create-agdf 0.20.2 → 0.30.0

package/runtime/core/lib/resources/language-preference.js

@@ -0,0 +1,59 @@
+import { CURRENT_LAYOUT } from '../control-state/run-identity.js';
+import process from "node:process";
+import { canonicalizeLanguageTag } from "../interaction-presentation.js";
+import { configuredLanguage, resources } from "./context.js";
+
+export function canonicalizeDetectedSystemLocale(value) {
+  if (typeof value !== "string") return "";
+  const candidate = value.trim().split(":", 1)[0];
+  if (!candidate || /^(?:C|POSIX)(?:\.|$)/iu.test(candidate)) return "";
+  const withoutModifier = candidate.split("@", 1)[0];
+  const withoutEncoding = withoutModifier.split(".", 1)[0];
+  return canonicalizeLanguageTag(withoutEncoding.replaceAll("_", "-"));
+}
+
+export function detectSystemLocale(env = process.env) {
+  const envLocale = env.LC_ALL || env.LC_MESSAGES || env.LANG || env.LANGUAGE || "";
+  if (envLocale) return envLocale;
+  try {
+    return Intl.DateTimeFormat().resolvedOptions().locale || "";
+  } catch {
+    return "";
+  }
+}
+
+export function resolveLanguagePreference(explicitLanguage, env = process.env, context = resources) {
+  const explicit = configuredLanguage(explicitLanguage, context);
+  if (explicit) {
+    return {
+      artifact_language: explicit,
+      chat_language: explicit,
+      runtime_language: "en",
+      source: "parameter",
+      detected_locale: detectSystemLocale(env) || "unknown",
+    };
+  }
+
+  const detectedLocale = detectSystemLocale(env);
+  const detectedTag = canonicalizeDetectedSystemLocale(detectedLocale);
+  const detected = configuredLanguage(detectedTag, context);
+  return {
+    artifact_language: detected || context.defaults.document.preferences.artifact_language,
+    chat_language: detected || context.defaults.document.preferences.chat_language,
+    runtime_language: "en",
+    source: detectedLocale ? "system_locale" : "default",
+    detected_locale: detectedLocale || "unknown",
+  };
+}
+
+export function languageConfigContent(languagePreference, existing = { control_layout: CURRENT_LAYOUT }) {
+  return `${JSON.stringify({
+    ...existing,
+    ...languagePreference,
+    artifact_language: languagePreference.artifact_language,
+    chat_language: languagePreference.chat_language,
+    runtime_language: languagePreference.runtime_language,
+    source: languagePreference.source,
+    detected_locale: languagePreference.detected_locale,
+  }, null, 2)}\n`;
+}

