create-agdf 0.20.1 → 0.30.0

package/lib/mcp-dispatch-runtime.js

@@ -1,65 +1,17 @@
 import { createCoreServices } from "#agdf-core";
 import { resources } from "./runtime/control-context.js";
-import {
-  SKILL_DISPATCH_CONTRACT_VERSION,
-  SKILL_DISPATCH_FUNCTION_DEFINITION,
-  SKILL_DISPATCH_SCHEMA_VERSION,
-  SKILL_DISPATCH_MAX_OUTPUT_BYTES,
-  emptySkillDispatchTiming,
-  parseSkillDispatchFunctionArguments,
-  serializeSkillDispatchResult,
-  SkillDispatchInputError,
-} from "#agdf-core/skill-dispatch/contract.js";
-import { TaskTargetInputError } from '#agdf-core/task-target-resolution.js';
-import { ReadSelectionError } from '#agdf-core/control-inspect/selection.js';
-import { localePack } from '#agdf-core/interaction-presentation.js';
-import { TOOL_ERROR_CONTRACT, TOOL_RESULT_META, describeToolResult, projectToolResult, consumeToolResult, executionFacts, validExecutionFacts } from '#agdf-core/mcp-tool-errors.js';
-import { existsSync, lstatSync, readFileSync, realpathSync } from "node:fs";
-import { isAbsolute, join, resolve } from "node:path";
-import { CONTROL_INSPECT_FUNCTION_DEFINITION, parseControlInspectFunctionArguments, serializeControlInspectResult } from "#agdf-core/control-inspect/contract.js";
-import { createInspectFailureResult } from "#agdf-core/control-inspect/service.js";
+import { cliGitObservation } from './control-evaluation/git-observation.js';
+import { createReadWorkerBudget } from '#agdf-core/control-read/cockpit-pool.js';
+import { createDoctorObservationService } from '#agdf-core/control-inspect/doctor-observation.js';
+import { createPresentationDelivery } from '#agdf-core/control-state/presentation-delivery.js';
+import { mcpControlContinuation } from '#agdf-core/skill-dispatch/mcp-continuation.js';
+import { inspectRunInputResolution } from '#agdf-core/control-state/run-input-resolution.js';
 import { assertMcpControlReadBoundary } from "#agdf-core/control-read-boundary.js";
-import { interactionLocales, packageRoot, pluginDefinition } from "./cli/runtime-context.js";
-import { RUN_COMMAND_GROUPS, RUN_COMMAND_LIMITS, commandGroupDefinition, validateRunCommand, runCommandRequestDigest } from '#agdf-core/control-state/run-command-contract.js';
-import {
-  digestDirectory,
-  digestMcpDispatcherPackage,
-  digestMcpSdkRuntime,
-  evaluateDecisionAppQualification, inspectDecisionAppQualification,
-} from "#agdf-core/runtime/plugin-provenance.js";
-
-const MCP_RUNTIME_OWNER = "create-agdf:mcp-runtime";
-
-function errorSupport(cockpit = false) {
-  return {
-    toolErrorContract: TOOL_ERROR_CONTRACT, responseLimit: SKILL_DISPATCH_MAX_OUTPUT_BYTES,
-    projectToolResult(name, input = {}, result, facts) {
-      const pack = localePack(interactionLocales, input.presentation_language ?? (cockpit ? 'de' : 'en'));
-      const { _meta, ...domain } = result;
-      const serialize = name === 'agdf_dispatch' ? serializeSkillDispatchResult : name === 'agdf_inspect' ? serializeControlInspectResult : JSON.stringify;
-      const checked = JSON.parse(serialize(domain));
-      const projected = projectToolResult(name, input, { ...checked, ...(_meta ? { _meta } : {}) }, pack, facts);
-      // Existing serializers can replace oversized output before projection.
-      // Their terminal instruction must agree with the same bounded guidance.
