create-agdf 0.20.0 → 0.20.2

package/generated/submissions/openai/agdf/submission/openai/inventory.json

@@ -1,11 +1,11 @@
 {
   "schemaVersion": 1,
-  "releaseVersion": "0.20.0",
-  "digest": "fe37d912617062f0c579f267e3209fe0ead8ee58389968c27a8e6251870481fc",
+  "releaseVersion": "0.20.2",
+  "digest": "2040ebb0706cc87fdc305250e40996bfcca3e6673b3bbc6946120802b851acd1",
   "files": [
     {
       "path": ".codex-plugin/plugin.json",
-      "sha256": "0b153b6ba45b06682325389448526aa7606866db6dac0e8394b8aa84dd5d7fbf"
+      "sha256": "daf2420e5278f955d52b6d47fc6c679cee928f074631c8a93fc9793251bc413c"
     },
     {
       "path": "assets/agdf-icon.svg",
@@ -29,7 +29,7 @@
     },
     {
       "path": "meta/agdf-plugin.definition.json",
-      "sha256": "d9640b4138ca76f31fdeaa812376c248a431617cd3843a66e6325fe31b57a394"
+      "sha256": "c0d263e644b1a55658954b2eb5bbd260db2436cd5330bb83034c5a831d7b9a3e"
     },
     {
       "path": "meta/agdf-runtime-contract.md",
@@ -77,7 +77,7 @@
     },
     {
       "path": "meta/contracts/quality.md",
-      "sha256": "92522ec24f9fa96ae2258c3c5e2e0ea786a2c79a9cd07b2a9cc51c5a0d249bf8"
+      "sha256": "75be32ae784d0a8483e9427b701c30302377ee18faa860a005b4ae4d14907197"
     },
     {
       "path": "meta/contracts/request-activation.md",
@@ -85,7 +85,7 @@
     },
     {
       "path": "meta/contracts/sd-definition.md",
-      "sha256": "21d667b5a020ae651a5d3ef4748b7eb19247cfe62f3f97c38f57385adaf671eb"
+      "sha256": "9ec104f39f1e080a78b41c735791dd1520267aa608c64e6a40344885176d15ba"
     },
     {
       "path": "meta/contracts/task-target-resolution.md",
@@ -93,7 +93,7 @@
     },
     {
       "path": "meta/contracts/tp-definition.md",
-      "sha256": "0c7530bdee6458b3088d8785eec2acdd258297fdd0aaef670fd8662efd51e99f"
+      "sha256": "72232f6fc3411e97e752f8aa7d0d993a5c5b3587595e82ef28a5e176208fefb7"
     },
     {
       "path": "meta/contracts/ur-definition.md",
@@ -101,11 +101,11 @@
     },
     {
       "path": "meta/copilot-payload-baseline.json",
-      "sha256": "209c62dabccaad06115ec3f4fea953371e023be6361faa622fe6ff1bb972bb0c"
+      "sha256": "9c122518c787468112aed3c8a6f25be491a6de13d253b21e9b9a2e66e98de414"
     },
     {
       "path": "meta/distribution-profile-history.json",
-      "sha256": "8c56e91579b5349eec7d0d0097642d5ffdd79002edf958da6fd4839c4636762f"
+      "sha256": "0ec135acd06c0acfdc593c05d1e8cc0d8348614ead3ef0f5c3500264c2118e70"
     },
     {
       "path": "meta/schemas/agent-plugins/1.0.0/mcp.schema.json",
@@ -121,7 +121,7 @@
     },
     {
       "path": "plugin.json",
-      "sha256": "c0c3dd123baee5936fcad38ee3eaeccd31ba3f78f3fe94bbaaef6aae1bb87f6d"
+      "sha256": "13dfd1623af9de73f02b2858f8a41df02380862e0e956e12b55776bff9e4fc10"
     },
     {
       "path": "skills/brownfield-analysis/SKILL.md",
@@ -133,7 +133,7 @@
     },
     {
       "path": "skills/clean-implementation-review/SKILL.md",
-      "sha256": "b89b5fb38560ebf49faf9444c1bd5816835fb4399d0fc4a8aab1e92527eb1ab7"
