eval-quality 1.4.2 → 3.0.0

package/dist/core/schemas/interface.js

@@ -1,7 +1,7 @@
 /** permitted interfaces and the per-operation declaration inventory. */
 import { z } from 'zod';
 import { DescriptorPointer } from './pointer.js';
-import { Identifier, KeyedShapeDescriptor, KeyName, KeyTypeMap, } from './primitives.js';
+import { Identifier, KeyedShapeDescriptor, KeyName, KeyTypeMap, ToolName, } from './primitives.js';
 import { SensitivityWitness } from './sensitivity-witness.js';
 /** AD-19's closed four-member set, declared per pointer the descriptor names. */
 export const ChannelRole = z.enum([
@@ -100,7 +100,7 @@ export const Operation = z
 })
     .meta({
     id: 'Operation',
-    description: "AD-19's per-operation declaration inventory for an interface that speaks HTTP. Carried by the `api`, `web`, and `mcp` branches alike, so the export names it once instead of inlining three copies that could drift apart.",
+    description: "AD-19's per-operation declaration inventory for an interface that speaks HTTP. Carried by the `api` and `web` branches alike, so the export names it once instead of inlining two copies that could drift apart.",
 });
 /**
  * AD-35 applied to a command: the operation names a logical executable and the
@@ -183,6 +183,59 @@ export const CommandOperation = z.strictObject({
     volatilePointers: z.array(DescriptorPointer),
     sensitivityWitness: SensitivityWitness.nullable().describe("AD-10, mandatory per declared operation rather than per interface, on the api operation's own terms. `null` is legal only for an operation declaring no keys in any request channel, which for a command means no argument, no option, no environment variable, and no standard input. An input-bearing operation declaring `null` fails a strict compilation under `undeclared-mandatory-input`."),
 });
+/**
+ * The tool-call counterpart of `RequestShape`, a one-key strict object for the
+ * reason that comment gives: a record over a channel enum demands every member
+ * at parse time, and the partial spelling that would relax it is the one the
+ * Consistency Conventions ban.
+ *
+ * One key rather than four. A tool call carries an arguments object and nothing
+ * else, so declaring `path`, `query`, and `header` beside it would put three
+ * channels on every contract that no call can ever send and no oracle can ever
+ * reach.
+ */
+export const McpRequestShape = z.strictObject({
+    arguments: KeyedShapeDescriptor.describe("The tool's declared arguments, keyed by the names the server publishes for them. AD-18 applies as it does to a header: a declaration names an argument and its type and never carries a credential value."),
+});
+/**
+ * Which output channel the operation's one response descriptor describes.
+ *
+ * Tagged on `kind` with one member, following `CommandDescriptorChannel`. The
+ * second member is already known: a tool that returns prose rather than
+ * structured content is outside this version, and admitting it later adds a
+ * member, which AD-11 makes additive, where retyping a bare field would be
+ * breaking.
+ */
+export const McpDescriptorChannel = z.discriminatedUnion('kind', [
+    z.strictObject({ kind: z.literal('structured-result') }),
+]);
+/**
+ * A tool-call operation.
+ *
+ * `toolName` is the whole transport identity. Every MCP call shares the one
+ * transport identity `tools/call` and the tool name is what distinguishes two
+ * of them, so a method and a path template would render one signature for every
+ * tool a server publishes and collide under `duplicate-operation-signature`.
+ * AD-40 needs that identity readable by a probe seeder who has never opened the
+ * contract, and a published tool name is exactly that.
+ *
+ * It carries the same `ResponseDescriptor` an api operation carries, over the
+ * structured result its `descriptorChannel` nominates, so all fourteen AD-31
+ * predicates read one descriptor one dereference deep with no kind-specific
+ * arm.
+ */
+export const McpOperation = z.strictObject({
+    operationId: Identifier,
+    toolName: ToolName,
+    stateChangeMarker: z
+        .boolean()
+        .describe('AD-19: whether the operation is intended to change state. AD-20 rule 7 relevance reads it, and AD-10 selects the sensitivity channel by it. Both values are legal and neither is a default.'),
+    requestShape: McpRequestShape,
+    descriptorChannel: McpDescriptorChannel,
+    responseDescriptor: ResponseDescriptor,
+    volatilePointers: z.array(DescriptorPointer),