-      if (checked.outcome === 'evaluator_error' && checked.diagnostics?.some(d => ['dispatch_output_too_large', 'inspect_output_too_large'].includes(d.code))) {
-        const message = projected._meta[TOOL_RESULT_META].message;
-        return { ...projected, recovery: { action: message }, host_action: { ...projected.host_action, text: message } };
-      }
-      return projected;
-    },
-    consumeToolResult,
-    normalizeFailure(error, { phase = 'execute' } = {}) {
-      if (phase === 'parse' && (error instanceof SkillDispatchInputError || error instanceof TaskTargetInputError || error instanceof ReadSelectionError)) {
-        const facts = { code: error instanceof ReadSelectionError ? 'inspect_input_invalid' : 'dispatch_input_invalid', dispatch: 'not_dispatched', ...(error.field ? { field: error.field } : {}) };
-        return validExecutionFacts(facts) ? facts : { code: 'dispatch_input_invalid', dispatch: 'not_dispatched' };
-      }
-      if (phase === 'parse' && ['command_schema_invalid', 'resource_denied', 'decision_schema_invalid'].includes(error?.code ?? error?.message))
-        return { code: error.code ?? error.message, dispatch: 'not_dispatched' };
-      return executionFacts(error, { phase });
-    },
-  };
-}
-
+import { existsSync, lstatSync, realpathSync } from 'node:fs';
+import { isAbsolute } from 'node:path';
+import { composeMcpProtocolRuntime, errorSupport, inspectMcpDispatcherRuntime, configuredMcpCommandGroups } from './mcp-protocol-runtime.js';
+export { inspectMcpDispatcherRuntime, configuredMcpCommandGroups, CONTROL_INSPECT_FUNCTION_DEFINITION, SKILL_DISPATCH_FUNCTION_DEFINITION,
+  parseControlInspectFunctionArguments, parseSkillDispatchFunctionArguments, serializeSkillDispatchResult, DECISION_UI_URI, OWNED_LOCK_CHANNEL, releaseAbandonedOwnedLock } from './mcp-protocol-runtime.js';
 export async function createMcpCockpitRuntime({ surface, cockpitDir, cockpitMode, inspected = inspectMcpDispatcherRuntime() } = {}) {
   const pluginMode = cockpitMode === 'plugin';
   if (cockpitMode !== undefined && !pluginMode || pluginMode && (surface !== 'codex' || cockpitDir !== undefined)
@@ -83,6 +35,7 @@ export async function createMcpCockpitRuntime({ surface, cockpitDir, cockpitMode
   ];
   // Claude Code renders no MCP app UI today; its cockpit stays hidden until a client declares support.
   return Object.freeze({ ...errorSupport(true), mode: 'cockpit', definition: renderDefinition, tools,
+    producerIdentity: inspected.generationIdentity ?? null,
     uiCapabilityRequired: pluginMode || surface === 'claude', responseLimit: READ_LIMITS.response,
     ...(pluginMode ? { unsupportedUiCode: 'host_ui_unsupported' } : {}),
     ui: Object.freeze({ uri: COCKPIT_UI_URI, mimeType: COCKPIT_MIME, limit: COCKPIT_LIMITS.html,
@@ -96,265 +49,85 @@ export async function createMcpCockpitRuntime({ surface, cockpitDir, cockpitMode
   });
 }
 
-function readOwnedRuntimeMarker(dispatcherDigest) {
-  const root = resolve(packageRoot, "..", "..");
-  const markerPath = join(root, ".agdf-mcp-owned.json");
-  const serverRoot = join(root, "node_modules", "@agdf", "mcp-server");
-  const sdkServerRoot = join(root, "node_modules", "@modelcontextprotocol", "server");
-  const sdkCoreRoot = join(root, "node_modules", "@modelcontextprotocol", "core");
-  const sdkClientRoot = join(root, "node_modules", "@modelcontextprotocol", "client");
-  const sdkV1Root = join(root, "node_modules", "@modelcontextprotocol", "sdk");
-  try {
-    if (lstatSync(packageRoot).isSymbolicLink() || !existsSync(markerPath)
-        || !existsSync(serverRoot) || !existsSync(sdkServerRoot) || !existsSync(sdkCoreRoot)
-        || existsSync(sdkClientRoot) || existsSync(sdkV1Root)) return null;
-    if ([serverRoot, sdkServerRoot, sdkCoreRoot].some((path) => {
-      const stats = lstatSync(path);
-      return !stats.isDirectory() || stats.isSymbolicLink();
-    })) return null;
-    const marker = JSON.parse(readFileSync(markerPath, "utf8"));
-    const serverManifest = JSON.parse(readFileSync(join(serverRoot, "package.json"), "utf8"));
-    const sdkServerManifest = JSON.parse(readFileSync(join(sdkServerRoot, "package.json"), "utf8"));
-    const sdkCoreManifest = JSON.parse(readFileSync(join(sdkCoreRoot, "package.json"), "utf8"));
-    const serverDigest = digestDirectory(serverRoot);
-    const sdkDigest = digestMcpSdkRuntime(root);
-    if (![1, 2].includes(marker.schema_version)
-        || marker.owner !== MCP_RUNTIME_OWNER
-        || marker.version !== pluginDefinition.version
-        || serverManifest.name !== "@agdf/mcp-server"
-        || serverManifest.version !== pluginDefinition.version
-        || serverManifest.dependencies?.["create-agdf"] !== pluginDefinition.version
-        || serverManifest.dependencies?.["@modelcontextprotocol/server"] !== "2.0.0"
-        || sdkServerManifest.name !== "@modelcontextprotocol/server"
-        || sdkServerManifest.version !== "2.0.0"
-        || sdkCoreManifest.name !== "@modelcontextprotocol/core"
-        || sdkCoreManifest.version !== "2.0.0"
-        || marker.dispatcher_digest !== dispatcherDigest
-        || marker.server_digest !== serverDigest
-        || marker.sdk_digest !== sdkDigest) return null;
-    return Object.freeze({ markerPath, root, dispatcherDigest, serverDigest, sdkDigest, decisionQualification: marker.decision_app_qualification });
-  } catch {
-    return null;
-  }
-}
-
-export {
-  CONTROL_INSPECT_FUNCTION_DEFINITION,
-  SKILL_DISPATCH_FUNCTION_DEFINITION,
-  parseControlInspectFunctionArguments,
-  parseSkillDispatchFunctionArguments,
-  serializeSkillDispatchResult,
-};
-export { DECISION_UI_URI } from '#agdf-core/mcp-resource-contract.js';
-// The worker executor releases locks of a thread it has seen exit (packages/mcp-server).
