create-agdf 0.20.2 → 0.31.0

package/lib/mcp-decision-protocol.js

@@ -0,0 +1,40 @@
+import { RUN_COMMAND_GROUPS, RUN_COMMAND_LIMITS } from '#agdf-core/control-state/run-command-schema.js';
+
+// Optional UI composition is deliberately outside the default headless import
+// closure. Full and thin UI fronts share this one structural contract.
+const unwrapped = () => { throw Object.assign(Error('generation_unavailable'), { code: 'generation_unavailable', dispatch: 'not_dispatched' }); };
+
+import { decisionActionDefinition, validateDecisionAction, DECISION_VIEW_DEFINITION, validateDecisionView } from '#agdf-core/control-state/decision-action-contract.js';
+import { COCKPIT_READ_DEFINITION, parseCockpitArguments } from '#agdf-core/control-inspect/cockpit-contract.js';
+
+export function composeMcpDecisionProtocol({ runtime, ui, prepared = unwrapped, open = unwrapped, read = unwrapped, action = unwrapped, close = () => {} } = {}) {
+  const groups = runtime.trustedContext.commandGroups;
+  const facade = decisionActionDefinition(groups);
+  const tools = [...runtime.tools];
+  if (groups.includes('agdf_prepare')) tools.push({ name: DECISION_VIEW_DEFINITION.name, definition: DECISION_VIEW_DEFINITION, requiresUi: true, parentOwned: true,
+    parse: input => { if (validateDecisionView(input).length) throw Error('decision_schema_invalid'); return input; },
+    execute: async (input, signal, host) => {
+      const remembered = prepared(input);
+      if (!remembered) return { schema_version: '1', outcome: 'rejected', reason: 'delivery_state_unavailable', authorizes: false };
+      const opened = await open(remembered.input, remembered.result, host);
+      return { schema_version: '1', outcome: opened._meta ? 'accepted' : 'rejected', reason: opened.app_reason ?? null,
+        app_capability: opened.app_capability, authorizes: false, ...(opened._meta ? { _meta: opened._meta } : {}) };
+    }, serialize: JSON.stringify });
+  tools.push({ name: COCKPIT_READ_DEFINITION.name, definition: COCKPIT_READ_DEFINITION, requiresUi: true, parentOwned: true,
+    parse: parseCockpitArguments, execute: (input, signal, host) => read(input, signal, host), serialize: value => JSON.stringify(value) });
+  if (facade) tools.push({ name: facade.name, definition: facade, requiresUi: true, parentOwned: true,
+    parse: input => { if (validateDecisionAction(input, facade.inputSchema.properties.action.enum).length) throw Error('decision_schema_invalid'); return input; },
+    execute: (input, signal, host) => action(input, host), serialize: value => JSON.stringify(value) });
+  const bytes = tools.filter(tool => Object.hasOwn(RUN_COMMAND_GROUPS, tool.name) || tool.name === facade?.name || tool.name === DECISION_VIEW_DEFINITION.name)
+    .reduce((sum, tool) => sum + Buffer.byteLength(JSON.stringify(tool.definition)), 0);
+  if (bytes > RUN_COMMAND_LIMITS.aggregate_definition_bytes) { void close(); throw Error('command_aggregate_definition_budget_exceeded'); }
+  return Object.freeze({ ...runtime, tools: Object.freeze(tools), ui, mode: 'decision',
+    tool: name => tools.find(tool => tool.name === name) ?? null,
+    failure(code, name, input, dispatch) {
+      return name === 'agdf_decision_action' ? { schema_version: '1', outcome: dispatch?.dispatch === 'not_dispatched' ? 'rejected' : 'effect_unknown',
+        reason: code, operation_id: input?.operation_id ?? null, authorizes: false, recovery: 'Inspect the original UUID; do not infer non-execution or submit another decision.' }
+        : ['agdf_cockpit_read', 'agdf_decision_view'].includes(name) ? { schema_version: '1', outcome: 'rejected', reason: code, authorizes: false } : runtime.failure(code, name, input, dispatch);
+    },
+  });
+}
+

