create-agdf 0.20.2 → 0.30.0

package/generated/plugins/agdf/runtime/create-agdf/lib/mcp-dispatch-runtime.js

@@ -1,73 +1,17 @@
 import { createCoreServices } from "#agdf-core";
 import { resources } from "./runtime/control-context.js";
-import {
-  SKILL_DISPATCH_CONTRACT_VERSION,
-  SKILL_DISPATCH_FUNCTION_DEFINITION,
-  SKILL_DISPATCH_SCHEMA_VERSION,
-  SKILL_DISPATCH_MAX_OUTPUT_BYTES,
-  emptySkillDispatchTiming,
-  parseSkillDispatchFunctionArguments,
-  serializeSkillDispatchResult,
-  SkillDispatchInputError,
-} from "#agdf-core/skill-dispatch/contract.js";
-import { TaskTargetInputError } from '#agdf-core/task-target-resolution.js';
-import { ReadSelectionError } from '#agdf-core/control-inspect/selection.js';
-import { localePack } from '#agdf-core/interaction-presentation.js';
-import { TOOL_ERROR_CONTRACT, TOOL_RESULT_META, describeToolResult, projectToolResult, consumeToolResult, executionFacts, validExecutionFacts } from '#agdf-core/mcp-tool-errors.js';
-import { existsSync, lstatSync, readFileSync, realpathSync } from "node:fs";
-import { isAbsolute, join, resolve } from "node:path";
-import { CONTROL_INSPECT_FUNCTION_DEFINITION, parseControlInspectFunctionArguments, serializeControlInspectResult } from "#agdf-core/control-inspect/contract.js";
-import { createInspectFailureResult } from "#agdf-core/control-inspect/service.js";
+import { cliGitObservation } from './control-evaluation/git-observation.js';
+import { createReadWorkerBudget } from '#agdf-core/control-read/cockpit-pool.js';
+import { createDoctorObservationService } from '#agdf-core/control-inspect/doctor-observation.js';
+import { createPresentationDelivery } from '#agdf-core/control-state/presentation-delivery.js';
+import { mcpControlContinuation } from '#agdf-core/skill-dispatch/mcp-continuation.js';
+import { inspectRunInputResolution } from '#agdf-core/control-state/run-input-resolution.js';
 import { assertMcpControlReadBoundary } from "#agdf-core/control-read-boundary.js";
-import { interactionLocales, packageRoot, pluginDefinition } from "./cli/runtime-context.js";
-import { RUN_COMMAND_GROUPS, RUN_COMMAND_LIMITS, commandGroupDefinition, validateRunCommand, validateRunCommandResult, runCommandRequestDigest } from '#agdf-core/control-state/run-command-contract.js';
-import {
-  digestDirectory,
-  digestMcpDispatcherPackage,
-  digestMcpSdkRuntime,
-  evaluateDecisionAppQualification, inspectDecisionAppQualification,
-} from "#agdf-core/runtime/plugin-provenance.js";
-
-const MCP_RUNTIME_OWNER = "create-agdf:mcp-runtime";
-
-// Compose the canonical structural contract at the existing producing/consuming
-// boundary. The descriptor projector stays dependency-free and policy-pure.
-function checkCommandResult(name, result) {
-  if (Object.hasOwn(RUN_COMMAND_GROUPS, name) && validateRunCommandResult(result).length) {
-    throw Object.assign(new Error('tool_result_invalid'), { facts: { code: 'tool_result_invalid', dispatch: 'unknown' } });
-  }
-}
-function errorSupport(cockpit = false) {
-  return {
-    toolErrorContract: TOOL_ERROR_CONTRACT, responseLimit: SKILL_DISPATCH_MAX_OUTPUT_BYTES,
-    projectToolResult(name, input = {}, result, facts) {
-      const pack = localePack(interactionLocales, input.presentation_language ?? (cockpit ? 'de' : 'en'));
-      checkCommandResult(name, result);
-      const { _meta, ...domain } = result;
-      const serialize = name === 'agdf_dispatch' ? serializeSkillDispatchResult : name === 'agdf_inspect' ? serializeControlInspectResult : JSON.stringify;
-      const checked = JSON.parse(serialize(domain));
-      const projected = projectToolResult(name, input, { ...checked, ...(_meta ? { _meta } : {}) }, pack, facts);
-      // Existing serializers can replace oversized output before projection.
-      // Their terminal instruction must agree with the same bounded guidance.
