chainlesschain 0.163.3 → 0.163.4

package/src/lib/mcp-call-ledger-store.js

@@ -34,13 +34,16 @@ export const MCP_CALL_LEDGER_EVENT = "mcp_call_ledger";
 export const MCP_CALL_LEDGER_EVENT_SCHEMA_VERSION = 1;
 export const MCP_CALL_RECOVERY_ADJUDICATION_EVENT =
   "mcp_call_recovery_adjudication";
-export const MCP_CALL_RECOVERY_ADJUDICATION_SCHEMA_VERSION = 1;
+export const MCP_CALL_RECOVERY_ADJUDICATION_SCHEMA_VERSION = 2;
 export const McpCallRecoveryDecision = Object.freeze({
   CONFIRMED_APPLIED: "confirmed_applied",
   CONFIRMED_NOT_APPLIED: "confirmed_not_applied",
 });
 export const MCP_CALL_RECOVERY_AUTHORITY = "local-cli-tty";
-export const MCP_CALL_RECOVERY_CONFIRMATION = "typed-digest-host-stopped";
+export const MCP_CALL_RECOVERY_CONFIRMATION =
+  "typed-digest-host-authority-revoke";
+export const MCP_CALL_RECOVERY_LEGACY_CONFIRMATION =
+  "typed-digest-host-stopped";
 
 const TERMINAL = new Set([
   McpCallStatus.COMPLETED,
@@ -86,7 +89,7 @@ const EFFECT_CONTRACT_FIELDS = new Set([
 ]);
 const OUTPUT_SUMMARY_FIELDS = new Set(["sha256", "bytes", "kind"]);
 const ERROR_SUMMARY_FIELDS = new Set(["name", "code", "messageDigest"]);
-const ADJUDICATION_FIELDS = new Set([
+const LEGACY_ADJUDICATION_FIELDS = new Set([
   "schemaVersion",
   "requestId",
   "sessionId",
@@ -98,6 +101,18 @@ const ADJUDICATION_FIELDS = new Set([
   "confirmation",
   "reasonDigest",
 ]);
+const ADJUDICATION_FIELDS = new Set([
+  ...LEGACY_ADJUDICATION_FIELDS,
+  "hostRevocation",
+]);
+const HOST_REVOCATION_FIELDS = new Set([
+  "requestId",
+  "revocationEpoch",
+  "targetLeaseId",
+  "targetFencingToken",
+  "targetOwnerPid",
+]);
+const HOST_LEASE_ID = /^lease-[0-9a-f-]{36}$/;
 const RECOVERY_PROJECTION_FIELDS = new Set([
   "sessionId",
   "records",
@@ -414,9 +429,32 @@ function stableSorted(values) {
 }
 