package/runtime/core/lib/runtime/mcp-owner-protocol.js

@@ -0,0 +1,102 @@
+import { createHash } from 'node:crypto';
+export const GENERATION_LIMITS = Object.freeze({ slots: 3, input: 65536, result: 1048576, qualify: 30000, close: 10000, receipts: 256, routes: 4096 });
+const uuid = value => typeof value === 'string' && /^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/u.test(value);
+const fields = ['schema_version', 'owner_epoch', 'generation_id', 'request_id', 'kind', 'original_operation_id', 'payload', 'context'];
+export function validGenerationMessage(value, { epoch, generation, reply = false } = {}) {
+  if (!finiteJson(value) || !value || typeof value !== 'object' || Array.isArray(value) || Object.keys(value).sort().join() !== [...fields].sort().join()
+    || value.schema_version !== '1' || value.owner_epoch !== epoch || value.generation_id !== generation
+    || !uuid(value.request_id) || !(value.original_operation_id === null || uuid(value.original_operation_id))
+    || !Number.isSafeInteger(value.generation_id) || value.generation_id < 1
+    || !(reply ? ['qualified', 'result', 'status', 'closed', 'failure'] : ['qualify', 'invoke', 'session_inspect', 'shutdown']).includes(value.kind)
+    || !value.context || typeof value.context !== 'object' || Array.isArray(value.context)) return false;
+  if (['status', 'closed'].includes(value.kind) && (!value.payload || !['views', 'inflight', 'executor', 'uncertain'].every(key =>
+    Number.isSafeInteger(value.payload[key]) && value.payload[key] >= 0) || typeof value.payload.closing !== 'boolean' || value.kind === 'closed' && value.payload.closing !== true)) return false;
+  try { return Buffer.byteLength(JSON.stringify(value)) <= (reply ? GENERATION_LIMITS.result : GENERATION_LIMITS.input); } catch { return false; }
+}
+export function generationMessage(epoch, generation, kind, payload, context = {}, original = null, requestId) {
+  return JSON.parse(JSON.stringify({ schema_version: '1', owner_epoch: epoch, generation_id: generation, request_id: requestId,
+    kind, original_operation_id: original, payload, context }));
+}
+export function generationManifest(runtime, uiDigest, sdkDigest) {
+  if (typeof runtime.toolErrorContract !== 'string' || !runtime.toolErrorContract
+    || typeof runtime.projectToolResult !== 'function' || typeof runtime.consumeToolResult !== 'function'
+    || typeof runtime.normalizeFailure !== 'function') throw Error('generation_manifest_incompatible');
+  // Stable transport shape, never business eligibility or a human-origin proof.
+  return { schema_version: '1', mode: runtime.mode ?? 'headless', sdk_digest: sdkDigest,
+    protocol: 'mcp-sdk/2:stdio-legacy-and-modern', tool_error_contract: runtime.toolErrorContract,
+    tools: runtime.tools.map(tool => ({ name: tool.name, definition: tool.definition })),
+    resource: runtime.ui ? { uri: runtime.ui.uri, mimeType: runtime.ui.mimeType, digest: uiDigest } : null,
+    command_groups: [...(runtime.trustedContext.commandGroups ?? [])] };
+}
+export const manifestDigest = manifest => createHash('sha256').update(JSON.stringify(manifest)).digest('hex');
+
+const FAILURE_REASONS = new Set([
+  'generation_unavailable', 'generation_input_limit', 'generation_response_unknown', 'generation_connection_lost',
+  'generation_capacity_protected', 'generation_manifest_incompatible', 'generation_result_limit',
+  'generation_request_capacity', 'generation_already_initialized', 'generation_work_protected',
+  'generation_cleanup_unconfirmed', 'resource_denied', 'runtime_provenance_invalid', 'runtime_version_mismatch',
+  'dispatch_busy', 'dispatch_cancelled', 'dispatch_timeout', 'dispatch_worker_failed', 'dispatch_worker_termination_unconfirmed',
+  'runtime_publication_unowned', 'runtime_candidate_manifest_invalid', 'runtime_candidate_unowned', 'runtime_candidate_digest_mismatch',
+  'AGDF_MCP_EXECUTABLE_CLAIM_INVALID', 'AGDF_MCP_EXECUTABLE_CLAIM_CONTENDED',
+  'AGDF_MCP_EXECUTABLE_CLAIM_LOCK_UNCONFIRMED', 'AGDF_MCP_PUBLICATION_DEADLINE_EXCEEDED',
+]);
+export function generationFailureReason(error) {
+  const reason = error?.code ?? error?.message;
+  return FAILURE_REASONS.has(reason) ? reason : 'generation_runtime_failed';
+}
+
+// Private owner transport. JSON strings deliberately preserve the old fork wire
+// semantics instead of accepting Worker structured-clone capabilities.
+export const OWNER_EXECUTION_MODEL = 'owner_threads_v1';
+// The fixed owner header is separate from the unchanged generation wire
+// budgets. Wrapping a previously legal 64 KiB/1 MiB packet must not reject it.
+export const OWNER_LIMITS = Object.freeze({ frames: 64, bytes: 3 * GENERATION_LIMITS.result, history: 8192,
+  header: 512, inputFrame: GENERATION_LIMITS.input + 512, resultFrame: GENERATION_LIMITS.result + 512 });
+const ownerFields = ['schema_version', 'token', 'connection_epoch', 'request_id', 'kind', 'generation_epoch', 'generation_id', 'publication_id', 'payload'];
+const ownerKinds = new Set(['open', 'opened', 'send', 'message', 'exit', 'failure', 'stop', 'closed']);
+export function finiteJson(value, depth = 0, seen = new Set()) {
+  if (depth > 64) return false;
+  if (value === null || typeof value === 'string' || typeof value === 'boolean') return true;
+  if (typeof value === 'number') return Number.isFinite(value);
+  if (!value || typeof value !== 'object' || seen.has(value)) return false;
+  const array = Array.isArray(value);
+  if (Object.getPrototypeOf(value) !== (array ? Array.prototype : Object.prototype)) return false;
+  const descriptors = Object.getOwnPropertyDescriptors(value), keys = Object.keys(descriptors);
+  if (Reflect.ownKeys(value).length !== keys.length) return false;
+  if (array && (keys.length !== value.length + 1 || keys.some(key => key !== 'length' && !/^(?:0|[1-9][0-9]*)$/u.test(key)))) return false;
+  seen.add(value);
+  for (const key of keys) {
+    if (array && key === 'length') continue;
+    const d = descriptors[key];
+    if (!d.enumerable || !Object.hasOwn(d, 'value') || !finiteJson(d.value, depth + 1, seen)) { seen.delete(value); return false; }
+  }
+  seen.delete(value); return true;
+}
+export function ownerFrame(binding, kind, payload, requestId, generation = {}) {
+  return { schema_version: '1', token: binding.token, connection_epoch: binding.connection_epoch,
+    request_id: requestId, kind, generation_epoch: generation.epoch ?? null,
+    generation_id: generation.generation ?? null, publication_id: generation.publication_id ?? binding.publication_id, payload };
+}
+export function encodeOwnerFrame(value, binding, { reply = false } = {}) {
+  if (!finiteJson(value) || Object.keys(value).sort().join() !== [...ownerFields].sort().join()
+    || value.schema_version !== '1' || value.token !== binding.token || value.connection_epoch !== binding.connection_epoch
+    || !uuid(value.token) || !uuid(value.connection_epoch) || !uuid(value.request_id) || !ownerKinds.has(value.kind)
+    || !(reply ? ['opened', 'message', 'exit', 'failure', 'stop'] : ['open', 'send', 'closed']).includes(value.kind)
+    || !/^[0-9a-f]{64}$/u.test(value.publication_id ?? '')
+    || !(value.generation_epoch === null && value.generation_id === null
+      || uuid(value.generation_epoch) && Number.isSafeInteger(value.generation_id) && value.generation_id > 0)) throw Error('generation_input_limit');
+  if (Buffer.byteLength(JSON.stringify(value.payload)) > (reply ? GENERATION_LIMITS.result : GENERATION_LIMITS.input)) throw Error('generation_input_limit');
+  if (['send', 'message'].includes(value.kind) && (!validGenerationMessage(value.payload, { epoch: value.generation_epoch, generation: value.generation_id, reply: value.kind === 'message' })
+    || value.payload.request_id !== value.request_id)) throw Error('generation_input_limit');
+  const wire = JSON.stringify(value);
+  if (Buffer.byteLength(wire) > (reply ? OWNER_LIMITS.resultFrame : OWNER_LIMITS.inputFrame)) throw Error('generation_input_limit');
+  return wire;
+}
+export function decodeOwnerFrame(wire, binding, options) {
+  if (typeof wire !== 'string' || Buffer.byteLength(wire) > (options?.reply ? OWNER_LIMITS.resultFrame : OWNER_LIMITS.inputFrame)) throw Error('generation_input_limit');
+  const value = JSON.parse(wire); encodeOwnerFrame(value, binding, options); return value;
+}
+export function publicationSelector(runtime) {
+  return { schema_version: '1', publication_id: runtime.publication_id, version: runtime.version,
+    server_digest: runtime.digest, dispatcher_digest: runtime.dispatcherDigest, sdk_digest: runtime.sdkDigest };
+}

package/runtime/core/lib/runtime/plugin-provenance.js

@@ -2,6 +2,9 @@ import { createHash } from "node:crypto";
 import { existsSync, readFileSync, readdirSync, statSync, lstatSync } from "node:fs";
 import { isAbsolute, join, relative, resolve, sep } from "node:path";
 