package/lib/mcp-dispatch-runtime.js

@@ -1,73 +1,36 @@
 import { createCoreServices } from "#agdf-core";
 import { resources } from "./runtime/control-context.js";
-import {
-  SKILL_DISPATCH_CONTRACT_VERSION,
-  SKILL_DISPATCH_FUNCTION_DEFINITION,
-  SKILL_DISPATCH_SCHEMA_VERSION,
-  SKILL_DISPATCH_MAX_OUTPUT_BYTES,
-  emptySkillDispatchTiming,
-  parseSkillDispatchFunctionArguments,
-  serializeSkillDispatchResult,
-  SkillDispatchInputError,
-} from "#agdf-core/skill-dispatch/contract.js";
-import { TaskTargetInputError } from '#agdf-core/task-target-resolution.js';
-import { ReadSelectionError } from '#agdf-core/control-inspect/selection.js';
-import { localePack } from '#agdf-core/interaction-presentation.js';
-import { TOOL_ERROR_CONTRACT, TOOL_RESULT_META, describeToolResult, projectToolResult, consumeToolResult, executionFacts, validExecutionFacts } from '#agdf-core/mcp-tool-errors.js';
-import { existsSync, lstatSync, readFileSync, realpathSync } from "node:fs";
-import { isAbsolute, join, resolve } from "node:path";
-import { CONTROL_INSPECT_FUNCTION_DEFINITION, parseControlInspectFunctionArguments, serializeControlInspectResult } from "#agdf-core/control-inspect/contract.js";
-import { createInspectFailureResult } from "#agdf-core/control-inspect/service.js";
+import { cliGitObservation } from './control-evaluation/git-observation.js';
+import { createReadWorkerBudget } from '#agdf-core/control-read/cockpit-pool.js';
+import { createDoctorObservationService } from '#agdf-core/control-inspect/doctor-observation.js';
+import { createPresentationDelivery } from '#agdf-core/control-state/presentation-delivery.js';
+import { mcpControlContinuation } from '#agdf-core/skill-dispatch/mcp-continuation.js';
+import { inspectRunInputResolution } from '#agdf-core/control-state/run-input-resolution.js';
 import { assertMcpControlReadBoundary } from "#agdf-core/control-read-boundary.js";
-import { interactionLocales, packageRoot, pluginDefinition } from "./cli/runtime-context.js";
-import { RUN_COMMAND_GROUPS, RUN_COMMAND_LIMITS, commandGroupDefinition, validateRunCommand, validateRunCommandResult, runCommandRequestDigest } from '#agdf-core/control-state/run-command-contract.js';
-import {
-  digestDirectory,
-  digestMcpDispatcherPackage,
-  digestMcpSdkRuntime,
-  evaluateDecisionAppQualification, inspectDecisionAppQualification,
-} from "#agdf-core/runtime/plugin-provenance.js";
-
-const MCP_RUNTIME_OWNER = "create-agdf:mcp-runtime";
-
-// Compose the canonical structural contract at the existing producing/consuming
-// boundary. The descriptor projector stays dependency-free and policy-pure.
-function checkCommandResult(name, result) {
-  if (Object.hasOwn(RUN_COMMAND_GROUPS, name) && validateRunCommandResult(result).length) {
-    throw Object.assign(new Error('tool_result_invalid'), { facts: { code: 'tool_result_invalid', dispatch: 'unknown' } });
-  }
-}
-function errorSupport(cockpit = false) {
-  return {
-    toolErrorContract: TOOL_ERROR_CONTRACT, responseLimit: SKILL_DISPATCH_MAX_OUTPUT_BYTES,
-    projectToolResult(name, input = {}, result, facts) {
-      const pack = localePack(interactionLocales, input.presentation_language ?? (cockpit ? 'de' : 'en'));
-      checkCommandResult(name, result);
-      const { _meta, ...domain } = result;
-      const serialize = name === 'agdf_dispatch' ? serializeSkillDispatchResult : name === 'agdf_inspect' ? serializeControlInspectResult : JSON.stringify;
-      const checked = JSON.parse(serialize(domain));
-      const projected = projectToolResult(name, input, { ...checked, ...(_meta ? { _meta } : {}) }, pack, facts);
-      // Existing serializers can replace oversized output before projection.
-      // Their terminal instruction must agree with the same bounded guidance.
-      if (checked.outcome === 'evaluator_error' && checked.diagnostics?.some(d => ['dispatch_output_too_large', 'inspect_output_too_large'].includes(d.code))) {
-        const message = projected._meta[TOOL_RESULT_META].message;
-        return { ...projected, recovery: { action: message }, host_action: { ...projected.host_action, text: message } };