 function canonicalAdjudication(value) {
+  const legacy = value?.schemaVersion === 1;
+  const validConfirmation =
+    (legacy && value?.confirmation === MCP_CALL_RECOVERY_LEGACY_CONFIRMATION) ||
+    (value?.schemaVersion === MCP_CALL_RECOVERY_ADJUDICATION_SCHEMA_VERSION &&
+      value?.confirmation === MCP_CALL_RECOVERY_CONFIRMATION);
+  const fields = legacy ? LEGACY_ADJUDICATION_FIELDS : ADJUDICATION_FIELDS;
+  const revocation = value?.hostRevocation;
+  const targetIsNull = revocation?.targetLeaseId === null;
+  const validRevocation =
+    legacy ||
+    (hasExactFields(revocation, HOST_REVOCATION_FIELDS) &&
+      revocation.requestId === value?.requestId &&
+      Number.isSafeInteger(revocation.revocationEpoch) &&
+      revocation.revocationEpoch >= 1 &&
+      (targetIsNull
+        ? revocation.targetFencingToken === null &&
+          revocation.targetOwnerPid === null
+        : HOST_LEASE_ID.test(String(revocation.targetLeaseId || "")) &&
+          Number.isSafeInteger(revocation.targetFencingToken) &&
+          revocation.targetFencingToken >= 1 &&
+          Number.isSafeInteger(revocation.targetOwnerPid) &&
+          revocation.targetOwnerPid >= 1));
   if (
-    !hasExactFields(value, ADJUDICATION_FIELDS) ||
-    value.schemaVersion !== MCP_CALL_RECOVERY_ADJUDICATION_SCHEMA_VERSION ||
+    !hasExactFields(value, fields) ||
+    !validConfirmation ||
+    !validRevocation ||
     !isCanonicalProtocolText(
       value.requestId,
       MCP_CALL_LEDGER_PROTOCOL_LIMITS.identifier,
@@ -433,7 +471,6 @@ function canonicalAdjudication(value) {
     !RAW_AUTHORITY_HASH.test(String(value.expectedHeadHash || "")) ||
     !PAYLOAD_DIGEST.test(String(value.expectedRecoveryDigest || "")) ||
     value.authority !== MCP_CALL_RECOVERY_AUTHORITY ||
-    value.confirmation !== MCP_CALL_RECOVERY_CONFIRMATION ||
     !PAYLOAD_DIGEST.test(String(value.reasonDigest || ""))
   ) {
     return null;
@@ -449,6 +486,17 @@ function canonicalAdjudication(value) {
     authority: value.authority,
     confirmation: value.confirmation,
     reasonDigest: value.reasonDigest,
+    ...(legacy
+      ? {}
+      : {
+          hostRevocation: Object.freeze({
+            requestId: revocation.requestId,
+            revocationEpoch: revocation.revocationEpoch,
+            targetLeaseId: revocation.targetLeaseId,
+            targetFencingToken: revocation.targetFencingToken,
+            targetOwnerPid: revocation.targetOwnerPid,
+          }),
+        }),
   });
 }
 
@@ -546,6 +594,10 @@ export function computeMcpRecoveryFenceDigest(recovery = {}) {
         authority: entry?.authority || null,
         confirmation: entry?.confirmation || null,
         reasonDigest: entry?.reasonDigest || null,
+        ...(entry?.schemaVersion ===
+        MCP_CALL_RECOVERY_ADJUDICATION_SCHEMA_VERSION
+          ? { hostRevocation: entry?.hostRevocation || null }
+          : {}),
       })),
     ),
     replayDenied: stableSorted(

package/src/lib/mcp-host-recovery-runtime.js

@@ -98,6 +98,7 @@ export function createMcpHostRecoveryRuntime({
   recovery = null,
   recoveryError = null,
   controller = null,
+  dispatchAdmission = null,
 } = {}) {
   const admissionController = tightenRecoveryController(
     controller,
@@ -120,6 +121,7 @@ export function createMcpHostRecoveryRuntime({
           resolveEffect: (serverName, toolName) =>
             resolveHostMcpEffect(bundle, serverName, toolName),
           sessionId,
+          dispatchAdmission,
         })
       : rawClient;
   return Object.freeze({

package/src/lib/mcp-ledger-recovery-admission.js

@@ -813,6 +813,7 @@ export function createRecoveryGuardedMcpClient({
   controller,
   resolveEffect = null,
   sessionId = null,
+  dispatchAdmission = null,
 } = {}) {
   if (!client || typeof client.callTool !== "function") {
     throw new TypeError("MCP client wrapper requires client.callTool()");
@@ -826,6 +827,9 @@ export function createRecoveryGuardedMcpClient({
   if (resolveEffect != null && typeof resolveEffect !== "function") {
     throw new TypeError("MCP client effect resolver must be a function");
   }
+  if (dispatchAdmission != null && typeof dispatchAdmission !== "function") {
+    throw new TypeError("MCP client dispatch admission must be a function");
+  }
 