+    sensitivityWitness: SensitivityWitness.nullable().describe("AD-10, mandatory per declared operation rather than per interface, on the api operation's own terms. `null` is legal only for an operation declaring no keys in its arguments channel. An input-bearing operation declaring `null` fails a strict compilation under `undeclared-mandatory-input`."),
+});
 /**
  * AD-19's four interface kinds, exported once so nothing else respells them:
  * the sealed evaluator brief carries interface identity without the operation
@@ -193,12 +246,14 @@ export const CommandOperation = z.strictObject({
 export const INTERFACE_KINDS = ['api', 'web', 'cli', 'mcp'];
 export const InterfaceKind = z.enum(INTERFACE_KINDS);
 const LOGICAL_ID_DESCRIPTION = "AD-35: a logical identifier for the interface, never a URL, host, or port. Mapping it to a target is the caller's, outside the contract.";
-const OPERATIONS_DESCRIPTION = 'No uniqueness constraint: two operations colliding on their transport identity after parameter-name erasure is `duplicate-operation-signature`, a coded compile-time error, and a schema that deduped them would delete it.';
-// `web` and `mcp` carry the api operation shape unchanged. A two-member union
-// would make either one a parse failure, and a parse failure carries no AD-5
-// code, no artifact path, and no name for the kind that is unsupported, which
-// is the opposite of AD-10's "fails compilation honestly under
-// `unsupported-interface-kind`".
+const OPERATIONS_DESCRIPTION = 'No uniqueness constraint: two operations colliding on their transport identity is `duplicate-operation-signature`, a coded compile-time error, and a schema that deduped them would delete it. What that identity is depends on the kind, and `compile/interface-inventory.ts` is what computes it.';
+// `web` is the only kind left sharing the api operation shape, and the factory
+// survives its second caller leaving because that is what keeps the two
+// branches byte-identical. `web` still fails compilation under
+// `unsupported-interface-kind`, which needs the kind to reach the compiler:
+// a parse failure carries no AD-5 code, no artifact path, and no name for the
+// kind that is unsupported, which is the opposite of AD-10's "fails
+// compilation honestly".
 const apiShapedInterface = (kind) => z.strictObject({
     logicalId: Identifier.describe(LOGICAL_ID_DESCRIPTION),
     kind: z.literal(kind),
@@ -206,13 +261,18 @@ const apiShapedInterface = (kind) => z.strictObject({
 });
 /**
  * Discriminated on `kind`, so an operation shape cannot be smuggled onto the
- * wrong interface: a `cli` interface declaring `method` and an `api` interface
- * declaring `invocation` are both parse errors.
+ * wrong interface: a `cli` interface declaring `method`, an `api` interface
+ * declaring `invocation`, and an `mcp` interface declaring either are all parse
+ * errors.
  */
 export const PermittedInterface = z.discriminatedUnion('kind', [
     apiShapedInterface('api'),
     apiShapedInterface('web'),
-    apiShapedInterface('mcp'),
+    z.strictObject({
+        logicalId: Identifier.describe(LOGICAL_ID_DESCRIPTION),
+        kind: z.literal('mcp'),
+        operations: z.array(McpOperation).describe(OPERATIONS_DESCRIPTION),
+    }),
     z.strictObject({
         logicalId: Identifier.describe(LOGICAL_ID_DESCRIPTION),
         kind: z.literal('cli'),
@@ -220,9 +280,16 @@ export const PermittedInterface = z.discriminatedUnion('kind', [
     }),
 ]);
 /**
- * One interface's operations widened to the element union. TypeScript will not
- * iterate `iface.operations` directly, because the union's branches give it a
- * union of array types whose `map` signatures do not unify; this is the one
- * place that widening is spelled, so no call site invents its own.
+ * One interface's operations widened to the element union, for the callers
+ * that read only fields all three shapes carry. `iface.operations.map(...)` on
+ * an un-narrowed interface does not compile, because the union's branches give
+ * it a union of array types whose `map` signatures do not unify, and this is
+ * the one place that widening is spelled so no call site invents its own.
+ *
+ * A caller that narrows on `iface.kind` first wants the opposite and should
+ * read `iface.operations` directly: each branch declares its own element type,
+ * and this function discards the kind-to-shape correlation that a later kind
+ * test cannot recover. `buildPlanIndex` (`core/seal/plan-index.ts`) is the site
+ * that sorts by kind, and it narrows first for exactly that reason.
  */
 export const operationsOf = (iface) => iface.operations;