-      if (checked.outcome === 'evaluator_error' && checked.diagnostics?.some(d => ['dispatch_output_too_large', 'inspect_output_too_large'].includes(d.code))) {
-        const message = projected._meta[TOOL_RESULT_META].message;
-        return { ...projected, recovery: { action: message }, host_action: { ...projected.host_action, text: message } };
-      }
-      return projected;
-    },
-    consumeToolResult(name, result) { checkCommandResult(name, result); return consumeToolResult(name, result); },
-    normalizeFailure(error, { phase = 'execute' } = {}) {
-      if (phase === 'parse' && (error instanceof SkillDispatchInputError || error instanceof TaskTargetInputError || error instanceof ReadSelectionError)) {
-        const facts = { code: error instanceof ReadSelectionError ? 'inspect_input_invalid' : 'dispatch_input_invalid', dispatch: 'not_dispatched', ...(error.field ? { field: error.field } : {}) };
-        return validExecutionFacts(facts) ? facts : { code: 'dispatch_input_invalid', dispatch: 'not_dispatched' };
-      }
-      if (phase === 'parse' && ['command_schema_invalid', 'resource_denied', 'decision_schema_invalid'].includes(error?.code ?? error?.message))
-        return { code: error.code ?? error.message, dispatch: 'not_dispatched' };
-      return executionFacts(error, { phase });
-    },
-  };
-}
-
+import { existsSync, lstatSync, realpathSync } from 'node:fs';
+import { isAbsolute } from 'node:path';
+import { composeMcpProtocolRuntime, errorSupport, inspectMcpDispatcherRuntime, configuredMcpCommandGroups } from './mcp-protocol-runtime.js';
+export { inspectMcpDispatcherRuntime, configuredMcpCommandGroups, CONTROL_INSPECT_FUNCTION_DEFINITION, SKILL_DISPATCH_FUNCTION_DEFINITION,
+  parseControlInspectFunctionArguments, parseSkillDispatchFunctionArguments, serializeSkillDispatchResult, DECISION_UI_URI, OWNED_LOCK_CHANNEL, releaseAbandonedOwnedLock } from './mcp-protocol-runtime.js';
 export async function createMcpCockpitRuntime({ surface, cockpitDir, cockpitMode, inspected = inspectMcpDispatcherRuntime() } = {}) {
   const pluginMode = cockpitMode === 'plugin';
   if (cockpitMode !== undefined && !pluginMode || pluginMode && (surface !== 'codex' || cockpitDir !== undefined)
@@ -91,6 +35,7 @@ export async function createMcpCockpitRuntime({ surface, cockpitDir, cockpitMode
   ];
   // Claude Code renders no MCP app UI today; its cockpit stays hidden until a client declares support.
   return Object.freeze({ ...errorSupport(true), mode: 'cockpit', definition: renderDefinition, tools,
+    producerIdentity: inspected.generationIdentity ?? null,
     uiCapabilityRequired: pluginMode || surface === 'claude', responseLimit: READ_LIMITS.response,
     ...(pluginMode ? { unsupportedUiCode: 'host_ui_unsupported' } : {}),
     ui: Object.freeze({ uri: COCKPIT_UI_URI, mimeType: COCKPIT_MIME, limit: COCKPIT_LIMITS.html,
@@ -104,265 +49,85 @@ export async function createMcpCockpitRuntime({ surface, cockpitDir, cockpitMode
   });
 }
 
-function readOwnedRuntimeMarker(dispatcherDigest) {
-  const root = resolve(packageRoot, "..", "..");
-  const markerPath = join(root, ".agdf-mcp-owned.json");
-  const serverRoot = join(root, "node_modules", "@agdf", "mcp-server");
-  const sdkServerRoot = join(root, "node_modules", "@modelcontextprotocol", "server");
-  const sdkCoreRoot = join(root, "node_modules", "@modelcontextprotocol", "core");
-  const sdkClientRoot = join(root, "node_modules", "@modelcontextprotocol", "client");
-  const sdkV1Root = join(root, "node_modules", "@modelcontextprotocol", "sdk");
-  try {
-    if (lstatSync(packageRoot).isSymbolicLink() || !existsSync(markerPath)
-        || !existsSync(serverRoot) || !existsSync(sdkServerRoot) || !existsSync(sdkCoreRoot)
-        || existsSync(sdkClientRoot) || existsSync(sdkV1Root)) return null;
-    if ([serverRoot, sdkServerRoot, sdkCoreRoot].some((path) => {
-      const stats = lstatSync(path);
-      return !stats.isDirectory() || stats.isSymbolicLink();
-    })) return null;
-    const marker = JSON.parse(readFileSync(markerPath, "utf8"));
-    const serverManifest = JSON.parse(readFileSync(join(serverRoot, "package.json"), "utf8"));
-    const sdkServerManifest = JSON.parse(readFileSync(join(sdkServerRoot, "package.json"), "utf8"));
-    const sdkCoreManifest = JSON.parse(readFileSync(join(sdkCoreRoot, "package.json"), "utf8"));
-    const serverDigest = digestDirectory(serverRoot);
-    const sdkDigest = digestMcpSdkRuntime(root);
-    if (![1, 2].includes(marker.schema_version)
-        || marker.owner !== MCP_RUNTIME_OWNER
-        || marker.version !== pluginDefinition.version
-        || serverManifest.name !== "@agdf/mcp-server"
-        || serverManifest.version !== pluginDefinition.version
-        || serverManifest.dependencies?.["create-agdf"] !== pluginDefinition.version
-        || serverManifest.dependencies?.["@modelcontextprotocol/server"] !== "2.0.0"
-        || sdkServerManifest.name !== "@modelcontextprotocol/server"
-        || sdkServerManifest.version !== "2.0.0"
-        || sdkCoreManifest.name !== "@modelcontextprotocol/core"
-        || sdkCoreManifest.version !== "2.0.0"
-        || marker.dispatcher_digest !== dispatcherDigest
-        || marker.server_digest !== serverDigest
-        || marker.sdk_digest !== sdkDigest) return null;
-    return Object.freeze({ markerPath, root, dispatcherDigest, serverDigest, sdkDigest, decisionQualification: marker.decision_app_qualification });
-  } catch {
-    return null;
-  }
-}
-
-export {
-  CONTROL_INSPECT_FUNCTION_DEFINITION,
-  SKILL_DISPATCH_FUNCTION_DEFINITION,
-  parseControlInspectFunctionArguments,
-  parseSkillDispatchFunctionArguments,
-  serializeSkillDispatchResult,
-};
-export { DECISION_UI_URI } from '#agdf-core/mcp-resource-contract.js';
-// The worker executor releases locks of a thread it has seen exit (packages/mcp-server).