+      "sha256": "ad59db78f10035d6439d4ce58743934e68e3a6e94b3384376b5c7346e4d54c78"
     },
     {
       "path": "skills/clean-implementation-review/help.md",
@@ -141,7 +141,7 @@
     },
     {
       "path": "skills/code-review/SKILL.md",
-      "sha256": "21870b51430849b30d3480aa28f0c6137ebcd41ea94b3ed6e57c0644bd45e9fe"
+      "sha256": "5e31849f6e20b3bae599702c91a8b1159991c6cdef3a8721821e002994d0e574"
     },
     {
       "path": "skills/code-review/help.md",
@@ -181,7 +181,7 @@
     },
     {
       "path": "skills/qa-gate/SKILL.md",
-      "sha256": "c6db8f795391ac1a73cb312e0ea20e8d5426fbd99a321387c2946740ecea01e0"
+      "sha256": "ad0ebdbc69a1f36e9ccb86991b053baee4063a9fcf9428ae5ea735e5ada229c5"
     },
     {
       "path": "skills/qa-gate/help.md",
@@ -197,7 +197,7 @@
     },
     {
       "path": "skills/sd-definition/SKILL.md",
-      "sha256": "30bb53adda60c665cb8e800b5b80622cef908f244a5909e768e90add240da4d4"
+      "sha256": "b38cc4320f12aa11a21c14fc9b8bf4f3aa7a45f22bf5262506811106bf2f581f"
     },
     {
       "path": "skills/sd-definition/help.md",
@@ -205,7 +205,7 @@
     },
     {
       "path": "skills/task-plan-review/SKILL.md",
-      "sha256": "145e9b7b3c9ea51e43a45031289ee3778ad468d8e7cce92cbdf65f9ae0e8ba1c"
+      "sha256": "8ae9cc237863484a19bdc94c8fc7f3c10b7a13386888bbfb2fc8cdde372aaf01"
     },
     {
       "path": "skills/task-plan-review/help.md",
@@ -213,7 +213,7 @@
     },
     {
       "path": "skills/tp-definition/SKILL.md",
-      "sha256": "bc219fb14bec7cc863951996850dad2f5dd4229cab82fb16a7b92f5d11bb0cdb"
+      "sha256": "825f5ba1856f665f0fa89c6fbb2c2cde293bf1f16949ba35a29974cf01896da1"
     },
     {
       "path": "skills/tp-definition/help.md",
@@ -237,23 +237,23 @@
     },
     {
       "path": "submission/openai/availability.md",
-      "sha256": "3d1a11e6e1225724b33fc59c9c82e683a6cb3192371a0d91f27b52eee91ec841"
+      "sha256": "a1b97103f9a692a818b7828c93a6af72c51e0103e0c446252109af4909e534f4"
     },
     {
       "path": "submission/openai/capability-matrix.json",
-      "sha256": "167767fd4b27e3803e29af4d3c8e23ddcd9c47fb2bc3a7ed3254cb316291af10"
+      "sha256": "97a0e62854f7cdb289d4e0c028596bf009198553594e8747cee9bcbe800a3b89"
     },
     {
       "path": "submission/openai/listing.json",
-      "sha256": "0d523fa1cc2ab879007ecedfb429a2cbfd337214de61b54cd0b8f88373f9cacc"
+      "sha256": "10e6840d84d2fbf6e8c829c75af2b6b3ca32bbb261929f67a4be5af86ebe18e1"
     },
     {
       "path": "submission/openai/release-notes.md",
-      "sha256": "754df01917f7aa3e781efb7c55ec7a057266b47b05de0e8ecdd66a843591894f"
+      "sha256": "1217ab97ca408d422b358cab4fc1f0409093ea8ddbfd37a49f2be06828b97846"
     },
     {
       "path": "submission/openai/reviewer-cases.json",
-      "sha256": "29c59fc2a3e0ed554124a8d6d4593beaf55f47baaeeea3fdc581bb91402efe7c"
+      "sha256": "1fa597b7336879aa764adb0edfb768105b3e4665857a49b62b45bd153246294e"
     }
   ]
 }