+export const MCP_RUNTIME_OWNER = "create-agdf:mcp-runtime";
+export const MCP_RUNTIME_MARKER = ".agdf-mcp-owned.json";
+
 export const INSTALLATION_PROVENANCE_FILE = ".agdf-installation.json";
 export const LEGACY_LOCAL_INSTALL_FILE = ".agdf-local-install.json";
 export const COPILOT_PAYLOAD_INVENTORY_FILE = ".agdf-payload-inventory.json";
@@ -132,17 +135,22 @@ function readJson(path) {
   }
 }
 
-export function digestDirectory(root) {
-  const files = [];
-  function visit(directory) {
-    for (const name of readdirSync(directory).sort()) {
-      const path = join(directory, name);
-      const stats = statSync(path);
-      if (stats.isDirectory()) visit(path);
-      else if (stats.isFile()) files.push(path);
-    }
+// Every invocation reads the live directory entries and every regular file's
+// bytes. Dirent types avoid redundant per-file stat calls; links/unknown types
+// retain the original stat-following predicate. No digest or trust cache exists.
+function* directoryFiles(directory) {
+  const entries = readdirSync(directory, { withFileTypes: true })
+    .sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+  for (const entry of entries) {
+    const path = join(directory, entry.name);
+    const type = entry.isDirectory() || entry.isFile() ? entry : statSync(path);
+    if (type.isDirectory()) yield* directoryFiles(path);
+    else if (type.isFile()) yield path;
   }
-  visit(root);
+}
+
+export function digestDirectory(root) {
+  const files = [...directoryFiles(root)];
   const hash = createHash("sha256");
   for (const path of files) {
     hash.update(relative(root, path).replaceAll("\\", "/"));
@@ -178,11 +186,55 @@ const CORE_MCP_DISPATCHER_RUNTIME_ENTRIES = Object.freeze([
   "package.json", "lib/mcp-dispatch-runtime.js", "lib/cli/runtime-context.js", "lib/runtime/control-context.js", "lib/cli/contract-command.js", "lib/runtime/plugin-provenance.js", "runtime/core",
   "generated/plugins/agdf/meta/agdf-plugin.definition.json", "generated/plugins/agdf/meta/agdf-interaction-locales.json", "generated/plugins/agdf/meta/contracts",
 ]);
-export const MCP_DISPATCHER_RUNTIME_ENTRIES = Object.freeze([...CORE_MCP_DISPATCHER_RUNTIME_ENTRIES,
+const FACADE_MCP_DISPATCHER_RUNTIME_ENTRIES = Object.freeze([...CORE_MCP_DISPATCHER_RUNTIME_ENTRIES,
   'lib/mcp-lifecycle/package.js', 'lib/mcp-lifecycle/facade-entry.js', 'lib/npm-invocation.js', 'lib/host-command.js']);
-const dispatcherEntries = root => existsSync(join(root, "runtime", "core"))
-  ? existsSync(join(root, 'lib/mcp-lifecycle/facade-entry.js')) ? MCP_DISPATCHER_RUNTIME_ENTRIES : CORE_MCP_DISPATCHER_RUNTIME_ENTRIES
+const PRE_PROTOCOL_MCP_DISPATCHER_RUNTIME_ENTRIES = Object.freeze([...FACADE_MCP_DISPATCHER_RUNTIME_ENTRIES,
+  'lib/control-evaluation/git-observation.js']);
+const PROTOCOL_MCP_DISPATCHER_RUNTIME_ENTRIES = Object.freeze([...PRE_PROTOCOL_MCP_DISPATCHER_RUNTIME_ENTRIES, 'lib/mcp-protocol-runtime.js', 'lib/mcp-decision-protocol.js']);
+const WORKER_MCP_DISPATCHER_RUNTIME_ENTRIES = Object.freeze([...PROTOCOL_MCP_DISPATCHER_RUNTIME_ENTRIES, 'lib/mcp-worker-runtime.js']);
+const OWNER_MCP_DISPATCHER_RUNTIME_ENTRIES = Object.freeze([...WORKER_MCP_DISPATCHER_RUNTIME_ENTRIES,
+  'lib/mcp-owner-protocol.js', 'lib/mcp-lifecycle/facade-runtime.js', 'lib/mcp-lifecycle/facade-thread-entry.js',
+  'lib/mcp-lifecycle/owner-client.js', 'lib/mcp-lifecycle/thread-owner.js']);
+const DEFAULT_RESOURCE_ENTRIES = Object.freeze(['generated/plugins/agdf/meta/agdf-defaults.json', 'generated/plugins/agdf/meta/agdf-defaults.schema.json']);
+export const MCP_DISPATCHER_RUNTIME_ENTRIES = Object.freeze([...OWNER_MCP_DISPATCHER_RUNTIME_ENTRIES, ...DEFAULT_RESOURCE_ENTRIES]);
+function declaresOwnerEntry(root) {
+  const entry = readJson(join(root, 'package.json'))?.exports?.['./mcp-owner-protocol'];
+  if (entry !== undefined && entry !== './lib/mcp-owner-protocol.js') throw Error('AGDF_MCP_OWNER_EXPORT_INVALID');
+  return entry !== undefined;
+}
+function declaresWorkerEntry(root) {
+  const entry = readJson(join(root, 'package.json'))?.exports?.['./mcp-worker-runtime'];
+  if (entry !== undefined && entry !== './lib/mcp-worker-runtime.js') throw Error('AGDF_MCP_WORKER_EXPORT_INVALID');
+  return entry !== undefined;
+}
+// Preserve historical owned digests for dispatchers that never import this
+// provider. The selecting dispatcher bytes are themselves always digested.
+const facadeEntries = root => {
+  const source = readFileSync(join(root, 'lib/mcp-dispatch-runtime.js'), 'utf8');
+  return source.includes('./mcp-protocol-runtime.js') ? declaresWorkerEntry(root) ? declaresOwnerEntry(root) ? OWNER_MCP_DISPATCHER_RUNTIME_ENTRIES : WORKER_MCP_DISPATCHER_RUNTIME_ENTRIES : PROTOCOL_MCP_DISPATCHER_RUNTIME_ENTRIES
+    : source.includes('./control-evaluation/git-observation.js') ? PRE_PROTOCOL_MCP_DISPATCHER_RUNTIME_ENTRIES : FACADE_MCP_DISPATCHER_RUNTIME_ENTRIES;
+};
+const legacyDispatcherEntries = root => existsSync(join(root, "runtime", "core"))
+  ? existsSync(join(root, 'lib/mcp-lifecycle/facade-entry.js')) ? facadeEntries(root) : CORE_MCP_DISPATCHER_RUNTIME_ENTRIES
   : LEGACY_MCP_DISPATCHER_RUNTIME_ENTRIES;
+// Selection follows digested consumer bytes, so deleting a required resource
+// cannot silently downgrade a new dispatcher to a historical image inventory.
+const dispatcherEntries = root => {
+  const entries = legacyDispatcherEntries(root);
+  const protocol = join(root, 'lib/mcp-protocol-runtime.js');
+  return entries.includes('lib/mcp-protocol-runtime.js') && readFileSync(protocol, 'utf8').includes('resolveMcpInput')
+    ? [...entries, ...DEFAULT_RESOURCE_ENTRIES] : entries;
+};
+
+// Projection and digesting select the same actual declared image. Old packages
+// retain their original entry set; a new declaration cannot omit its worker.
+export const mcpDispatcherRuntimeEntries = root => dispatcherEntries(root);
+export function mcpDispatcherPackageExports(root) {
+  return { './mcp-dispatch-runtime': './lib/mcp-dispatch-runtime.js',
+    ...(dispatcherEntries(root).includes('lib/mcp-protocol-runtime.js') ? { './mcp-protocol-runtime': './lib/mcp-protocol-runtime.js' } : {}),
+    ...(declaresWorkerEntry(root) ? { './mcp-worker-runtime': './lib/mcp-worker-runtime.js' } : {}),
+    ...(declaresOwnerEntry(root) ? { './mcp-owner-protocol': './lib/mcp-owner-protocol.js' } : {}) };
+}
 