-export { OWNED_LOCK_CHANNEL, releaseAbandonedOwnedLock } from '#agdf-core/control-state/run-state-writer.js';
-
-const FAILURE_ACTIONS = Object.freeze({
-  dispatch_busy: "Wait for the active AGDF dispatch to finish and retry once.",
-  dispatch_cancelled: "Retry the AGDF dispatch if it is still required.",
-  dispatch_timeout: "Inspect the original operation status before replaying the identical UUID and request; a timeout does not prove rollback.",
-  dispatch_worker_termination_unconfirmed: "Inspect the original operation status and retained executor; its termination is unconfirmed. Do not start a replacement mutation.",
-  dispatch_worker_failed: "Repair the installed AGDF MCP runtime and retry once.",
-  runtime_version_mismatch: "Install matching AGDF MCP server and dispatcher versions, then retry once.",
-  runtime_provenance_invalid: "Repair the owned AGDF MCP runtime and retry once.",
-});
-
-function createFailureResult(code, runtimeEvidence) {
-  const action = FAILURE_ACTIONS[code] ?? FAILURE_ACTIONS.dispatch_worker_failed;
-  return {
-    schema_version: SKILL_DISPATCH_SCHEMA_VERSION,
-    contract_version: SKILL_DISPATCH_CONTRACT_VERSION,
-    outcome: "evaluator_error",
-    terminal: true,
-    authorizes: false,
-    skill: null,
-    runtime: runtimeEvidence,
-    target: null,
-    control: null,
-    presentation: null,
-    continuation: null,
-    recovery: { action },
-    host_action: {
-      mode: "transmit_recovery_verbatim_and_stop",
-      source: "recovery.action",
-      text: action,
-      allow_surrounding_text: false,
-      may_request_run_or_evidence: false,
-    },
-    timing: emptySkillDispatchTiming(),
-    diagnostics: [{ code }],
-  };
-}
-
-export function inspectMcpDispatcherRuntime() {
-  const runtimeDigest = digestMcpDispatcherPackage(packageRoot);
-  const owned = readOwnedRuntimeMarker(runtimeDigest);
-  return Object.freeze({
-    expectedVersion: pluginDefinition.version,
-    packageRoot,
-    skillSet: pluginDefinition.skillSet,
-    interactionLocales,
-    provenanceStatus: owned ? "matched" : "unowned",
-    generationIdentity: owned ? { server_digest: owned.serverDigest, dispatcher_digest: owned.dispatcherDigest, sdk_digest: owned.sdkDigest } : null,
-    runtimeEvidence: Object.freeze({
-      machine_validation: owned ? "local_exact_version_digest" : "unavailable",
-      plugin_root: packageRoot,
-      runtime_digest: runtimeDigest,
-      provenance_status: owned ? "matched" : "unowned",
-    }),
-    decisionQualificationReport: owned ? (client, resourceDigest) => inspectDecisionAppQualification(owned.root, owned.decisionQualification, {
-      client, server_digest: owned.serverDigest, dispatcher_digest: owned.dispatcherDigest, sdk_digest: owned.sdkDigest, resource_digest: resourceDigest,
-    }) : () => ({ qualified: false, reason: 'runtime_provenance_unavailable', authorizes: false }),
-    decisionQualification: owned ? (client, resourceDigest) => evaluateDecisionAppQualification(owned.root, owned.decisionQualification, {
-      client, server_digest: owned.serverDigest, dispatcher_digest: owned.dispatcherDigest,
-      sdk_digest: owned.sdkDigest, resource_digest: resourceDigest,
-    }) : () => false,
-  });
-}
-
-export function configuredMcpCommandGroups(env = process.env) {
-  if (env.AGDF_MCP_COMMAND_GROUPS === undefined) return Object.keys(RUN_COMMAND_GROUPS);
-  const values = env.AGDF_MCP_COMMAND_GROUPS === '' ? [] : env.AGDF_MCP_COMMAND_GROUPS.split(',');
-  if (new Set(values).size !== values.length || values.some(group => !Object.hasOwn(RUN_COMMAND_GROUPS, group))) throw Error('AGDF_MCP_COMMAND_GROUPS_INVALID');
-  return values;
-}
-
-export function createMcpDispatchRuntime({ surface, inspected = inspectMcpDispatcherRuntime(), commandGroups = configuredMcpCommandGroups(), runtimeControl } = {}) {
-  const trustedContext = Object.freeze({
-    surface,
-    expectedVersion: inspected.expectedVersion,
-    skillSet: inspected.skillSet,
-    interactionLocales: inspected.interactionLocales,
-    provenanceStatus: inspected.provenanceStatus ?? "unowned",
-    commandGroups: Object.freeze([...commandGroups]),
-    decisionQualification: inspected.decisionQualification ?? (() => false),
-    decisionQualificationReport: inspected.decisionQualificationReport ?? (() => ({ qualified: false, reason: 'host_context_unavailable', authorizes: false })),
-  });
+export function createMcpDispatchRuntime({ surface, inspected = inspectMcpDispatcherRuntime(), commandGroups = configuredMcpCommandGroups(), runtimeControl, materialGrants, verifyRuntime, inputContext, executionContext } = {}) {
+  const readBudget = createReadWorkerBudget();
+  const delivery = createPresentationDelivery();