package/generated/submissions/openai/agdf/submission/openai/listing.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "releaseVersion": "0.20.0",
+  "releaseVersion": "0.20.2",
   "submissionType": "skills",
   "identity": {
     "technicalId": "agdf",

package/generated/submissions/openai/agdf/submission/openai/readiness.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "releaseVersion": "0.20.0",
+  "releaseVersion": "0.20.2",
   "candidateState": "repository_ready",
   "submissionReady": false,
   "submissionBlockers": [
@@ -16,7 +16,7 @@
     },
     "bundle": {
       "state": "pass",
-      "detail": "63 inventoried files; inventory digest fe37d912617062f0c579f267e3209fe0ead8ee58389968c27a8e6251870481fc"
+      "detail": "63 inventoried files; inventory digest 2040ebb0706cc87fdc305250e40996bfcca3e6673b3bbc6946120802b851acd1"
     },
     "installed_host": {
       "state": "unverified",

package/generated/submissions/openai/agdf/submission/openai/readiness.md

@@ -1,6 +1,6 @@
 # AGDF Public Plugin Readiness
 
-- release: `0.20.0`
+- release: `0.20.2`
 - candidate_state: `repository_ready`
 - submission_ready: `false`
 
@@ -9,7 +9,7 @@
 | Class | State | Detail |
 |---|---|---|
 | repository | pass | canonical contract and deterministic source checks |
-| bundle | pass | 63 inventoried files; inventory digest fe37d912617062f0c579f267e3209fe0ead8ee58389968c27a8e6251870481fc |
+| bundle | pass | 63 inventoried files; inventory digest 2040ebb0706cc87fdc305250e40996bfcca3e6673b3bbc6946120802b851acd1 |
 | installed_host | unverified | PPD-L02 and PPD-L03 not performed |
 | portal | unverified | unverified |
 | post_publication | unverified | not published |

package/generated/submissions/openai/agdf/submission/openai/release-notes.md

@@ -1,4 +1,4 @@
-# AGDF 0.20.0 — Initial OpenAI Public Plugin Candidate
+# AGDF 0.20.2 — Initial OpenAI Public Plugin Candidate
 
 This candidate packages the canonical AGDF workflow skills for public discovery in ChatGPT and
 Codex. It helps users assess delivery fit, preserve explicit human approvals, inspect existing-system

package/generated/submissions/openai/agdf/submission/openai/reviewer-cases.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "releaseVersion": "0.20.0",
+  "releaseVersion": "0.20.2",
   "cases": [
     {
       "id": "positive-proportional-fit",