package/dist/core/schemas/plan.d.ts

@@ -186,10 +186,28 @@ export declare const CommandInputBinding: z.ZodObject<{
         principal: z.ZodString;
     }, z.core.$strict>]>>>;
 }, z.core.$strict>;
+/** The same shape over the one channel a tool call accepts input on. */
+export declare const McpInputBinding: z.ZodObject<{
+    arguments: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
+        literal: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+    }, z.core.$strict>, z.ZodObject<{
+        matcher: z.ZodEnum<{
+            any: "any";
+            "type-violating": "type-violating";
+        }>;
+    }, z.core.$strict>, z.ZodObject<{
+        captured: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        principal: z.ZodString;
+    }, z.core.$strict>]>>>;
+}, z.core.$strict>;
 /**
  * A plain union rather than a discriminated one, and the agreement between a
  * step's bound channels and its operation's kind is a compile-time check
- * rather than a schema refinement.
+ * rather than a schema refinement. That agreement is checked per bound channel,
+ * so a step binding every channel of the wrong kind's branch to `null` parses
+ * and passes: `null` means the step binds nothing there, and there is nothing
+ * left to disagree about.
  *
  * A step names an `operationId` and nothing else; the kind of the interface
  * declaring that operation lives in a different subtree of the same document.
@@ -297,6 +315,19 @@ export declare const InputBinding: z.ZodUnion<readonly [z.ZodObject<{
     }, z.core.$strict>, z.ZodObject<{
         principal: z.ZodString;
     }, z.core.$strict>]>>>;
+}, z.core.$strict>, z.ZodObject<{
+    arguments: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
+        literal: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+    }, z.core.$strict>, z.ZodObject<{
+        matcher: z.ZodEnum<{
+            any: "any";
+            "type-violating": "type-violating";
+        }>;
+    }, z.core.$strict>, z.ZodObject<{
+        captured: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        principal: z.ZodString;
+    }, z.core.$strict>]>>>;
 }, z.core.$strict>]>;
 export type InputBinding = z.infer<typeof InputBinding>;
 export type BindingChannel = z.infer<typeof BindingChannel>;
@@ -430,6 +461,19 @@ export declare const InteractionStep: z.ZodObject<{
         }, z.core.$strict>, z.ZodObject<{
             principal: z.ZodString;
         }, z.core.$strict>]>>>;
+    }, z.core.$strict>, z.ZodObject<{
+        arguments: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
+            literal: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+        }, z.core.$strict>, z.ZodObject<{
+            matcher: z.ZodEnum<{
+                any: "any";
+                "type-violating": "type-violating";
+            }>;
+        }, z.core.$strict>, z.ZodObject<{
+            captured: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            principal: z.ZodString;
+        }, z.core.$strict>]>>>;
     }, z.core.$strict>]>;
     after: z.ZodNullable<z.ZodString>;
     cardinality: z.ZodEnum<{

package/dist/core/schemas/plan.js

@@ -93,10 +93,17 @@ export const CommandInputBinding = z.strictObject({
     environment: BindingChannel,
     stdin: BindingChannel,
 });
+/** The same shape over the one channel a tool call accepts input on. */
+export const McpInputBinding = z.strictObject({
+    arguments: BindingChannel,
+});
 /**
  * A plain union rather than a discriminated one, and the agreement between a
  * step's bound channels and its operation's kind is a compile-time check
- * rather than a schema refinement.
+ * rather than a schema refinement. That agreement is checked per bound channel,
+ * so a step binding every channel of the wrong kind's branch to `null` parses
+ * and passes: `null` means the step binds nothing there, and there is nothing
+ * left to disagree about.
  *
  * A step names an `operationId` and nothing else; the kind of the interface
  * declaring that operation lives in a different subtree of the same document.
@@ -106,7 +113,11 @@ export const CommandInputBinding = z.strictObject({
  * already carries, which makes a disagreeing step a second inconsistency to
  * check rather than one fewer.
  */
-export const InputBinding = z.union([ApiInputBinding, CommandInputBinding]);
+export const InputBinding = z.union([
+    ApiInputBinding,
+    CommandInputBinding,
+    McpInputBinding,
+]);
 /**
  * AD-39's declared selector cardinality (owed item 2): what a step means when
  * its selector matches more than one observation was not decided at the