-      }
-      return projected;
-    },
-    consumeToolResult(name, result) { checkCommandResult(name, result); return consumeToolResult(name, result); },
-    normalizeFailure(error, { phase = 'execute' } = {}) {
-      if (phase === 'parse' && (error instanceof SkillDispatchInputError || error instanceof TaskTargetInputError || error instanceof ReadSelectionError)) {
-        const facts = { code: error instanceof ReadSelectionError ? 'inspect_input_invalid' : 'dispatch_input_invalid', dispatch: 'not_dispatched', ...(error.field ? { field: error.field } : {}) };
-        return validExecutionFacts(facts) ? facts : { code: 'dispatch_input_invalid', dispatch: 'not_dispatched' };
-      }
-      if (phase === 'parse' && ['command_schema_invalid', 'resource_denied', 'decision_schema_invalid'].includes(error?.code ?? error?.message))
-        return { code: error.code ?? error.message, dispatch: 'not_dispatched' };
-      return executionFacts(error, { phase });
-    },
-  };
+import { knownExecutionCode, validExecutionFacts } from '#agdf-core/mcp-tool-errors.js';
+import { createCompanionJournal } from '#agdf-core/companion/journal.js';
+import { existsSync, lstatSync, realpathSync } from 'node:fs';
+import { isAbsolute } from 'node:path';
+import { composeMcpProtocolRuntime, errorSupport, inspectMcpDispatcherRuntime, configuredMcpCommandGroups } from './mcp-protocol-runtime.js';
+export { inspectMcpDispatcherRuntime, configuredMcpCommandGroups, CONTROL_INSPECT_FUNCTION_DEFINITION, SKILL_DISPATCH_FUNCTION_DEFINITION,
+  parseControlInspectFunctionArguments, parseSkillDispatchFunctionArguments, serializeSkillDispatchResult, DECISION_UI_URI, OWNED_LOCK_CHANNEL, releaseAbandonedOwnedLock } from './mcp-protocol-runtime.js';
+// Core reasons that the tool-error contract names differently. Core's command service maps
+// RECOVERY_REQUIRED the same way and rejects the others under these existing codes.
+const PREPARATION_REASONS = Object.freeze([
+  [/RECOVERY_REQUIRED/iu, 'recovery_required'],
+  [/^AGDF_PLANNED_SOURCE_STALE$/u, 'planning_source_stale'],
+  [/^(?:run_state_invalid|run_id_invalid)$/u, 'invalid_run'],
+  [/^AGDF_CONTROL_LAYOUT_MIGRATION_REQUIRED$/u, 'control_layout_unsupported'],
+]);
+// Dispatch preparation only reads the input context and grants staged material; no command has
+// been dispatched yet. Its failures therefore carry typed not_dispatched facts, so the facade and
+// generation call sites report a rejected command with its classified reason, never an unknown effect.
+export function preDispatchFailure(error) {
+  if (validExecutionFacts(error?.facts)) return Object.assign(error, { facts: { ...error.facts, dispatch: 'not_dispatched' } });
+  const reason = String(error?.message ?? '');
+  const code = knownExecutionCode(PREPARATION_REASONS.find(([pattern]) => pattern.test(reason))?.[1] ?? reason);
+  return Object.assign(new Error(code), { facts: { code, dispatch: 'not_dispatched' } });
 }
-
 export async function createMcpCockpitRuntime({ surface, cockpitDir, cockpitMode, inspected = inspectMcpDispatcherRuntime() } = {}) {
   const pluginMode = cockpitMode === 'plugin';
   if (cockpitMode !== undefined && !pluginMode || pluginMode && (surface !== 'codex' || cockpitDir !== undefined)
@@ -91,6 +54,7 @@ export async function createMcpCockpitRuntime({ surface, cockpitDir, cockpitMode
   ];
   // Claude Code renders no MCP app UI today; its cockpit stays hidden until a client declares support.
   return Object.freeze({ ...errorSupport(true), mode: 'cockpit', definition: renderDefinition, tools,
+    producerIdentity: inspected.generationIdentity ?? null,
     uiCapabilityRequired: pluginMode || surface === 'claude', responseLimit: READ_LIMITS.response,
     ...(pluginMode ? { unsupportedUiCode: 'host_ui_unsupported' } : {}),
     ui: Object.freeze({ uri: COCKPIT_UI_URI, mimeType: COCKPIT_MIME, limit: COCKPIT_LIMITS.html,
@@ -104,265 +68,92 @@ export async function createMcpCockpitRuntime({ surface, cockpitDir, cockpitMode
   });
 }
 
