deadbyte-mcp 0.9.0 → 0.11.0

package/src/autonomous-timeout-recovery.mjs

@@ -0,0 +1,27 @@
+const HEX64=/^[0-9a-f]{64}$/;
+
+export function classifyAutonomousTimeoutRecovery(status,{beforeJournalHead}={}){
+  if(!status||typeof status!=='object'||Array.isArray(status)) throw new Error('autonomous timeout status invalid');
+  if(!HEX64.test(beforeJournalHead??'')) throw new Error('autonomous timeout before journal head invalid');
+  if(status.status!=='ok') throw new Error('autonomous timeout status not ok');
+  if(!HEX64.test(status.journal_head_sha256??'')) throw new Error('autonomous timeout journal head invalid');
+  if(status.state==='succeeded') return Object.freeze({kind:'completed',state:'succeeded',journal_head_sha256:status.journal_head_sha256});
+  if(status.state==='cancelled'||status.state==='paused'){
+    return Object.freeze({kind:'terminal_failure',state:status.state,reason:status.reason??null,journal_head_sha256:status.journal_head_sha256});
+  }
+  if(status.state!=='pending'&&status.state!=='running') throw new Error(`autonomous timeout unexpected state: ${status.state}`);
+  if(status.run_busy===true){
+    return Object.freeze({kind:'wait',state:status.state,reason:'server_run_in_flight',journal_head_sha256:status.journal_head_sha256});
+  }
+  if(status.run_busy!==false) throw new Error('autonomous timeout run-lock state unavailable');
+  if(status.pending_request!==null&&status.pending_request!==undefined){
+    return Object.freeze({kind:'wait',state:status.state,reason:'planner_request_in_flight',journal_head_sha256:status.journal_head_sha256});
+  }
+  if(status.pending_decision!==null&&status.pending_decision!==undefined){
+    return Object.freeze({kind:'wait',state:status.state,reason:'decision_in_flight',journal_head_sha256:status.journal_head_sha256});
+  }
+  if(status.journal_head_sha256===beforeJournalHead){
+    return Object.freeze({kind:'wait',state:status.state,reason:'no_durable_progress',journal_head_sha256:status.journal_head_sha256});
+  }
+  return Object.freeze({kind:'resumable',state:status.state,reason:'durable_cycle_completed',journal_head_sha256:status.journal_head_sha256});
+}

package/src/capability-benchmark-runner.mjs

@@ -4,7 +4,7 @@ import { readdir, readFile, stat } from 'node:fs/promises';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { canonicalJson } from './canonical-json.mjs';
-import { buildCapabilityBenchmark } from './capability-benchmark.mjs';
+import { buildCapabilityBenchmark, buildR36CapabilityBenchmark } from './capability-benchmark.mjs';
 