package/dist/core/schemas/pointer.d.ts

@@ -45,25 +45,39 @@ export declare const TransportChannel: z.ZodEnum<{
 export declare const COMMAND_CHANNELS: readonly ['argument', 'option', 'environment', 'stdin'];
 export type CommandChannelName = (typeof COMMAND_CHANNELS)[number];
 /**
- * Every channel `call-inputs` may take as its next segment, both kinds
+ * The one channel a tool call accepts input on. Every MCP tool call carries an
+ * arguments object and nothing else, so the tuple has one member and the kind
+ * declares no dead channels the way the transport shape would have given it
+ * three.
+ *
+ * Its own name rather than a reuse of `argument`: a command's positional
+ * argument and a tool call's named arguments object are different shapes with
+ * different declaration rules, and one name for both would make an
+ * `undeclared-mandatory-input` message ambiguous about which it meant.
+ */
+export declare const MCP_CHANNELS: readonly ['arguments'];
+export type McpChannelName = (typeof MCP_CHANNELS)[number];
+/**
+ * Every channel `call-inputs` may take as its next segment, all three kinds
  * together. A pointer is parsed with no contract in hand, so the grammar
- * admits all eight and the question of which four a given operation may use is
+ * admits all nine and the question of which a given operation may use is
  * answered by reachability, which has the operation.
  */
-export declare const INPUT_CHANNELS: readonly ["path", "query", "header", "body", "argument", "option", "environment", "stdin"];
+export declare const INPUT_CHANNELS: readonly ["path", "query", "header", "body", "argument", "option", "environment", "stdin", "arguments"];
 export type InputChannelName = (typeof INPUT_CHANNELS)[number];
 export declare const TAIL_BEARING_CHANNELS: readonly ["response-body", "response-headers", "stdout", "stderr"];
 export declare const SCALAR_CHANNELS: readonly ["response-status", "exit-code"];
-export declare const TRANSPORT_ROOTED_CHANNEL: "call-inputs";
+export declare const INPUT_ROOTED_CHANNEL: "call-inputs";
 export declare const IDENTIFIER_ROOTED_CHANNEL: "artifact";
 /**
- * The response-side channels each kind produces, and neither produces the
- * other's. Declared here rather than rebuilt from a description, so a channel
- * added to the vocabulary has to be assigned to a side and a test can assert
- * the two partition the response side exactly.
+ * The response-side channels an interface that speaks HTTP produces and the
+ * ones a command produces, and neither produces the other's. A tool call fills
+ * a strict subset of the first. Declared here rather than rebuilt from a
+ * description, so a channel added to the vocabulary has to be assigned to a
+ * side and a test can assert the two partition the response side exactly.
  *
  * `call-inputs` belongs to neither: it carries what was sent rather than what
- * came back, and both kinds have it.
+ * came back, and every kind has it.
  */
 export declare const API_RESPONSE_CHANNELS: readonly ["response-body", "response-headers", "response-status"];
 export declare const COMMAND_RESPONSE_CHANNELS: readonly ["stdout", "stderr", "exit-code", "artifact"];