-function readOwnedRuntimeMarker(dispatcherDigest) {
-  const root = resolve(packageRoot, "..", "..");
-  const markerPath = join(root, ".agdf-mcp-owned.json");
-  const serverRoot = join(root, "node_modules", "@agdf", "mcp-server");
-  const sdkServerRoot = join(root, "node_modules", "@modelcontextprotocol", "server");
-  const sdkCoreRoot = join(root, "node_modules", "@modelcontextprotocol", "core");
-  const sdkClientRoot = join(root, "node_modules", "@modelcontextprotocol", "client");
-  const sdkV1Root = join(root, "node_modules", "@modelcontextprotocol", "sdk");
-  try {
-    if (lstatSync(packageRoot).isSymbolicLink() || !existsSync(markerPath)
-        || !existsSync(serverRoot) || !existsSync(sdkServerRoot) || !existsSync(sdkCoreRoot)
-        || existsSync(sdkClientRoot) || existsSync(sdkV1Root)) return null;
-    if ([serverRoot, sdkServerRoot, sdkCoreRoot].some((path) => {
-      const stats = lstatSync(path);
-      return !stats.isDirectory() || stats.isSymbolicLink();
-    })) return null;
-    const marker = JSON.parse(readFileSync(markerPath, "utf8"));
-    const serverManifest = JSON.parse(readFileSync(join(serverRoot, "package.json"), "utf8"));
-    const sdkServerManifest = JSON.parse(readFileSync(join(sdkServerRoot, "package.json"), "utf8"));
-    const sdkCoreManifest = JSON.parse(readFileSync(join(sdkCoreRoot, "package.json"), "utf8"));
-    const serverDigest = digestDirectory(serverRoot);
-    const sdkDigest = digestMcpSdkRuntime(root);
-    if (![1, 2].includes(marker.schema_version)
-        || marker.owner !== MCP_RUNTIME_OWNER
-        || marker.version !== pluginDefinition.version
-        || serverManifest.name !== "@agdf/mcp-server"
-        || serverManifest.version !== pluginDefinition.version
-        || serverManifest.dependencies?.["create-agdf"] !== pluginDefinition.version
-        || serverManifest.dependencies?.["@modelcontextprotocol/server"] !== "2.0.0"
-        || sdkServerManifest.name !== "@modelcontextprotocol/server"
-        || sdkServerManifest.version !== "2.0.0"
-        || sdkCoreManifest.name !== "@modelcontextprotocol/core"
-        || sdkCoreManifest.version !== "2.0.0"
-        || marker.dispatcher_digest !== dispatcherDigest
-        || marker.server_digest !== serverDigest
-        || marker.sdk_digest !== sdkDigest) return null;
-    return Object.freeze({ markerPath, root, dispatcherDigest, serverDigest, sdkDigest, decisionQualification: marker.decision_app_qualification });
-  } catch {
-    return null;
-  }
-}
-
-export {
-  CONTROL_INSPECT_FUNCTION_DEFINITION,
-  SKILL_DISPATCH_FUNCTION_DEFINITION,
-  parseControlInspectFunctionArguments,
-  parseSkillDispatchFunctionArguments,
-  serializeSkillDispatchResult,
-};
-export { DECISION_UI_URI } from '#agdf-core/mcp-resource-contract.js';
-// The worker executor releases locks of a thread it has seen exit (packages/mcp-server).
-export { OWNED_LOCK_CHANNEL, releaseAbandonedOwnedLock } from '#agdf-core/control-state/run-state-writer.js';
-
-const FAILURE_ACTIONS = Object.freeze({
-  dispatch_busy: "Wait for the active AGDF dispatch to finish and retry once.",
-  dispatch_cancelled: "Retry the AGDF dispatch if it is still required.",
-  dispatch_timeout: "Inspect the original operation status before replaying the identical UUID and request; a timeout does not prove rollback.",
-  dispatch_worker_termination_unconfirmed: "Inspect the original operation status and retained executor; its termination is unconfirmed. Do not start a replacement mutation.",
-  dispatch_worker_failed: "Repair the installed AGDF MCP runtime and retry once.",
-  runtime_version_mismatch: "Install matching AGDF MCP server and dispatcher versions, then retry once.",
-  runtime_provenance_invalid: "Repair the owned AGDF MCP runtime and retry once.",
-});
-
-function createFailureResult(code, runtimeEvidence) {
-  const action = FAILURE_ACTIONS[code] ?? FAILURE_ACTIONS.dispatch_worker_failed;
-  return {
-    schema_version: SKILL_DISPATCH_SCHEMA_VERSION,
-    contract_version: SKILL_DISPATCH_CONTRACT_VERSION,
-    outcome: "evaluator_error",
-    terminal: true,
-    authorizes: false,
-    skill: null,
-    runtime: runtimeEvidence,
-    target: null,
-    control: null,
-    presentation: null,
-    continuation: null,
-    recovery: { action },
-    host_action: {
-      mode: "transmit_recovery_verbatim_and_stop",
-      source: "recovery.action",
-      text: action,
-      allow_surrounding_text: false,
-      may_request_run_or_evidence: false,
-    },
-    timing: emptySkillDispatchTiming(),
-    diagnostics: [{ code }],
-  };
-}
-
-export function inspectMcpDispatcherRuntime() {
-  const runtimeDigest = digestMcpDispatcherPackage(packageRoot);
-  const owned = readOwnedRuntimeMarker(runtimeDigest);
-  return Object.freeze({
-    expectedVersion: pluginDefinition.version,
-    packageRoot,
-    skillSet: pluginDefinition.skillSet,
-    interactionLocales,
-    provenanceStatus: owned ? "matched" : "unowned",
-    generationIdentity: owned ? { server_digest: owned.serverDigest, dispatcher_digest: owned.dispatcherDigest, sdk_digest: owned.sdkDigest } : null,
-    runtimeEvidence: Object.freeze({
-      machine_validation: owned ? "local_exact_version_digest" : "unavailable",
-      plugin_root: packageRoot,
-      runtime_digest: runtimeDigest,
-      provenance_status: owned ? "matched" : "unowned",
-    }),