package/lib/host-adapters/codex/config-source.js

@@ -0,0 +1,48 @@
+// A bounded lexical view for the adapter's deliberately narrow TOML readers.
+// Keep UTF-16 offsets and line endings so edits and hashes always use original
+// bytes. Comments and multiline string payloads cannot supply tables, enabled
+// fields or ownership markers. This is not a general TOML parser: unsupported
+// MCP shapes still fail the existing structural/ownership checks.
+export function codexConfigSyntax(content) {
+  if (Buffer.byteLength(content) > 65_536) throw Error('AGDF_MCP_CODEX_CONFIG_INVALID');
+  const syntax = content.split('');
+  const hide = (start, end) => {
+    for (let i = start; i < end; i++) if (content[i] !== '\n' && content[i] !== '\r') syntax[i] = ' ';
+  };
+  for (let i = 0; i < content.length;) {
+    if (content[i] === '#') {
+      const end = content.indexOf('\n', i);
+      hide(i, end < 0 ? content.length : end);
+      i = end < 0 ? content.length : end;
+      continue;
+    }
+    const quote = content[i];
+    if (quote !== '"' && quote !== "'") { i++; continue; }
+    const start = i, multiline = content.startsWith(quote.repeat(3), i);
+    i += multiline ? 3 : 1;
+    let closed = false;
+    while (i < content.length) {
+      if (quote === '"' && content[i] === '\\') {
+        if (!multiline && /[\r\n]/u.test(content[i + 1] ?? '')) throw Error('AGDF_MCP_CODEX_CONFIG_INVALID');
+        i += 2; continue;
+      }
+      if (!multiline && /[\r\n]/u.test(content[i])) throw Error('AGDF_MCP_CODEX_CONFIG_INVALID');
+      if (content[i] !== quote) { i++; continue; }
+      if (!multiline) { i++; closed = true; break; }
+      let end = i;
+      while (content[end] === quote) end++;
+      const count = end - i;
+      if (count > 5) throw Error('AGDF_MCP_CODEX_CONFIG_INVALID');
+      i = end;
+      if (count >= 3) { closed = true; break; }
+    }
+    if (!closed) throw Error('AGDF_MCP_CODEX_CONFIG_INVALID');
+    if (multiline) {
+      hide(start, i);
+      // Keep a non-boolean placeholder so a multiline enabled value is unknown,
+      // rather than mistaken for a missing field with its default value.
+      syntax[start] = quote; syntax[start + 1] = quote;
+    }
+  }
+  return syntax.join('');
+}

package/lib/mcp-dispatch-runtime.js

@@ -20,7 +20,7 @@ import { CONTROL_INSPECT_FUNCTION_DEFINITION, parseControlInspectFunctionArgumen
 import { createInspectFailureResult } from "#agdf-core/control-inspect/service.js";
 import { assertMcpControlReadBoundary } from "#agdf-core/control-read-boundary.js";
 import { interactionLocales, packageRoot, pluginDefinition } from "./cli/runtime-context.js";
-import { RUN_COMMAND_GROUPS, RUN_COMMAND_LIMITS, commandGroupDefinition, validateRunCommand, runCommandRequestDigest } from '#agdf-core/control-state/run-command-contract.js';
+import { RUN_COMMAND_GROUPS, RUN_COMMAND_LIMITS, commandGroupDefinition, validateRunCommand, validateRunCommandResult, runCommandRequestDigest } from '#agdf-core/control-state/run-command-contract.js';
 import {
   digestDirectory,
   digestMcpDispatcherPackage,
@@ -30,11 +30,19 @@ import {
 
 const MCP_RUNTIME_OWNER = "create-agdf:mcp-runtime";
 
+// Compose the canonical structural contract at the existing producing/consuming
+// boundary. The descriptor projector stays dependency-free and policy-pure.
+function checkCommandResult(name, result) {
+  if (Object.hasOwn(RUN_COMMAND_GROUPS, name) && validateRunCommandResult(result).length) {
+    throw Object.assign(new Error('tool_result_invalid'), { facts: { code: 'tool_result_invalid', dispatch: 'unknown' } });
+  }
+}
 function errorSupport(cockpit = false) {
   return {
     toolErrorContract: TOOL_ERROR_CONTRACT, responseLimit: SKILL_DISPATCH_MAX_OUTPUT_BYTES,
     projectToolResult(name, input = {}, result, facts) {
       const pack = localePack(interactionLocales, input.presentation_language ?? (cockpit ? 'de' : 'en'));
+      checkCommandResult(name, result);
       const { _meta, ...domain } = result;
       const serialize = name === 'agdf_dispatch' ? serializeSkillDispatchResult : name === 'agdf_inspect' ? serializeControlInspectResult : JSON.stringify;
       const checked = JSON.parse(serialize(domain));
@@ -47,7 +55,7 @@ function errorSupport(cockpit = false) {
       }
       return projected;
     },
-    consumeToolResult,
+    consumeToolResult(name, result) { checkCommandResult(name, result); return consumeToolResult(name, result); },
     normalizeFailure(error, { phase = 'execute' } = {}) {
       if (phase === 'parse' && (error instanceof SkillDispatchInputError || error instanceof TaskTargetInputError || error instanceof ReadSelectionError)) {
         const facts = { code: error instanceof ReadSelectionError ? 'inspect_input_invalid' : 'dispatch_input_invalid', dispatch: 'not_dispatched', ...(error.field ? { field: error.field } : {}) };