 export const MCP_SDK_RUNTIME_ENTRIES = Object.freeze([
   "node_modules/@modelcontextprotocol/server",
@@ -195,8 +247,8 @@ function digestSelectedEntries(root, entries, syntheticEntries = []) {
   function visit(path) {
     const stats = statSync(path);
     if (stats.isDirectory()) {
-      for (const name of readdirSync(path).sort()) visit(join(path, name));
-    } else if (stats.isFile()) files.push({ path, content: readFileSync(path) });
+      for (const file of directoryFiles(path)) files.push({ path: file });
+    } else if (stats.isFile()) files.push({ path });
   }
   for (const entry of entries) visit(join(root, entry));
   for (const entry of syntheticEntries) files.push({ path: join(root, entry.path), content: Buffer.from(entry.content) });
@@ -204,7 +256,10 @@ function digestSelectedEntries(root, entries, syntheticEntries = []) {
   for (const file of files.sort((left, right) => left.path < right.path ? -1 : left.path > right.path ? 1 : 0)) {
     hash.update(relative(root, file.path).replaceAll("\\", "/"));
     hash.update("\0");
-    hash.update(file.content);
+    // Sort paths first, then consume each current file immediately. Retaining
+    // every SDK buffer until sorting only adds allocation/GC pressure; it does
+    // not provide an atomic snapshot. Preserve the exact selected wire order.
+    hash.update(file.content ?? readFileSync(file.path));
     hash.update("\0");
   }
   return hash.digest("hex");
@@ -220,7 +275,7 @@ export function digestPluginMcpDispatcherSource(root, version) {
     version,
     private: true,
     type: "module",
-    exports: { "./mcp-dispatch-runtime": "./lib/mcp-dispatch-runtime.js" },
+    exports: mcpDispatcherPackageExports(root),
     ...(existsSync(join(root, "runtime", "core")) ? { imports: { "#agdf-core": "./runtime/core/lib/index.js", "#agdf-core/*": "./runtime/core/lib/*" } } : {}),
   }, null, 2)}\n`;
   return digestSelectedEntries(
@@ -353,7 +408,15 @@ export function inspectGeneratedRepositoryMarketplace(targetDir) {
   const marketplacePath = join(targetDir, ".agents", "plugins", "marketplace.json");
   if (!existsSync(marketplacePath)) return { status: "absent", marketplacePath };
   const marketplace = readJson(marketplacePath);
-  const plugin = marketplace?.plugins?.length === 1 ? marketplace.plugins[0] : null;
+  const entries = marketplace?.plugins;
+  // Generated catalogs may expose the optional skill-only Planning package.
+  // Keep the closed local identities and unique Core binding; never select an
+  // arbitrary first entry or accept foreign paths as generated provenance.
+  const validEntries = Array.isArray(entries) && entries.length >= 1 && entries.length <= 2
+    && new Set(entries.map(entry => entry?.name)).size === entries.length
+    && entries.every(entry => ['agdf', 'agdf-planning'].includes(entry?.name)
+      && entry.source?.source === 'local' && entry.source.path === `./plugins/${entry.name}`);
+  const plugin = validEntries ? entries.find(entry => entry.name === 'agdf') : null;
   const pluginPath = plugin?.source?.source === "local" ? plugin.source.path : null;
   if (marketplace?.name !== "agdf-repo" || plugin?.name !== "agdf" || pluginPath !== "./plugins/agdf") {
     return { status: "invalid", reason: "repository_marketplace_invalid", marketplacePath };
@@ -494,3 +557,95 @@ export function inspectInstallationProvenance(pluginRoot, {
 export const distributionProfileContract = Object.freeze({
   expectedProfiles: EXPECTED_PROFILES,
 });
+
+// Shared read-only package qualification. Publication/claim writers consume
+// this same predicate; the transport adds no competing provenance policy.
+export function inspectOwnedMcpRuntimeRoot(root, expectedVersion) {
+  const OWNER = MCP_RUNTIME_OWNER, MARKER = MCP_RUNTIME_MARKER;
+  // Parsing failures remain inside the original mismatch boundary.
+  const readJson = path => JSON.parse(readFileSync(path, "utf8"));
+  const markerPath = join(root, MARKER);
+  if (!existsSync(root)) return Object.freeze({ status: "absent", root, entrypoint: null, digest: null });
+  if (!lstatSync(root).isDirectory() || lstatSync(root).isSymbolicLink() || !existsSync(markerPath)) {
+    return Object.freeze({ status: "foreign", root, entrypoint: null, digest: null });
+  }
+  try {
+    const marker = readJson(markerPath, "AGDF_MCP_RUNTIME_MARKER_INVALID");
+    const packageRoot = join(root, "node_modules", "@agdf", "mcp-server");
+    const dispatcherRoot = join(root, "node_modules", "create-agdf");
