create-agdf 0.20.1 → 0.30.0

package/generated/plugins/copilot/agdf/mcp/server/src/generation-entry.js

@@ -1,86 +1,4 @@
-// A directly owned private child. It never reads or writes public MCP STDIO.
+// Explicit process adapter retained for undeclared/direct runtimes.
 import process from 'node:process';
-import { createAgdfWorkerExecutor } from './server.js';
-import { loadCockpitResource } from './cockpit-resource.js';
-import { generationMessage, validGenerationMessage, generationManifest, generationFailureReason } from './generation-protocol.js';
-import { createMcpDispatchRuntime, createMcpDecisionRuntime, createMcpCockpitRuntime, DECISION_UI_URI,
-  inspectMcpDispatcherRuntime, releaseAbandonedOwnedLock } from 'create-agdf/mcp-dispatch-runtime';
-const epoch = process.argv[2], generation = Number(process.argv[3]);
-let runtime, executor, starting = false, closing = false, inflight = 0, serverDigest, sdkDigest, uiDigest;
-const observed = new Set(), unknown = new Set();
-function status() {
-  const owned = runtime?.inspectOwnership?.() ?? { views: 0 };
-  return { ...owned, inflight: inflight + (starting ? 1 : 0) + (owned.inflight ?? 0),
-    executor: executor?.active ? 1 : 0, uncertain: unknown.size + (owned.uncertain ?? 0), closing };
-}
-function send(input, kind, payload) {
-  const reply = generationMessage(epoch, generation, kind, payload, {}, input.original_operation_id, input.request_id);
-  if (validGenerationMessage(reply, { epoch, generation, reply: true })) process.send?.(reply);
-  else process.send?.(generationMessage(epoch, generation, 'failure', { reason: 'generation_result_limit' }, {}, input.original_operation_id, input.request_id));
-}
-process.on('message', async input => {
-  if (!validGenerationMessage(input, { epoch, generation }) || observed.has(input.request_id)) return;
-  if (observed.size >= 8192) { send(input, 'failure', { reason: 'generation_request_capacity' }); return; }
-  observed.add(input.request_id);
-  try {
-    if (input.kind === 'qualify') {
-      if (runtime || starting || closing) throw Error('generation_already_initialized');
-      starting = true;
-      const { surface, commandGroups, cockpitDir, cockpitMode } = input.payload;
-      const inspected = inspectMcpDispatcherRuntime();
-      if (inspected.provenanceStatus !== 'matched') throw Error('runtime_provenance_invalid');
-      runtime = cockpitDir || cockpitMode ? await createMcpCockpitRuntime({ surface, cockpitDir, cockpitMode, inspected })
-        : createMcpDispatchRuntime({ surface, commandGroups, inspected });
-      if (!cockpitDir && !cockpitMode && surface === 'codex') {
-        const ui = { uri: DECISION_UI_URI, mimeType: 'text/html;profile=mcp-app', limit: 4 * 1024 ** 2, kind: 'decision' };
-        ui.digest = loadCockpitResource(ui).digest;
-        runtime = await createMcpDecisionRuntime({ runtime, ui });
-      }
-      if (runtime.ui) uiDigest = loadCockpitResource(runtime.ui).digest;
-      // Inspect reports package-owned immutable identities, not caller evidence.
-      sdkDigest = inspected.generationIdentity.sdk_digest; serverDigest = inspected.generationIdentity.server_digest;
-      executor = runtime.mode === 'cockpit' ? null : createAgdfWorkerExecutor(runtime, { releaseOwnedLock: releaseAbandonedOwnedLock });
-      const support = { ui: Boolean(runtime.ui), app_mediation: runtime.mode === 'decision'
-        && runtime.trustedContext.decisionQualification(input.context.client, uiDigest) === true };
-      starting = false;
-      send(input, 'qualified', { manifest: generationManifest(runtime, uiDigest, sdkDigest),
-        producer: { server_digest: serverDigest, dispatcher_digest: inspected.generationIdentity.dispatcher_digest, sdk_digest: sdkDigest }, support });
-    } else if (input.kind === 'session_inspect') {
-      send(input, 'status', status());
-    } else if (input.kind === 'shutdown') {
-      if (closing || starting || inflight || unknown.size) throw Error('generation_work_protected');
-      closing = true;
-      await executor?.close(); await runtime?.close?.();
-      const remaining = status();
-      if (remaining.views || remaining.inflight || remaining.executor || remaining.uncertain) throw Error('generation_cleanup_unconfirmed');
-      send(input, 'closed', remaining);
-      process.disconnect(); // Natural exit, no kill, after all owned work is closed.