package/lib/mcp-lifecycle/adapters/codex.js

@@ -6,6 +6,7 @@ import { inspectMcpServerPackage, inspectMcpExecutableRoot } from '../package.js
 import { homedir } from "node:os";
 import { dirname, basename, join, isAbsolute, resolve, relative, sep } from "node:path";
 import { fileURLToPath } from 'node:url';
+import { codexConfigSyntax } from '../../host-adapters/codex/config-source.js';
 import {
   allSourceResult,
   atomicWrite,
@@ -49,13 +50,13 @@ function section(spec, { createdConfig = false, createdDirectory = false } = {})
 }
 
 function sectionRange(content, id = 'agdf') {
-  // This bounded owner edits generated single-line sections only. Headers inside
-  // TOML multiline strings cannot establish ownership; preserve unsupported sources.
-  if (/'''|"""/u.test(content)) throw Error('AGDF_MCP_CODEX_CONFIG_INVALID');
+  // Ownership remains limited to generated single-line sections. Ignore table
+  // examples inside unrelated TOML strings without rewriting those strings.
+  const syntax = codexConfigSyntax(content);
   const escaped = id.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
   const exactHeader = `[mcp_servers.${id}]`;
-  const headers = [...content.matchAll(new RegExp('^[ \\t]*\\[mcp_servers\\.' + escaped + '\\][ \\t]*$', 'gm'))];
-  const unsupported = content.split("\n").some((line) => {
+  const headers = [...syntax.matchAll(new RegExp('^[ \\t]*\\[mcp_servers\\.' + escaped + '\\][ \\t]*\\r?$', 'gm'))];
+  const unsupported = syntax.split("\n").some((line) => {
     const trimmed = line.trim();
     if (!trimmed || trimmed.startsWith("#")) return false;
     if (trimmed.startsWith("[")) {
@@ -71,12 +72,12 @@ function sectionRange(content, id = 'agdf') {
   const [header] = headers;
   if (!header) return null;
   const sectionStart = header.index;
-  const next = /^[ \t]*\[[^\n]+\][ \t]*$/gm;
+  const next = /^[ \t]*\[[^\r\n]+\][ \t]*\r?$/gm;
   next.lastIndex = sectionStart + header[0].length;
-  const nextHeader = next.exec(content);
+  const nextHeader = next.exec(syntax);
   let start = sectionStart;
-  const marker = content.slice(0, sectionStart).match(/(?:^|\n)(# AGDF-OWNED-MCP: [^\n]+)\n$/);
-  if (marker) start = sectionStart - marker[0].length + (marker[0].startsWith("\n") ? 1 : 0);
+  const marker = content.slice(0, sectionStart).match(/(?:^|\r?\n)(# AGDF-OWNED-MCP: [^\r\n]+)\r?\n$/);
+  if (marker) start = sectionStart - marker[0].length + (marker[0].startsWith('\r\n') ? 2 : marker[0].startsWith('\n') ? 1 : 0);
   return { start, sectionStart, end: nextHeader?.index ?? content.length, marker: marker?.[1] ?? null };
 }
 