-    decisionQualificationReport: owned ? (client, resourceDigest) => inspectDecisionAppQualification(owned.root, owned.decisionQualification, {
-      client, server_digest: owned.serverDigest, dispatcher_digest: owned.dispatcherDigest, sdk_digest: owned.sdkDigest, resource_digest: resourceDigest,
-    }) : () => ({ qualified: false, reason: 'runtime_provenance_unavailable', authorizes: false }),
-    decisionQualification: owned ? (client, resourceDigest) => evaluateDecisionAppQualification(owned.root, owned.decisionQualification, {
-      client, server_digest: owned.serverDigest, dispatcher_digest: owned.dispatcherDigest,
-      sdk_digest: owned.sdkDigest, resource_digest: resourceDigest,
-    }) : () => false,
-  });
-}
-
-export function configuredMcpCommandGroups(env = process.env) {
-  if (env.AGDF_MCP_COMMAND_GROUPS === undefined) return Object.keys(RUN_COMMAND_GROUPS);
-  const values = env.AGDF_MCP_COMMAND_GROUPS === '' ? [] : env.AGDF_MCP_COMMAND_GROUPS.split(',');
-  if (new Set(values).size !== values.length || values.some(group => !Object.hasOwn(RUN_COMMAND_GROUPS, group))) throw Error('AGDF_MCP_COMMAND_GROUPS_INVALID');
-  return values;
-}
-
-export function createMcpDispatchRuntime({ surface, inspected = inspectMcpDispatcherRuntime(), commandGroups = configuredMcpCommandGroups(), runtimeControl } = {}) {
-  const trustedContext = Object.freeze({
-    surface,
-    expectedVersion: inspected.expectedVersion,
-    skillSet: inspected.skillSet,
-    interactionLocales: inspected.interactionLocales,
-    provenanceStatus: inspected.provenanceStatus ?? "unowned",
-    commandGroups: Object.freeze([...commandGroups]),
-    decisionQualification: inspected.decisionQualification ?? (() => false),
-    decisionQualificationReport: inspected.decisionQualificationReport ?? (() => ({ qualified: false, reason: 'host_context_unavailable', authorizes: false })),
-  });
+export function createMcpDispatchRuntime({ surface, inspected = inspectMcpDispatcherRuntime(), commandGroups = configuredMcpCommandGroups(), runtimeControl, materialGrants, verifyRuntime, inputContext, executionContext } = {}) {
+  const readBudget = createReadWorkerBudget();
+  const delivery = createPresentationDelivery();
+  const verifyProducer = verifyRuntime ?? (() => {
+      const current = inspectMcpDispatcherRuntime();
+      if (current.provenanceStatus !== 'matched' || current.runtimeEvidence.runtime_digest !== inspected.runtimeEvidence.runtime_digest
+        || JSON.stringify(current.generationIdentity) !== JSON.stringify(inspected.generationIdentity))
+        throw Object.assign(Error('runtime_provenance_invalid'), { code: 'runtime_provenance_invalid' });
+      return current.generationIdentity;
+    });
+  const diagnostic = createDoctorObservationService({ budget: readBudget, gitObservation: cliGitObservation, verifyRuntime: verifyProducer });
   const services = createCoreServices({ resources, observers: {
     runtimeEvidence: inspected.runtimeEvidence,
     validateControlReadBoundary: assertMcpControlReadBoundary,
-    commandGroups, runtimeControl,
+    commandGroups, runtimeControl, materialGrants, gitObservation: cliGitObservation,
+    observeDoctor: (root, input, signal) => diagnostic.observe(root, input, signal),
   } });
-  const execute = services.dispatch;
+  // Companion events (companion core SDD-006): the executing process journals each final command result
+  // once, below the data root the launcher hands over; review facts read the sealed material here.
+  const journal = createCompanionJournal({ sealedFiles: transferId => services.material.sealedFiles(transferId) });
+  const execute = input => mcpControlContinuation(input, services.dispatch(input), commandGroups);
   const executeInspect = services.inspect;
-  const parse = (argumentsValue) => parseSkillDispatchFunctionArguments(argumentsValue, trustedContext);
-  const failureEvidence = { ...inspected.runtimeEvidence, expected_version: inspected.expectedVersion };
-  const tools = Object.freeze([
-    Object.freeze({ name: SKILL_DISPATCH_FUNCTION_DEFINITION.name, definition: SKILL_DISPATCH_FUNCTION_DEFINITION, parse, execute, serialize: serializeSkillDispatchResult }),
-    Object.freeze({
-      name: CONTROL_INSPECT_FUNCTION_DEFINITION.name,
-      definition: CONTROL_INSPECT_FUNCTION_DEFINITION,
-      parse: (argumentsValue) => parseControlInspectFunctionArguments(argumentsValue, trustedContext),
-      execute: executeInspect,
-      serialize: serializeControlInspectResult,
-    }),
-    ...commandGroups.map(group => Object.freeze({ name: group, definition: commandGroupDefinition(group),
-      parse: argumentsValue => {
-        const errors = validateRunCommand(group, argumentsValue);
-        if (errors.length) throw Error('command_schema_invalid');
-        return argumentsValue;
-      }, execute: input => services.command(group, input), serialize: value => JSON.stringify(value) })),
-  ]);
-  if (tools.filter(tool => Object.hasOwn(RUN_COMMAND_GROUPS, tool.name)).reduce((bytes, tool) => bytes + Buffer.byteLength(JSON.stringify(tool.definition)), 0) > RUN_COMMAND_LIMITS.aggregate_definition_bytes) throw Error('command_aggregate_definition_budget_exceeded');
-  return Object.freeze({
-    ...errorSupport(),
-    definition: SKILL_DISPATCH_FUNCTION_DEFINITION,
-    parse,
-    execute,
-    tools,
-    tool(name) {
-      return tools.find((entry) => entry.name === name) ?? null;
