whose fast check runs no linter while the repo has one. When the profile asks for confirmation, the first call returns the commands to show the user; call again with confirmed: true. Refused with E_LANE_INVALID, running nothing, while any lane's Kind: or Difficulty: is not one the catalog knows.",
-      inputSchema: {
-        run: z.string(),
-        confirmed: z.boolean().optional(),
-        milestone: z.string().regex(ID_PATTERN).optional(),
-      },
-    },
-    (a) => handle(() => preflight(deps, { run: a.run, confirmed: a.confirmed, milestone: a.milestone })),
-  );
-
-  server.registerTool(
-    "climb",
-    {
-      description:
-        "Move a routed lane one rung up its ladder and record why. Returns the next rung, or top: true, and any hints. Dispatch the lane again at that rung on a fresh thread. Pass env: true when the environment caused it (a missing service, a broken tool, a usage limit), not the rung. Refused with E_CLIMB_DESIGN when the evidence is a design question (Jev's finding answer is design, or a blocked climb's evidence is about lane ownership): send it to the architect instead. Refused with E_CLIMB_ENV when the lane's last reply named the environment on an ENV: line: fix the environment or park the milestone.",
-      inputSchema: {
-        run: z.string(),
-        lane: z.string().regex(ID_PATTERN),
-        reason: z.enum(CLIMB_REASONS),
-        evidence: z.string().optional(),
-        env: z.boolean().optional(),
-      },
-    },
-    (a) => handle(() => climb(deps, a)),
-  );
-
-  server.registerTool(
-    "ask",
-    {
-      description:
-        "Ask Jev one fixed question. finding: state { lane_file, finding } → design | code | unclear. same-defect: state { before, after } → yes | no. Falls back to the default when Jev is unsure or absent. Keep the state short, in English, and free of secrets.",
-      inputSchema: {
-        run: z.string(),
-        question: z.enum(["finding", "same-defect"]),
-        state: z.record(z.string(), z.string()),
-      },
-    },
-    (a) => handle(() => ask(deps, a)),
-  );
-
-  server.registerTool(
-    "land",
-    {
-      description:
-        "Record a landed milestone after you commit it: its five-column ledger row (with the minutes it took) and state.md's last check and next step, with any hints. learned, when given, goes to this repo's knowledge.md. Returns digest: the milestone's digest (R/digests/<milestone>.md: A-lines, the commits, lanes with rungs and climbs, the reviewer's BLOCKER and BUG lines, the owner questions still open, the verifier's verdict with carried items, minutes and tokens), and digestPath, its full path, for the milestone push to link. Refused with E_LAND_GATE unless, since the milestone's lanes started, a reviewer named reviewer-<milestone> ended ok (a dispatch, or a Claude subagent recorded with record_agent_run, role reviewer) and a verifier verdict was recorded ok under exactly verifier-<milestone> (record_agent_run, role verifier; a headless verifier's reply opening VERDICT: PASS; verifier-M1-pre does not count). minutes leave out the time the milestone was parked and any machine or workspace pause. A skip over an empty commit range is refused: commit first. skip: docs-only lands a milestone whose commit range changed only docs; skip: no-code one that changed no source file (put the evidence, e.g. a green pipeline, in evidence).",
-      inputSchema: {
-        run: z.string(),
-        milestone: z.string().regex(ID_PATTERN),
-        what: z.string().min(1),
-        commit: z.string().regex(/^[0-9a-f]{7,40}$/),
-        evidence: z.string().min(1),
-        next: z.string().min(1),
-        learned: z.string().min(1).optional(),
-        skip: z.enum(LAND_SKIPS).optional(),
-      },
-    },
-    (a) => handle(() => land(deps, a)),
-  );
-}