@@ -215,11 +216,10 @@ export function inspectCodexSetup({ target, env = {}, pluginRoot } = {}) {
   for (const source of sources({ scope: 'project', target, env })) {
     try {
       const snapshot = safeSnapshot(source.path);
-      if (Buffer.byteLength(snapshot.content) > 65_536) throw Error('bounded_source');
-      if (/'''|"""/u.test(snapshot.content)) throw Error('unsupported_multiline_source');
+      const syntax = codexConfigSyntax(snapshot.content);
       const sourceDigest = createHash('sha256').update(snapshot.content).digest('hex');
       checked.push({ source: source.id, path: source.path, status: snapshot.existed ? 'declared' : 'absent', digest: sourceDigest });
-      const sections = [...snapshot.content.matchAll(/^[ \t]*\[([^\n]+)\][ \t]*$/gm)];
+      const sections = [...syntax.matchAll(/^[ \t]*\[([^\r\n]+)\][ \t]*\r?$/gm)];
       for (let index = 0; index < sections.length; index++) {
         const header = sections[index][1];
         const id = /^mcp_servers\.([A-Za-z0-9_-]+)$/u.exec(header)?.[1];
@@ -227,13 +227,13 @@ export function inspectCodexSetup({ target, env = {}, pluginRoot } = {}) {
         if (!id && !plugin) continue;
         if (entries.length >= 32) throw Error('bounded_entries');
         const name = plugin ? 'agdf' : id;
-        const body = snapshot.content.slice(sections[index].index + sections[index][0].length, sections[index + 1]?.index ?? snapshot.content.length);
+        const body = syntax.slice(sections[index].index + sections[index][0].length, sections[index + 1]?.index ?? syntax.length);
         const role = plugin ? 'product' : ['agdf-cockpit', 'agdf-cockpit-local'].includes(name) ? 'cockpit'
           : name.startsWith('agdf-test-') || ['agdf-cockpit-draft-check', 'agdf-decision-probe'].includes(name) ? 'diagnostic' : 'legacy_or_conflict';
         const value = key => new RegExp('^' + key + '[ \\t]*=[ \\t]*([^\\n#]+)', 'm').exec(body)?.[1]?.trim();
         const declaredEnabled = value('enabled');
         const enabled = declaredEnabled === 'false' ? false : declaredEnabled === 'true' ? true : declaredEnabled !== undefined || plugin ? null : true;
-        const beforeHeader = snapshot.content.slice(0, sections[index].index).match(/(# AGDF-OWNED-MCP: [^\n]+)\n$/u)?.[1];
+        const beforeHeader = snapshot.content.slice(0, sections[index].index).match(/(# AGDF-OWNED-MCP: [^\r\n]+)\r?\n$/u)?.[1];
         const mark = identity(beforeHeader);
         const exactIdOwned = mark && (plugin || name === 'agdf' || mark.server_id === name && mark.role === role);
         const timeout = key => { const raw = value(key); return raw && /^\d+(?:\.\d+)?$/u.test(raw) ? Number(raw) : null; };
@@ -298,6 +298,24 @@ function mcpTable(header) {
   return match ? { name: match[1], nested: Boolean(match[2]) } : null;
 }
 