+  const protocol = composeMcpProtocolRuntime({ surface, inspected, commandGroups, execute, executeInspect, inputContext, executionContext,
+    lookupOriginal: (root, input) => ['material.stage', 'planned_material.stage'].includes(input.command?.kind) ? services.material.originalInput(input)
+      : input.command?.kind === 'presentation.deliver' ? delivery.originalInput(input)
+        : runtimeControl?.originalInput?.(input) ?? inspectRunInputResolution(root, input),
+    executeCommand: (group, input, signal, host) => ['material.stage', 'planned_material.stage'].includes(input.command.kind) ? services.material.stage(input)
+      : input.command.kind === 'presentation.deliver' ? delivery.deliver(input, host) : services.command(group, input) });
+  return Object.freeze({ ...protocol,
+    verifyProducer,
+    prepareDispatch(name, input) {
+      try {
+        return { inputContext: protocol.inputContextFor(input), materialGrants: ['agdf_record', 'agdf_revise', 'agdf_closeout'].includes(name) ? services.material.grants(input) : [] };
+      } catch (error) { throw preDispatchFailure(error); }
     },
-    serialize: serializeSkillDispatchResult,
-    failure(code, toolName = SKILL_DISPATCH_FUNCTION_DEFINITION.name, argumentsValue, { dispatch = 'unknown', field, cause_code, worker_phase } = {}) {
-      const facts = { code, dispatch, ...(field ? { field } : {}),
-        ...(cause_code ? { cause_code } : {}), ...(worker_phase ? { worker_phase } : {}) };
-      const finish = value => {
-        if (validExecutionFacts(facts)) {
-          const { code: _code, dispatch: _dispatch, ...details } = facts;
-          if (value.diagnostics?.length) value = { ...value, diagnostics: value.diagnostics.map((d, i) => i === 0 ? { ...d, ...details } : d) };
-          else if (facts.cause_code || facts.worker_phase) value = { ...value, diagnostics: [{ code, ...details }] };
-        }
-        const message = describeToolResult(toolName, argumentsValue ?? {}, value,
-          localePack(interactionLocales, argumentsValue?.presentation_language ?? 'en'), facts).message;
-        return value.terminal ? { ...value, recovery: { action: message }, host_action: { ...value.host_action, text: message } } : value;
-      };
-      if (Object.hasOwn(RUN_COMMAND_GROUPS, toolName)) {
-        const valid = argumentsValue && validateRunCommand(toolName, argumentsValue).length === 0;
-        return finish({ schema_version: '1', outcome: dispatch === 'not_dispatched' ? 'rejected' : 'effect_unknown', reason: code,
-          operation_id: valid ? argumentsValue.operation_id : null, request_digest: valid ? runCommandRequestDigest(argumentsValue) : null,
-          binding: valid ? { target_id: argumentsValue.target_id, run_id: argumentsValue.run_id, expected_revision_id: argumentsValue.expected_revision_id, kind: argumentsValue.command.kind } : null,
-          dispatch, authorizes: false, recovery: dispatch === 'not_dispatched' ? 'No command was dispatched by this attempt.'
-            : 'Inspect operation-status with the original UUID and preserve the exact original payload. Do not infer non-execution or create another decision.' });
-      }
-      if (toolName === CONTROL_INSPECT_FUNCTION_DEFINITION.name) {
-        const action = FAILURE_ACTIONS[code] ?? FAILURE_ACTIONS.dispatch_worker_failed;
-        return finish(createInspectFailureResult(code, failureEvidence, action));
-      }
-      return finish(createFailureResult(code, failureEvidence));
+    readBudget,
+    delivery,
+    observeOutcome: (name, input, result) => journal.observe(name, input, result),
+    async postprocessToolResult(name, input, result) {
+      const configuration = protocol.configurationProjection(input);
+      if (configuration && name === 'agdf_inspect' && result.report) result = { ...result, report: { ...result.report, effective_configuration: configuration } };
+      if (['agdf_record', 'agdf_revise', 'agdf_closeout'].includes(name)) services.material.settle(input, result);
+      if (name !== 'agdf_prepare' || input.command?.kind !== 'presentation.prepare' || !result.family_result?.text) return result;
+      delivery.remember(input, result);
+      const prepared = result.family_result;
+      return { ...result, presentation_delivery: { mode: 'prepared', text: '', presentation_id: prepared.presentation_id,
+        document_digest: prepared.document_digest, authorizes: false,
+        ...(prepared.preview_review ? { preview_review: { operation: 'presentation-preview', version: prepared.preview_review.descriptor.version,
+          content_digest: prepared.preview_review.rendered_digest, access_state: 'not_observed', target_id: input.target_id,
+          run_id: input.run_id, gate: 'PRD', expected_revision_id: input.expected_revision_id, presentation_id: prepared.presentation_id } } : {}),
+        instruction: 'Prepared, not delivered. Optionally open agdf_decision_view as a non-primary preview. Follow the authoritative top-level next action for presentation.deliver; its original UUID and binding are already supplied. No second summary and no generated delivery UUID.',
+        next_action_source: 'next_calls' } };
     },
-    trustedContext,
+    async close() { services.material.close(); delivery.close(); await diagnostic.close(); },
+    inspectOwnership() { const d = diagnostic.inspectOwnership(); return { diagnostic: d, read_workers: readBudget.inspect(),
+      views: d.observations, inflight: d.inflight, uncertain: 0 }; },
   });
 }
 