   const existingGuard = GUARDED_MCP_CLIENTS.get(client);
   if (existingGuard) {
@@ -833,7 +837,8 @@ export function createRecoveryGuardedMcpClient({
       existingGuard.ledger === ledger &&
       existingGuard.controller === controller &&
       existingGuard.resolveEffect === resolveEffect &&
-      existingGuard.sessionId === sessionId
+      existingGuard.sessionId === sessionId &&
+      existingGuard.dispatchAdmission === dispatchAdmission
     ) {
       return client;
     }
@@ -850,6 +855,33 @@ export function createRecoveryGuardedMcpClient({
     // Snapshot before the first await. Admission, durable identity and the raw
     // transport all receive this exact deeply-frozen JSON value.
     const inputSnapshot = snapshotMcpJsonRpcInput(input);
+    let callOptions = rest;
+    if (dispatchAdmission) {
+      const supplied = rest[0];
+      if (
+        supplied != null &&
+        (typeof supplied !== "object" ||
+          Array.isArray(supplied) ||
+          isProxy(supplied))
+      ) {
+        throw new TypeError("MCP call options must be a plain object");
+      }
+      const merged = {};
+      if (supplied) {
+        for (const key of Reflect.ownKeys(supplied)) {
+          if (typeof key !== "string") {
+            throw new TypeError("MCP call options cannot contain symbols");
+          }
+          const descriptor = Object.getOwnPropertyDescriptor(supplied, key);
+          if (!descriptor || !("value" in descriptor)) {
+            throw new TypeError("MCP call options cannot contain accessors");
+          }
+          merged[key] = descriptor.value;
+        }
+      }
+      merged.dispatchAdmission = dispatchAdmission;
+      callOptions = [merged, ...rest.slice(1)];
+    }
     const effect = await resolveHostEffectContract(
       resolveEffect,
       client,
@@ -871,10 +903,13 @@ export function createRecoveryGuardedMcpClient({
         serverName,
         toolName,
         inputSnapshot,
-        ...rest,
+        ...callOptions,
       ]);
     } catch (callError) {
-      if (effect.effectContract.effect !== McpEffect.READ) {
+      if (
+        effect.effectContract.effect !== McpEffect.READ &&
+        safeProperty(callError, "dispatched") !== false
+      ) {
         throw outcomeUnknown(
           controller,
           ticket,
@@ -1060,6 +1095,7 @@ export function createRecoveryGuardedMcpClient({
     controller,
     resolveEffect,
     sessionId,
+    dispatchAdmission,
   });
   return wrappedClient;
 }

package/src/lib/mcp-recovery-adjudication.js

@@ -1,10 +1,10 @@
-import { randomUUID as nodeRandomUUID } from "node:crypto";
 import { appendAuthorityEventIfHead as storeAppendAuthorityEventIfHead } from "../harness/jsonl-session-store.js";
 import {
   MCP_CALL_RECOVERY_ADJUDICATION_EVENT,
   MCP_CALL_RECOVERY_ADJUDICATION_SCHEMA_VERSION,
   MCP_CALL_RECOVERY_AUTHORITY,
   MCP_CALL_RECOVERY_CONFIRMATION,
+  MCP_CALL_RECOVERY_LEGACY_CONFIRMATION,
   McpCallRecoveryDecision,
   deriveMcpExactReplayDenies,
   loadMcpLedgerRecovery,
@@ -15,6 +15,7 @@ import {
   sha256PayloadDigest,
   snapshotMcpJsonRpcInput,
 } from "./mcp-call-ledger.js";
+import { revokeSessionHostAuthority as storeRevokeSessionHostAuthority } from "./session-host-lease.js";
 
 const PAYLOAD_DIGEST = /^sha256:[0-9a-f]{64}$/;
 const RAW_AUTHORITY_HASH = /^[0-9a-f]{64}$/;
@@ -32,6 +33,30 @@ const PUBLIC_REPLAY_DENY_FIELDS = new Set([
   "inputBytes",
   "replayDigest",
 ]);
+const PUBLIC_ADJUDICATION_FIELDS_V1 = new Set([
+  "schemaVersion",
+  "requestId",
+  "sessionId",
+  "ledgerId",
+  "decision",
+  "expectedHeadHash",
+  "expectedRecoveryDigest",
+  "authority",
+  "confirmation",
+  "reasonDigest",
+]);
+const PUBLIC_ADJUDICATION_FIELDS_V2 = new Set([
+  ...PUBLIC_ADJUDICATION_FIELDS_V1,
+  "hostRevocation",
+]);
+const PUBLIC_HOST_REVOCATION_FIELDS = new Set([
+  "requestId",
+  "revocationEpoch",
+  "targetLeaseId",
+  "targetFencingToken",
+  "targetOwnerPid",
+]);
+const HOST_LEASE_ID = /^lease-[0-9a-f-]{36}$/;
 