 const sha256=bytes=>createHash('sha256').update(bytes).digest('hex');
 const TEST_TIMEOUT_MS=180_000;
@@ -106,3 +106,88 @@ export async function runCapabilityBenchmark({rootUrl,definitions=benchmarkCaseD
   }
   return buildCapabilityBenchmark({suite_id:'r35-offline-v1',cases});
 }
+
+export const R36_BENCHMARK_CASE_IDS=Object.freeze([
+  'repository_tree_exploration','literal_content_search','regex_content_search','filename_path_search',
+  'deterministic_search_paging_cancel','bounded_multi_file_read','rich_stat_reparse_handling','stale_edit_race_rejection',
+  'transactional_multi_file_native_diff','topology_mkdir_move_delete_rollback','semantic_typescript_navigation',
+  'semantic_python_navigation','semantic_rust_navigation','semantic_cpp_navigation','diagnostics_normalization',
+  'implementation_lookup','cross_file_rename_transaction','long_process_lifecycle','policy_defined_process_action',
+  'process_crash_reconciliation','autonomous_failing_test_repair','autonomous_search_semantic_patch_test',
+  'release_gate_finish_without_evidence_refusal','provider_bridge_interruption_recovery','remote_result_replay_deduplication',
+  'compact_connector_capability_closure','live_log_request_before_result','live_log_redaction',
+  'forged_stale_receipt_rejection','rollback_r35_restore_r36'
+]);
+
+const r36Def=(case_id,purpose,test_files,fixture_files,{test_name_pattern=null,pass_witness=null,round_trips=2,stale_rejected=false,recovery_success=true,release_gate_result='not_applicable'}={})=>Object.freeze({
+  case_id,purpose,test_files:Object.freeze([...test_files]),fixture_files:Object.freeze([...fixture_files]),
+  ...(test_name_pattern?{test_name_pattern}:{}),...(pass_witness?{pass_witness}:{}),round_trips,stale_rejected,recovery_success,
+  capability_reachable:true,evidence_verified:true,release_gate_result
+});
+
+const R36_DEFINITIONS=Object.freeze([
+  r36Def('repository_tree_exploration','repository tree exploration',['test/coding-plane.test.mjs'],['test/coding-plane.test.mjs'],{round_trips:1}),
+  r36Def('literal_content_search','literal content search',['test/coding-search-r36.test.mjs'],['test/coding-search-r36.test.mjs'],{test_name_pattern:'R36 regex search returns multiple matches',pass_witness:'R36 regex search returns multiple matches',round_trips:2}),
+  r36Def('regex_content_search','regex content search',['test/coding-search-r36.test.mjs'],['test/coding-search-r36.test.mjs'],{test_name_pattern:'R36 regex search returns multiple matches',pass_witness:'R36 regex search returns multiple matches',round_trips:2}),
+  r36Def('filename_path_search','filename/path search',['test/coding-search-r36.test.mjs'],['test/coding-search-r36.test.mjs'],{test_name_pattern:'R36 path search does not decode',pass_witness:'R36 path search does not decode',round_trips:2}),
+  r36Def('deterministic_search_paging_cancel','deterministic paging/cancel',['test/coding-search-r36.test.mjs','test/observation-runtime.test.mjs'],['test/coding-search-r36.test.mjs','test/observation-runtime.test.mjs'],{round_trips:4}),
+  r36Def('bounded_multi_file_read','bounded multi-file read',['test/multi-file-read.test.mjs'],['test/multi-file-read.test.mjs'],{round_trips:1}),
+  r36Def('rich_stat_reparse_handling','rich stat and reparse denial',['test/coding-runtime.test.mjs','test/native-diff-topology-r36.test.mjs'],['test/coding-runtime.test.mjs','test/native-diff-topology-r36.test.mjs'],{test_name_pattern:'(?:R36 coding stat exposes|R36 Native Diff V2 denies topology through reparse)',round_trips:3,stale_rejected:true}),
+  r36Def('stale_edit_race_rejection','stale-edit race rejection',['test/coding-runtime.test.mjs','test/native-diff-topology-r36.test.mjs'],['test/coding-runtime.test.mjs','test/native-diff-topology-r36.test.mjs'],{test_name_pattern:'(?:rejects mutation when lease is absent or precondition is stale|rejects stale move identity)',round_trips:3,stale_rejected:true}),
+  r36Def('transactional_multi_file_native_diff','transactional multi-file Native Diff',['test/native-diff.test.mjs'],['test/native-diff.test.mjs'],{test_name_pattern:'native diff commits exact preconditioned edits',pass_witness:'native diff commits exact preconditioned edits',round_trips:4,stale_rejected:true}),
+  r36Def('topology_mkdir_move_delete_rollback','topology transaction and rollback',['test/native-diff-topology-r36.test.mjs'],['test/native-diff-topology-r36.test.mjs'],{round_trips:5,stale_rejected:true}),
+  r36Def('semantic_typescript_navigation','TypeScript symbol navigation',['test/semantic-code.test.mjs'],['test/semantic-code.test.mjs','test/fixtures/semantic/typescript'],{round_trips:4,stale_rejected:true}),
+  r36Def('semantic_python_navigation','Python symbol navigation through hermetic LSP adapter',['test/capability-benchmark-semantic-r36.test.mjs'],['test/capability-benchmark-semantic-r36.test.mjs','test/fixtures/lsp-framed-server.mjs'],{test_name_pattern:'R36 benchmark Python symbol navigation',pass_witness:'R36 benchmark Python symbol navigation',round_trips:4}),
+  r36Def('semantic_rust_navigation','Rust symbol navigation through hermetic LSP adapter',['test/capability-benchmark-semantic-r36.test.mjs'],['test/capability-benchmark-semantic-r36.test.mjs','test/fixtures/lsp-framed-server.mjs'],{test_name_pattern:'R36 benchmark Rust symbol navigation',pass_witness:'R36 benchmark Rust symbol navigation',round_trips:4}),
+  r36Def('semantic_cpp_navigation','C/C++ symbol navigation through hermetic LSP adapter',['test/capability-benchmark-semantic-r36.test.mjs'],['test/capability-benchmark-semantic-r36.test.mjs','test/fixtures/lsp-framed-server.mjs'],{test_name_pattern:'R36 benchmark Cpp symbol navigation',pass_witness:'R36 benchmark Cpp symbol navigation',round_trips:4}),
+  r36Def('diagnostics_normalization','diagnostics normalization',['test/semantic-r36-rename.test.mjs'],['test/semantic-r36-rename.test.mjs'],{test_name_pattern:'R36 TypeScript diagnostics carry',pass_witness:'R36 TypeScript diagnostics carry',round_trips:2}),
+  r36Def('implementation_lookup','implementation lookup',['test/semantic-r36-rename.test.mjs'],['test/semantic-r36-rename.test.mjs'],{test_name_pattern:'R36 TypeScript implementations normalize',pass_witness:'R36 TypeScript implementations normalize',round_trips:2}),
+  r36Def('cross_file_rename_transaction','cross-file rename through Native Diff',['test/semantic-r36-rename.test.mjs'],['test/semantic-r36-rename.test.mjs'],{test_name_pattern:'R36 cross-file rename preview',pass_witness:'R36 cross-file rename preview',round_trips:5,stale_rejected:true}),
+  r36Def('long_process_lifecycle','long process start/output/status/terminate',['test/process-longrun-r36.test.mjs','test/process-runtime.test.mjs'],['test/process-longrun-r36.test.mjs','test/process-runtime.test.mjs'],{test_name_pattern:'(?:R36 long process returns before exit|R31 runtime lists, reports and terminates)',round_trips:6,recovery_success:true}),
+  r36Def('policy_defined_process_action','policy-defined named process action',['test/process-runtime.test.mjs'],['test/process-runtime.test.mjs'],{test_name_pattern:'R32 runtime executes one policy-defined named action',pass_witness:'R32 runtime executes one policy-defined named action',round_trips:3}),
+  r36Def('process_crash_reconciliation','terminal process journal/output recovery',['test/process-longrun-r36.test.mjs'],['test/process-longrun-r36.test.mjs'],{test_name_pattern:'R36 terminal process session is recovered',pass_witness:'R36 terminal process session is recovered',round_trips:4,recovery_success:true}),
+  r36Def('autonomous_failing_test_repair','autonomous failing-test critic/repair/release',['test/autonomous-r34-e2e.test.mjs','test/autonomous-loop-v2.test.mjs'],['test/autonomous-r34-e2e.test.mjs','test/autonomous-loop-v2.test.mjs','test/helpers/autonomous-r34-fixture.mjs'],{test_name_pattern:'(?:multi-step fail replan repair finish|failed VERIFY enters CRITIC|REPAIR must change)',round_trips:8,stale_rejected:true,release_gate_result:'passed'}),
+  r36Def('autonomous_search_semantic_patch_test','capability-aware planner inspection/mutation loop',['test/autonomous-capability-r36.test.mjs','test/semantic-r36-rename.test.mjs','test/autonomous-r34-e2e.test.mjs'],['test/autonomous-capability-r36.test.mjs','test/semantic-r36-rename.test.mjs','test/autonomous-r34-e2e.test.mjs','test/helpers/autonomous-r34-fixture.mjs'],{test_name_pattern:'(?:planner parses first-class capability actions|typed native_diff_apply|cross-file rename preview|multi-step fail replan repair finish)',round_trips:8,stale_rejected:true,release_gate_result:'passed'}),
+  r36Def('release_gate_finish_without_evidence_refusal','finish claim cannot bypass objective release evidence',['test/autonomous-r34-e2e.test.mjs'],['test/autonomous-r34-e2e.test.mjs'],{test_name_pattern:'R34 finish is blocked while the active plan is incomplete',pass_witness:'R34 finish is blocked while the active plan is incomplete',round_trips:3,release_gate_result:'blocked'}),
+  r36Def('provider_bridge_interruption_recovery','provider circuit and remote-session interruption recovery',['test/provider-circuit.test.mjs','test/remote-session-cli.test.mjs'],['test/provider-circuit.test.mjs','test/remote-session-cli.test.mjs'],{test_name_pattern:'(?:OPEN becomes HALF_OPEN|bare remote recovers a stale crashed session)',round_trips:4,recovery_success:true}),
+  r36Def('remote_result_replay_deduplication','remote result replay/dedupe',['test/remote-result-journal.test.mjs','test/remote-session-cli.test.mjs'],['test/remote-result-journal.test.mjs','test/remote-session-cli.test.mjs'],{test_name_pattern:'(?:remote result journal is monotonic|remote --resume replays only terminal results)',round_trips:4,recovery_success:true}),
+  r36Def('compact_connector_capability_closure','compact connector <=42 with production capability closure',['test/compact-catalog-r36.test.mjs','test/capability-ledger-r36.test.mjs'],['test/compact-catalog-r36.test.mjs','test/capability-ledger-r36.test.mjs'],{test_name_pattern:'(?:real compact stdio catalog stays <=42|compact closure covers every production non-host capability)',round_trips:2}),
+  r36Def('live_log_request_before_result','live activity request-before-result ordering',['test/remote-live-log-recovery-r36.test.mjs'],['test/remote-live-log-recovery-r36.test.mjs','src/remote-live-log.mjs'],{test_name_pattern:'R36 live activity tracker prints RUN before terminal result',pass_witness:'R36 live activity tracker prints RUN before terminal result',round_trips:2,recovery_success:true}),
+  r36Def('live_log_redaction','live activity secret/payload redaction',['test/remote-live-log-r36.test.mjs','test/remote-session-cli.test.mjs'],['test/remote-live-log-r36.test.mjs','test/remote-session-cli.test.mjs','src/remote-live-log.mjs'],{test_name_pattern:'compact live activity shows request context without payload or secret values',pass_witness:'compact live activity shows request context without payload or secret values',round_trips:1}),
+  r36Def('forged_stale_receipt_rejection','forged/stale receipt and precondition rejection',['test/autonomous-r34-e2e.test.mjs','test/coding-plane-adversarial.test.mjs'],['test/autonomous-r34-e2e.test.mjs','test/coding-plane-adversarial.test.mjs'],{test_name_pattern:'(?:forged profile receipt substitution|signed autonomous journal tamper|coding task adopts a signed command receipt)',round_trips:4,stale_rejected:true,recovery_success:true}),
+  r36Def('rollback_r35_restore_r36','hermetic signed predecessor rollback and exact slot restore mechanism',['test/runtime-self-update.test.mjs','test/release-slot.test.mjs'],['test/runtime-self-update.test.mjs','test/release-slot.test.mjs'],{test_name_pattern:'(?:R31 explicit rollback restores the exact signed prior pointer|release slot materialization copies only manifest-bound files)',round_trips:5,recovery_success:true})
+]);
+
+export function r36BenchmarkCaseDefinitions(){
+  return R36_DEFINITIONS.map(item=>({...structuredClone(item),fixture_files:['bench/fixtures/corpus.json','bench/fixtures/r36/case-map.json',...item.fixture_files]}));
+}
+
+function hasPassingWitness(stdout,witness){
+  if(!witness) return true;
+  const text=Buffer.isBuffer(stdout)?stdout.toString('utf8'):String(stdout??'');
+  return text.split(/\r?\n/).some(line=>line.includes(witness)&&!/\bSKIP\b/i.test(line)&&/(?:✔|\bok\b)/i.test(line));
+}
+
+export async function runR36CapabilityBenchmark({rootUrl,definitions=r36BenchmarkCaseDefinitions(),env={},timeoutMs=TEST_TIMEOUT_MS}={}){
+  const root=typeof rootUrl==='string'?path.resolve(rootUrl):fileURLToPath(rootUrl??new URL('../',import.meta.url));
+  if(!Array.isArray(definitions)||definitions.length<1) throw new Error('R36 benchmark definitions invalid');
+  if(!Number.isInteger(timeoutMs)||timeoutMs<1000||timeoutMs>600000) throw new Error('R36 benchmark timeout invalid');
+  const cases=[];
+  for(const definition of definitions){
+    const fixture_sha256=await fixtureIdentityForCase({rootUrl:root,definition});
+    let result;
+    try{result=await runNodeTest({root,definition,env,timeoutMs});}
+    catch(error){result={exit_code:null,timed_out:false,error:String(error),stdout:Buffer.alloc(0),stderr:Buffer.alloc(0),bytes:0,elapsed_ms:0};}
+    const witnessOk=hasPassingWitness(result.stdout,definition.pass_witness??null);
+    const correct=result.exit_code===0&&!result.timed_out&&!result.error&&witnessOk;
+    const evidence={schema:'deadbyte.r36-benchmark-case-evidence.v1',case_id:definition.case_id,exit_code:result.exit_code,
+      timed_out:result.timed_out===true,signal:result.signal??null,error:result.error??null,pass_witness:definition.pass_witness??null,
+      pass_witness_observed:witnessOk,stdout_sha256:sha256(result.stdout??Buffer.alloc(0)),stderr_sha256:sha256(result.stderr??Buffer.alloc(0))};
+    cases.push({case_id:definition.case_id,fixture_sha256,correct,round_trips:definition.round_trips,
+      bytes_returned:result.bytes??0,elapsed_ms:result.elapsed_ms??0,stale_rejected:correct&&definition.stale_rejected===true,
+      recovery_success:correct&&definition.recovery_success===true,duplicate_side_effects:correct?0:1,
+      capability_reachable:correct&&definition.capability_reachable===true,evidence_verified:correct&&definition.evidence_verified===true,
+      release_gate_result:correct?definition.release_gate_result:'blocked',evidence_sha256:sha256(Buffer.from(canonicalJson(evidence),'utf8'))});
+  }
+  return buildR36CapabilityBenchmark({suite_id:'r36-production-coding-v1',cases});
+}