-// Only the App-capable adapter loads ephemeral view owners; Copilot/default Core
-// projections do not acquire a hidden dependency on the private cockpit reader.
-export async function createMcpDecisionRuntime({ runtime, ui, appOnlyMediationQualified = false } = {}) {
+export async function createMcpDecisionRuntime({ runtime, ui, appOnlyMediationQualified = false, surfaceBinding } = {}) {
   if (!runtime || runtime.trustedContext.surface !== 'codex') throw Error('decision_runtime_surface_invalid');
-  const [{ createDecisionSessionService }, { decisionActionDefinition, validateDecisionAction },
-    { COCKPIT_READ_DEFINITION, parseCockpitArguments }] = await Promise.all([
-    import('#agdf-core/control-inspect/decision-session.js'), import('#agdf-core/control-state/decision-action-contract.js'),
-    import('#agdf-core/control-inspect/cockpit-contract.js'),
+  const [{ createDecisionSessionService }, { createCockpitSessionService }, { composeMcpDecisionProtocol }] = await Promise.all([
+    import('#agdf-core/control-inspect/decision-session.js'), import('#agdf-core/control-inspect/cockpit-session.js'),
+    import('./mcp-decision-protocol.js'),
   ]);
-  const groups = runtime.trustedContext.commandGroups, session = createDecisionSessionService({ groups, appOnlyMediationQualified,
+  const groups = runtime.trustedContext.commandGroups, session = createDecisionSessionService({ groups, delivery: runtime.delivery, appOnlyMediationQualified, surfaceBinding,
+    readServiceFactory: root => createCockpitSessionService(root, { budget: runtime.readBudget }),
     qualification: ({ client }) => appOnlyMediationQualified === true
       || runtime.trustedContext.decisionQualification(client, ui.digest) === true });
-  const facade = decisionActionDefinition(groups);
-  const tools = runtime.tools.map(tool => tool.name === 'agdf_prepare' ? { ...tool,
-    definition: { ...tool.definition, _meta: { ui: { resourceUri: ui.uri, visibility: ['model', 'app'] } } } } : tool);
-  tools.push({ name: COCKPIT_READ_DEFINITION.name, definition: COCKPIT_READ_DEFINITION, requiresUi: true, parentOwned: true,
-    parse: parseCockpitArguments, execute: (input, signal) => session.read(input, signal), serialize: value => JSON.stringify(value) });
-  if (facade) tools.push({ name: facade.name, definition: facade, requiresUi: true, parentOwned: true,
-    parse: input => { if (validateDecisionAction(input, facade.inputSchema.properties.action.enum).length) throw Error('decision_schema_invalid'); return input; },
-    execute: (input, signal, host) => session.action(input, host), serialize: value => JSON.stringify(value) });
-  const bytes = tools.filter(tool => Object.hasOwn(RUN_COMMAND_GROUPS, tool.name) || tool.name === facade?.name)
-    .reduce((sum, tool) => sum + Buffer.byteLength(JSON.stringify(tool.definition)), 0);
-  if (bytes > RUN_COMMAND_LIMITS.aggregate_definition_bytes) { await session.close(); throw Error('command_aggregate_definition_budget_exceeded'); }
-  return Object.freeze({ ...runtime, tools: Object.freeze(tools), ui, mode: 'decision',
-    tool: name => tools.find(tool => tool.name === name) ?? null,
+  const protocol = composeMcpDecisionProtocol({ runtime, ui, prepared: input => session.prepared(input),
+    open: (input, result, host) => session.open(input, result, host), read: (input, signal, host) => session.read(input, signal, host),
+    action: (input, host) => session.action(input, host), close: () => session.close() });
+  return Object.freeze({ ...protocol,
+    observeOutcome: (name, input, result) => runtime.observeOutcome?.(name, input, result) ?? false,
     async postprocessToolResult(name, input, result, { uiSupported, client } = {}) {
       if (name === 'agdf_inspect' && input.operation === 'native-qualification' && result.report?.available) {
         return { ...result, report: { ...result.report, ui_rendering_support: uiSupported ? 'supported' : 'unsupported',
           action_qualification: runtime.trustedContext.decisionQualificationReport(client, ui.digest),
           enabled_command_groups: [...groups], authorizes: false } };
       }
-      if (name !== 'agdf_prepare' || input.command?.kind !== 'presentation.prepare') return result;
-      const delivered = uiSupported ? await session.open(input, result, { client })
-        : { ...result, app_capability: 'unavailable', app_reason: 'host_ui_unsupported' };
-      const prepared = result.family_result;
-      if (typeof prepared?.text !== 'string') return delivered;
-      // Capability advertisement and an emitted resource do not prove that this
-      // request surface displays it (in particular a remote/iPad Chat). Until an
-      // actual display observation exists, send the complete decision once.
-      const displayed = delivered.app_capability === 'available' && delivered.app_display === 'confirmed';
-      const text = displayed && typeof prepared.companion_text === 'string'
-        ? prepared.companion_text : prepared.text;
-      return { ...delivered, presentation_delivery: { mode: displayed ? 'native_plus_chat' : 'full_chat', display: displayed ? 'confirmed' : 'unconfirmed',
-        text, presentation_id: prepared.presentation_id, revision_id: prepared.revision_id,
-        document_digest: prepared.document_digest ?? prepared.artefact_digest, document_language: prepared.document_language ?? null,
-        ...(prepared.preview_review ? { preview_review: { operation: 'presentation-preview', version: prepared.preview_review.descriptor.version,
-          content_digest: prepared.preview_review.rendered_digest, access_state: displayed ? 'native_bound' : 'not_observed',
-          target_id: input.target_id, run_id: input.run_id, gate: 'PRD', expected_revision_id: input.expected_revision_id, presentation_id: prepared.presentation_id } } : {}),
-        instruction: 'Forward this exact Chat text once. Do not append a second decision request. On a human request to read the document, use presentation-document with this exact binding and every returned cursor; deliver all ordered chunks in the same Chat before requesting a decision. A local file link is not remote access proof.'
-          + (prepared.preview_review ? ' The required preview uses presentation-preview with the supplied exact selectors and every cursor. Offer only supported isolated rendering of those exact bytes. If this surface cannot show it, state that access is unavailable and the review remains open; never call raw HTML, a local link or an unopened resource a viewed preview.' : ''),
-        authorizes: false } };
-    },
-    failure(code, name, input, dispatch) {
-      return name === 'agdf_decision_action' ? { schema_version: '1', outcome: dispatch?.dispatch === 'not_dispatched' ? 'rejected' : 'effect_unknown',
-        reason: code, operation_id: input?.operation_id ?? null, authorizes: false, recovery: 'Inspect the original UUID; do not infer non-execution or submit another decision.' }
-        : name === 'agdf_cockpit_read' ? { schema_version: '1', outcome: 'rejected', reason: code, authorizes: false } : runtime.failure(code, name, input, dispatch);
+      return runtime.postprocessToolResult(name, input, result);
+
     },
-    close: () => session.close(), inspectOwnership: () => session.inspectOwnership(),
+    async close() { await Promise.all([session.close(), runtime.close?.()]); },
+    inspectOwnership() { const base = runtime.inspectOwnership(), decision = session.inspectOwnership(); return { ...base, decision,
+      views: base.views + decision.views, inflight: base.inflight + decision.inflight, uncertain: base.uncertain + (decision.uncertain ?? 0) }; },
   });
 }
 