 export class McpRecoveryAdjudicationError extends Error {
   constructor(code, message, options = {}) {
@@ -40,6 +65,9 @@ export class McpRecoveryAdjudicationError extends Error {
     this.code = code;
     this.sessionId = options.sessionId || null;
     this.ledgerId = options.ledgerId || null;
+    this.hostRevocation = options.hostRevocation || null;
+    this.commitState = options.commitState || null;
+    this.outcomeUnknown = options.outcomeUnknown === true;
   }
 }
 
@@ -226,25 +254,70 @@ export function publicMcpRecoveryAuthority(sessionId, recovery) {
     });
   });
   const adjudications = snapshot.adjudications.map((entry) => {
+    const legacy = entry?.schemaVersion === 1;
+    const fields = Object.keys(entry || {});
+    const allowedFields = legacy
+      ? PUBLIC_ADJUDICATION_FIELDS_V1
+      : PUBLIC_ADJUDICATION_FIELDS_V2;
     const requestId = canonicalIdentifier(entry?.requestId);
     const ledgerId = canonicalLedgerId(entry?.ledgerId);
+    const confirmationIsValid =
+      (entry?.schemaVersion === 1 &&
+        entry?.confirmation === MCP_CALL_RECOVERY_LEGACY_CONFIRMATION) ||
+      (entry?.schemaVersion === MCP_CALL_RECOVERY_ADJUDICATION_SCHEMA_VERSION &&
+        entry?.confirmation === MCP_CALL_RECOVERY_CONFIRMATION);
+    const revocation = entry?.hostRevocation;
+    const revocationFields = Object.keys(revocation || {});
+    const targetIsNull = revocation?.targetLeaseId === null;
+    const revocationIsValid =
+      legacy ||
+      (revocationFields.length === PUBLIC_HOST_REVOCATION_FIELDS.size &&
+        revocationFields.every((field) =>
+          PUBLIC_HOST_REVOCATION_FIELDS.has(field),
+        ) &&
+        revocation?.requestId === requestId &&
+        Number.isSafeInteger(revocation?.revocationEpoch) &&
+        revocation.revocationEpoch >= 1 &&
+        (targetIsNull
+          ? revocation.targetFencingToken === null &&
+            revocation.targetOwnerPid === null
+          : HOST_LEASE_ID.test(String(revocation?.targetLeaseId || "")) &&
+            Number.isSafeInteger(revocation?.targetFencingToken) &&
+            revocation.targetFencingToken >= 1 &&
+            Number.isSafeInteger(revocation?.targetOwnerPid) &&
+            revocation.targetOwnerPid >= 1));
     if (
+      fields.length !== allowedFields.size ||
+      fields.some((field) => !allowedFields.has(field)) ||
       !requestId ||
       !ledgerId ||
       !Object.values(McpCallRecoveryDecision).includes(entry?.decision) ||
       entry?.authority !== MCP_CALL_RECOVERY_AUTHORITY ||
-      entry?.confirmation !== MCP_CALL_RECOVERY_CONFIRMATION ||
+      !confirmationIsValid ||
+      !revocationIsValid ||
       !PAYLOAD_DIGEST.test(String(entry?.reasonDigest || ""))
     ) {
       return invalidProjection();
     }
     return Object.freeze({
+      schemaVersion: entry.schemaVersion,
       requestId,
       ledgerId,
       decision: entry.decision,
       authority: entry.authority,
       confirmation: entry.confirmation,
       reasonDigest: entry.reasonDigest,
+      ...(legacy
+        ? {}
+        : {
+            hostRevocation: Object.freeze({
+              requestId: revocation.requestId,
+              revocationEpoch: revocation.revocationEpoch,
+              targetLeaseId: revocation.targetLeaseId,
+              targetFencingToken: revocation.targetFencingToken,
+              targetOwnerPid: revocation.targetOwnerPid,
+            }),
+          }),
     });
   });
   return Object.freeze({
@@ -286,14 +359,106 @@ export function buildMcpRecoveryAdjudicationChallenge({
     );
   }
   return (
-    `HOST STOPPED; ADJUDICATE ${canonicalSessionId} ${canonicalId} ` +
+    `HOST STOPPED AND MCP DISPATCH DRAINED; REVOKE HOST AUTHORITY; ADJUDICATE ${canonicalSessionId} ${canonicalId} ` +
     `${canonicalDecision} ${canonicalDigest}`
   );
 }
 