+  const verifyProducer = verifyRuntime ?? (() => {
+      const current = inspectMcpDispatcherRuntime();
+      if (current.provenanceStatus !== 'matched' || current.runtimeEvidence.runtime_digest !== inspected.runtimeEvidence.runtime_digest
+        || JSON.stringify(current.generationIdentity) !== JSON.stringify(inspected.generationIdentity))
+        throw Object.assign(Error('runtime_provenance_invalid'), { code: 'runtime_provenance_invalid' });
+      return current.generationIdentity;
+    });
+  const diagnostic = createDoctorObservationService({ budget: readBudget, gitObservation: cliGitObservation, verifyRuntime: verifyProducer });
   const services = createCoreServices({ resources, observers: {
     runtimeEvidence: inspected.runtimeEvidence,
     validateControlReadBoundary: assertMcpControlReadBoundary,
-    commandGroups, runtimeControl,
+    commandGroups, runtimeControl, materialGrants, gitObservation: cliGitObservation,
+    observeDoctor: (root, input, signal) => diagnostic.observe(root, input, signal),
   } });
-  const execute = services.dispatch;
+  const execute = input => mcpControlContinuation(input, services.dispatch(input), commandGroups);
   const executeInspect = services.inspect;
-  const parse = (argumentsValue) => parseSkillDispatchFunctionArguments(argumentsValue, trustedContext);
-  const failureEvidence = { ...inspected.runtimeEvidence, expected_version: inspected.expectedVersion };
-  const tools = Object.freeze([
-    Object.freeze({ name: SKILL_DISPATCH_FUNCTION_DEFINITION.name, definition: SKILL_DISPATCH_FUNCTION_DEFINITION, parse, execute, serialize: serializeSkillDispatchResult }),
-    Object.freeze({
-      name: CONTROL_INSPECT_FUNCTION_DEFINITION.name,
-      definition: CONTROL_INSPECT_FUNCTION_DEFINITION,
-      parse: (argumentsValue) => parseControlInspectFunctionArguments(argumentsValue, trustedContext),
-      execute: executeInspect,
-      serialize: serializeControlInspectResult,
-    }),
-    ...commandGroups.map(group => Object.freeze({ name: group, definition: commandGroupDefinition(group),
-      parse: argumentsValue => {
-        const errors = validateRunCommand(group, argumentsValue);
-        if (errors.length) throw Error('command_schema_invalid');
-        return argumentsValue;
-      }, execute: input => services.command(group, input), serialize: value => JSON.stringify(value) })),
-  ]);
-  if (tools.filter(tool => Object.hasOwn(RUN_COMMAND_GROUPS, tool.name)).reduce((bytes, tool) => bytes + Buffer.byteLength(JSON.stringify(tool.definition)), 0) > RUN_COMMAND_LIMITS.aggregate_definition_bytes) throw Error('command_aggregate_definition_budget_exceeded');
-  return Object.freeze({
-    ...errorSupport(),
-    definition: SKILL_DISPATCH_FUNCTION_DEFINITION,
-    parse,
-    execute,
-    tools,
-    tool(name) {
-      return tools.find((entry) => entry.name === name) ?? null;
-    },
-    serialize: serializeSkillDispatchResult,
-    failure(code, toolName = SKILL_DISPATCH_FUNCTION_DEFINITION.name, argumentsValue, { dispatch = 'unknown', field, cause_code, worker_phase } = {}) {
-      const facts = { code, dispatch, ...(field ? { field } : {}),
-        ...(cause_code ? { cause_code } : {}), ...(worker_phase ? { worker_phase } : {}) };
-      const finish = value => {
-        if (validExecutionFacts(facts)) {
-          const { code: _code, dispatch: _dispatch, ...details } = facts;
-          if (value.diagnostics?.length) value = { ...value, diagnostics: value.diagnostics.map((d, i) => i === 0 ? { ...d, ...details } : d) };
-          else if (facts.cause_code || facts.worker_phase) value = { ...value, diagnostics: [{ code, ...details }] };
-        }
-        const message = describeToolResult(toolName, argumentsValue ?? {}, value,
-          localePack(interactionLocales, argumentsValue?.presentation_language ?? 'en'), facts).message;
-        return value.terminal ? { ...value, recovery: { action: message }, host_action: { ...value.host_action, text: message } } : value;
-      };
-      if (Object.hasOwn(RUN_COMMAND_GROUPS, toolName)) {
-        const valid = argumentsValue && validateRunCommand(toolName, argumentsValue).length === 0;
-        return finish({ schema_version: '1', outcome: dispatch === 'not_dispatched' ? 'rejected' : 'effect_unknown', reason: code,
-          operation_id: valid ? argumentsValue.operation_id : null, request_digest: valid ? runCommandRequestDigest(argumentsValue) : null,
-          binding: valid ? { target_id: argumentsValue.target_id, run_id: argumentsValue.run_id, expected_revision_id: argumentsValue.expected_revision_id, kind: argumentsValue.command.kind } : null,
-          dispatch, authorizes: false, recovery: dispatch === 'not_dispatched' ? 'No command was dispatched by this attempt.'