package/src/capability-benchmark.mjs

@@ -2,6 +2,7 @@ import { createHash } from 'node:crypto';
 import { canonicalJson } from './canonical-json.mjs';
 
 export const CAPABILITY_BENCHMARK_SCHEMA='deadbyte.r35-capability-benchmark.v1';
+export const R36_CAPABILITY_BENCHMARK_SCHEMA='deadbyte.r36-capability-benchmark.v1';
 const HEX64=/^[0-9a-f]{64}$/;
 const CASE_ID=/^[A-Za-z0-9._-]{1,96}$/;
 const SUITE_ID=/^[A-Za-z0-9._-]{1,96}$/;
@@ -48,3 +49,47 @@ export function buildCapabilityBenchmark({suite_id:rawSuiteId,cases:rawCases}={}
     observation_sha256:sha256(observation)
   });
 }
+
+const R36_RELEASE_GATE_RESULTS=new Set(['passed','blocked','not_applicable']);
+export function normalizeR36BenchmarkCase(raw){
+  const base=normalizeBenchmarkCase(raw);
+  if(typeof raw.capability_reachable!=='boolean') throw new Error('benchmark capability_reachable invalid');
+  if(typeof raw.evidence_verified!=='boolean') throw new Error('benchmark evidence_verified invalid');
+  if(typeof raw.release_gate_result!=='string'||!R36_RELEASE_GATE_RESULTS.has(raw.release_gate_result)) throw new Error('benchmark release_gate_result invalid');
+  return Object.freeze({...base,
+    capability_reachable:raw.capability_reachable,
+    evidence_verified:raw.evidence_verified,
+    release_gate_result:raw.release_gate_result
+  });
+}
+
+export function buildR36CapabilityBenchmark({suite_id:rawSuiteId,cases:rawCases}={}){
+  if(typeof rawSuiteId!=='string'||!SUITE_ID.test(rawSuiteId)) throw new Error('benchmark suite_id invalid');
+  if(!Array.isArray(rawCases)||rawCases.length<1||rawCases.length>128) throw new Error('benchmark cases invalid');
+  const cases=rawCases.map(normalizeR36BenchmarkCase).sort((a,b)=>a.case_id.localeCompare(b.case_id));
+  const seen=new Set();
+  for(const item of cases){if(seen.has(item.case_id)) throw new Error(`duplicate case '${item.case_id}'`);seen.add(item.case_id);}
+  const fixtureIdentity={schema:'deadbyte.r36-capability-fixtures.v1',suite_id:rawSuiteId,
+    fixtures:cases.map(item=>({case_id:item.case_id,fixture_sha256:item.fixture_sha256}))};
+  const fixture_identity_sha256=sha256(fixtureIdentity);
+  const observation={schema:R36_CAPABILITY_BENCHMARK_SCHEMA,suite_id:rawSuiteId,fixture_identity_sha256,cases};
+  const capability_closure=cases.every(item=>item.capability_reachable);
+  const evidence_closure=cases.every(item=>item.evidence_verified);
+  const verdictIdentity={
+    schema:'deadbyte.r36-capability-verdict.v1',suite_id:rawSuiteId,fixture_identity_sha256,
+    cases:cases.map(item=>({
+      case_id:item.case_id,fixture_sha256:item.fixture_sha256,correct:item.correct,
+      stale_rejected:item.stale_rejected,recovery_success:item.recovery_success,
+      duplicate_side_effects:item.duplicate_side_effects,capability_reachable:item.capability_reachable,
+      evidence_verified:item.evidence_verified,release_gate_result:item.release_gate_result
+    }))
+  };
+  return Object.freeze({
+    ...observation,
+    capability_closure,
+    evidence_closure,
+    overall_correct:cases.every(item=>item.correct)&&capability_closure&&evidence_closure,
+    verdict_identity_sha256:sha256(verdictIdentity),
+    observation_sha256:sha256(observation)
+  });
+}