+function mcpTables(syntax) {
+  const headers = [...syntax.matchAll(/^[ \t]*\[([^\r\n]+)\][ \t]*\r?$/gm)], tables = [], seen = new Set();
+  for (let i = 0; i < headers.length; i++) {
+    const header = headers[i][1], normalized = header.replace(/[\s"'\[\]]/gu, '');
+    if (normalized !== 'mcp_servers' && !normalized.startsWith('mcp_servers.')) continue;
+    const table = mcpTable(header);
+    if (!table || seen.has(header)) throw Error('unsupported_mcp_header');
+    seen.add(header);
+    tables.push({ ...table, bodyStart: headers[i].index + headers[i][0].length,
+      end: headers[i + 1]?.index ?? syntax.length });
+  }
+  if (syntax.split('\n').some(line => {
+    const key = line.match(/^[ \t]*([^=\n]+)=/u)?.[1]?.replace(/[\s"']/gu, '');
+    return key === 'mcp_servers' || key?.startsWith('mcp_servers.');
+  })) throw Error('unsupported_mcp_assignment');
+  return tables;
+}
+
 export function inspectCodexCockpitPlugin(pluginRoot) {
   try {
     if (!isAbsolute(pluginRoot) || portablePath(realpathSync(pluginRoot)) !== portablePath(pluginRoot)) throw Error('plugin_path_invalid');
@@ -390,12 +408,10 @@ export function createCodexCockpitTransition({ target, env = {}, serverId: id, r
     }
     // No higher/lower scope same key, aliases or second Cockpit is silently adopted.
     for (const source of snapshots) {
-      if (/'''|"""/u.test(source.content) || /^[ \t]*mcp_servers(?:[. \t]|=)/mu.test(source.content))
-        throw Error('AGDF_MCP_COCKPIT_INVENTORY_UNCONFIRMED');
-      const headers = [...source.content.matchAll(/^[ \t]*\[mcp_servers\.([^\n\]]+)\][ \t]*$/gm)];
-      for (const header of headers) {
-        const table = mcpTable(`mcp_servers.${header[1]}`);
-        if (!table) throw Error('AGDF_MCP_COCKPIT_INVENTORY_UNCONFIRMED');
+      let tables;
+      try { tables = mcpTables(codexConfigSyntax(source.content)); }
+      catch { throw Error('AGDF_MCP_COCKPIT_INVENTORY_UNCONFIRMED'); }
+      for (const table of tables) {
         if ([potentialAlias('agdf-cockpit'), potentialAlias('agdf-cockpit-local')].includes(potentialAlias(table.name))
           && !(source.path === path && table.name === id && !table.nested)) throw Error('AGDF_MCP_COCKPIT_NAME_CONFLICT');
       }
@@ -437,23 +453,18 @@ export function inspectCodexCockpitAdmission({ target, env = {}, exec, manifestR
   for (const source of sources({ scope: 'project', target, env })) {
     try {
       const snapshot = safeSnapshot(source.path), content = snapshot.content;
-      if (Buffer.byteLength(content) > 65_536 || /'''|"""/u.test(content)) throw Error('unsupported_source');
+      let syntax;
+      try { syntax = codexConfigSyntax(content); } catch { throw Error('unsupported_source'); }
       checked.push({ path: source.path, digest: sha(content) });
-      const headers = [...content.matchAll(/^[ \t]*\[([^\n]+)\][ \t]*$/gm)];
-      for (let i = 0; i < headers.length; i++) {
-        const header = headers[i][1];
-        if (!header.replace(/[\s"']/gu, '').startsWith('mcp_servers.')) continue;
-        const table = mcpTable(header);
-        if (!table) throw Error('unsupported_mcp_header');
+      for (const table of mcpTables(syntax)) {
         const name = table.name;
         if (potentialAlias(name) !== 'agdf_cockpit') continue;
         if (table.nested) throw Error('unsupported_mcp_header');
-        const body = content.slice(headers[i].index + headers[i][0].length, headers[i + 1]?.index ?? content.length);
+        const body = syntax.slice(table.bodyStart, table.end);
         const enabled = [...body.matchAll(/^[ \t]*enabled[ \t]*=[ \t]*([^\n#]+)(?:#[^\n]*)?$/gm)];
         if (enabled.length === 1 && enabled[0][1].trim() === 'false') continue;
         conflicts.push({ path: source.path, server_id: name, reason: 'same_key_or_possible_alias' });
       }
-      if (/^[ \t]*mcp_servers(?:[. \t]|=)/mu.test(content)) throw Error('unsupported_mcp_assignment');
     } catch (error) { conflicts.push({ path: source.path, reason: error.message }); }
   }
   let nativeProviderStatus = 'unobserved';