+    const sdkServerRoot = join(root, "node_modules", "@modelcontextprotocol", "server");
+    const sdkCoreRoot = join(root, "node_modules", "@modelcontextprotocol", "core");
+    const sdkClientRoot = join(root, "node_modules", "@modelcontextprotocol", "client");
+    const sdkV1Root = join(root, "node_modules", "@modelcontextprotocol", "sdk");
+    const manifestPath = join(packageRoot, "package.json");
+    const dispatcherManifestPath = join(dispatcherRoot, "package.json");
+    if (marker.owner !== OWNER || marker.version !== expectedVersion
+        || !existsSync(manifestPath) || !existsSync(dispatcherManifestPath)) {
+      return Object.freeze({ status: "mismatch", root, entrypoint: null, digest: null });
+    }
+    for (const ownedRoot of [packageRoot, dispatcherRoot, sdkServerRoot, sdkCoreRoot]) {
+      if (!existsSync(ownedRoot) || !lstatSync(ownedRoot).isDirectory() || lstatSync(ownedRoot).isSymbolicLink()) {
+        return Object.freeze({ status: "mismatch", root, entrypoint: null, digest: null });
+      }
+    }
+    const manifest = readJson(manifestPath, "AGDF_MCP_SERVER_MANIFEST_INVALID");
+    const dispatcherManifest = readJson(dispatcherManifestPath, "AGDF_MCP_DISPATCHER_MANIFEST_INVALID");
+    const sdkServerManifest = readJson(join(sdkServerRoot, "package.json"), "AGDF_MCP_SDK_MANIFEST_INVALID");
+    const sdkCoreManifest = readJson(join(sdkCoreRoot, "package.json"), "AGDF_MCP_SDK_MANIFEST_INVALID");
+    const entrypoint = join(packageRoot, "bin", "agdf-mcp.js");
+    const serverDigest = digestDirectory(packageRoot);
+    const dispatcherDigest = digestMcpDispatcherPackage(dispatcherRoot);
+    const sdkDigest = digestMcpSdkRuntime(root);
+    const valid = [1, 2].includes(marker.schema_version)
+      && typeof marker.node_executable === "string"
+      && isAbsolute(marker.node_executable)
+      && manifest.name === "@agdf/mcp-server"
+      && manifest.version === expectedVersion
+      && manifest.dependencies?.["create-agdf"] === expectedVersion
+      && manifest.dependencies?.["@modelcontextprotocol/server"] === "2.0.0"
+      && manifest.engines?.node === ">=22"
+      && dispatcherManifest.name === "create-agdf"
+      && dispatcherManifest.version === expectedVersion
+      // The actual server import map declares its worker interface. Historical
+      // servers have no such entry; new servers must reject an older same-version
+      // dispatcher before public admission, rather than failing on the first call.
+      && (manifest.imports?.['#agdf-dispatch-worker'] === undefined
+        || manifest.imports['#agdf-dispatch-worker'] === 'create-agdf/mcp-worker-runtime' && declaresWorkerEntry(dispatcherRoot))
+      && (manifest.imports?.['#agdf-owner-protocol'] === undefined
+        || manifest.imports['#agdf-owner-protocol'] === 'create-agdf/mcp-owner-protocol' && declaresOwnerEntry(dispatcherRoot))
+      && (manifest.agdfExecutionModel === undefined || manifest.agdfExecutionModel === 'owner_threads_v1'
+        && manifest.imports?.['#agdf-owner-protocol'] === 'create-agdf/mcp-owner-protocol'
+        && declaresOwnerEntry(dispatcherRoot) && declaresWorkerEntry(dispatcherRoot))
+      && sdkServerManifest.name === "@modelcontextprotocol/server"
+      && sdkServerManifest.version === "2.0.0"
+      && sdkCoreManifest.name === "@modelcontextprotocol/core"
+      && sdkCoreManifest.version === "2.0.0"
+      && !existsSync(sdkClientRoot)
+      && !existsSync(sdkV1Root)
+      && existsSync(entrypoint)
+      && lstatSync(entrypoint).isFile()
+      && !lstatSync(entrypoint).isSymbolicLink()
+      && marker.server_digest === serverDigest
+      && marker.dispatcher_digest === dispatcherDigest
+      && marker.sdk_digest === sdkDigest;
+    return Object.freeze({
+      status: valid ? "matched" : "mismatch",
+      version: expectedVersion,
+      root,
+      packageRoot,
+      dispatcherRoot,
+      markerPath,
+      entrypoint: valid ? entrypoint : null,
+      digest: serverDigest,
+      dispatcherDigest,
+      sdkDigest,
+      executionModel: manifest.agdfExecutionModel ?? 'process_v1',
+      nodeExecutable: typeof marker.node_executable === "string" ? marker.node_executable : null,
+      references: Object.freeze(Array.isArray(marker.references) ? marker.references : []),
+      markerSchemaVersion: marker.schema_version,
+      sdkVerification: typeof marker.sdk_verification === "string" ? marker.sdk_verification : null,
+    });
+  } catch {
+    return Object.freeze({ status: "mismatch", root, entrypoint: null, digest: null });
+  }
+}