-            : 'Inspect operation-status with the original UUID and preserve the exact original payload. Do not infer non-execution or create another decision.' });
-      }
-      if (toolName === CONTROL_INSPECT_FUNCTION_DEFINITION.name) {
-        const action = FAILURE_ACTIONS[code] ?? FAILURE_ACTIONS.dispatch_worker_failed;
-        return finish(createInspectFailureResult(code, failureEvidence, action));
-      }
-      return finish(createFailureResult(code, failureEvidence));
+  const protocol = composeMcpProtocolRuntime({ surface, inspected, commandGroups, execute, executeInspect, inputContext, executionContext,
+    lookupOriginal: (root, input) => ['material.stage', 'planned_material.stage'].includes(input.command?.kind) ? services.material.originalInput(input)
+      : input.command?.kind === 'presentation.deliver' ? delivery.originalInput(input)
+        : runtimeControl?.originalInput?.(input) ?? inspectRunInputResolution(root, input),
+    executeCommand: (group, input, signal, host) => ['material.stage', 'planned_material.stage'].includes(input.command.kind) ? services.material.stage(input)
+      : input.command.kind === 'presentation.deliver' ? delivery.deliver(input, host) : services.command(group, input) });
+  return Object.freeze({ ...protocol,
+    verifyProducer,
+    prepareDispatch(name, input) { return { inputContext: protocol.inputContextFor(input), materialGrants: ['agdf_record', 'agdf_revise', 'agdf_closeout'].includes(name) ? services.material.grants(input) : [] }; },
+    readBudget,
+    delivery,
+    async postprocessToolResult(name, input, result) {
+      const configuration = protocol.configurationProjection(input);
+      if (configuration && name === 'agdf_inspect' && result.report) result = { ...result, report: { ...result.report, effective_configuration: configuration } };
+      if (['agdf_record', 'agdf_revise', 'agdf_closeout'].includes(name)) services.material.settle(input, result);
+      if (name !== 'agdf_prepare' || input.command?.kind !== 'presentation.prepare' || !result.family_result?.text) return result;
+      delivery.remember(input, result);
+      const prepared = result.family_result, { operation_id, ...binding } = input;
+      return { ...result, presentation_delivery: { mode: 'prepared', text: '', presentation_id: prepared.presentation_id,
+        document_digest: prepared.document_digest, authorizes: false,
+        ...(prepared.preview_review ? { preview_review: { operation: 'presentation-preview', version: prepared.preview_review.descriptor.version,
+          content_digest: prepared.preview_review.rendered_digest, access_state: 'not_observed', target_id: input.target_id,
+          run_id: input.run_id, gate: 'PRD', expected_revision_id: input.expected_revision_id, presentation_id: prepared.presentation_id } } : {}),
+        instruction: 'Prepared, not delivered. Optionally open agdf_decision_view as a non-primary preview. Then presentation.deliver selects once. Default route markdown; no second summary.',
+        next_calls: [{ tool: 'agdf_prepare', arguments: { ...binding, command: { kind: 'presentation.deliver',
+          payload: { gate: input.command.payload.gate, presentation_id: prepared.presentation_id, route: 'markdown' } } },
+          required_input: { operation_id: 'Generate a new UUID for delivery; no gate approval is required.' } }] } };
     },
-    trustedContext,
+    async close() { services.material.close(); delivery.close(); await diagnostic.close(); },
+    inspectOwnership() { const d = diagnostic.inspectOwnership(); return { diagnostic: d, read_workers: readBudget.inspect(),
+      views: d.observations, inflight: d.inflight, uncertain: 0 }; },
   });
 }
 
-// Only the App-capable adapter loads ephemeral view owners; Copilot/default Core
-// projections do not acquire a hidden dependency on the private cockpit reader.