-    } else {
-      if (!runtime || closing) throw Error('generation_unavailable');
-      const { name, arguments: args } = input.payload, tool = runtime.tool?.(name) ?? runtime.tools.find(t => t.name === name);
-      if (!tool || tool.requiresUi && input.context.uiSupported !== true) throw Error('resource_denied');
-      ++inflight;
-      let result, phase = tool.parentOwned || !executor ? 'parse' : 'execute';
-      try {
-        if (tool.parentOwned || !executor) {
-          const parsed = tool.parse(args); phase = 'execute';
-          result = await tool.execute(parsed, undefined, input.context);
-        } else result = await executor.execute(args, { toolName: name });
-        if (runtime.postprocessToolResult) result = await runtime.postprocessToolResult(name, args, result, input.context);
-        if (input.original_operation_id && result.outcome === 'effect_unknown') unknown.add(input.original_operation_id);
-        if (name === 'agdf_inspect' && args.operation === 'operation-status' && result.report?.status === 'recorded'
-          && result.report.receipt?.operation_id === args.module) unknown.delete(args.module);
-        send(input, 'result', runtime.projectToolResult(name, args, result));
-      } catch (error) {
-        const facts = runtime.normalizeFailure(error, { phase });
-        if (input.original_operation_id && facts.dispatch !== 'not_dispatched') unknown.add(input.original_operation_id);
-        send(input, 'result', runtime.projectToolResult(name, args, runtime.failure(facts.code, name, args, facts), facts));
-      } finally { --inflight; }
-    }
-  } catch (error) { if (input.kind === 'qualify') starting = false; send(input, 'failure', { reason: generationFailureReason(error) }); }
-});
-process.on('disconnect', () => {
-  // Loss of the facade does not cancel or replay business effects. Timers and
-  // existing worker/view owners retain their bounds; no process-wide force kill.
-  if (!closing) { void executor?.close().catch(() => {}); void runtime?.close?.().catch(() => {}); }
-});
+import { startGenerationRuntime } from './generation-runtime.js';
+startGenerationRuntime({ epoch: process.argv[2], generation: Number(process.argv[3]), channel: { on: (...args) => process.on(...args), send: value => process.send?.(value), close: () => process.disconnect() } });

package/generated/plugins/copilot/agdf/mcp/server/src/generation-protocol.js

@@ -1,44 +1,2 @@
-import { createHash } from 'node:crypto';
-export const GENERATION_LIMITS = Object.freeze({ slots: 3, input: 65536, result: 1048576, qualify: 30000, close: 10000, receipts: 256, routes: 4096 });
-const uuid = value => typeof value === 'string' && /^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/u.test(value);
-const fields = ['schema_version', 'owner_epoch', 'generation_id', 'request_id', 'kind', 'original_operation_id', 'payload', 'context'];
-export function validGenerationMessage(value, { epoch, generation, reply = false } = {}) {
-  if (!value || typeof value !== 'object' || Array.isArray(value) || Object.keys(value).sort().join() !== [...fields].sort().join()
-    || value.schema_version !== '1' || value.owner_epoch !== epoch || value.generation_id !== generation
-    || !uuid(value.request_id) || !(value.original_operation_id === null || uuid(value.original_operation_id))
-    || !Number.isSafeInteger(value.generation_id) || value.generation_id < 1
-    || !(reply ? ['qualified', 'result', 'status', 'closed', 'failure'] : ['qualify', 'invoke', 'session_inspect', 'shutdown']).includes(value.kind)
-    || !value.context || typeof value.context !== 'object' || Array.isArray(value.context)) return false;
-  try { return Buffer.byteLength(JSON.stringify(value)) <= (reply ? GENERATION_LIMITS.result : GENERATION_LIMITS.input); } catch { return false; }
-}
-export function generationMessage(epoch, generation, kind, payload, context = {}, original = null, requestId) {
-  return { schema_version: '1', owner_epoch: epoch, generation_id: generation, request_id: requestId,
-    kind, original_operation_id: original, payload, context };
-}
-export function generationManifest(runtime, uiDigest, sdkDigest) {
-  if (typeof runtime.toolErrorContract !== 'string' || !runtime.toolErrorContract
-    || typeof runtime.projectToolResult !== 'function' || typeof runtime.consumeToolResult !== 'function'
-    || typeof runtime.normalizeFailure !== 'function') throw Error('generation_manifest_incompatible');
-  // Stable transport shape, never business eligibility or a human-origin proof.
-  return { schema_version: '1', mode: runtime.mode ?? 'headless', sdk_digest: sdkDigest,
-    protocol: 'mcp-sdk/2:stdio-legacy-and-modern', tool_error_contract: runtime.toolErrorContract,
-    tools: runtime.tools.map(tool => ({ name: tool.name, definition: tool.definition })),
-    resource: runtime.ui ? { uri: runtime.ui.uri, mimeType: runtime.ui.mimeType, digest: uiDigest } : null,
-    command_groups: [...(runtime.trustedContext.commandGroups ?? [])] };
-}
-export const manifestDigest = manifest => createHash('sha256').update(JSON.stringify(manifest)).digest('hex');
-
-const FAILURE_REASONS = new Set([
-  'generation_unavailable', 'generation_input_limit', 'generation_response_unknown', 'generation_connection_lost',
-  'generation_capacity_protected', 'generation_manifest_incompatible', 'generation_result_limit',
-  'generation_request_capacity', 'generation_already_initialized', 'generation_work_protected',
-  'generation_cleanup_unconfirmed', 'resource_denied', 'runtime_provenance_invalid', 'runtime_version_mismatch',
-  'dispatch_busy', 'dispatch_cancelled', 'dispatch_timeout', 'dispatch_worker_failed', 'dispatch_worker_termination_unconfirmed',
-  'runtime_publication_unowned', 'runtime_candidate_manifest_invalid', 'runtime_candidate_unowned', 'runtime_candidate_digest_mismatch',
-  'AGDF_MCP_EXECUTABLE_CLAIM_INVALID', 'AGDF_MCP_EXECUTABLE_CLAIM_CONTENDED',
-  'AGDF_MCP_EXECUTABLE_CLAIM_LOCK_UNCONFIRMED', 'AGDF_MCP_PUBLICATION_DEADLINE_EXCEEDED',
-]);
-export function generationFailureReason(error) {
-  const reason = error?.code ?? error?.message;
-  return FAILURE_REASONS.has(reason) ? reason : 'generation_runtime_failed';
-}
+// One SDK-free protocol owner, shared with the actual lifecycle owner.