package/src/capability-ledger.mjs

@@ -0,0 +1,158 @@
+import { createHash } from 'node:crypto';
+
+export const CAPABILITY_LEDGER_SCHEMA='deadbyte.capability-ledger.v1';
+const AUTHORITIES=new Set(['none','process','coding','autonomous','host']);
+const PROFILE_ENV='DEADBYTE_CAPABILITY_PROFILE';
+const COMPACT_TOOL_LIMIT=42;
+
+function sha256(text){return createHash('sha256').update(text,'utf8').digest('hex');}
+function canonicalJson(value){
+  if(value===null||typeof value!=='object') return JSON.stringify(value);
+  if(Array.isArray(value)) return `[${value.map(canonicalJson).join(',')}]`;
+  return `{${Object.keys(value).sort((a,b)=>a.localeCompare(b,'en')).map(key=>`${JSON.stringify(key)}:${canonicalJson(value[key])}`).join(',')}}`;
+}
+function nonEmpty(value,label){if(typeof value!=='string'||value.length<1) throw new Error(`${label} must be non-empty`); return value;}
+function nullableRoute(value,label){if(value===null) return null; return nonEmpty(value,label);}
+function normalizedEntry(raw){
+  if(!raw||typeof raw!=='object'||Array.isArray(raw)) throw new Error('capability entry must be an object');
+  const authority=nonEmpty(raw.authority,'capability authority');
+  if(!AUTHORITIES.has(authority)) throw new Error(`unknown capability authority: ${authority}`);
+  const entry={
+    id:nonEmpty(raw.id,'capability id'),
+    full_tool:nonEmpty(raw.full_tool,'capability full_tool'),
+    compact_tool:nullableRoute(raw.compact_tool??null,'capability compact_tool'),
+    compact_op:nullableRoute(raw.compact_op??null,'capability compact_op'),
+    runtime_flag:raw.runtime_flag===null?null:nonEmpty(raw.runtime_flag,'capability runtime_flag'),
+    authority,
+    mutating:raw.mutating===true,
+    receipt_class:raw.receipt_class===null?null:nonEmpty(raw.receipt_class,'capability receipt_class'),
+    production:raw.production===true,
+    host_only:raw.host_only===true
+  };
+  if((entry.compact_tool===null)!==(entry.compact_op===null)) throw new Error(`capability ${entry.id} compact route requires both tool and op`);
+  if(entry.host_only&&entry.authority!=='host') throw new Error(`capability ${entry.id} host_only requires host authority`);
+  return Object.freeze(entry);
+}
+
+export function createCapabilityLedger(entries){
+  if(!Array.isArray(entries)) throw new Error('capability entries must be an array');
+  const seen=new Set();
+  const normalized=entries.map(normalizedEntry);
+  for(const item of normalized){
+    if(seen.has(item.id)) throw new Error(`duplicate capability id: ${item.id}`);
+    seen.add(item.id);
+  }
+  normalized.sort((a,b)=>a.id.localeCompare(b.id,'en'));
+  const frozenEntries=Object.freeze(normalized.slice());
+  const body={schema:CAPABILITY_LEDGER_SCHEMA,entries:frozenEntries};
+  return Object.freeze({...body,ledger_sha256:sha256(canonicalJson(body))});
+}
+
+export function capabilityProfileFromEnv(env=process.env){
+  const value=env?.[PROFILE_ENV]??'full';
+  if(value!=='full'&&value!=='compact') throw new Error(`${PROFILE_ENV} must be full or compact`);
+  return value;
+}
+
+function toolNames(snapshot,label){
+  if(!snapshot||typeof snapshot!=='object'||!Array.isArray(snapshot.tools)) throw new Error(`${label} tool surface snapshot invalid`);
+  const names=snapshot.tools.map(tool=>tool?.name);
+  if(names.some(name=>typeof name!=='string'||name.length<1)) throw new Error(`${label} tool surface contains invalid name`);
+  return new Set(names);
+}
+
+export function assertCapabilityClosure({ledger,fullToolSnapshot,compactToolSnapshot}){
+  if(!ledger||ledger.schema!==CAPABILITY_LEDGER_SCHEMA||!Array.isArray(ledger.entries)) throw new Error('capability ledger invalid');
+  const full=toolNames(fullToolSnapshot,'full');
+  const compact=toolNames(compactToolSnapshot,'compact');
+  if(compact.size>COMPACT_TOOL_LIMIT) throw new Error(`compact surface exceeds ${COMPACT_TOOL_LIMIT}-tool limit: ${compact.size}`);
+  for(const capability of ledger.entries){
+    if(!full.has(capability.full_tool)) throw new Error(`capability ${capability.id} full tool missing: ${capability.full_tool}`);
+    if(capability.production&&!capability.host_only){
+      if(!capability.compact_tool||!capability.compact_op) throw new Error(`capability ${capability.id} compact route missing`);
+      if(!compact.has(capability.compact_tool)) throw new Error(`capability ${capability.id} compact tool missing: ${capability.compact_tool}`);
+    }
+  }
+  return true;
+}
+
+const direct=(id,tool,runtime_flag,authority,{mutating=false,receipt_class='direct',production=true,host_only=false}={})=>({id,full_tool:tool,compact_tool:tool,compact_op:'direct',runtime_flag,authority,mutating,receipt_class,production,host_only});
+const gateway=(id,full_tool,compact_tool,compact_op,runtime_flag,authority,{mutating=false,receipt_class='direct',production=true}={})=>({id,full_tool,compact_tool,compact_op,runtime_flag,authority,mutating,receipt_class,production,host_only:false});
+
+export const R36_CAPABILITY_ENTRIES=Object.freeze([
+  direct('evidence.verify','evidence_verify',null,'none',{receipt_class:'verification'}),
+  gateway('machine.list','machine_list','machine_observe','machine_list','DEADBYTE_MACHINE_RUNTIME','none',{receipt_class:'machine'}),
+  gateway('machine.status','machine_status','machine_observe','machine_status','DEADBYTE_MACHINE_RUNTIME','none',{receipt_class:'machine'}),
+  gateway('machine.ping','machine_ping','machine_observe','machine_ping','DEADBYTE_MACHINE_RUNTIME','none',{receipt_class:'machine'}),
+  direct('machine.revoke','machine_revoke','DEADBYTE_MACHINE_RUNTIME','host',{mutating:true,receipt_class:'machine',production:false,host_only:true}),
+
+  gateway('process.start','process_session_start','process_session','start','DEADBYTE_PROCESS_RUNTIME','process',{mutating:true,receipt_class:'process'}),
+  gateway('process.read','process_session_read','process_session','read','DEADBYTE_PROCESS_RUNTIME','process',{receipt_class:'process'}),
+  gateway('process.status','process_session_status','process_session','status','DEADBYTE_PROCESS_RUNTIME','process',{receipt_class:'process'}),
+  gateway('process.list','process_session_list','process_session','list','DEADBYTE_PROCESS_RUNTIME','process',{receipt_class:'process'}),
+  gateway('process.action','process_session_action','process_session','action','DEADBYTE_PROCESS_RUNTIME','process',{mutating:true,receipt_class:'process'}),
+  gateway('process.terminate','process_session_terminate','process_session','terminate','DEADBYTE_PROCESS_RUNTIME','process',{mutating:true,receipt_class:'process'}),
+
+  direct('coding.session_status','coding_session_status','DEADBYTE_CODING_RUNTIME','coding',{receipt_class:'coding'}),
+  direct('coding.tree','coding_tree','DEADBYTE_CODING_RUNTIME','coding',{receipt_class:'coding'}),
+  gateway('coding.stat','coding_stat','coding_inspect','stat','DEADBYTE_CODING_RUNTIME','coding',{receipt_class:'coding'}),
+  gateway('coding.search','coding_search','coding_inspect','search','DEADBYTE_CODING_RUNTIME','coding',{receipt_class:'coding'}),
+  gateway('coding.files_read','coding_files_read','coding_inspect','files_read','DEADBYTE_CODING_RUNTIME','coding',{receipt_class:'coding'}),