-export async function createMcpDecisionRuntime({ runtime, ui, appOnlyMediationQualified = false } = {}) {
+export async function createMcpDecisionRuntime({ runtime, ui, appOnlyMediationQualified = false, surfaceBinding } = {}) {
   if (!runtime || runtime.trustedContext.surface !== 'codex') throw Error('decision_runtime_surface_invalid');
-  const [{ createDecisionSessionService }, { decisionActionDefinition, validateDecisionAction },
-    { COCKPIT_READ_DEFINITION, parseCockpitArguments }] = await Promise.all([
-    import('#agdf-core/control-inspect/decision-session.js'), import('#agdf-core/control-state/decision-action-contract.js'),
-    import('#agdf-core/control-inspect/cockpit-contract.js'),
+  const [{ createDecisionSessionService }, { createCockpitSessionService }, { composeMcpDecisionProtocol }] = await Promise.all([
+    import('#agdf-core/control-inspect/decision-session.js'), import('#agdf-core/control-inspect/cockpit-session.js'),
+    import('./mcp-decision-protocol.js'),
   ]);
-  const groups = runtime.trustedContext.commandGroups, session = createDecisionSessionService({ groups, appOnlyMediationQualified,
+  const groups = runtime.trustedContext.commandGroups, session = createDecisionSessionService({ groups, delivery: runtime.delivery, appOnlyMediationQualified, surfaceBinding,
+    readServiceFactory: root => createCockpitSessionService(root, { budget: runtime.readBudget }),
     qualification: ({ client }) => appOnlyMediationQualified === true
       || runtime.trustedContext.decisionQualification(client, ui.digest) === true });
-  const facade = decisionActionDefinition(groups);
-  const tools = runtime.tools.map(tool => tool.name === 'agdf_prepare' ? { ...tool,
-    definition: { ...tool.definition, _meta: { ui: { resourceUri: ui.uri, visibility: ['model', 'app'] } } } } : tool);
-  tools.push({ name: COCKPIT_READ_DEFINITION.name, definition: COCKPIT_READ_DEFINITION, requiresUi: true, parentOwned: true,
-    parse: parseCockpitArguments, execute: (input, signal) => session.read(input, signal), serialize: value => JSON.stringify(value) });
-  if (facade) tools.push({ name: facade.name, definition: facade, requiresUi: true, parentOwned: true,
-    parse: input => { if (validateDecisionAction(input, facade.inputSchema.properties.action.enum).length) throw Error('decision_schema_invalid'); return input; },
-    execute: (input, signal, host) => session.action(input, host), serialize: value => JSON.stringify(value) });
-  const bytes = tools.filter(tool => Object.hasOwn(RUN_COMMAND_GROUPS, tool.name) || tool.name === facade?.name)
-    .reduce((sum, tool) => sum + Buffer.byteLength(JSON.stringify(tool.definition)), 0);
-  if (bytes > RUN_COMMAND_LIMITS.aggregate_definition_bytes) { await session.close(); throw Error('command_aggregate_definition_budget_exceeded'); }
-  return Object.freeze({ ...runtime, tools: Object.freeze(tools), ui, mode: 'decision',
-    tool: name => tools.find(tool => tool.name === name) ?? null,
+  const protocol = composeMcpDecisionProtocol({ runtime, ui, prepared: input => session.prepared(input),
+    open: (input, result, host) => session.open(input, result, host), read: (input, signal, host) => session.read(input, signal, host),
+    action: (input, host) => session.action(input, host), close: () => session.close() });
+  return Object.freeze({ ...protocol,
     async postprocessToolResult(name, input, result, { uiSupported, client } = {}) {
       if (name === 'agdf_inspect' && input.operation === 'native-qualification' && result.report?.available) {
         return { ...result, report: { ...result.report, ui_rendering_support: uiSupported ? 'supported' : 'unsupported',
           action_qualification: runtime.trustedContext.decisionQualificationReport(client, ui.digest),
           enabled_command_groups: [...groups], authorizes: false } };
       }
-      if (name !== 'agdf_prepare' || input.command?.kind !== 'presentation.prepare') return result;
-      const delivered = uiSupported ? await session.open(input, result, { client })
-        : { ...result, app_capability: 'unavailable', app_reason: 'host_ui_unsupported' };
-      const prepared = result.family_result;
-      if (typeof prepared?.text !== 'string') return delivered;
-      // Capability advertisement and an emitted resource do not prove that this
-      // request surface displays it (in particular a remote/iPad Chat). Until an
-      // actual display observation exists, send the complete decision once.
-      const displayed = delivered.app_capability === 'available' && delivered.app_display === 'confirmed';
-      const text = displayed && typeof prepared.companion_text === 'string'
-        ? prepared.companion_text : prepared.text;
-      return { ...delivered, presentation_delivery: { mode: displayed ? 'native_plus_chat' : 'full_chat', display: displayed ? 'confirmed' : 'unconfirmed',
-        text, presentation_id: prepared.presentation_id, revision_id: prepared.revision_id,
-        document_digest: prepared.document_digest ?? prepared.artefact_digest, document_language: prepared.document_language ?? null,
-        ...(prepared.preview_review ? { preview_review: { operation: 'presentation-preview', version: prepared.preview_review.descriptor.version,
-          content_digest: prepared.preview_review.rendered_digest, access_state: displayed ? 'native_bound' : 'not_observed',
-          target_id: input.target_id, run_id: input.run_id, gate: 'PRD', expected_revision_id: input.expected_revision_id, presentation_id: prepared.presentation_id } } : {}),
-        instruction: 'Forward this exact Chat text once. Do not append a second decision request. On a human request to read the document, use presentation-document with this exact binding and every returned cursor; deliver all ordered chunks in the same Chat before requesting a decision. A local file link is not remote access proof.'
-          + (prepared.preview_review ? ' The required preview uses presentation-preview with the supplied exact selectors and every cursor. Offer only supported isolated rendering of those exact bytes. If this surface cannot show it, state that access is unavailable and the review remains open; never call raw HTML, a local link or an unopened resource a viewed preview.' : ''),
-        authorizes: false } };
-    },
-    failure(code, name, input, dispatch) {
-      return name === 'agdf_decision_action' ? { schema_version: '1', outcome: dispatch?.dispatch === 'not_dispatched' ? 'rejected' : 'effect_unknown',
-        reason: code, operation_id: input?.operation_id ?? null, authorizes: false, recovery: 'Inspect the original UUID; do not infer non-execution or submit another decision.' }
-        : name === 'agdf_cockpit_read' ? { schema_version: '1', outcome: 'rejected', reason: code, authorizes: false } : runtime.failure(code, name, input, dispatch);
+      return runtime.postprocessToolResult(name, input, result);
+
     },
-    close: () => session.close(), inspectOwnership: () => session.inspectOwnership(),
+    async close() { await Promise.all([session.close(), runtime.close?.()]); },
+    inspectOwnership() { const base = runtime.inspectOwnership(), decision = session.inspectOwnership(); return { ...base, decision,
+      views: base.views + decision.views, inflight: base.inflight + decision.inflight, uncertain: base.uncertain + (decision.uncertain ?? 0) }; },
   });
 }
 

package/generated/plugins/agdf/runtime/create-agdf/lib/mcp-lifecycle/facade-entry.js

@@ -1,26 +1,5 @@
-// Private child of the installed launcher. Public input remains MCP STDIO only.