+export * from '#agdf-owner-protocol';

package/generated/plugins/copilot/agdf/mcp/server/src/generation-runtime.js

@@ -0,0 +1,94 @@
+// A directly owned private child. It never reads or writes public MCP STDIO.
+import { createAgdfWorkerExecutor } from './worker.js';
+import { loadCockpitResource } from './cockpit-resource.js';
+import { generationMessage, validGenerationMessage, generationManifest, generationFailureReason } from './generation-protocol.js';
+import { createMcpDispatchRuntime, createMcpDecisionRuntime, createMcpCockpitRuntime, DECISION_UI_URI,
+  inspectMcpDispatcherRuntime, releaseAbandonedOwnedLock } from 'create-agdf/mcp-worker-runtime';
+export function startGenerationRuntime({ epoch, generation, channel }) {
+  let runtime, executor, starting = false, closing = false, inflight = 0, serverDigest, sdkDigest, uiDigest;
+  const observed = new Set(), unknown = new Set();
+  function status() {
+    const owned = runtime?.inspectOwnership?.() ?? { views: 0 };
+    return { ...owned, inflight: inflight + (starting ? 1 : 0) + (owned.inflight ?? 0),
+      executor: executor?.active ? 1 : 0, uncertain: unknown.size + (owned.uncertain ?? 0), closing };
+  }
+  function send(input, kind, payload) {
+    const reply = generationMessage(epoch, generation, kind, payload, {}, input.original_operation_id, input.request_id);
+    if (validGenerationMessage(reply, { epoch, generation, reply: true })) channel.send(reply);
+    else channel.send(generationMessage(epoch, generation, 'failure', { reason: 'generation_result_limit' }, {}, input.original_operation_id, input.request_id));
+  }
+  channel.on('message', async input => {
+    if (!validGenerationMessage(input, { epoch, generation }) || observed.has(input.request_id)) return;
+    if (observed.size >= 8192) { send(input, 'failure', { reason: 'generation_request_capacity' }); return; }
+    observed.add(input.request_id);
+    try {
+      if (input.kind === 'qualify') {
+        if (runtime || starting || closing) throw Error('generation_already_initialized');
+        starting = true;
+        const { surface, commandGroups, cockpitDir, cockpitMode } = input.payload;
+        const inspected = inspectMcpDispatcherRuntime();
+        if (inspected.provenanceStatus !== 'matched') throw Error('runtime_provenance_invalid');
+        runtime = cockpitDir || cockpitMode ? await createMcpCockpitRuntime({ surface, cockpitDir, cockpitMode, inspected })
+          : createMcpDispatchRuntime({ surface, commandGroups, inspected });
+        if (!cockpitDir && !cockpitMode && surface === 'codex') {
+          const ui = { uri: DECISION_UI_URI, mimeType: 'text/html;profile=mcp-app', limit: 4 * 1024 ** 2, kind: 'decision' };
+          ui.digest = loadCockpitResource(ui).digest;
+          runtime = await createMcpDecisionRuntime({ runtime, ui });
+        }
+        if (runtime.ui) uiDigest = loadCockpitResource(runtime.ui).digest;
+        // Inspect reports package-owned immutable identities, not caller evidence.
+        sdkDigest = inspected.generationIdentity.sdk_digest; serverDigest = inspected.generationIdentity.server_digest;
+        executor = runtime.mode === 'cockpit' ? null : createAgdfWorkerExecutor(runtime, { releaseOwnedLock: releaseAbandonedOwnedLock });
+        const support = { ui: Boolean(runtime.ui), app_mediation: runtime.mode === 'decision'
+          && runtime.trustedContext.decisionQualification(input.context.client, uiDigest) === true };
+        starting = false;
+        send(input, 'qualified', { manifest: generationManifest(runtime, uiDigest, sdkDigest),
+          producer: { server_digest: serverDigest, dispatcher_digest: inspected.generationIdentity.dispatcher_digest, sdk_digest: sdkDigest }, support });
+      } else if (input.kind === 'session_inspect') {
+        send(input, 'status', status());
+      } else if (input.kind === 'shutdown') {
+        if (closing || starting || inflight || unknown.size) throw Error('generation_work_protected');
+        closing = true;
+        await executor?.close(); await runtime?.close?.();
+        const remaining = status();
+        if (remaining.views || remaining.inflight || remaining.executor || remaining.uncertain) throw Error('generation_cleanup_unconfirmed');
+        send(input, 'closed', remaining);
+        channel.close(); // Natural exit, no kill, after all owned work is closed.