package/lib/mcp-lifecycle/adapters/copilot.js

@@ -1,6 +1,9 @@
 import { rmSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
+import { SKILL_DISPATCH_FUNCTION_DEFINITION } from '#agdf-core/skill-dispatch/contract.js';
+import { CONTROL_INSPECT_FUNCTION_DEFINITION } from '#agdf-core/control-inspect/contract.js';
+import { RUN_COMMAND_GROUPS } from '#agdf-core/control-state/run-command-contract.js';
 import {
   allSourceResult,
   atomicWrite,
@@ -16,15 +19,15 @@ const OWNER = "create-agdf:mcp-runtime";
 function entry(spec) {
   return { type: "local", command: spec.command, args: [...spec.args],
     env: { AGDF_MCP_OWNER: OWNER, AGDF_MCP_VERSION: spec.version, AGDF_MCP_DIGEST: spec.digest },
-    tools: ["agdf_dispatch", "agdf_inspect"] };
+    tools: [SKILL_DISPATCH_FUNCTION_DEFINITION.name, CONTROL_INSPECT_FUNCTION_DEFINITION.name, ...Object.keys(RUN_COMMAND_GROUPS)] };
 }
 
-function inspectPath(path, expected) {
+function inspectPath(path, expected, allowBare = false) {
   const { config } = readJsonObject(path, "AGDF_MCP_COPILOT_CONFIG_INVALID");
   if (config.mcpServers !== undefined && (!config.mcpServers || typeof config.mcpServers !== "object" || Array.isArray(config.mcpServers))) {
     throw new Error("AGDF_MCP_COPILOT_CONFIG_INVALID");
   }
-  const observedEntry = config.mcpServers?.agdf;
+  const observedEntry = (config.mcpServers ?? (allowBare ? config : {})).agdf;
   if (observedEntry === undefined) return { status: "absent", path, identity: null };
   const owned = observedEntry?.env?.AGDF_MCP_OWNER === OWNER;
   if (!owned) return { status: "foreign", path, identity: null };
@@ -56,7 +59,7 @@ function supplementalReadback({ exec, target }) {
 function inspect(input) {
   const list = sources(input);
   const selected = list.find((source) => source.selected);
-  const states = new Map(list.map((source) => [source.id, inspectPath(source.path, input.spec)]));
+  const states = new Map(list.map((source) => [source.id, inspectPath(source.path, input.spec, source.id !== 'user')]));
   return { ...allSourceResult({ sources: list, inspected: states, selectedSource: selected }),
     native_scope: input.scope, native_readback: supplementalReadback(input) };
 }
@@ -70,10 +73,13 @@ function transaction({ action, scope, target, spec, previousSpec, env }) {
   }
   const snapshot = fileSnapshot(current.path);
   const { config } = readJsonObject(current.path, "AGDF_MCP_COPILOT_CONFIG_INVALID");
-  const servers = { ...(config.mcpServers ?? {}) };
+  const bare = scope === 'project' && config.mcpServers === undefined && snapshot.existed;
+  const servers = { ...(bare ? config : config.mcpServers ?? {}) };
   if (action === "enable") servers.agdf = entry(spec); else delete servers.agdf;
-  const next = { ...config };
-  if (Object.keys(servers).length) next.mcpServers = servers; else delete next.mcpServers;
+  const next = bare ? servers : { ...config };
+  if (!bare) {
+    if (Object.keys(servers).length) next.mcpServers = servers; else delete next.mcpServers;
+  }
   const createdByAgdf = spec.reference?.created_config === true;
   const after = action === "disable" && createdByAgdf && Object.keys(next).length === 0
     ? null : `${JSON.stringify(next, null, 2)}\n`;