+  gateway('semantic.outline','coding_symbol_outline','coding_inspect','symbol_outline','DEADBYTE_CODING_RUNTIME','coding',{receipt_class:'semantic'}),
+  gateway('semantic.definition','coding_symbol_definition','coding_inspect','symbol_definition','DEADBYTE_CODING_RUNTIME','coding',{receipt_class:'semantic'}),
+  gateway('semantic.references','coding_symbol_references','coding_inspect','symbol_references','DEADBYTE_CODING_RUNTIME','coding',{receipt_class:'semantic'}),
+  gateway('semantic.diagnostics','coding_symbol_diagnostics','coding_inspect','symbol_diagnostics','DEADBYTE_CODING_RUNTIME','coding',{receipt_class:'semantic'}),
+  gateway('semantic.implementations','coding_symbol_implementations','coding_inspect','symbol_implementations','DEADBYTE_CODING_RUNTIME','coding',{receipt_class:'semantic'}),
+  gateway('semantic.rename_preview','coding_symbol_rename_preview','coding_inspect','symbol_rename_preview','DEADBYTE_AUTONOMOUS_RUNTIME','autonomous',{receipt_class:'native_diff'}),
+  direct('semantic.replace','coding_symbol_replace','DEADBYTE_CODING_RUNTIME','coding',{mutating:true,receipt_class:'coding'}),
+  direct('coding.file_read','coding_file_read','DEADBYTE_CODING_RUNTIME','coding',{receipt_class:'coding'}),
+  direct('coding.file_write','coding_file_write','DEADBYTE_CODING_RUNTIME','coding',{mutating:true,receipt_class:'coding'}),
+  direct('coding.text_replace','coding_text_replace','DEADBYTE_CODING_RUNTIME','coding',{mutating:true,receipt_class:'coding'}),
+  direct('coding.command_run','coding_command_run','DEADBYTE_CODING_RUNTIME','coding',{mutating:true,receipt_class:'coding'}),
+  direct('coding.benchmark_run','coding_benchmark_run','DEADBYTE_CODING_RUNTIME','coding',{mutating:true,receipt_class:'coding'}),
+  direct('coding.receipt_verify','coding_receipt_verify','DEADBYTE_CODING_RUNTIME','coding',{receipt_class:'verification'}),
+  direct('coding.task_submit','coding_task_submit','DEADBYTE_CODING_RUNTIME','coding',{mutating:true,receipt_class:'task'}),
+  direct('coding.task_run','coding_task_run','DEADBYTE_CODING_RUNTIME','coding',{mutating:true,receipt_class:'task'}),
+  direct('coding.task_status','coding_task_status','DEADBYTE_CODING_RUNTIME','coding',{receipt_class:'task'}),
+  direct('coding.task_events','coding_task_events','DEADBYTE_CODING_RUNTIME','coding',{receipt_class:'task'}),
+  direct('coding.task_cancel','coding_task_cancel','DEADBYTE_CODING_RUNTIME','coding',{mutating:true,receipt_class:'task'}),
+  direct('coding.task_approve','coding_task_approve','DEADBYTE_CODING_RUNTIME','coding',{mutating:true,receipt_class:'task'}),
+  direct('coding.task_verify','coding_task_verify','DEADBYTE_CODING_RUNTIME','coding',{receipt_class:'verification'}),
+
+  gateway('machine_fs.stat','machine_fs_stat','machine_fs','stat','DEADBYTE_MACHINE_FS_RUNTIME','coding',{receipt_class:'machine_fs'}),
+  gateway('machine_fs.list','machine_fs_list','machine_fs','list','DEADBYTE_MACHINE_FS_RUNTIME','coding',{receipt_class:'machine_fs'}),
+  gateway('machine_fs.read','machine_fs_read','machine_fs','read','DEADBYTE_MACHINE_FS_RUNTIME','coding',{receipt_class:'machine_fs'}),
+  gateway('machine_fs.write','machine_fs_write','machine_fs','write','DEADBYTE_MACHINE_FS_RUNTIME','coding',{mutating:true,receipt_class:'machine_fs'}),
+  gateway('machine_fs.edit_exact','machine_fs_edit_exact','machine_fs','edit_exact','DEADBYTE_MACHINE_FS_RUNTIME','coding',{mutating:true,receipt_class:'machine_fs'}),
+  gateway('machine_fs.mkdir','machine_fs_mkdir','machine_fs','mkdir','DEADBYTE_MACHINE_FS_RUNTIME','coding',{mutating:true,receipt_class:'machine_fs'}),
+  gateway('machine_fs.move','machine_fs_move','machine_fs','move','DEADBYTE_MACHINE_FS_RUNTIME','coding',{mutating:true,receipt_class:'machine_fs'}),
+  gateway('machine_fs.delete','machine_fs_delete','machine_fs','delete','DEADBYTE_MACHINE_FS_RUNTIME','coding',{mutating:true,receipt_class:'machine_fs'}),
+
+  gateway('observation.search_start','machine_search_start','machine_observe','search_start','DEADBYTE_OBSERVATION_RUNTIME','none',{receipt_class:'observation'}),
+  gateway('observation.search_page','machine_search_page','machine_observe','search_page','DEADBYTE_OBSERVATION_RUNTIME','none',{receipt_class:'observation'}),
+  gateway('observation.search_status','machine_search_status','machine_observe','search_status','DEADBYTE_OBSERVATION_RUNTIME','none',{receipt_class:'observation'}),
+  gateway('observation.search_cancel','machine_search_cancel','machine_observe','search_cancel','DEADBYTE_OBSERVATION_RUNTIME','none',{receipt_class:'observation'}),
+  gateway('observation.process_list','machine_process_list','machine_observe','process_list','DEADBYTE_OBSERVATION_RUNTIME','none',{receipt_class:'observation'}),
+  gateway('observation.system_status','machine_system_status','machine_observe','system_status','DEADBYTE_OBSERVATION_RUNTIME','none',{receipt_class:'observation'}),
+
+  direct('autonomous.session_status','autonomous_session_status','DEADBYTE_AUTONOMOUS_RUNTIME','autonomous',{receipt_class:'autonomous'}),
+  direct('native_diff.preview','native_diff_preview','DEADBYTE_AUTONOMOUS_RUNTIME','autonomous',{mutating:true,receipt_class:'native_diff'}),
+  direct('native_diff.apply','native_diff_apply','DEADBYTE_AUTONOMOUS_RUNTIME','autonomous',{mutating:true,receipt_class:'native_diff'}),
+  direct('native_diff.verify','native_diff_verify','DEADBYTE_AUTONOMOUS_RUNTIME','autonomous',{receipt_class:'verification'}),
+  direct('autonomous.goal_submit','autonomous_goal_submit','DEADBYTE_AUTONOMOUS_RUNTIME','autonomous',{mutating:true,receipt_class:'autonomous'}),
+  direct('autonomous.goal_run','autonomous_goal_run','DEADBYTE_AUTONOMOUS_RUNTIME','autonomous',{mutating:true,receipt_class:'autonomous'}),
+  direct('autonomous.goal_status','autonomous_goal_status','DEADBYTE_AUTONOMOUS_RUNTIME','autonomous',{receipt_class:'autonomous'}),
+  direct('autonomous.goal_events','autonomous_goal_events','DEADBYTE_AUTONOMOUS_RUNTIME','autonomous',{receipt_class:'autonomous'}),
+  direct('autonomous.goal_cancel','autonomous_goal_cancel','DEADBYTE_AUTONOMOUS_RUNTIME','autonomous',{mutating:true,receipt_class:'autonomous'}),
+  direct('autonomous.goal_approve','autonomous_goal_approve','DEADBYTE_AUTONOMOUS_RUNTIME','autonomous',{mutating:true,receipt_class:'autonomous'}),
+  direct('autonomous.goal_verify','autonomous_goal_verify','DEADBYTE_AUTONOMOUS_RUNTIME','autonomous',{receipt_class:'verification'}),
+  direct('autonomous.release_gate','autonomous_release_gate','DEADBYTE_AUTONOMOUS_RUNTIME','autonomous',{mutating:true,receipt_class:'release'}),
+
+  direct('host.file_read','host_file_read','DEADBYTE_PRIVILEGED_POLICY','host',{receipt_class:'host',production:false,host_only:true}),
+  direct('host.file_write','host_file_write','DEADBYTE_PRIVILEGED_POLICY','host',{mutating:true,receipt_class:'host',production:false,host_only:true}),
+  direct('host.exec','host_exec','DEADBYTE_PRIVILEGED_POLICY','host',{mutating:true,receipt_class:'host',production:false,host_only:true})
+]);
+export const R36_CAPABILITY_LEDGER=createCapabilityLedger(R36_CAPABILITY_ENTRIES);
+
+export const CAPABILITY_PROFILE_ENV=PROFILE_ENV;
+export const COMPACT_SURFACE_TOOL_LIMIT=COMPACT_TOOL_LIMIT;