+      } else {
+        if (!runtime || closing) throw Error('generation_unavailable');
+        const { name } = input.payload;
+        let args = input.payload.arguments;
+        const tool = runtime.tool?.(name) ?? runtime.tools.find(t => t.name === name);
+        if (!tool || tool.requiresUi && input.context.uiSupported !== true) throw Error('resource_denied');
+        ++inflight;
+        const parentOwned = typeof tool.parentOwned === 'function' ? tool.parentOwned(args) : tool.parentOwned;
+        const started = performance.now();
+        let result, phase = parentOwned || !executor ? 'parse' : 'execute';
+        try {
+          phase = 'parse';
+          args = runtime.prepareInput?.(name, args) ?? args;
+          phase = parentOwned || !executor ? 'parse' : 'execute';
+          if (parentOwned || !executor) {
+            const parsed = tool.parse(args); phase = 'execute';
+            result = await tool.execute(parsed, undefined, input.context);
+          } else result = await executor.execute(args, { toolName: name, trusted: runtime.prepareDispatch?.(name, args) });
+          if (runtime.postprocessToolResult) result = await runtime.postprocessToolResult(name, args, result, input.context);
+          if (input.original_operation_id && result.outcome === 'effect_unknown') unknown.add(input.original_operation_id);
+          if (name === 'agdf_inspect' && args.operation === 'operation-status' && result.report?.status === 'recorded'
+            && (result.report.receipt?.operation_id ?? result.report.receipt?.operation?.operation_id) === args.module.split('/').at(-1)) unknown.delete(args.module.split('/').at(-1));
+          send(input, 'result', runtime.projectToolResult(name, args, result));
+        } catch (error) {
+          const facts = runtime.normalizeFailure(error, { phase });
+          if (input.original_operation_id && facts.dispatch !== 'not_dispatched') unknown.add(input.original_operation_id);
+          send(input, 'result', runtime.projectToolResult(name, args, runtime.failure(facts.code, name, args, { ...facts, elapsed_ms: performance.now() - started }), facts));
+        } finally { --inflight; }
+      }
+    } catch (error) { if (input.kind === 'qualify') starting = false; send(input, 'failure', { reason: generationFailureReason(error) }); }
+  });
+  channel.on('disconnect', () => {
+    // Loss of the facade does not cancel or replay business effects. Timers and
+    // existing worker/view owners retain their bounds; no process-wide force kill.
+    if (!closing) { void executor?.close().catch(() => {}); void runtime?.close?.().catch(() => {}); }
+  });
+
+}

package/generated/plugins/copilot/agdf/mcp/server/src/generation-thread-entry.js

@@ -0,0 +1,8 @@
+// Genuine owner-hosted Worker; no public STDIO and no process impersonation.
+import { parentPort, workerData } from 'node:worker_threads';
+import { startGenerationRuntime } from './generation-runtime.js';
+if (!parentPort) throw Error('generation_unavailable');
+startGenerationRuntime({ epoch: workerData.epoch, generation: workerData.generation,
+  channel: { on: (kind, listener) => parentPort.on(kind === 'disconnect' ? 'close' : kind,
+    kind === 'message' ? wire => { try { listener(JSON.parse(wire)); } catch {} } : listener),
+    send: value => parentPort.postMessage(JSON.stringify(value)), close: () => parentPort.close() } });

package/generated/plugins/copilot/agdf/mcp/server/src/generation.js

@@ -8,7 +8,7 @@ import { DispatchExecutionError } from './worker.js';
 // One live facade, three directly owned children, no process registry or PID
 // discovery. Capacity includes startup and unconfirmed cleanup, not just current.
 export async function createOwnedGenerationFacade({ runtime, publisher, createControlRuntime, surface, cockpitDir, cockpitMode,
-  Fork = fork, qualifyMs = L.qualify, closeMs = L.close, invokeMs = L.qualify, onEvent = () => {} } = {}) {
+  generationTransport, Fork = fork, qualifyMs = L.qualify, closeMs = L.close, invokeMs = L.qualify, onEvent = () => {} } = {}) {
   if (![qualifyMs, closeMs, invokeMs].every(value => Number.isSafeInteger(value) && value > 0)
     || qualifyMs > L.qualify || closeMs > L.close || invokeMs > L.qualify) throw Error('generation_deadline_invalid');
   const epoch = randomUUID(), slots = new Map(), routes = new Map(), presentations = new Map(), operations = new Map(), receipts = new Map();
@@ -64,10 +64,16 @@ export async function createOwnedGenerationFacade({ runtime, publisher, createCo
       unknown: new Set(), inflight: 0, exited: false, closeAck: false, observed: null };
     slots.set(row.id, row); event(row, 'reserved'); // Reservation precedes acquisition/load/spawn.