-export { OWNED_LOCK_CHANNEL, releaseAbandonedOwnedLock } from '#agdf-core/control-state/run-state-writer.js';
-
-const FAILURE_ACTIONS = Object.freeze({
-  dispatch_busy: "Wait for the active AGDF dispatch to finish and retry once.",
-  dispatch_cancelled: "Retry the AGDF dispatch if it is still required.",
-  dispatch_timeout: "Inspect the original operation status before replaying the identical UUID and request; a timeout does not prove rollback.",
-  dispatch_worker_termination_unconfirmed: "Inspect the original operation status and retained executor; its termination is unconfirmed. Do not start a replacement mutation.",
-  dispatch_worker_failed: "Repair the installed AGDF MCP runtime and retry once.",
-  runtime_version_mismatch: "Install matching AGDF MCP server and dispatcher versions, then retry once.",
-  runtime_provenance_invalid: "Repair the owned AGDF MCP runtime and retry once.",
-});
-
-function createFailureResult(code, runtimeEvidence) {
-  const action = FAILURE_ACTIONS[code] ?? FAILURE_ACTIONS.dispatch_worker_failed;
-  return {
-    schema_version: SKILL_DISPATCH_SCHEMA_VERSION,
-    contract_version: SKILL_DISPATCH_CONTRACT_VERSION,
-    outcome: "evaluator_error",
-    terminal: true,
-    authorizes: false,
-    skill: null,
-    runtime: runtimeEvidence,
-    target: null,
-    control: null,
-    presentation: null,
-    continuation: null,
-    recovery: { action },
-    host_action: {
-      mode: "transmit_recovery_verbatim_and_stop",
-      source: "recovery.action",
-      text: action,
-      allow_surrounding_text: false,
-      may_request_run_or_evidence: false,
-    },
-    timing: emptySkillDispatchTiming(),
-    diagnostics: [{ code }],
-  };
-}
-
-export function inspectMcpDispatcherRuntime() {
-  const runtimeDigest = digestMcpDispatcherPackage(packageRoot);
-  const owned = readOwnedRuntimeMarker(runtimeDigest);
-  return Object.freeze({
-    expectedVersion: pluginDefinition.version,
-    packageRoot,
-    skillSet: pluginDefinition.skillSet,
-    interactionLocales,
-    provenanceStatus: owned ? "matched" : "unowned",
-    generationIdentity: owned ? { server_digest: owned.serverDigest, dispatcher_digest: owned.dispatcherDigest, sdk_digest: owned.sdkDigest } : null,
-    runtimeEvidence: Object.freeze({
-      machine_validation: owned ? "local_exact_version_digest" : "unavailable",
-      plugin_root: packageRoot,
-      runtime_digest: runtimeDigest,
-      provenance_status: owned ? "matched" : "unowned",
-    }),
-    decisionQualificationReport: owned ? (client, resourceDigest) => inspectDecisionAppQualification(owned.root, owned.decisionQualification, {
-      client, server_digest: owned.serverDigest, dispatcher_digest: owned.dispatcherDigest, sdk_digest: owned.sdkDigest, resource_digest: resourceDigest,
-    }) : () => ({ qualified: false, reason: 'runtime_provenance_unavailable', authorizes: false }),
-    decisionQualification: owned ? (client, resourceDigest) => evaluateDecisionAppQualification(owned.root, owned.decisionQualification, {
-      client, server_digest: owned.serverDigest, dispatcher_digest: owned.dispatcherDigest,
-      sdk_digest: owned.sdkDigest, resource_digest: resourceDigest,
-    }) : () => false,
-  });
-}
-
-export function configuredMcpCommandGroups(env = process.env) {
-  if (env.AGDF_MCP_COMMAND_GROUPS === undefined) return Object.keys(RUN_COMMAND_GROUPS);
-  const values = env.AGDF_MCP_COMMAND_GROUPS === '' ? [] : env.AGDF_MCP_COMMAND_GROUPS.split(',');
-  if (new Set(values).size !== values.length || values.some(group => !Object.hasOwn(RUN_COMMAND_GROUPS, group))) throw Error('AGDF_MCP_COMMAND_GROUPS_INVALID');
-  return values;
-}
-
-export function createMcpDispatchRuntime({ surface, inspected = inspectMcpDispatcherRuntime(), commandGroups = configuredMcpCommandGroups(), runtimeControl } = {}) {
-  const trustedContext = Object.freeze({
-    surface,
-    expectedVersion: inspected.expectedVersion,
-    skillSet: inspected.skillSet,
-    interactionLocales: inspected.interactionLocales,
-    provenanceStatus: inspected.provenanceStatus ?? "unowned",
-    commandGroups: Object.freeze([...commandGroups]),
-    decisionQualification: inspected.decisionQualification ?? (() => false),
-    decisionQualificationReport: inspected.decisionQualificationReport ?? (() => ({ qualified: false, reason: 'host_context_unavailable', authorizes: false })),
-  });
+export function createMcpDispatchRuntime({ surface, inspected = inspectMcpDispatcherRuntime(), commandGroups = configuredMcpCommandGroups(), runtimeControl, materialGrants, verifyRuntime, inputContext, executionContext } = {}) {
+  const readBudget = createReadWorkerBudget();
+  const delivery = createPresentationDelivery();