package/src/coding-mcp-tools.mjs

@@ -4,7 +4,8 @@ import {
   codingBenchmarkRunOutputSchema, codingCommandRunOutputSchema,
   codingFileReadOutputSchema, codingFilesReadOutputSchema, codingFileWriteOutputSchema,
   codingReceiptVerifyOutputSchema, codingSearchOutputSchema, codingSessionStatusOutputSchema, codingStatOutputSchema,
-  codingSymbolOutlineOutputSchema, codingSymbolDefinitionOutputSchema, codingSymbolReferencesOutputSchema, codingSymbolReplaceOutputSchema,
+  codingSymbolOutlineOutputSchema, codingSymbolDefinitionOutputSchema, codingSymbolReferencesOutputSchema,
+  codingSymbolDiagnosticsOutputSchema, codingSymbolImplementationsOutputSchema, codingSymbolRenamePreviewOutputSchema, codingSymbolReplaceOutputSchema,
   codingTaskApproveOutputSchema, codingTaskCancelOutputSchema,
   codingTaskEventsOutputSchema, codingTaskRunOutputSchema,
   codingTaskStatusOutputSchema, codingTaskSubmitOutputSchema,
@@ -67,13 +68,16 @@ export function registerCodingTools(server, { codingRuntime, taskRuntime, semant
   }, async ({ root_id, path, hash }) => { try { return result(codingStatOutputSchema, await codingRuntime.stat({ rootId: root_id, relativePath: path, hash })); } catch (error) { return fail(codingStatOutputSchema, error); } });
 
   server.registerTool('coding_search', {
-    description: 'Deterministic literal content search using the existing coding tree/read authority.',
+    description: 'Deterministic bounded content/path search with literal or regex mode, signed cursor paging, and observed file identities.',
     inputSchema: z.strictObject({ root_id: rootId, path: relPath.default('.'), pattern: z.string().min(1).max(256),
-      mode: z.literal('literal').default('literal'), case_sensitive: z.boolean().default(false),
-      max_results: z.number().int().min(1).max(1000).default(200), max_file_bytes: z.number().int().min(1).max(4194304).default(262144) }),
+      target: z.enum(['content','path']).default('content'), mode: z.enum(['literal','regex']).default('literal'), case_sensitive: z.boolean().default(false),
+      max_results: z.number().int().min(1).max(1000).default(200), max_file_bytes: z.number().int().min(1).max(4194304).default(262144),
+      max_scan_bytes: z.number().int().min(1).max(67108864).default(4194304), page_size: z.number().int().min(1).max(500).default(100),
+      cursor: z.string().max(8192).nullable().default(null) }),
     outputSchema: codingSearchOutputSchema
-  }, async ({ root_id, path, pattern, mode, case_sensitive, max_results, max_file_bytes }) => {
-    try { return result(codingSearchOutputSchema, await codingRuntime.search({ rootId: root_id, path, pattern, mode, caseSensitive: case_sensitive, maxResults: max_results, maxFileBytes: max_file_bytes })); }
+  }, async ({ root_id, path, pattern, target, mode, case_sensitive, max_results, max_file_bytes, max_scan_bytes, page_size, cursor }) => {
+    try { return result(codingSearchOutputSchema, await codingRuntime.search({ rootId: root_id, path, pattern, target, mode, caseSensitive: case_sensitive,
+      maxResults: max_results, maxFileBytes: max_file_bytes, maxScanBytes: max_scan_bytes, pageSize: page_size, cursor })); }
     catch (error) { return fail(codingSearchOutputSchema, error); }
   });
 