     try {
-      const claim = publisher.acquire(packageInfo, { ownerEpoch: epoch, generation: row.id });
-      row.child = Fork(join(packageInfo.packageRoot, 'src/generation-entry.js'), [epoch, String(row.id)],
-        { stdio: ['ignore', 'ignore', 'ignore', 'ipc'], serialization: 'json', execArgv: [] });
-      claim.bindOwnedChild(row.child, { confirmedEnd: () => row.closeAck && !row.inflight && !row.unknown.size });
+      if (generationTransport) {
+        // This is a logical private connection. Actual Worker and claim ownership
+        // stay in the detached owner; no ChildProcess/Worker impersonation.
+        row.child = await generationTransport.open({ packageInfo, epoch, generation: row.id });
+      } else {
+        const claim = publisher.acquire(packageInfo, { ownerEpoch: epoch, generation: row.id });
+        row.child = Fork(join(packageInfo.packageRoot, 'src/generation-entry.js'), [epoch, String(row.id)],
+          { stdio: ['ignore', 'ignore', 'ignore', 'ipc'], serialization: 'json', execArgv: [] });
+        claim.bindOwnedChild(row.child, { confirmedEnd: () => row.closeAck && !row.inflight && !row.unknown.size });
+      }
       row.child.on('message', reply => {
         if (!validGenerationMessage(reply, { epoch, generation: row.id, reply: true })) { event(row, 'invalid_reply'); return; }
         const pending = row.pending.get(reply.request_id);
@@ -81,13 +87,18 @@ export async function createOwnedGenerationFacade({ runtime, publisher, createCo
           pending.resolve(reply);
         }
       });
-      row.child.once('exit', () => {
+      row.child.once('exit', (code, signal) => {
         row.exited = true;
         for (const pending of row.pending.values()) { clearTimeout(pending.timer); pending.reject(new DispatchExecutionError('generation_connection_lost')); }
         row.pending.clear();
-        if (row.closeAck && !row.inflight && !row.unknown.size) { slots.delete(row.id); row.state = 'closed'; event(row, 'confirmed_exit'); row.end?.(true); }
+        if (code === 0 && !signal && row.closeAck && !row.inflight && !row.unknown.size) { slots.delete(row.id); row.state = 'closed'; event(row, 'confirmed_exit'); row.end?.(true); }
         else { row.state = 'close_unconfirmed'; event(row, 'unexpected_exit'); row.end?.(false); }
       });
+      row.child.once('disconnect', () => {
+        row.state = 'close_unconfirmed'; event(row, 'connection_lost');
+        for (const pending of row.pending.values()) { clearTimeout(pending.timer); pending.reject(new DispatchExecutionError('generation_connection_lost')); }
+        row.pending.clear();
+      });
       row.child.once('error', () => { row.state = 'close_unconfirmed'; event(row, 'spawn_failed'); });
       row.state = 'qualifying'; event(row, 'qualifying');
       const qualified = (await request(row, 'qualify', { surface, commandGroups: [...(runtime.trustedContext.commandGroups ?? [])],
@@ -105,6 +116,11 @@ export async function createOwnedGenerationFacade({ runtime, publisher, createCo
   }
   const control = {
     status,
+    originalInput(input) {
+      const prior = receipts.get(input.operation_id);
+      if (!prior) return null;
+      return { known: true, resolution: prior.resolution ?? null };
+    },
     async refresh() { await Promise.all([...slots.values()].filter(row => !row.exited).map(observe)); return status(); },
     inspect(id, input) { const record = receipts.get(id);
       if (record && (record.input.run_id !== input.run_id || record.input.primary_target !== input.primary_target
@@ -112,18 +128,23 @@ export async function createOwnedGenerationFacade({ runtime, publisher, createCo
       return record ? { status: record.result ? 'recorded' : 'pending',
       request_digest: record.digest, result: record.result, current: status(), authorizes: false }
       : { status: 'unknown', reason: 'connection_control_record_unavailable', current: status(), authorizes: false }; },
-    async replace({ input, candidate, requestDigest, revalidate }) {
+    async replace({ input, candidate, requestDigest, resolution, revalidate }) {
       const prior = receipts.get(input.operation_id);
       if (prior) return prior.digest !== requestDigest ? failure('operation_payload_conflict')
         : prior.result ? { ...prior.result, outcome: prior.result.outcome === 'accepted' ? 'already_applied' : prior.result.outcome, historical_effect: true, current: status() }
         : { outcome: 'effect_unknown', reason: 'generation_replacement_pending', current: status(), authorizes: false };
       if (receipts.size >= L.receipts) return failure('connection_control_capacity');
       if (closed || replacing) return failure(closed ? 'connection_closed' : 'generation_replacement_busy');
-      const record = { digest: requestDigest, input, result: null }; receipts.set(input.operation_id, record); replacing = true;
+      const record = { digest: requestDigest, input, resolution, result: null }; receipts.set(input.operation_id, record); replacing = true;
       let candidateRow;
       try {
-        revalidate(); const packageInfo = publisher.resolve(candidate);
-        candidateRow = await reserve(packageInfo, actualContext); revalidate();
+        const recheck = () => {
+          if (closed) throw new DispatchExecutionError('connection_closed', 'not_dispatched');
+          controlRuntimeInstance?.verifyProducer();
+          revalidate();
+        };
+        recheck(); const packageInfo = publisher.resolve(candidate);
+        candidateRow = await reserve(packageInfo, actualContext); recheck();
         const previous = current; current = candidateRow; current.state = 'current';
         if (previous) previous.state = previous.exited ? 'close_unconfirmed' : 'draining';
         event(current, 'admitted'); record.result = { outcome: 'accepted', reason: null, operation_id: input.operation_id,
@@ -135,44 +156,66 @@ export async function createOwnedGenerationFacade({ runtime, publisher, createCo
       record.result.current = status(); return record.result;
     },
   };
-  const controlRuntime = createControlRuntime(control);
+  // Ordinary requests belong to the fully qualified generation. Only the rare
+  // facade control branches need another Core instance; share one initialization.