package/runtime/core/lib/skill-dispatch/compact-continuation.js

@@ -67,10 +67,10 @@ export function compactContinuation(root, report, input) {
     source_artifacts: sources, ...(record ? { verified_change: record } : {}),
     instruction: implementation
       ? `Inspect current execution and review evidence first; perform only unfinished work within the approved UR and Brownfield scope. ${mode === 'verified_change'
-        ? 'Use only the evaluated record paths; run its declared propagation and validation commands, record exact changed paths and passing evidence through the existing record/run-update owner. Escalate through the existing declared structured path if eligibility is lost.'
+        ? 'Use only the evaluated record paths; run its declared propagation and validation commands, record exact changed paths and passing evidence through verified_change.record phase execution. Escalate through the existing declared structured path if eligibility is lost.'
         : 'Run relevant checks, record actual evidence and mandatory Code Review through the existing run-step owners before OR-lite.'} After recorded changes redispatch gate-check for this same target/run with continue_delivery and its fresh revision. Stop at any decision or concrete blocker. Never infer QA, UAT, VCS or release authority.`
       : `Close only this already reviewed/executed compact scope through release-or. ${mode === 'verified_change'
-        ? 'Complete the linked Verified Change Mini-Closeout and publish lifecycle-consistent role links through the existing run-update owner; closeout.record does not support this mode. Revalidate with Git-aware CLI evaluation.'
-        : 'Persist OR-lite with Result, Evidence, Risk and Next Step through the existing run-step closeout owner.'} Do not repeat implementation or perform VCS/release actions. Redispatch gate-check for this same target/run after recording; completed state stops.`,
+        ? 'Complete the linked Verified Change Mini-Closeout and publish lifecycle-consistent role links through the current typed closeout.record owner with its exact confirmation. Revalidate with Git-aware CLI evaluation.'
+        : 'Read the bound OR template and closeout authoring format; persist OR-lite with the exact Run and Report mode declared once, plus Result, Evidence, Risk and Next Step through the existing closeout owner.'} Do not repeat implementation or perform VCS/release actions. Redispatch gate-check for this same target/run after recording; completed state stops.`,
   };
 }

package/runtime/core/lib/skill-dispatch/contract.js

@@ -1,5 +1,7 @@
+import { projectMcpInputSchema } from '../mcp-input-schema.js';
 import { isAbsolute } from "node:path";
 import { REVISION_ID_PATTERN, RUN_ID_PATTERN } from "../control-state/run-identity.js";
+import { PLANNING_SCOPE_SCHEMA, schemaDiagnostics } from '../control-state/run-command-schema.js';
 import {
   PRESENTATION_LANGUAGE_TAG_PATTERN_SOURCE,
   canonicalizeLanguageTag,
@@ -25,25 +27,33 @@ function deepFreeze(value) {
   return Object.freeze(value);
 }
 
-export const SKILL_DISPATCH_PRESENTATION_LANGUAGE_DESCRIPTION = "Required presentation language for the latest natural-language user request as one well-formed BCP 47 tag. If the request explicitly asks for a response language, use that tag; otherwise use the dominant request language. Use en when mixed or ambiguous. A valid unsupported tag renders through the complete English pack. Missing or invalid input fails before governance evaluation.";
+export const SKILL_DISPATCH_PRESENTATION_LANGUAGE_DESCRIPTION = "MCP reply-language override (BCP 47). Omit for a matching configured preference; otherwise supply the current request's language (explicit instruction, then dominant language, en if ambiguous). Invalid explicit tags fail; valid unsupported tags use the complete English pack. Core input remains complete.";
+const COMPLETE_DISPATCH_REQUIRED = Object.freeze(['skill_id', 'presentation_language', 'working_directory']);
 export const SKILL_DISPATCH_PRESENTATION_LANGUAGE_RECOVERY = "Provide one well-formed BCP 47 presentation_language tag and retry once.";
 export const SKILL_DISPATCH_TERMINAL_RESPONSE_DESCRIPTION = "For a result with `terminal: true`, the entire assistant response must consist only of host_action.text, copied verbatim. Add no question, explanation, heading, citation, link or other surrounding text; do not translate or reformat it; invoke no later tool and stop.";
 export const SKILL_DISPATCH_INTAKE_DESCRIPTION = "Set true only with skill_id gate-check when the governed delivery intake (catalog delivery.start) is the active route; delivery wins mixed intent, so a gate-check invocation that asks for a change also sets it. Omit it for status, approval or next-step questions. It never grants approval or delivery authority.";
 export const SKILL_DISPATCH_INTAKE_CONTINUATION_DESCRIPTION = "For intake_continuation phase resolve_delivery_run, match the request to supplied UR scope evidence; resume one same-scope run with its expected_revision_id, or start a clear new scope. Ask only about genuinely ambiguous work, never for technical Run IDs. Other phases execute continuation.steps in order; presentation_required shows run-present text and waits for a NEW deliberate response. Preparation approves no gate.";
 export const SKILL_DISPATCH_QA_CANDIDATES_DESCRIPTION = "For a qa-gate skill_continuation, control.candidate_runs is the complete canonical active-run inventory when run selection is unresolved, otherwise an empty array. Use its run_id, objective, normalized current_gate, decision and revision_id fields as data; filter by current_gate: QA and do not rescan run files, invent candidates or omit returned QA candidates.";
 