+  const verifyProducer = verifyRuntime ?? (() => {
+      const current = inspectMcpDispatcherRuntime();
+      if (current.provenanceStatus !== 'matched' || current.runtimeEvidence.runtime_digest !== inspected.runtimeEvidence.runtime_digest
+        || JSON.stringify(current.generationIdentity) !== JSON.stringify(inspected.generationIdentity))
+        throw Object.assign(Error('runtime_provenance_invalid'), { code: 'runtime_provenance_invalid' });
+      return current.generationIdentity;
+    });
+  const diagnostic = createDoctorObservationService({ budget: readBudget, gitObservation: cliGitObservation, verifyRuntime: verifyProducer });
   const services = createCoreServices({ resources, observers: {
     runtimeEvidence: inspected.runtimeEvidence,
     validateControlReadBoundary: assertMcpControlReadBoundary,
-    commandGroups, runtimeControl,
+    commandGroups, runtimeControl, materialGrants, gitObservation: cliGitObservation,
+    observeDoctor: (root, input, signal) => diagnostic.observe(root, input, signal),
   } });
-  const execute = services.dispatch;
+  const execute = input => mcpControlContinuation(input, services.dispatch(input), commandGroups);
   const executeInspect = services.inspect;
-  const parse = (argumentsValue) => parseSkillDispatchFunctionArguments(argumentsValue, trustedContext);
-  const failureEvidence = { ...inspected.runtimeEvidence, expected_version: inspected.expectedVersion };
-  const tools = Object.freeze([
-    Object.freeze({ name: SKILL_DISPATCH_FUNCTION_DEFINITION.name, definition: SKILL_DISPATCH_FUNCTION_DEFINITION, parse, execute, serialize: serializeSkillDispatchResult }),
-    Object.freeze({
-      name: CONTROL_INSPECT_FUNCTION_DEFINITION.name,
-      definition: CONTROL_INSPECT_FUNCTION_DEFINITION,
-      parse: (argumentsValue) => parseControlInspectFunctionArguments(argumentsValue, trustedContext),
-      execute: executeInspect,
-      serialize: serializeControlInspectResult,
-    }),
-    ...commandGroups.map(group => Object.freeze({ name: group, definition: commandGroupDefinition(group),
-      parse: argumentsValue => {
-        const errors = validateRunCommand(group, argumentsValue);
-        if (errors.length) throw Error('command_schema_invalid');
-        return argumentsValue;
-      }, execute: input => services.command(group, input), serialize: value => JSON.stringify(value) })),
-  ]);
-  if (tools.filter(tool => Object.hasOwn(RUN_COMMAND_GROUPS, tool.name)).reduce((bytes, tool) => bytes + Buffer.byteLength(JSON.stringify(tool.definition)), 0) > RUN_COMMAND_LIMITS.aggregate_definition_bytes) throw Error('command_aggregate_definition_budget_exceeded');
-  return Object.freeze({
-    ...errorSupport(),
-    definition: SKILL_DISPATCH_FUNCTION_DEFINITION,
-    parse,
-    execute,
-    tools,
-    tool(name) {
-      return tools.find((entry) => entry.name === name) ?? null;
-    },
-    serialize: serializeSkillDispatchResult,
-    failure(code, toolName = SKILL_DISPATCH_FUNCTION_DEFINITION.name, argumentsValue, { dispatch = 'unknown', field, cause_code, worker_phase } = {}) {
-      const facts = { code, dispatch, ...(field ? { field } : {}),
-        ...(cause_code ? { cause_code } : {}), ...(worker_phase ? { worker_phase } : {}) };
-      const finish = value => {
-        if (validExecutionFacts(facts)) {
-          const { code: _code, dispatch: _dispatch, ...details } = facts;
-          if (value.diagnostics?.length) value = { ...value, diagnostics: value.diagnostics.map((d, i) => i === 0 ? { ...d, ...details } : d) };
-          else if (facts.cause_code || facts.worker_phase) value = { ...value, diagnostics: [{ code, ...details }] };
-        }
-        const message = describeToolResult(toolName, argumentsValue ?? {}, value,
-          localePack(interactionLocales, argumentsValue?.presentation_language ?? 'en'), facts).message;
-        return value.terminal ? { ...value, recovery: { action: message }, host_action: { ...value.host_action, text: message } } : value;
-      };
-      if (Object.hasOwn(RUN_COMMAND_GROUPS, toolName)) {
-        const valid = argumentsValue && validateRunCommand(toolName, argumentsValue).length === 0;
-        return finish({ schema_version: '1', outcome: dispatch === 'not_dispatched' ? 'rejected' : 'effect_unknown', reason: code,
-          operation_id: valid ? argumentsValue.operation_id : null, request_digest: valid ? runCommandRequestDigest(argumentsValue) : null,
-          binding: valid ? { target_id: argumentsValue.target_id, run_id: argumentsValue.run_id, expected_revision_id: argumentsValue.expected_revision_id, kind: argumentsValue.command.kind } : null,
-          dispatch, authorizes: false, recovery: dispatch === 'not_dispatched' ? 'No command was dispatched by this attempt.'