+  let controlRuntimePromise, controlRuntimeInstance;
+  const getControlRuntime = () => controlRuntimePromise ??= Promise.resolve().then(() => createControlRuntime(control)).then(async created => {
+    const producer = created?.producerIdentity;
+    const code = created?.trustedContext?.expectedVersion !== runtime.trustedContext.expectedVersion ? 'runtime_version_mismatch'
+      : created?.trustedContext?.provenanceStatus !== 'matched'
+      || !producer || producer.server_digest !== publisher.initial.digest || producer.dispatcher_digest !== publisher.initial.dispatcherDigest
+      || producer.sdk_digest !== publisher.initial.sdkDigest || typeof created.verifyProducer !== 'function'
+      ? 'runtime_provenance_invalid' : null;
+    if (code) {
+      await created?.close?.(); throw new DispatchExecutionError(code, 'not_dispatched');
+    }
+    controlRuntimeInstance = created;
+    return created;
+  }).catch(error => { throw new DispatchExecutionError(generationFailureReason(error), 'not_dispatched'); });
   function operationKey(input, id = input.operation_id) { return JSON.stringify([input.primary_target, input.run_id, id]); }
   async function invoke(name, args, host = {}, signal) {
     if (signal?.aborted) throw new DispatchExecutionError('dispatch_cancelled', 'not_dispatched');
     if (closed) throw new DispatchExecutionError('connection_closed', 'not_dispatched');
     actualContext = { client: host.client, uiSupported: host.uiSupported === true };
+    const canonical = Boolean(args.operation_id) && !runtime.isEphemeralControlCommand?.(name,args);
     if (args.operation_id && name === 'agdf_record' && args.command?.kind === 'runtime_generation.replace'
       && operations.has(operationKey(args))) throw new DispatchExecutionError('operation_payload_conflict', 'not_dispatched');
     if (args.operation_id && args.command?.kind !== 'runtime_generation.replace' && receipts.has(args.operation_id))
       throw new DispatchExecutionError('operation_payload_conflict', 'not_dispatched');
     if (name === 'agdf_record' && args.command?.kind === 'runtime_generation.replace'
       || name === 'agdf_inspect' && args.operation === 'runtime-generations') {
+      const controlRuntime = await getControlRuntime();
+      if (closed || signal?.aborted) throw new DispatchExecutionError(closed ? 'connection_closed' : 'dispatch_cancelled', 'not_dispatched');
+      try { controlRuntime.verifyProducer(); } catch (error) { throw new DispatchExecutionError(generationFailureReason(error), 'not_dispatched'); }
       const result = await controlRuntime.tool(name).execute(controlRuntime.tool(name).parse(args));
       return controlRuntime.projectToolResult(name, args, name === 'agdf_inspect' && result.report?.available ? { ...result, report: await control.refresh() } : result);
     }
     if (name === 'agdf_inspect' && args.operation === 'operation-status' && receipts.has(args.module)) {
+      const controlRuntime = await getControlRuntime();
+      if (closed || signal?.aborted) throw new DispatchExecutionError(closed ? 'connection_closed' : 'dispatch_cancelled', 'not_dispatched');
+      try { controlRuntime.verifyProducer(); } catch (error) { throw new DispatchExecutionError(generationFailureReason(error), 'not_dispatched'); }
       const validated = await controlRuntime.tool(name).execute(controlRuntime.tool(name).parse(args));
       return controlRuntime.projectToolResult(name, args, validated.report?.status === 'unknown' || validated.report?.status === 'absent'
         ? { ...validated, report: control.inspect(args.module, args) } : validated);
     }
     const knownSession = args.session_id && routes.get(args.session_id);
     if (args.session_id && !knownSession) throw new DispatchExecutionError('session_expired', 'not_dispatched');
-    const id = name === 'agdf_inspect' && args.operation === 'operation-status' ? args.module : args.operation_id;
+    const id = name === 'agdf_inspect' && args.operation === 'operation-status' ? args.module.split('/').at(-1) : canonical ? args.operation_id : null;
     const key = id && operationKey(args, id), original = key && operations.get(key);
     const presentationId = args.command?.payload?.presentation_id ?? args.presentation_id;
     const presentationOwner = presentationId && presentations.get(operationKey(args, presentationId));
     const row = knownSession ?? original ?? presentationOwner ?? current;
     if (!row || row.exited) throw new DispatchExecutionError('generation_unavailable', 'not_dispatched');
-    if (args.operation_id && !original) {