+// Explicit process adapter retained for historical owned packages.
 import process from 'node:process';
-import { dirname, join } from 'node:path';
-import { pathToFileURL } from 'node:url';
-import { inspectMcpServerPackage, createMcpGenerationPublisher } from './package.js';
-
+import { startFacadeRuntime } from './facade-runtime.js';
 if (!process.send || !process.argv[2] || process.argv[2].length > 65536) throw Error('AGDF_MCP_FACADE_INPUT_INVALID');
-const { runtime: expected, surface, cockpitDir, cockpitMode, pluginRoot, token, deadline_ns } = JSON.parse(process.argv[2]);
-let handle, stopRequested = false;
-const stop = () => { stopRequested = true; if (handle) void handle.close(); };
-process.on('message', message => { if (message?.kind === 'facade_stop' && message.token === token) stop(); });
-process.on('disconnect', stop); process.on('SIGINT', stop); process.on('SIGTERM', stop);
-const actual = inspectMcpServerPackage({ dataRoot: dirname(expected.root), expectedVersion: expected.version });
-if (actual.status !== 'matched' || actual.root !== expected.root || actual.digest !== expected.digest
-  || actual.dispatcherDigest !== expected.dispatcherDigest || actual.sdkDigest !== expected.sdkDigest) throw Error('AGDF_MCP_FACADE_IDENTITY_INVALID');
-const runtime = { ...actual, immutable: true, publication_id: expected.publication_id, publisher_root: expected.publisher_root };
-process.env.AGDF_DISPATCH_PLUGIN_ROOT = pluginRoot;
-const { runMcpServer } = await import(pathToFileURL(join(runtime.packageRoot, 'src/main.js')));
-handle = await runMcpServer({ surface, cockpitDir, cockpitMode, ownedPublication: runtime,
-  ownedPublisher: createMcpGenerationPublisher(runtime, {
-    publicationDeadline: performance.now() + Math.max(0, Number(BigInt(deadline_ns) - process.hrtime.bigint()) / 1e6),
-  }), onClosed(result) {
-    process.send?.({ kind: 'facade_closed', token, confirmed: result?.confirmed === true }, () => process.disconnect());
-  } });
-if (!handle) throw Error('AGDF_MCP_FACADE_START_UNCONFIRMED');
-if (stopRequested) await handle.close();
+await startFacadeRuntime({ input: JSON.parse(process.argv[2]), channel: { on: (...args) => process.on(...args), send: (...args) => process.send(...args), close: () => process.disconnect() } });

package/generated/plugins/agdf/runtime/create-agdf/lib/mcp-lifecycle/facade-owner-entry.js

@@ -1,29 +1,45 @@
 // Stable launcher-side owner; it loads no immutable SDK code itself. Loss of
 // its host parent requests orderly shutdown, never deletion of active bytes.
 import process from 'node:process';
-import { dirname } from 'node:path';
 import { EventEmitter } from 'node:events';
-import { inspectMcpServerPackage, acquireMcpExecutableClaim } from './package.js';
+import { acquireMcpExecutableClaim } from './package.js';
 import { supervisePluginMcpFacade } from './plugin-runtime.js';
+import { superviseThreadMcpFacade } from './thread-owner.js';
 
 if (!process.send || !process.connected || !process.argv[2] || process.argv[2].length > 65536) throw Error('AGDF_MCP_FACADE_INPUT_INVALID');
-const input = JSON.parse(process.argv[2]), expected = input.runtime;
+const input = JSON.parse(process.argv[2]);
 const signals = new EventEmitter();
-let stopRequested = false, supervising = false;
-const stop = () => { stopRequested = true; if (supervising) signals.emit('SIGTERM'); };
+let stopRequested = false, supervising = false, releaseWaiting;
+const stop = () => { stopRequested = true; releaseWaiting?.(null); if (supervising) signals.emit('SIGTERM'); };
 process.on('disconnect', stop); process.on('SIGINT', stop); process.on('SIGTERM', stop);
 process.on('message', message => { if (message?.kind === 'owner_stop' && message.token === input.token) stop(); });
 try {
-  const actual = inspectMcpServerPackage({ dataRoot: dirname(expected.root), expectedVersion: expected.version });
-  if (actual.status !== 'matched' || actual.root !== expected.root || actual.digest !== expected.digest
-    || actual.dispatcherDigest !== expected.dispatcherDigest || actual.sdkDigest !== expected.sdkDigest) throw Error('AGDF_MCP_FACADE_IDENTITY_INVALID');
-  const runtime = { ...actual, immutable: true, publication_id: expected.publication_id, publisher_root: expected.publisher_root };
-  const publicationDeadline = performance.now() + Math.max(0, Number(BigInt(input.deadline_ns) - process.hrtime.bigint()) / 1e6);
-  const claim = acquireMcpExecutableClaim(runtime, { publicationDeadline });
-  const ended = supervisePluginMcpFacade({ ...input, runtime, env: process.env, claim, signals, deadlineNs: input.deadline_ns });
-  supervising = true;
-  if (stopRequested) signals.emit('SIGTERM');
-  await ended;
+  const expected = input.await_runtime === true ? await new Promise((resolve, reject) => {
+    const remaining = Math.max(0, Number(BigInt(input.deadline_ns) - process.hrtime.bigint()) / 1e6);
+    const timer = setTimeout(() => finish(null, Error('AGDF_MCP_PUBLICATION_DEADLINE_EXCEEDED')), remaining);
+    const start = message => { if (message?.kind === 'owner_start' && message.token === input.token) finish(message.runtime); };
+    const finish = (runtime, error) => {
+      clearTimeout(timer); process.off('message', start); releaseWaiting = undefined;
+      if (error) reject(error); else resolve(runtime);
+    };
+    releaseWaiting = finish; process.on('message', start);
+    if (stopRequested) finish(null);
+    else process.send({ kind: 'owner_ready', token: input.token });
+  }) : input.runtime;
+  if (expected) {
+    const publicationDeadline = performance.now() + Math.max(0, Number(BigInt(input.deadline_ns) - process.hrtime.bigint()) / 1e6);
+    // Claim acquisition performs the full current server/dispatcher/SDK inspection
+    // under the publication lock. Continue with its canonical observed paths.