-            : 'Inspect operation-status with the original UUID and preserve the exact original payload. Do not infer non-execution or create another decision.' });
-      }
-      if (toolName === CONTROL_INSPECT_FUNCTION_DEFINITION.name) {
-        const action = FAILURE_ACTIONS[code] ?? FAILURE_ACTIONS.dispatch_worker_failed;
-        return finish(createInspectFailureResult(code, failureEvidence, action));
-      }
-      return finish(createFailureResult(code, failureEvidence));
+  const protocol = composeMcpProtocolRuntime({ surface, inspected, commandGroups, execute, executeInspect, inputContext, executionContext,
+    lookupOriginal: (root, input) => ['material.stage', 'planned_material.stage'].includes(input.command?.kind) ? services.material.originalInput(input)
+      : input.command?.kind === 'presentation.deliver' ? delivery.originalInput(input)
+        : runtimeControl?.originalInput?.(input) ?? inspectRunInputResolution(root, input),
+    executeCommand: (group, input, signal, host) => ['material.stage', 'planned_material.stage'].includes(input.command.kind) ? services.material.stage(input)
+      : input.command.kind === 'presentation.deliver' ? delivery.deliver(input, host) : services.command(group, input) });
+  return Object.freeze({ ...protocol,
+    verifyProducer,
+    prepareDispatch(name, input) { return { inputContext: protocol.inputContextFor(input), materialGrants: ['agdf_record', 'agdf_revise', 'agdf_closeout'].includes(name) ? services.material.grants(input) : [] }; },
+    readBudget,
+    delivery,
+    async postprocessToolResult(name, input, result) {
+      const configuration = protocol.configurationProjection(input);
+      if (configuration && name === 'agdf_inspect' && result.report) result = { ...result, report: { ...result.report, effective_configuration: configuration } };
+      if (['agdf_record', 'agdf_revise', 'agdf_closeout'].includes(name)) services.material.settle(input, result);
+      if (name !== 'agdf_prepare' || input.command?.kind !== 'presentation.prepare' || !result.family_result?.text) return result;
+      delivery.remember(input, result);
+      const prepared = result.family_result, { operation_id, ...binding } = input;
+      return { ...result, presentation_delivery: { mode: 'prepared', text: '', presentation_id: prepared.presentation_id,
+        document_digest: prepared.document_digest, authorizes: false,
+        ...(prepared.preview_review ? { preview_review: { operation: 'presentation-preview', version: prepared.preview_review.descriptor.version,
+          content_digest: prepared.preview_review.rendered_digest, access_state: 'not_observed', target_id: input.target_id,
+          run_id: input.run_id, gate: 'PRD', expected_revision_id: input.expected_revision_id, presentation_id: prepared.presentation_id } } : {}),
+        instruction: 'Prepared, not delivered. Optionally open agdf_decision_view as a non-primary preview. Then presentation.deliver selects once. Default route markdown; no second summary.',
+        next_calls: [{ tool: 'agdf_prepare', arguments: { ...binding, command: { kind: 'presentation.deliver',
+          payload: { gate: input.command.payload.gate, presentation_id: prepared.presentation_id, route: 'markdown' } } },
+          required_input: { operation_id: 'Generate a new UUID for delivery; no gate approval is required.' } }] } };
     },
-    trustedContext,
+    async close() { services.material.close(); delivery.close(); await diagnostic.close(); },
+    inspectOwnership() { const d = diagnostic.inspectOwnership(); return { diagnostic: d, read_workers: readBudget.inspect(),
+      views: d.observations, inflight: d.inflight, uncertain: 0 }; },
   });
 }
 
-// Only the App-capable adapter loads ephemeral view owners; Copilot/default Core
-// projections do not acquire a hidden dependency on the private cockpit reader.