+    if (canonical && !original) {
       if (operations.size >= L.routes) throw new DispatchExecutionError('generation_route_capacity', 'not_dispatched');
       operations.set(key, row);
     }
     ++row.inflight; event(row, 'invoke', name);
     try {
-      const result = (await request(row, 'invoke', { name, arguments: args }, actualContext, args.operation_id ?? null, invokeMs)).payload;
-      if (args.operation_id && result.outcome === 'effect_unknown') row.unknown.add(key);
+      const result = (await request(row, 'invoke', { name, arguments: args }, actualContext, canonical ? args.operation_id : null, invokeMs)).payload;
+      if (canonical && result.outcome === 'effect_unknown') row.unknown.add(key);
       if (name === 'agdf_inspect' && args.operation === 'operation-status' && result.report?.status === 'recorded'
-        && result.report.receipt?.operation_id === args.module) row.unknown.delete(key);
+        && (result.report.receipt?.operation_id ?? result.report.receipt?.operation?.operation_id) === id) row.unknown.delete(key);
       if (result.app_capability === 'available') nativeRequired = true;
       if (result.family_result?.presentation_id && ['accepted', 'already_applied'].includes(result.outcome)) {
         const presentationKey = operationKey(args, result.family_result.presentation_id);
@@ -185,7 +228,7 @@ export async function createOwnedGenerationFacade({ runtime, publisher, createCo
         }
       }
       return result;
-    } catch (error) { if (args.operation_id && error.dispatch !== 'not_dispatched') row.unknown.add(key); throw error; }
+    } catch (error) { if (canonical && error.dispatch !== 'not_dispatched') row.unknown.add(key); throw error; }
     finally { --row.inflight; if (closed && !row.inflight && !row.unknown.size) void retire(row, true); }
   }
   current = await reserve(publisher.initial, {}); current.state = 'current'; event(current, 'admitted');
@@ -194,16 +237,17 @@ export async function createOwnedGenerationFacade({ runtime, publisher, createCo
   // not wire requests; parsing them again in a child both breaks the contract
   // and copies the entire locale registry into a bounded private message.
   const tools = runtime.tools.map(tool => ({ ...tool, parentOwned: true,
-    parse: input => { tool.parse(input); return input; }, execute: input => invoke(tool.name, input) }));
+    parse: input => { if (runtime.validatePublicInput?.(tool.name, input) !== true) tool.parse(input); return input; }, execute: input => invoke(tool.name, input) }));
   // The server supplies actual initialize/request context only at this seam.
   for (const tool of tools) tool.execute = (input, signal, host) => invoke(tool.name, input, host, signal);
   return Object.freeze({ ...runtime, tools, tool: name => tools.find(tool => tool.name === name),
-    requiresProjectedResult: true, postprocessToolResult: undefined, inspectOwnership: status, runtimeControl: control,
+    requiresProjectedResult: true, prepareInput: undefined, postprocessToolResult: undefined, inspectOwnership: status, runtimeControl: control,
     close() {
       return closing ??= (async () => {
         closed = true;
         const previous = current; current = null; if (previous && !previous.exited) previous.state = 'draining';
         await Promise.allSettled([...slots.values()].map(row => retire(row, true)));
+        if (controlRuntimePromise) await controlRuntimePromise.then(controlRuntime => controlRuntime.close?.(), () => {});
         return status();
       })();
     },

package/generated/plugins/copilot/agdf/mcp/server/src/main.js

@@ -1,15 +1,16 @@
 import { readFileSync } from "node:fs";
 import process from "node:process";
-import { createAgdfWorkerExecutor, serveAgdfStdio } from "./server.js";
 import { loadCockpitResource } from './cockpit-resource.js';
 
-export async function runMcpServer({ surface, cockpitDir, cockpitMode, runtime, executor, ownedPublication, ownedPublisher, onClosed } = {}) {
+export async function runMcpServer({ surface, cockpitDir, cockpitMode, runtime, executor, ownedPublication, ownedPublisher, generationTransport, onClosed } = {}) {
   if (cockpitMode !== undefined && (cockpitMode !== 'plugin' || surface !== 'codex' || cockpitDir !== undefined)) throw Error('AGDF_COCKPIT_TARGET_INVALID');
   const defaultRuntime = runtime === undefined && cockpitDir === undefined && cockpitMode === undefined;
   // A supplied, bound runtime owns its resources. Do not load a second package
   // composition merely to run an explicit adapter/protocol fixture.