+// skill_id is required, so these constraints still run for every valid request.
+// Keep root properties visible to hosts that project root allOf as intersections.
+function visibleDispatchInput(schema) {
+  const { allOf, ...input } = schema;
+  return { ...input, dependentSchemas: { ...input.dependentSchemas, skill_id: { allOf } } };
+}
+
 export const SKILL_DISPATCH_FUNCTION_DEFINITION = deepFreeze({
   name: "agdf_dispatch",
-  description: `Run the version-matched AGDF preflight for one canonical skill. It resolves target and control state but never grants approval or delivery authority. Only authorized bound continue_delivery may record one previously sealed relationship correction through the Core continuation service before fresh routing; status stays read-only. ${SKILL_DISPATCH_TERMINAL_RESPONSE_DESCRIPTION} For skill_continuation, follow its continuation instruction using only the returned target and control. ${SKILL_DISPATCH_INTAKE_CONTINUATION_DESCRIPTION}`,
+  description: `For version-matched AGDF preflight only; explicit presented-gate replies use agdf_approve. Read-only Run status uses agdf_inspect operation=gate-check; documents/contracts also use agdf_inspect. ALWAYS supply primary_target + target_source when the target is known; working_directory alone never selects it. It resolves target and control state but never grants approval or delivery authority. Only authorized bound continue_delivery may record one previously sealed relationship correction through the Core continuation service before fresh routing; status stays read-only. ${SKILL_DISPATCH_TERMINAL_RESPONSE_DESCRIPTION} For skill_continuation, follow its continuation instruction using only the returned target and control. ${SKILL_DISPATCH_INTAKE_CONTINUATION_DESCRIPTION}`,
   annotations: {
     readOnlyHint: false,
     destructiveHint: false,
     idempotentHint: true,
     openWorldHint: false,
   },
-  inputSchema: {
+  inputSchema: projectMcpInputSchema(visibleDispatchInput({
     type: "object", additionalProperties: false,
-    required: ["skill_id", "presentation_language", "working_directory"],
+    required: COMPLETE_DISPATCH_REQUIRED,
     properties: {
       skill_id: { type: "string", minLength: 1, maxLength: 240, description: "Canonical AGDF skill slug or exact catalog-registered skill name for the calling host; normalized internally to the stable canonical ID." },
       presentation_language: {
@@ -58,6 +68,7 @@ export const SKILL_DISPATCH_FUNCTION_DEFINITION = deepFreeze({
       },
       primary_target: { type: "string", minLength: 1, maxLength: 4096, description: "Absolute governance-target path paired with target_source. Never derive it from working_directory alone." },
       run_id: { type: "string", pattern: RUN_ID_PATTERN.source, description: "Canonical run identifier. Select an existing run from an explicit request, confirmed continuation or unequivocal same-scope assignment after resolve_delivery_run. Scope assignment must use expected_revision_id. For intake_mode new, choose an unused id for the authorized change; never reuse an existing run." },
+      planning: { ...PLANNING_SCOPE_SCHEMA, description: 'Explicit ur-definition planning mode before any Run. Use one selected plan and source digest (null for capture); no delivery intake or gate approval.' },
       expected_revision_id: { type: "string", pattern: REVISION_ID_PATTERN.source, description: "Revision from the resolve_delivery_run candidate used for scope matching. Requires intake true, intake_mode resume and run_id. Changed or unavailable binding returns fresh assignment evidence before gate evaluation; it never adopts another run automatically." },
       intake: { type: "boolean", description: SKILL_DISPATCH_INTAKE_DESCRIPTION },
       intake_mode: { type: "string", enum: ["new", "resume"], description: "With intake true: new prepares the explicitly authorized new scope at an unused run_id; resume continues the bound run. Requires run_id. Never infer new from ambiguous continuation." },
@@ -69,6 +80,8 @@ export const SKILL_DISPATCH_FUNCTION_DEFINITION = deepFreeze({
     },
     dependentRequired: { target_source: ["primary_target"], primary_target: ["target_source"] },
     dependentSchemas: {
+      planning: { required: ['primary_target', 'target_source'], properties: { skill_id: { enum: ['ur-definition', 'agdf:ur-definition', 'agdf-ur-definition', 'agdf-global-ur-definition'] } },
+        not: { anyOf: ['run_id', 'expected_revision_id', 'intake', 'intake_mode', 'continue_delivery', 'ur_action', 'prd_action', 'sd_action', 'tp_action'].map(key => ({ required: [key] })) } },
       ur_action: { required: ["skill_id", "intake", "intake_mode", "run_id", "expected_revision_id"], properties: { skill_id: { enum: ["gate-check", "agdf:gate-check", "agdf-gate-check", "agdf-global-gate-check"] }, intake: { const: true }, intake_mode: { const: "resume" } } },
       prd_action: { required: ["skill_id", "intake", "intake_mode", "run_id", "expected_revision_id"], properties: { skill_id: { enum: ["gate-check", "agdf:gate-check", "agdf-gate-check", "agdf-global-gate-check"] }, intake: { const: true }, intake_mode: { const: "resume" } } },
       sd_action: { required: ["skill_id", "intake", "intake_mode", "run_id", "expected_revision_id"], properties: { skill_id: { enum: ["gate-check", "agdf:gate-check", "agdf-gate-check", "agdf-global-gate-check"] }, intake: { const: true }, intake_mode: { const: "resume" } } },
@@ -82,7 +95,7 @@ export const SKILL_DISPATCH_FUNCTION_DEFINITION = deepFreeze({
       if: { required: ["continue_delivery"], properties: { continue_delivery: { const: true } } },
       then: { required: ["run_id"], properties: { intake: { const: false } }, not: { required: ["intake_mode"] } },
     }],
-  },
+  })),
   outputSchema: {
     type: "object",
     additionalProperties: false,
@@ -149,7 +162,7 @@ export function renderSkillDispatchSemanticProjection() {
 
 export function renderSkillDispatchLanguageProjection() {
   const description = SKILL_DISPATCH_FUNCTION_DEFINITION.inputSchema.properties.presentation_language.description;
-  return `For \`--language\`: ${description}`;
+  return `MCP: ${description}\nFor \`--language\`: Required; apply the same current-request selection and locale validation.`;
 }
 
 export function renderSkillDispatchTerminalProjection() {
@@ -235,6 +248,9 @@ export function normalizeSkillDispatchInput(input, registry, pluginDefinition) {
   if (primaryTarget && (!isAbsolute(primaryTarget) || primaryTarget.length > 4096)) throw new SkillDispatchInputError("primary_target", "primary_target must be an absolute bounded path");
   const targetSource = rawTargetSource ? normalizeTaskTargetSource(rawTargetSource, { allowEmpty: false }) : null;
   const runId = input.runId || null;
+  if (input.planning !== undefined && (skillId !== 'ur-definition' || !primaryTarget || schemaDiagnostics(input.planning, PLANNING_SCOPE_SCHEMA).length
+    || ['runId', 'expectedRevisionId', 'intake', 'intakeMode', 'continueDelivery', 'urAction', 'prdAction', 'sdAction', 'tpAction'].some(key => input[key] !== undefined)))
+    throw new SkillDispatchInputError('planning', 'Planning is an explicit pre-Run ur-definition scope; delivery and gate selectors are forbidden');
   if (runId && !RUN_ID_PATTERN.test(runId)) throw new SkillDispatchInputError("run_id", "run_id is invalid");
   if (input.intake !== undefined && (typeof input.intake !== "boolean" || (input.intake && skill.dispatch_mode !== "deterministic_control"))) {
     throw new SkillDispatchInputError("intake", "intake is invalid");
@@ -278,6 +294,7 @@ export function normalizeSkillDispatchInput(input, registry, pluginDefinition) {
     target_source: targetSource,
     primary_target: primaryTarget,
     run_id: runId,
+    planning: input.planning,
     intake: input.intake === true,
     intake_mode: input.intakeMode,
     expected_revision_id: input.expectedRevisionId,
@@ -299,7 +316,7 @@ export function parseSkillDispatchFunctionArguments(argumentsValue, trustedConte
   const allowed = new Set(Object.keys(schema.properties));
   const unknown = Object.keys(argumentsValue).find((key) => !allowed.has(key));
   if (unknown) throw new SkillDispatchInputError(unknown, "unsupported argument");
-  const missing = schema.required.find((key) => !Object.hasOwn(argumentsValue, key));
+  const missing = COMPLETE_DISPATCH_REQUIRED.find((key) => !Object.hasOwn(argumentsValue, key));
   if (missing) throw new SkillDispatchInputError(missing, "required argument is missing");
   if (!trustedContext || typeof trustedContext !== "object") {
     throw new SkillDispatchInputError("trusted_context", "trusted context is required");
@@ -314,6 +331,7 @@ export function parseSkillDispatchFunctionArguments(argumentsValue, trustedConte
     targetSource: argumentsValue.target_source,
     primaryTarget: argumentsValue.primary_target,
     runId: argumentsValue.run_id,
+    ...(argumentsValue.planning !== undefined ? { planning: argumentsValue.planning } : {}),
     ...(argumentsValue.intake !== undefined ? { intake: argumentsValue.intake } : {}),
     ...(argumentsValue.intake_mode !== undefined ? { intakeMode: argumentsValue.intake_mode } : {}),
     ...(argumentsValue.expected_revision_id !== undefined ? { expectedRevisionId: argumentsValue.expected_revision_id } : {}),
@@ -334,8 +352,9 @@ export function emptySkillDispatchTiming() {
   return { wrapper_ms: 0, input_ms: 0, target_ms: 0, control_ms: 0, render_ms: 0, total_ms: 0 };
 }
 