+function deterministicAdjudicationRequestId({
+  sessionId,
+  ledgerId,
+  decision,
+  expectedHeadHash,
+  expectedRecoveryDigest,
+  reasonDigest,
+}) {
+  const digest = sha256PayloadDigest({
+    schemaVersion: MCP_CALL_RECOVERY_ADJUDICATION_SCHEMA_VERSION,
+    sessionId,
+    ledgerId,
+    decision,
+    expectedHeadHash,
+    expectedRecoveryDigest,
+    reasonDigest,
+  });
+  return `mcp-recovery-${digest.slice("sha256:".length)}`;
+}
+
+function canonicalHostRevocation(value, requestId, context) {
+  let snapshot;
+  try {
+    snapshot = snapshotMcpJsonRpcInput(value);
+  } catch (cause) {
+    throw new McpRecoveryAdjudicationError(
+      "CC_MCP_RECOVERY_HOST_REVOCATION_FAILED",
+      "MCP recovery host revocation returned malformed authority",
+      { ...context, cause },
+    );
+  }
+  const targetIsNull = snapshot?.targetLeaseId === null;
+  if (
+    !snapshot ||
+    snapshot.requestId !== requestId ||
+    snapshot.reasonCode !== "mcp-recovery-adjudication" ||
+    !Number.isSafeInteger(snapshot.revocationEpoch) ||
+    snapshot.revocationEpoch < 1 ||
+    typeof snapshot.replayed !== "boolean" ||
+    (targetIsNull
+      ? snapshot.targetFencingToken !== null || snapshot.targetOwnerPid !== null
+      : !HOST_LEASE_ID.test(String(snapshot.targetLeaseId || "")) ||
+        !Number.isSafeInteger(snapshot.targetFencingToken) ||
+        snapshot.targetFencingToken < 1 ||
+        !Number.isSafeInteger(snapshot.targetOwnerPid) ||
+        snapshot.targetOwnerPid < 1)
+  ) {
+    throw new McpRecoveryAdjudicationError(
+      "CC_MCP_RECOVERY_HOST_REVOCATION_FAILED",
+      "MCP recovery host revocation returned malformed authority",
+      context,
+    );
+  }
+  return Object.freeze({
+    requestId: snapshot.requestId,
+    revocationEpoch: snapshot.revocationEpoch,
+    replayed: snapshot.replayed,
+    targetLeaseId: snapshot.targetLeaseId,
+    targetFencingToken: snapshot.targetFencingToken,
+    targetOwnerPid: snapshot.targetOwnerPid,
+  });
+}
+
+function persistedHostRevocation(hostRevocation) {
+  return Object.freeze({
+    requestId: hostRevocation.requestId,
+    revocationEpoch: hostRevocation.revocationEpoch,
+    targetLeaseId: hostRevocation.targetLeaseId,
+    targetFencingToken: hostRevocation.targetFencingToken,
+    targetOwnerPid: hostRevocation.targetOwnerPid,
+  });
+}
+
+function exactAdjudicationReadback(sessionId, data, dependencies) {
+  try {
+    const recovery = readMcpRecoveryAuthority(sessionId, dependencies);
+    const expected = sha256PayloadDigest(data);
+    const match = recovery.adjudications.find(
+      (entry) =>
+        entry?.requestId === data.requestId &&
+        sha256PayloadDigest(entry) === expected,
+    );
+    if (!match || !RAW_AUTHORITY_HASH.test(String(recovery.headHash || ""))) {
+      return null;
+    }
+    return Object.freeze({ hash: recovery.headHash, recovery });
+  } catch {
+    return null;
+  }
+}
+
 /**
- * Append exactly one human adjudication authority event under a verified-head
- * CAS. A stale comparison is returned to the caller and is never retried.
+ * Durably revoke current host authority, then append exactly one human
+ * adjudication event under a verified-head CAS. A stale comparison is never
+ * retried; the capability-reducing revocation remains durable on append loss.
  */
 export async function adjudicateMcpRecovery(request, dependencies = {}) {
   let safeRequest;
@@ -364,9 +529,16 @@ export async function adjudicateMcpRecovery(request, dependencies = {}) {
   }
 