+    const claim = acquireMcpExecutableClaim(expected, { publicationDeadline });
+    const runtime = { ...claim.verifiedRuntime, immutable: true, publication_id: expected.publication_id, publisher_root: expected.publisher_root };
+    // Both SDK-free adapters load during owner bootstrap. There is no await
+    // between the fresh lock-bound claim and actual executable Worker creation.
+    const supervise = runtime.executionModel === 'owner_threads_v1' ? superviseThreadMcpFacade : supervisePluginMcpFacade;
+    const ended = supervise({ ...input, runtime, env: process.env, claim, signals, deadlineNs: input.deadline_ns });
+    supervising = true;
+    if (stopRequested) signals.emit('SIGTERM');
+    await ended;
+  }
   if (process.connected) process.send({ kind: 'owner_closed', token: input.token, confirmed: true }, () => process.disconnect());
 } catch (error) {
   process.exitCode = 1;

package/generated/plugins/agdf/runtime/create-agdf/lib/mcp-lifecycle/facade-runtime.js

@@ -0,0 +1,29 @@
+// Private child of the installed launcher. Public input remains MCP STDIO only.
+import process from 'node:process';
+import { join } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { createMcpGenerationPublisher } from './package.js';
+
+export async function startFacadeRuntime({ input, channel, generationTransport, signals = process }) {
+  const { runtime: expected, surface, cockpitDir, cockpitMode, pluginRoot, token, deadline_ns } = input;
+  let handle, stopRequested = false;
+  const stop = () => { stopRequested = true; if (handle) void handle.close(); };
+  channel.on('message', message => { if (message?.kind === 'facade_stop' && message.token === token) stop(); });
+  channel.on('disconnect', stop); signals.on('SIGINT', stop); signals.on('SIGTERM', stop);
+  // The parent freshly claims the complete immutable image immediately before
+  // creating this actual executable. These are expected identities, not a reused
+  // observation. The SDK-free main/protocol load performs its own full fresh
+  // inspection and binds that producer below, before any SDK import/service.
+  const runtime = { ...expected, immutable: true };
+  process.env.AGDF_DISPATCH_PLUGIN_ROOT = pluginRoot;
+  const { runMcpServer } = await import(pathToFileURL(join(runtime.packageRoot, 'src/main.js')));
+  handle = await runMcpServer({ surface, cockpitDir, cockpitMode, ownedPublication: runtime,
+    generationTransport, ownedPublisher: createMcpGenerationPublisher(runtime, {
+      publicationDeadline: performance.now() + Math.max(0, Number(BigInt(deadline_ns) - process.hrtime.bigint()) / 1e6),
+    }), onClosed(result) {
+      channel.send({ kind: 'facade_closed', token, confirmed: result?.confirmed === true }, () => channel.close());
+    } });
+  if (!handle) throw Error('AGDF_MCP_FACADE_START_UNCONFIRMED');
+  if (stopRequested) await handle.close();
+
+}

package/generated/plugins/agdf/runtime/create-agdf/lib/mcp-lifecycle/facade-thread-entry.js

@@ -0,0 +1,11 @@
+import { parentPort, workerData } from 'node:worker_threads';
+import { createOwnerClient } from './owner-client.js';
+import { startFacadeRuntime } from './facade-runtime.js';
+if (!parentPort) throw Error('AGDF_MCP_FACADE_INPUT_INVALID');
+const client = createOwnerClient(parentPort, workerData.binding);
+await startFacadeRuntime({ input: workerData.input, generationTransport: client,
+  channel: { ...client.lifecycle, close() {
+    // Node's Worker stdin retains its internal port until readable EOF. The SDK
+    // has stopped reading after close; drain the owner's final EOF naturally.
+    process.stdin.resume(); client.lifecycle.close();
+  } } });