@@ -95,6 +99,24 @@ export function registerCodingTools(server, { codingRuntime, taskRuntime, semant
     outputSchema: codingSymbolReferencesOutputSchema
   }, async ({ root_id, path, line, column, max_results }) => { try { return result(codingSymbolReferencesOutputSchema, await semanticRuntime.references({ rootId: root_id, relativePath: path, line, column, maxResults: max_results })); } catch (error) { return fail(codingSymbolReferencesOutputSchema, error); } });
 
+  server.registerTool('coding_symbol_diagnostics', {
+    description: 'Return bounded normalized semantic diagnostics with target and result identities.',
+    inputSchema: z.strictObject({ root_id: rootId, path: relPath, max_results: z.number().int().min(1).max(500).default(200) }),
+    outputSchema: codingSymbolDiagnosticsOutputSchema
+  }, async ({ root_id, path, max_results }) => { try { const value=await semanticRuntime.diagnostics({ rootId:root_id, relativePath:path, maxResults:max_results }); return result(codingSymbolDiagnosticsOutputSchema,value,value.status==='failed'); } catch(error){ return fail(codingSymbolDiagnosticsOutputSchema,error); } });
+
+  server.registerTool('coding_symbol_implementations', {
+    description: 'Resolve bounded semantic implementations at a zero-based line/column. Unsupported backends report an explicit typed status.',
+    inputSchema: z.strictObject({ root_id:rootId, path:relPath, line:z.number().int().min(0), column:z.number().int().min(0), max_results:z.number().int().min(1).max(500).default(200) }),
+    outputSchema: codingSymbolImplementationsOutputSchema
+  }, async ({ root_id, path, line, column, max_results }) => { try { const value=await semanticRuntime.implementations({rootId:root_id,relativePath:path,line,column,maxResults:max_results}); return result(codingSymbolImplementationsOutputSchema,value,false); } catch(error){ return fail(codingSymbolImplementationsOutputSchema,error); } });
+
+  server.registerTool('coding_symbol_rename_preview', {
+    description: 'Preview one semantic rename as a content-addressed Native Diff. This tool never mutates source bytes.',
+    inputSchema: z.strictObject({ root_id:rootId, path:relPath, line:z.number().int().min(0), column:z.number().int().min(0), new_name:z.string().regex(/^[A-Za-z_$][A-Za-z0-9_$]{0,127}$/) }),
+    outputSchema: codingSymbolRenamePreviewOutputSchema
+  }, async ({ root_id, path, line, column, new_name }) => { try { const value=await semanticRuntime.renamePreview({rootId:root_id,relativePath:path,line,column,newName:new_name}); return result(codingSymbolRenamePreviewOutputSchema,value,false); } catch(error){ return fail(codingSymbolRenamePreviewOutputSchema,error); } });
+
   server.registerTool('coding_symbol_replace', {
     description: 'Replace one current JS/TS symbol body by symbol_id under exact file SHA-256 precondition. The commit reuses the coding plane signed surgical-edit receipt path.',
     inputSchema: z.strictObject({ root_id: rootId, path: relPath, symbol_id: hex64, new_body: z.string().max(524288), expected_sha256: hex64 }),
@@ -102,21 +124,13 @@ export function registerCodingTools(server, { codingRuntime, taskRuntime, semant
   }, async ({ root_id, path, symbol_id, new_body, expected_sha256 }) => { try { return result(codingSymbolReplaceOutputSchema, await semanticRuntime.replaceSymbol({ rootId: root_id, relativePath: path, symbolId: symbol_id, newBody: new_body, expectedSha256: expected_sha256 })); } catch (error) { return fail(codingSymbolReplaceOutputSchema, error); } });
 
   server.registerTool('coding_files_read', {
-    description: 'Read up to 32 bounded files in one request using the same coding-policy lease and deny-path checks as coding_file_read.',
+    description: 'Read up to 32 bounded files under one coding lease and return an aggregate observation identity over ordered file metadata.',
     inputSchema: z.strictObject({ root_id: rootId, files: z.array(z.strictObject({ path: relPath, encoding: z.enum(['utf8','base64']).default('utf8') })).min(1).max(32),
       max_total_bytes: z.number().int().min(1).max(2097152).default(1048576) }),
     outputSchema: codingFilesReadOutputSchema
   }, async ({ root_id, files, max_total_bytes }) => {
-    try {
-      const values=[]; let total=0;
-      for(const item of files){
-        const read=await codingRuntime.fileRead({rootId:root_id,relativePath:item.path,encoding:item.encoding});
-        total+=read.bytes;
-        if(total>max_total_bytes) throw new Error(`coding multi-read exceeds ${max_total_bytes} byte total limit`);
-        values.push({path:item.path,encoding:item.encoding,bytes:read.bytes,sha256:read.sha256,content:read.content});
-      }
-      return result(codingFilesReadOutputSchema,{status:'ok',root_id,total_bytes:total,files:values});
-    } catch(error){ return fail(codingFilesReadOutputSchema,error); }
+    try { return result(codingFilesReadOutputSchema,await codingRuntime.filesRead({rootId:root_id,files,maxTotalBytes:max_total_bytes})); }
+    catch(error){ return fail(codingFilesReadOutputSchema,error); }
   });
 