package/src/entry/mcp/protocol-tools.ts

@@ -1,63 +0,0 @@
-import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { z } from "zod";
-import { ID_PATTERN } from "../../domain/ids.ts";
-import { gateCheckOrList, gatePass } from "../../services/gate-service.ts";
-import { answer, park } from "../../services/questions.ts";
-import type { Deps } from "../../services/ports.ts";
-import { handle } from "./result.ts";
-
-// Spec 1.1 §7 and §8: the tools the enforced protocol adds.
-export function registerProtocolTools(server: McpServer, deps: Deps): void {
-  const gate = {
-    run: z.string(),
-    item: z.string().min(1),
-    command: z.string().min(1),
-    paths: z.array(z.string().min(1)).min(1),
-  };
-
-  server.registerTool(
-    "gate_check",
-    {
-      description:
-        "The verifier, before running a gate item: { carried: true, passedAt, commit } when this repo already has a pass of the same command on the same content of paths (repo-relative; . for the whole repo: the tracked files plus uncommitted not-ignored changes; the repo's lockfiles always count, so never name node_modules; a git-ignored input such as .env or a build output is hashed only when named as a path, and as absent while it is not built), so it reports the item as carried over from that commit instead of running it; else { carried: false }, and it runs the item. Either way the call is recorded as the verifier's current step, which status and peek show. Pass milestone (the M the verifier checks): the milestone's digest then lists only its own carried items, and the answer adds recorded, the items already checked for that milestone in this run, each with its command and whether it passed. Call it first with only run and milestone to get that list without checking anything: reuse those item names, and re-check the failed ones first.",
-      inputSchema: {
-        run: z.string(),
-        item: gate.item.optional(),
-        command: gate.command.optional(),
-        paths: gate.paths.optional(),
-        milestone: z.string().regex(ID_PATTERN).optional(),
-      },
-    },
-    (a) => handle(() => gateCheckOrList(deps, a)),
-  );
-
-  server.registerTool(
-    "gate_pass",
-    {
-      description:
-        "The verifier, after a gate item passed: records the command, the content hash of paths and the commit, with the evidence (a log path or the decisive line), so a later gate_check on unchanged content carries it over.",
-      inputSchema: { ...gate, evidence: z.string().min(1) },
-    },
-    (a) => handle(() => gatePass(deps, a)),
-  );
-
-  server.registerTool(
-    "park",
-    {
-      description:
-        "An owner question only the user can answer: parks the milestone (land refuses it until answered) and puts it in front of state.md's next step, instead of stopping the run. Returns the parked milestones and hints: push the full question to the user with PushNotification, and go on with the milestones and runs that do not depend on it.",
-      inputSchema: { run: z.string(), milestone: z.string().regex(ID_PATTERN), question: z.string().min(1) },
-    },
-    (a) => handle(() => park(deps, a)),
-  );
-
-  server.registerTool(
-    "answer",
-    {
-      description:
-        "The owner answered a parked milestone's question in this session: records the answer and unparks the milestone. status, peek and run_start list the questions still open.",
-      inputSchema: { run: z.string(), milestone: z.string().regex(ID_PATTERN), answer: z.string().min(1) },
-    },
-    (a) => handle(() => answer(deps, a)),
-  );
-}

package/src/entry/mcp/push-tools.ts

@@ -1,16 +0,0 @@
-import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { probePush } from "../../services/doctor-push.ts";
-import type { Deps } from "../../services/ports.ts";
-import { handle } from "./result.ts";
-
-export function registerPushTools(server: McpServer, deps: Deps): void {
-  server.registerTool(
-    "test_push",
-    {
-      description:
-        "Send this session one labeled smoke message through catherd's push (Claude Code's peer inbox, or the native Codex queue for this thread) and return the receipt: { outcome, enqueue, processing, msgId, detail }. A receipt proves the host accepted it, never that the model read it. For a check from inside a session, where a shell cannot name the Codex thread; catherd doctor --test-push --thread <uuid> is the shell's form.",
-      inputSchema: {},
-    },
-    () => handle(() => probePush(deps.host, process.env)),
-  );
-}