-export async function createMcpDecisionRuntime({ runtime, ui, appOnlyMediationQualified = false } = {}) {
+export async function createMcpDecisionRuntime({ runtime, ui, appOnlyMediationQualified = false, surfaceBinding } = {}) {
   if (!runtime || runtime.trustedContext.surface !== 'codex') throw Error('decision_runtime_surface_invalid');
-  const [{ createDecisionSessionService }, { decisionActionDefinition, validateDecisionAction },
-    { COCKPIT_READ_DEFINITION, parseCockpitArguments }] = await Promise.all([
-    import('#agdf-core/control-inspect/decision-session.js'), import('#agdf-core/control-state/decision-action-contract.js'),
-    import('#agdf-core/control-inspect/cockpit-contract.js'),
+  const [{ createDecisionSessionService }, { createCockpitSessionService }, { composeMcpDecisionProtocol }] = await Promise.all([
+    import('#agdf-core/control-inspect/decision-session.js'), import('#agdf-core/control-inspect/cockpit-session.js'),
+    import('./mcp-decision-protocol.js'),
   ]);
-  const groups = runtime.trustedContext.commandGroups, session = createDecisionSessionService({ groups, appOnlyMediationQualified,
+  const groups = runtime.trustedContext.commandGroups, session = createDecisionSessionService({ groups, delivery: runtime.delivery, appOnlyMediationQualified, surfaceBinding,
+    readServiceFactory: root => createCockpitSessionService(root, { budget: runtime.readBudget }),
     qualification: ({ client }) => appOnlyMediationQualified === true
       || runtime.trustedContext.decisionQualification(client, ui.digest) === true });
-  const facade = decisionActionDefinition(groups);
-  const tools = runtime.tools.map(tool => tool.name === 'agdf_prepare' ? { ...tool,
-    definition: { ...tool.definition, _meta: { ui: { resourceUri: ui.uri, visibility: ['model', 'app'] } } } } : tool);
-  tools.push({ name: COCKPIT_READ_DEFINITION.name, definition: COCKPIT_READ_DEFINITION, requiresUi: true, parentOwned: true,
-    parse: parseCockpitArguments, execute: (input, signal) => session.read(input, signal), serialize: value => JSON.stringify(value) });
-  if (facade) tools.push({ name: facade.name, definition: facade, requiresUi: true, parentOwned: true,
-    parse: input => { if (validateDecisionAction(input, facade.inputSchema.properties.action.enum).length) throw Error('decision_schema_invalid'); return input; },
-    execute: (input, signal, host) => session.action(input, host), serialize: value => JSON.stringify(value) });
-  const bytes = tools.filter(tool => Object.hasOwn(RUN_COMMAND_GROUPS, tool.name) || tool.name === facade?.name)
-    .reduce((sum, tool) => sum + Buffer.byteLength(JSON.stringify(tool.definition)), 0);
-  if (bytes > RUN_COMMAND_LIMITS.aggregate_definition_bytes) { await session.close(); throw Error('command_aggregate_definition_budget_exceeded'); }
-  return Object.freeze({ ...runtime, tools: Object.freeze(tools), ui, mode: 'decision',
-    tool: name => tools.find(tool => tool.name === name) ?? null,
+  const protocol = composeMcpDecisionProtocol({ runtime, ui, prepared: input => session.prepared(input),
+    open: (input, result, host) => session.open(input, result, host), read: (input, signal, host) => session.read(input, signal, host),
+    action: (input, host) => session.action(input, host), close: () => session.close() });
+  return Object.freeze({ ...protocol,
     async postprocessToolResult(name, input, result, { uiSupported, client } = {}) {
       if (name === 'agdf_inspect' && input.operation === 'native-qualification' && result.report?.available) {
         return { ...result, report: { ...result.report, ui_rendering_support: uiSupported ? 'supported' : 'unsupported',
           action_qualification: runtime.trustedContext.decisionQualificationReport(client, ui.digest),
           enabled_command_groups: [...groups], authorizes: false } };
       }
-      if (name !== 'agdf_prepare' || input.command?.kind !== 'presentation.prepare') return result;
-      const delivered = uiSupported ? await session.open(input, result, { client })
-        : { ...result, app_capability: 'unavailable', app_reason: 'host_ui_unsupported' };
-      const prepared = result.family_result;
-      if (typeof prepared?.text !== 'string') return delivered;
-      // Capability advertisement and an emitted resource do not prove that this
-      // request surface displays it (in particular a remote/iPad Chat). Until an
-      // actual display observation exists, send the complete decision once.
-      const displayed = delivered.app_capability === 'available' && delivered.app_display === 'confirmed';
-      const text = displayed && typeof prepared.companion_text === 'string'
-        ? prepared.companion_text : prepared.text;
-      return { ...delivered, presentation_delivery: { mode: displayed ? 'native_plus_chat' : 'full_chat', display: displayed ? 'confirmed' : 'unconfirmed',
-        text, presentation_id: prepared.presentation_id, revision_id: prepared.revision_id,
-        document_digest: prepared.document_digest ?? prepared.artefact_digest, document_language: prepared.document_language ?? null,
-        ...(prepared.preview_review ? { preview_review: { operation: 'presentation-preview', version: prepared.preview_review.descriptor.version,
-          content_digest: prepared.preview_review.rendered_digest, access_state: displayed ? 'native_bound' : 'not_observed',
-          target_id: input.target_id, run_id: input.run_id, gate: 'PRD', expected_revision_id: input.expected_revision_id, presentation_id: prepared.presentation_id } } : {}),
-        instruction: 'Forward this exact Chat text once. Do not append a second decision request. On a human request to read the document, use presentation-document with this exact binding and every returned cursor; deliver all ordered chunks in the same Chat before requesting a decision. A local file link is not remote access proof.'