package/lib/mcp-lifecycle/adapters/codex-origin-probe.js

@@ -5,8 +5,20 @@ import { fileURLToPath } from 'node:url';
 import { resolveHostCommand } from '../../host-command.js';
 import { CODEX_MCP_STARTUP_ARGS, independentCodexEnvironment } from '../../host-adapters/codex/mcp-startup.js';
 
-export function observeCodexOrigins({ target, all = false, command, spawnProcess = spawn, timeoutMs = 45_000, now = Date.now }) {
+export function codexStartupConfiguration(result) {
+  const key = 'mcp_optional_startup_grace_ms', value = result?.config?.[key];
+  const observed = Number.isSafeInteger(value) && value >= 0;
+  const type = result?.origins?.[key]?.name?.type;
+  const kind = ['user', 'project', 'system', 'sessionFlags', 'commandLine', 'profile', 'default'].includes(type) ? type : null;
+  // Never return config/layers: they may contain credentials, commands or policy.
+  return { status: observed ? 'observed' : 'unknown', wait_ms: observed ? value : null,
+    origin: kind ? { kind } : null, reason: !observed ? 'setting_not_exposed' : !kind ? 'origin_not_exposed' : null };
+}
+
+export function observeCodexOrigins({ target, all = false, mode = 'catalog', env = process.env,
+  command, spawnProcess = spawn, timeoutMs = 45_000, now = Date.now, configurationObserver = () => {} }) {
   if (typeof target !== 'string' || !isAbsolute(target)) return Promise.resolve({ status: 'unavailable', reason: 'target_invalid' });
+  if (!['catalog', 'configuration'].includes(mode)) return Promise.resolve({ status: 'unavailable', reason: 'mode_invalid' });
   return new Promise(resolve => {
     let child, pending = '', received = 0, done = false, phase = 'initialize', threadId, closing, closeTimer, pollTimer, inventoryId = 3;
     const deadline = now() + timeoutMs;
@@ -26,8 +38,8 @@ export function observeCodexOrigins({ target, all = false, command, spawnProcess
     const timer = setTimeout(() => finish({ status: 'unavailable', reason: 'timeout' }), timeoutMs);
     const send = message => child.stdin.write(JSON.stringify(message) + '\n');
     try {
-      const resolved = command ?? resolveHostCommand('codex', { env: process.env });
-      child = spawnProcess(resolved.executable, [...resolved.prefixArgs, ...CODEX_MCP_STARTUP_ARGS, 'app-server'], { cwd: target, env: independentCodexEnvironment(process.env),
+      const resolved = command ?? resolveHostCommand(env.CODEX_BIN || 'codex', { env });
+      child = spawnProcess(resolved.executable, [...resolved.prefixArgs, ...(mode === 'catalog' ? CODEX_MCP_STARTUP_ARGS : []), 'app-server'], { cwd: target, env: independentCodexEnvironment(env),
         stdio: ['pipe', 'pipe', 'pipe'], shell: false, windowsHide: true });
       child.on('error', () => finish({ status: 'unavailable', reason: 'spawn_failed' }));
       child.on('exit', (code, signal) => {
@@ -45,10 +57,22 @@ export function observeCodexOrigins({ target, all = false, command, spawnProcess
           let message; try { message = JSON.parse(line); } catch { continue; }
           if (phase === 'initialize' && message.id === 1) {
             if (message.error) return finish({ status: 'unavailable', reason: 'initialize_failed' });
-            phase = 'project'; send({ method: 'initialized' });
+            send({ method: 'initialized' });
+            if (mode === 'configuration') {
+              phase = 'configuration'; send({ id: 2, method: 'config/read', params: { includeLayers: true, cwd: target } });
+              continue;
+            }
+            phase = 'project';
             // Cwd on the process alone does not scope mcpServerStatus/list.
             // The context is in-memory and receives no turn/start or user message.
             send({ id: 2, method: 'thread/start', params: { cwd: target, ephemeral: true } });
+          } else if (phase === 'configuration' && message.id === 2) {
+            // Private observer seam for the native harness's configured-model
+            // attestation. Status still returns only its whitelisted wait facts.
+            try { if (!message.error) configurationObserver(message.result); }
+            catch { return finish({ status: 'unavailable', reason: 'configuration_observer_failed' }); }
+            finish(message.error ? { status: 'unknown', wait_ms: null, origin: null, reason: 'config_read_unsupported' }
+              : codexStartupConfiguration(message.result));
           } else if (phase === 'project' && message.id === 2) {
             const context = message.result;
             if (message.error || typeof context?.thread?.id !== 'string' || !context.thread.id

package/lib/mcp-lifecycle/evidence.js

@@ -1,3 +1,4 @@
+import { isRunOwnedDataPath } from '#agdf-core/control-state/run-identity.js';
 const SURFACES = new Set(["codex", "claude", "opencode", "copilot"]);
 const SCOPES = new Set(["project", "user"]);
 const QUALIFICATION_FIELDS = Object.freeze([
@@ -28,7 +29,7 @@ function plainObject(value) {
 }
 
 function evidenceRef(value) {
-  return typeof value === "string" && value.startsWith(".agdf/control/artefacts/") && !value.includes("..");
+  return isRunOwnedDataPath(value);
 }
 
 export function validateMcpQualificationRecord(record) {

package/lib/mcp-lifecycle/facade-entry.js

@@ -1,26 +1,5 @@
-// Private child of the installed launcher. Public input remains MCP STDIO only.
+// Explicit process adapter retained for historical owned packages.
 import process from 'node:process';
-import { dirname, join } from 'node:path';
-import { pathToFileURL } from 'node:url';
-import { inspectMcpServerPackage, createMcpGenerationPublisher } from './package.js';
-
+import { startFacadeRuntime } from './facade-runtime.js';
 if (!process.send || !process.argv[2] || process.argv[2].length > 65536) throw Error('AGDF_MCP_FACADE_INPUT_INVALID');
-const { runtime: expected, surface, cockpitDir, cockpitMode, pluginRoot, token, deadline_ns } = JSON.parse(process.argv[2]);
-let handle, stopRequested = false;
-const stop = () => { stopRequested = true; if (handle) void handle.close(); };
-process.on('message', message => { if (message?.kind === 'facade_stop' && message.token === token) stop(); });
-process.on('disconnect', stop); process.on('SIGINT', stop); process.on('SIGTERM', stop);
-const actual = inspectMcpServerPackage({ dataRoot: dirname(expected.root), expectedVersion: expected.version });
-if (actual.status !== 'matched' || actual.root !== expected.root || actual.digest !== expected.digest
-  || actual.dispatcherDigest !== expected.dispatcherDigest || actual.sdkDigest !== expected.sdkDigest) throw Error('AGDF_MCP_FACADE_IDENTITY_INVALID');
-const runtime = { ...actual, immutable: true, publication_id: expected.publication_id, publisher_root: expected.publisher_root };
-process.env.AGDF_DISPATCH_PLUGIN_ROOT = pluginRoot;
-const { runMcpServer } = await import(pathToFileURL(join(runtime.packageRoot, 'src/main.js')));
-handle = await runMcpServer({ surface, cockpitDir, cockpitMode, ownedPublication: runtime,
-  ownedPublisher: createMcpGenerationPublisher(runtime, {
-    publicationDeadline: performance.now() + Math.max(0, Number(BigInt(deadline_ns) - process.hrtime.bigint()) / 1e6),
-  }), onClosed(result) {
-    process.send?.({ kind: 'facade_closed', token, confirmed: result?.confirmed === true }, () => process.disconnect());
-  } });
-if (!handle) throw Error('AGDF_MCP_FACADE_START_UNCONFIRMED');
-if (stopRequested) await handle.close();
+await startFacadeRuntime({ input: JSON.parse(process.argv[2]), channel: { on: (...args) => process.on(...args), send: (...args) => process.send(...args), close: () => process.disconnect() } });