   const reasonDigest = sha256PayloadDigest(reason);
-  const randomUUID = dependencies.randomUUID || nodeRandomUUID;
   const requestId = canonicalIdentifier(
-    safeRequest.requestId || `mcp-recovery-${randomUUID()}`,
+    safeRequest.requestId ||
+      deterministicAdjudicationRequestId({
+        sessionId,
+        ledgerId,
+        decision,
+        expectedHeadHash: recovery.headHash,
+        expectedRecoveryDigest: recovery.recoveryDigest,
+        reasonDigest,
+      }),
   );
   if (!requestId) {
     throw new McpRecoveryAdjudicationError(
@@ -375,6 +547,39 @@ export async function adjudicateMcpRecovery(request, dependencies = {}) {
       context,
     );
   }
+  const revokeSessionHostAuthority =
+    dependencies.revokeSessionHostAuthority || storeRevokeSessionHostAuthority;
+  let hostRevocation;
+  try {
+    hostRevocation = canonicalHostRevocation(
+      await revokeSessionHostAuthority(sessionId, {
+        requestId,
+        reasonCode: "mcp-recovery-adjudication",
+      }),
+      requestId,
+      context,
+    );
+  } catch (cause) {
+    if (cause instanceof McpRecoveryAdjudicationError) throw cause;
+    const commitState = cause?.commitState || "unknown";
+    if (commitState !== "not-committed") {
+      throw new McpRecoveryAdjudicationError(
+        "CC_MCP_RECOVERY_HOST_REVOCATION_OUTCOME_UNKNOWN",
+        "MCP recovery host revocation outcome is unknown; do not retry or adjudicate until exact authority readback succeeds",
+        {
+          ...context,
+          cause,
+          commitState,
+          outcomeUnknown: true,
+        },
+      );
+    }
+    throw new McpRecoveryAdjudicationError(
+      "CC_MCP_RECOVERY_HOST_REVOCATION_FAILED",
+      "MCP recovery host authority could not be durably revoked; no adjudication was appended",
+      { ...context, cause, commitState },
+    );
+  }
   const data = Object.freeze({
     schemaVersion: MCP_CALL_RECOVERY_ADJUDICATION_SCHEMA_VERSION,
     requestId,
@@ -386,6 +591,7 @@ export async function adjudicateMcpRecovery(request, dependencies = {}) {
     authority: MCP_CALL_RECOVERY_AUTHORITY,
     confirmation: MCP_CALL_RECOVERY_CONFIRMATION,
     reasonDigest,
+    hostRevocation: persistedHostRevocation(hostRevocation),
   });
   const appendAuthorityEventIfHead =
     dependencies.appendAuthorityEventIfHead || storeAppendAuthorityEventIfHead;
@@ -403,22 +609,52 @@ export async function adjudicateMcpRecovery(request, dependencies = {}) {
     if (cause?.code === "SESSION_REVISION_STALE") {
       throw new McpRecoveryAdjudicationError(
         "CC_MCP_RECOVERY_ADJUDICATION_STALE",
-        "MCP recovery authority changed; run show again before adjudicating",
-        { ...context, cause },
+        "MCP recovery authority changed after host revocation; run show again before adjudicating",
+        { ...context, cause, hostRevocation },
+      );
+    }
+    const commitState = cause?.commitState || "unknown";
+    if (commitState !== "not-committed") {
+      const readback = exactAdjudicationReadback(sessionId, data, dependencies);
+      if (readback) {
+        appended = readback;
+      } else {
+        throw new McpRecoveryAdjudicationError(
+          "CC_MCP_RECOVERY_ADJUDICATION_OUTCOME_UNKNOWN",
+          "MCP recovery adjudication persistence outcome is unknown; host authority remains revoked and exact transcript reconciliation is required before retry",
+          {
+            ...context,
+            cause,
+            hostRevocation,
+            commitState,
+            outcomeUnknown: true,
+          },
+        );
+      }
+    } else {
+      throw new McpRecoveryAdjudicationError(
+        "CC_MCP_RECOVERY_ADJUDICATION_PERSIST_FAILED",
+        "MCP recovery adjudication was not persisted; host authority remains revoked",
+        { ...context, cause, hostRevocation, commitState },
       );
     }
-    throw new McpRecoveryAdjudicationError(
-      "CC_MCP_RECOVERY_ADJUDICATION_PERSIST_FAILED",
-      "MCP recovery adjudication was not persisted",
-      { ...context, cause },
-    );
   }
   if (!appended || !RAW_AUTHORITY_HASH.test(String(appended.hash || ""))) {
-    throw new McpRecoveryAdjudicationError(
-      "CC_MCP_RECOVERY_ADJUDICATION_PERSIST_FAILED",
-      "MCP recovery adjudication did not return a durable authority hash",
-      context,
-    );
+    const readback = exactAdjudicationReadback(sessionId, data, dependencies);
+    if (readback) {
+      appended = readback;
+    } else {
+      throw new McpRecoveryAdjudicationError(
+        "CC_MCP_RECOVERY_ADJUDICATION_OUTCOME_UNKNOWN",
+        "MCP recovery adjudication returned no durable authority hash; host authority remains revoked and exact transcript reconciliation is required",
+        {
+          ...context,
+          hostRevocation,
+          commitState: appended?.commitState || "unknown",
+          outcomeUnknown: true,
+        },
+      );
+    }
   }
 