-          + (prepared.preview_review ? ' The required preview uses presentation-preview with the supplied exact selectors and every cursor. Offer only supported isolated rendering of those exact bytes. If this surface cannot show it, state that access is unavailable and the review remains open; never call raw HTML, a local link or an unopened resource a viewed preview.' : ''),
-        authorizes: false } };
-    },
-    failure(code, name, input, dispatch) {
-      return name === 'agdf_decision_action' ? { schema_version: '1', outcome: dispatch?.dispatch === 'not_dispatched' ? 'rejected' : 'effect_unknown',
-        reason: code, operation_id: input?.operation_id ?? null, authorizes: false, recovery: 'Inspect the original UUID; do not infer non-execution or submit another decision.' }
-        : name === 'agdf_cockpit_read' ? { schema_version: '1', outcome: 'rejected', reason: code, authorizes: false } : runtime.failure(code, name, input, dispatch);
+      return runtime.postprocessToolResult(name, input, result);
+
     },
-    close: () => session.close(), inspectOwnership: () => session.inspectOwnership(),
+    async close() { await Promise.all([session.close(), runtime.close?.()]); },
+    inspectOwnership() { const base = runtime.inspectOwnership(), decision = session.inspectOwnership(); return { ...base, decision,
+      views: base.views + decision.views, inflight: base.inflight + decision.inflight, uncertain: base.uncertain + (decision.uncertain ?? 0) }; },
   });
 }
 

package/lib/mcp-lifecycle/adapters/codex-origin-probe.js

@@ -5,8 +5,20 @@ import { fileURLToPath } from 'node:url';
 import { resolveHostCommand } from '../../host-command.js';
 import { CODEX_MCP_STARTUP_ARGS, independentCodexEnvironment } from '../../host-adapters/codex/mcp-startup.js';
 
-export function observeCodexOrigins({ target, all = false, command, spawnProcess = spawn, timeoutMs = 45_000, now = Date.now }) {
+export function codexStartupConfiguration(result) {
+  const key = 'mcp_optional_startup_grace_ms', value = result?.config?.[key];
+  const observed = Number.isSafeInteger(value) && value >= 0;
+  const type = result?.origins?.[key]?.name?.type;
+  const kind = ['user', 'project', 'system', 'sessionFlags', 'commandLine', 'profile', 'default'].includes(type) ? type : null;
+  // Never return config/layers: they may contain credentials, commands or policy.
+  return { status: observed ? 'observed' : 'unknown', wait_ms: observed ? value : null,
+    origin: kind ? { kind } : null, reason: !observed ? 'setting_not_exposed' : !kind ? 'origin_not_exposed' : null };
+}
+
+export function observeCodexOrigins({ target, all = false, mode = 'catalog', env = process.env,
+  command, spawnProcess = spawn, timeoutMs = 45_000, now = Date.now, configurationObserver = () => {} }) {
   if (typeof target !== 'string' || !isAbsolute(target)) return Promise.resolve({ status: 'unavailable', reason: 'target_invalid' });
+  if (!['catalog', 'configuration'].includes(mode)) return Promise.resolve({ status: 'unavailable', reason: 'mode_invalid' });
   return new Promise(resolve => {
     let child, pending = '', received = 0, done = false, phase = 'initialize', threadId, closing, closeTimer, pollTimer, inventoryId = 3;
     const deadline = now() + timeoutMs;
@@ -26,8 +38,8 @@ export function observeCodexOrigins({ target, all = false, command, spawnProcess
     const timer = setTimeout(() => finish({ status: 'unavailable', reason: 'timeout' }), timeoutMs);
     const send = message => child.stdin.write(JSON.stringify(message) + '\n');
     try {
-      const resolved = command ?? resolveHostCommand('codex', { env: process.env });
-      child = spawnProcess(resolved.executable, [...resolved.prefixArgs, ...CODEX_MCP_STARTUP_ARGS, 'app-server'], { cwd: target, env: independentCodexEnvironment(process.env),
+      const resolved = command ?? resolveHostCommand(env.CODEX_BIN || 'codex', { env });
+      child = spawnProcess(resolved.executable, [...resolved.prefixArgs, ...(mode === 'catalog' ? CODEX_MCP_STARTUP_ARGS : []), 'app-server'], { cwd: target, env: independentCodexEnvironment(env),
         stdio: ['pipe', 'pipe', 'pipe'], shell: false, windowsHide: true });
       child.on('error', () => finish({ status: 'unavailable', reason: 'spawn_failed' }));
       child.on('exit', (code, signal) => {
@@ -45,10 +57,22 @@ export function observeCodexOrigins({ target, all = false, command, spawnProcess
           let message; try { message = JSON.parse(line); } catch { continue; }
           if (phase === 'initialize' && message.id === 1) {
             if (message.error) return finish({ status: 'unavailable', reason: 'initialize_failed' });
-            phase = 'project'; send({ method: 'initialized' });
+            send({ method: 'initialized' });
+            if (mode === 'configuration') {
+              phase = 'configuration'; send({ id: 2, method: 'config/read', params: { includeLayers: true, cwd: target } });
+              continue;
+            }
+            phase = 'project';
             // Cwd on the process alone does not scope mcpServerStatus/list.