   server.registerTool('coding_file_read', {

package/src/coding-output-contracts.mjs

@@ -70,18 +70,25 @@ export const codingTreeOutputSchema = statusContract({
 export const codingStatOutputSchema = statusContract({
   statuses: ['ok', 'failed'],
   shape: { root_id: z.string().min(1).max(64).optional(), path: z.string().min(1).max(512).optional(),
-    type: z.enum(['file','directory','symlink','other']).optional(), bytes: z.number().int().min(0).optional(),
-    mtime_utc: z.string().min(1).optional(), sha256: hex64.nullable().optional() },
-  successStatuses: ['ok'], successRequired: ['root_id','path','type','bytes','mtime_utc','sha256']
+    normalized_path: z.string().min(1).max(512).optional(), type: z.enum(['file','directory','symlink','other']).optional(),
+    bytes: z.number().int().min(0).optional(), mtime_utc: z.string().min(1).optional(), sha256: hex64.nullable().optional(),
+    reparse_state: z.enum(['none','symlink']).optional(), object_identity_sha256: hex64.optional(),
+    policy_root_id: z.string().min(1).max(64).optional(), observation_sha256: hex64.optional() },
+  successStatuses: ['ok'], successRequired: ['root_id','path','normalized_path','type','bytes','mtime_utc','sha256','reparse_state','object_identity_sha256','policy_root_id','observation_sha256']
 });
 export const codingSearchOutputSchema = statusContract({
   statuses: ['ok', 'failed'],
   shape: { root_id: z.string().min(1).max(64).optional(), path: z.string().min(1).max(512).optional(),
-    pattern: z.string().min(1).max(256).optional(), mode: z.literal('literal').optional(), case_sensitive: z.boolean().optional(),
-    matches: z.array(z.strictObject({ path: z.string().min(1).max(512), line: z.number().int().min(1),
-      column: z.number().int().min(1), preview: z.string().max(512) })).max(1000).optional(),
-    files_scanned: z.number().int().min(0).optional(), bytes_scanned: z.number().int().min(0).optional(), truncated: z.boolean().optional() },
-  successStatuses: ['ok'], successRequired: ['root_id','path','pattern','mode','case_sensitive','matches','files_scanned','bytes_scanned','truncated']
+    pattern: z.string().min(1).max(256).optional(), target: z.enum(['content','path']).optional(),
+    mode: z.enum(['literal','regex']).optional(), case_sensitive: z.boolean().optional(),
+    matches: z.array(z.strictObject({ path: z.string().min(1).max(512), line: z.number().int().min(1).nullable(),
+      column: z.number().int().min(1).nullable(), preview: z.string().max(512), file_sha256: hex64.nullable() })).max(500).optional(),
+    files_scanned: z.number().int().min(0).optional(), bytes_scanned: z.number().int().min(0).optional(),
+    binary_files_skipped: z.number().int().min(0).optional(), truncated: z.boolean().optional(),
+    truncation_reason: z.enum(['tree_limit','scan_byte_limit','max_results']).nullable().optional(),
+    query_sha256: hex64.optional(), snapshot_sha256: hex64.optional(), page_sha256: hex64.optional(),
+    next_cursor: z.string().max(8192).nullable().optional() },
+  successStatuses: ['ok'], successRequired: ['root_id','path','pattern','target','mode','case_sensitive','matches','files_scanned','bytes_scanned','binary_files_skipped','truncated','truncation_reason','query_sha256','snapshot_sha256','page_sha256','next_cursor']
 });
 const semanticLocationSchema = z.strictObject({
   path: z.string().min(1).max(512), name: z.string().max(256), kind: z.string().min(1).max(64),
@@ -113,6 +120,36 @@ export const codingSymbolReferencesOutputSchema = statusContract({
     locations: z.array(semanticLocationSchema).max(500).optional(), truncated: z.boolean().optional() },
   successStatuses: ['ok'], successRequired: ['root_id','path','line','column','engine','locations','truncated']
 });
+export const codingSymbolDiagnosticsOutputSchema = z.strictObject({
+  status:z.enum(['ok','unsupported','failed']), error:z.string().optional(), capability:z.string().max(64).optional(),
+  root_id:z.string().min(1).max(64).optional(), path:z.string().min(1).max(512).optional(), file_sha256:hex64.optional(),
+  engine:z.string().min(1).max(128).optional(), diagnostics:z.array(z.strictObject({message:z.string().max(4096),code:z.string().max(256),severity:z.string().min(1).max(64),location:semanticLocationSchema.optional()})).max(500).optional(),
+  truncated:z.boolean().optional(), result_sha256:hex64.optional()
+}).superRefine((value,ctx)=>{
+  if(value.status==='failed'){requireFields(value,ctx,['error']);return;}
+  if(value.status==='unsupported'){requireFields(value,ctx,['capability','engine']);return;}
+  requireFields(value,ctx,['root_id','path','file_sha256','engine','diagnostics','truncated','result_sha256']);
+});
+export const codingSymbolImplementationsOutputSchema = z.strictObject({
+  status:z.enum(['ok','unsupported','failed']), error:z.string().optional(), capability:z.string().max(64).optional(),
+  root_id:z.string().min(1).max(64).optional(), path:z.string().min(1).max(512).optional(), line:z.number().int().min(0).optional(), column:z.number().int().min(0).optional(),
+  file_sha256:hex64.optional(), engine:z.string().min(1).max(128).optional(), locations:z.array(semanticLocationSchema).max(500).optional(),
+  truncated:z.boolean().optional(), result_sha256:hex64.optional()
+}).superRefine((value,ctx)=>{
+  if(value.status==='failed'){requireFields(value,ctx,['error']);return;}
+  if(value.status==='unsupported'){requireFields(value,ctx,['capability','engine']);return;}
+  requireFields(value,ctx,['root_id','path','line','column','file_sha256','engine','locations','truncated','result_sha256']);
+});
+export const codingSymbolRenamePreviewOutputSchema = z.strictObject({
+  status:z.enum(['ready','unsupported','failed']), error:z.string().optional(), capability:z.string().max(64).optional(), engine:z.string().min(1).max(128).optional(),
+  diff_id:hex64.optional(), affected_files:z.number().int().min(1).max(32).optional(), edit_count:z.number().int().min(1).optional(), backend:z.string().min(1).max(128).optional(),
+  preimages:z.array(z.strictObject({path:z.string().min(1).max(512),sha256:hex64})).max(32).optional()
+}).superRefine((value,ctx)=>{
+  if(value.status==='failed'){requireFields(value,ctx,['error']);return;}
+  if(value.status==='unsupported'){requireFields(value,ctx,['capability','engine']);return;}
+  requireFields(value,ctx,['diff_id','affected_files','edit_count','backend','preimages']);
+});
+
 export const codingSymbolReplaceOutputSchema = statusContract({
   statuses: ['committed','failed'],
   shape: { root_id: z.string().min(1).max(64).optional(), path: z.string().min(1).max(512).optional(), previous_sha256: hex64.optional(),
@@ -125,8 +162,9 @@ export const codingSymbolReplaceOutputSchema = statusContract({
 export const codingFilesReadOutputSchema = statusContract({
   statuses: ['ok','failed'],
   shape: { root_id: z.string().min(1).max(64).optional(), total_bytes: z.number().int().min(0).optional(),
-    files: z.array(z.strictObject({ path: z.string().min(1).max(512), encoding: z.enum(['utf8','base64']), bytes: z.number().int().min(0), sha256: hex64, content: z.string() })).max(32).optional() },
-  successStatuses: ['ok'], successRequired: ['root_id','total_bytes','files']
+    files: z.array(z.strictObject({ path: z.string().min(1).max(512), encoding: z.enum(['utf8','base64']), bytes: z.number().int().min(0), sha256: hex64, content: z.string() })).max(32).optional(),
+    observation_sha256: hex64.optional() },
+  successStatuses: ['ok'], successRequired: ['root_id','total_bytes','files','observation_sha256']
 });
 export const codingFileReadOutputSchema = statusContract({
   statuses: ['ok', 'failed'],