-export function serializeSkillDispatchResult(result, { outputTooLargeRecovery = "Repair the installed locale registry and retry once." } = {}) {
-  const output = JSON.stringify(result, null, 2);
+// space 0 is the compact transport form; the CLI keeps its indented output.
+export function serializeSkillDispatchResult(result, { outputTooLargeRecovery = "Repair the installed locale registry and retry once.", space = 2 } = {}) {
+  const output = JSON.stringify(result, null, space);
   if (Buffer.byteLength(output, "utf8") <= SKILL_DISPATCH_MAX_OUTPUT_BYTES) return output;
   const recoveryAction = typeof outputTooLargeRecovery === "string"
     && outputTooLargeRecovery.trim()

package/runtime/core/lib/skill-dispatch/delivery-intake.js

@@ -1,3 +1,5 @@
+import { REVISION_ID_PATTERN } from '../control-state/run-identity.js';
+import { runDocumentPath } from '../control-state/run-identity.js';
 import { lstatSync } from "node:fs";
 import { dirname } from "node:path";
 import { assertCanonicalRunStore } from "../control-state/run-store-inspection.js";
@@ -18,12 +20,14 @@ export function deliveryIntakePhase(targetDir, control, input = {}) {
   const blockers = (control?.doctor_report?.findings ?? []).filter((finding) => finding.severity === "block");
   if (input.intake_mode === "new") {
     // The not-yet-created run is expected to be unselectable; any other blocker keeps the result terminal.
-    if (blockers.some((finding) => !["AGDF_RUN_NOT_SELECTABLE", "AGDF_ACTIVE_RUN_MISSING"].includes(finding.code))) return null;
+    if (blockers.some((finding) => !["AGDF_RUN_NOT_SELECTABLE", "AGDF_ACTIVE_RUN_MISSING"].includes(finding.code)
+      && !(finding.code === 'AGDF_RUN_PATH_INVALID' && finding.path === runPath(targetDir, input.run_id)))) return null;
     assertCanonicalRunStore(targetDir);
     let exists = true;
     try { lstatSync(dirname(runPath(targetDir, input.run_id))); }
     catch (error) { if (error.code !== "ENOENT") throw error; exists = false; }
     if (exists) throw new Error("AGDF_RUN_COLLISION");
+    if (!input.run_id?.startsWith('run-') || !REVISION_ID_PATTERN.test(input.run_id.slice(4))) throw Error('AGDF_NEW_RUN_OPERATION_REQUIRED');
     return Object.freeze({ phase: "run_missing", run_id: input.run_id, revision_id: null });
   }
 
@@ -35,12 +39,14 @@ export function deliveryIntakeSteps(governanceTarget, intake) {
   if (!runId) throw new Error("AGDF_INTAKE_RUN_BINDING_REQUIRED");
   const dir = `--dir ${quoteDispatchArgument(governanceTarget)}`;
   if (intake.phase === "run_missing") {
+    const operation = runId.startsWith('run-') ? runId.slice(4) : '';
+    if (!REVISION_ID_PATTERN.test(operation)) throw Error('AGDF_NEW_RUN_OPERATION_REQUIRED');
     return Object.freeze([
       Object.freeze({
         id: "create_run",
-        command: `run-create ${dir} --run ${runId}`,
-        argv: ["run-create", "--dir", governanceTarget, "--run", runId],
-        rule: "Create this exact run; use its returned revision_id for the following resume dispatch.",
+        command: `run-create ${dir} --title ${quoteDispatchArgument(runId)} --operation ${operation}`,
+        argv: ["run-create", "--dir", governanceTarget, "--title", runId, "--operation", operation],
+        rule: "The original operation UUID determines this exact Run ID. Record the actual requirement title with UR content; use the returned Run/revision for resume dispatch.",
       }),
       Object.freeze({
         id: "dispatch_again",
@@ -62,7 +68,7 @@ export function urDefinitionPhase(targetDir, control, input) {
   const revisionId = extractField(runState.content ?? "", "revision_id");
   if (!revisionId) return null;
   const registered = isDurableApprovalArtefactPresent(targetDir, runState, "UR");
-  const canonicalPath = `.agdf/control/artefacts/${input.run_id}/UR.md`;
+  const canonicalPath = `${runDocumentPath(input.run_id, '')}/UR.md`;
   // Never substitute an existing noncanonical draft path.
   if (registered && String(runState.artefacts.get("UR")?.path ?? "").replaceAll("`", "") !== canonicalPath) return null;
   if (input.skill_id !== "ur-definition" && !(input.intake || input.continue_delivery)) return null;