-  const dispatcherRuntime = runtime === undefined ? await import('create-agdf/mcp-dispatch-runtime') : null;
-  runtime ??= cockpitDir !== undefined || cockpitMode !== undefined ? await dispatcherRuntime.createMcpCockpitRuntime({ surface, cockpitDir, cockpitMode }) : dispatcherRuntime.createMcpDispatchRuntime({ surface });
+  const thin = defaultRuntime && !!ownedPublication;
+  const dispatcherRuntime = runtime === undefined ? await import(thin ? 'create-agdf/mcp-protocol-runtime' : 'create-agdf/mcp-dispatch-runtime') : null;
+  runtime ??= cockpitDir !== undefined || cockpitMode !== undefined ? await dispatcherRuntime.createMcpCockpitRuntime({ surface, cockpitDir, cockpitMode })
+    : thin ? dispatcherRuntime.createMcpTransportRuntime({ surface }) : dispatcherRuntime.createMcpDispatchRuntime({ surface });
   const serverVersion = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version;
   if (runtime.trustedContext.expectedVersion !== serverVersion) {
     process.stderr.write("AGDF_MCP_VERSION_MISMATCH\n");
@@ -21,21 +22,52 @@ export async function runMcpServer({ surface, cockpitDir, cockpitMode, runtime,
     process.exitCode = 1;
     return null;
   }
-  if (defaultRuntime && surface === 'codex' && dispatcherRuntime?.createMcpDecisionRuntime) {
+  if (ownedPublication) {
+    // The serving protocol factory freshly inspects all selected source and SDK
+    // bytes. Bind that actual producer to the parent's claimed expectation;
+    // never treat a cross-thread/async observation as fresh inspection evidence.
+    const producer = runtime.producerIdentity;
+    if (!producer || producer.server_digest !== ownedPublication.digest
+      || producer.dispatcher_digest !== ownedPublication.dispatcherDigest || producer.sdk_digest !== ownedPublication.sdkDigest)
+      throw Error('AGDF_MCP_FACADE_IDENTITY_INVALID');
+  }
+  if (defaultRuntime && surface === 'codex') {
     const ui = { uri: dispatcherRuntime.DECISION_UI_URI, mimeType: 'text/html;profile=mcp-app', limit: 4 * 1024 ** 2, kind: 'decision' };
-    ui.digest = loadCockpitResource(ui).digest;
+    // The thin front has no session/qualification consumer. Its facade loads
+    // the resource for the real generation manifest; full runtimes need it here.
+    if (!thin) ui.digest = loadCockpitResource(ui).digest;
     // A shipped resource does not qualify native App-only mediation. Production
     // actions remain disabled until exact package/host evidence is provided.
-    runtime = await dispatcherRuntime.createMcpDecisionRuntime({ runtime, ui });
+    runtime = thin ? await dispatcherRuntime.createMcpDecisionTransportRuntime({ runtime, ui })
+      : await dispatcherRuntime.createMcpDecisionRuntime({ runtime, ui });
   }
   if (runtime.mode === 'cockpit') loadCockpitResource(runtime.ui);
+  let transport;
   if (ownedPublication) {
     const { createOwnedGenerationFacade } = await import('./generation.js');
     if (!ownedPublisher) throw Error('runtime_publication_unowned');
     const publisher = ownedPublisher;
-    runtime = await createOwnedGenerationFacade({ runtime, publisher, surface, cockpitDir, cockpitMode,
-      createControlRuntime: runtimeControl => dispatcherRuntime.createMcpDispatchRuntime({ surface, runtimeControl }) });
-  }
+    let beginTransport;
+    const claimed = new Promise(resolve => { beginTransport = resolve; });
+    const starting = createOwnedGenerationFacade({ runtime, publisher, generationTransport, surface, cockpitDir, cockpitMode,
+      onEvent: event => { if (event.kind === 'qualifying') beginTransport(); },
+      createControlRuntime: async runtimeControl => {
+        const full = thin ? await import('create-agdf/mcp-dispatch-runtime') : dispatcherRuntime;
+        return full.createMcpDispatchRuntime({ surface, runtimeControl });
+      } });
+    // Only a claimed private-generation start releases the SDK import. A
+    // pre-claim failure rejects starting without loading transport code. Its full
+    // qualification and the facade SDK must both finish before public service.
+    // Observe both promises so a transport failure cannot abandon a live child.
+    const transportStarting = Promise.race([claimed, starting]).then(() => import('./server.js'));
+    const [generation, loaded] = await Promise.allSettled([starting, transportStarting]);
+    if (generation.status === 'rejected' || loaded.status === 'rejected') {
+      if (generation.status === 'fulfilled') await generation.value.close();
+      throw generation.status === 'rejected' ? generation.reason : loaded.reason;
+    }
+    runtime = generation.value; transport = loaded.value;
+  } else transport = await import('./server.js');
+  const { createAgdfWorkerExecutor, serveAgdfStdio } = transport;
   const dispatchExecutor = executor ?? (runtime.mode === 'cockpit' ? undefined
     : createAgdfWorkerExecutor(runtime, { releaseOwnedLock: dispatcherRuntime?.releaseAbandonedOwnedLock ?? null }));
   const handle = serveAgdfStdio({