             // The context is in-memory and receives no turn/start or user message.
             send({ id: 2, method: 'thread/start', params: { cwd: target, ephemeral: true } });
+          } else if (phase === 'configuration' && message.id === 2) {
+            // Private observer seam for the native harness's configured-model
+            // attestation. Status still returns only its whitelisted wait facts.
+            try { if (!message.error) configurationObserver(message.result); }
+            catch { return finish({ status: 'unavailable', reason: 'configuration_observer_failed' }); }
+            finish(message.error ? { status: 'unknown', wait_ms: null, origin: null, reason: 'config_read_unsupported' }
+              : codexStartupConfiguration(message.result));
           } else if (phase === 'project' && message.id === 2) {
             const context = message.result;
             if (message.error || typeof context?.thread?.id !== 'string' || !context.thread.id

package/lib/mcp-lifecycle/adapters/copilot.js

@@ -1,6 +1,9 @@
 import { rmSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
+import { SKILL_DISPATCH_FUNCTION_DEFINITION } from '#agdf-core/skill-dispatch/contract.js';
+import { CONTROL_INSPECT_FUNCTION_DEFINITION } from '#agdf-core/control-inspect/contract.js';
+import { RUN_COMMAND_GROUPS } from '#agdf-core/control-state/run-command-contract.js';
 import {
   allSourceResult,
   atomicWrite,
@@ -16,15 +19,15 @@ const OWNER = "create-agdf:mcp-runtime";
 function entry(spec) {
   return { type: "local", command: spec.command, args: [...spec.args],
     env: { AGDF_MCP_OWNER: OWNER, AGDF_MCP_VERSION: spec.version, AGDF_MCP_DIGEST: spec.digest },
-    tools: ["agdf_dispatch", "agdf_inspect"] };
+    tools: [SKILL_DISPATCH_FUNCTION_DEFINITION.name, CONTROL_INSPECT_FUNCTION_DEFINITION.name, ...Object.keys(RUN_COMMAND_GROUPS)] };
 }
 
-function inspectPath(path, expected) {
+function inspectPath(path, expected, allowBare = false) {
   const { config } = readJsonObject(path, "AGDF_MCP_COPILOT_CONFIG_INVALID");
   if (config.mcpServers !== undefined && (!config.mcpServers || typeof config.mcpServers !== "object" || Array.isArray(config.mcpServers))) {
     throw new Error("AGDF_MCP_COPILOT_CONFIG_INVALID");
   }
-  const observedEntry = config.mcpServers?.agdf;
+  const observedEntry = (config.mcpServers ?? (allowBare ? config : {})).agdf;
   if (observedEntry === undefined) return { status: "absent", path, identity: null };
   const owned = observedEntry?.env?.AGDF_MCP_OWNER === OWNER;
   if (!owned) return { status: "foreign", path, identity: null };
@@ -56,7 +59,7 @@ function supplementalReadback({ exec, target }) {
 function inspect(input) {
   const list = sources(input);
   const selected = list.find((source) => source.selected);
-  const states = new Map(list.map((source) => [source.id, inspectPath(source.path, input.spec)]));
+  const states = new Map(list.map((source) => [source.id, inspectPath(source.path, input.spec, source.id !== 'user')]));
   return { ...allSourceResult({ sources: list, inspected: states, selectedSource: selected }),
     native_scope: input.scope, native_readback: supplementalReadback(input) };
 }
@@ -70,10 +73,13 @@ function transaction({ action, scope, target, spec, previousSpec, env }) {
   }
   const snapshot = fileSnapshot(current.path);
   const { config } = readJsonObject(current.path, "AGDF_MCP_COPILOT_CONFIG_INVALID");
-  const servers = { ...(config.mcpServers ?? {}) };
+  const bare = scope === 'project' && config.mcpServers === undefined && snapshot.existed;
+  const servers = { ...(bare ? config : config.mcpServers ?? {}) };
   if (action === "enable") servers.agdf = entry(spec); else delete servers.agdf;
-  const next = { ...config };
-  if (Object.keys(servers).length) next.mcpServers = servers; else delete next.mcpServers;
+  const next = bare ? servers : { ...config };
+  if (!bare) {
+    if (Object.keys(servers).length) next.mcpServers = servers; else delete next.mcpServers;
+  }
   const createdByAgdf = spec.reference?.created_config === true;
   const after = action === "disable" && createdByAgdf && Object.keys(next).length === 0
     ? null : `${JSON.stringify(next, null, 2)}\n`;