   return Object.freeze({
@@ -437,6 +673,7 @@ export async function adjudicateMcpRecovery(request, dependencies = {}) {
         : [],
     ),
     replayDenied: decision === McpCallRecoveryDecision.CONFIRMED_APPLIED,
+    hostRevocation,
     runtimeReloadRequired: true,
     remediation: "restart_or_resume_before_mcp_calls",
   });

package/src/lib/mcp-sandbox-policy.js

@@ -153,3 +153,32 @@ export function normalizeMcpSandboxPolicy(value, options = {}) {
 
   return Object.freeze({ requiredBoundaries });
 }
+
+/**
+ * Add the host-owned isolation floor for an exact-package stdio capsule.
+ *
+ * Source configuration is normalized as untrusted data first and can only add
+ * requirements to this floor. The returned policy is a new deeply-frozen
+ * runtime value, so neither the source object nor later launch preparation can
+ * remove a host requirement. Callers must only attach this policy after the
+ * trusted executable-identity preparer has issued a capsule execution
+ * contract; legacy stdio sources intentionally retain their existing policy.
+ * There is deliberately no source-configured escape hatch: future workspace
+ * or egress access must be a separate host-issued, authority-bound capability.
+ *
+ * @param {unknown} value
+ * @param {{label?: string}} [options]
+ * @returns {{requiredBoundaries: readonly string[]}}
+ */
+export function enforceMcpStdioCapsuleHostSandboxPolicy(value, options = {}) {
+  const sourcePolicy = normalizeMcpSandboxPolicy(value, options);
+  const requiredBoundaries = Object.freeze(
+    [
+      ...new Set([
+        ...MCP_SANDBOX_BOUNDARIES,
+        ...(sourcePolicy?.requiredBoundaries || []),
+      ]),
+    ].sort(),
+  );
+  return Object.freeze({ requiredBoundaries });
+}