package/dist/core/schemas/pointer.js

@@ -30,7 +30,7 @@ export const EvidenceChannel = z.enum(EVIDENCE_CHANNELS).meta({
 export const TRANSPORT_CHANNELS = ['path', 'query', 'header', 'body'];
 export const TransportChannel = z.enum(TRANSPORT_CHANNELS).meta({
     id: 'TransportChannel',
-    description: "AD-19's four transport channels. They are the segment `call-inputs` takes before its tail, and the four keys an observation's recorded call inputs are keyed by.",
+    description: "AD-19's four transport channels. They are four of the segments `call-inputs` takes before its tail, and four of the keys an observation's recorded call inputs are keyed by; `INPUT_CHANNELS` is the whole set.",
 });
 /**
  * The four channels a command-kind operation accepts input on. They sit beside
@@ -49,14 +49,27 @@ export const COMMAND_CHANNELS = [
     'stdin',
 ];
 /**
- * Every channel `call-inputs` may take as its next segment, both kinds
+ * The one channel a tool call accepts input on. Every MCP tool call carries an
+ * arguments object and nothing else, so the tuple has one member and the kind
+ * declares no dead channels the way the transport shape would have given it
+ * three.
+ *
+ * Its own name rather than a reuse of `argument`: a command's positional
+ * argument and a tool call's named arguments object are different shapes with
+ * different declaration rules, and one name for both would make an
+ * `undeclared-mandatory-input` message ambiguous about which it meant.
+ */
+export const MCP_CHANNELS = ['arguments'];
+/**
+ * Every channel `call-inputs` may take as its next segment, all three kinds
  * together. A pointer is parsed with no contract in hand, so the grammar
- * admits all eight and the question of which four a given operation may use is
+ * admits all nine and the question of which a given operation may use is
  * answered by reachability, which has the operation.
  */
 export const INPUT_CHANNELS = [
     ...TRANSPORT_CHANNELS,
     ...COMMAND_CHANNELS,
+    ...MCP_CHANNELS,
 ];
 // The four-way partition (tail-bearing, scalar, transport-rooted,
 // identifier-rooted) is spelled out and typed against the enum rather than
@@ -73,7 +86,7 @@ export const SCALAR_CHANNELS = [
     'response-status',
     'exit-code',
 ];
-export const TRANSPORT_ROOTED_CHANNEL = 'call-inputs';
+export const INPUT_ROOTED_CHANNEL = 'call-inputs';
 // A fourth class rather than a fourth rule. AD-26's repair for `call-inputs`
 // is that "a channel that names one of several things needs a declared segment
 // to resolve against", and a written file is the same situation: an operation
@@ -85,13 +98,14 @@ export const TRANSPORT_ROOTED_CHANNEL = 'call-inputs';
 // rather than evidence that resolves absent.
 export const IDENTIFIER_ROOTED_CHANNEL = 'artifact';
 /**
- * The response-side channels each kind produces, and neither produces the
- * other's. Declared here rather than rebuilt from a description, so a channel
- * added to the vocabulary has to be assigned to a side and a test can assert
- * the two partition the response side exactly.
+ * The response-side channels an interface that speaks HTTP produces and the
+ * ones a command produces, and neither produces the other's. A tool call fills
+ * a strict subset of the first. Declared here rather than rebuilt from a
+ * description, so a channel added to the vocabulary has to be assigned to a
+ * side and a test can assert the two partition the response side exactly.
  *
  * `call-inputs` belongs to neither: it carries what was sent rather than what
- * came back, and both kinds have it.
+ * came back, and every kind has it.
  */
 export const API_RESPONSE_CHANNELS = [
     'response-body',
@@ -134,7 +148,7 @@ export const RESPONSE_SIDE_CHANNELS = [
 const TOKEN = '(?:[^/~]|~[01])*';
 const TAIL = `(?:/${TOKEN})*`;
 const alternation = (members) => members.join('|');
-export const INTERACTION_POINTER_PATTERN = new RegExp(`^/interactions/${IDENTIFIER_CHARSET_SOURCE}/(?:(?:${alternation(TAIL_BEARING_CHANNELS)})${TAIL}|(?:${alternation(SCALAR_CHANNELS)})|${TRANSPORT_ROOTED_CHANNEL}/(?:${alternation(INPUT_CHANNELS)})${TAIL}|${IDENTIFIER_ROOTED_CHANNEL}/${IDENTIFIER_CHARSET_SOURCE}${TAIL})$`);
+export const INTERACTION_POINTER_PATTERN = new RegExp(`^/interactions/${IDENTIFIER_CHARSET_SOURCE}/(?:(?:${alternation(TAIL_BEARING_CHANNELS)})${TAIL}|(?:${alternation(SCALAR_CHANNELS)})|${INPUT_ROOTED_CHANNEL}/(?:${alternation(INPUT_CHANNELS)})${TAIL}|${IDENTIFIER_ROOTED_CHANNEL}/${IDENTIFIER_CHARSET_SOURCE}${TAIL})$`);
 export const BOUND_ELEMENT_POINTER_PATTERN = new RegExp(`^@(?:/${TOKEN})+$`);
 export const DESCRIPTOR_POINTER_PATTERN = new RegExp(`^(?:/${TOKEN})*$`);
 /**
@@ -144,7 +158,7 @@ export const DESCRIPTOR_POINTER_PATTERN = new RegExp(`^(?:/${TOKEN})*$`);
 export const InteractionPointer = z
     .string()
     .regex(INTERACTION_POINTER_PATTERN)
-    .describe('AD-26 interaction-rooted pointer: "/interactions/{stepId}/" followed by one channel of the closed vocabulary. `call-inputs` takes one input channel as its next segment, one of the four transport channels or one of the four command channels; `artifact` takes the identifier of a file the operation declares it writes; `response-status` and `exit-code` take no tail. Syntax only: whether the step exists and whether the evidence is reachable are compile-time checks, not schema checks.');
+    .describe('AD-26 interaction-rooted pointer: "/interactions/{stepId}/" followed by one channel of the closed vocabulary. `call-inputs` takes one input channel as its next segment, one of the four transport channels, one of the four command channels, or the `arguments` channel a tool call accepts; `artifact` takes the identifier of a file the operation declares it writes; `response-status` and `exit-code` take no tail. Syntax only: whether the step exists and whether the evidence is reachable are compile-time checks, not schema checks.');
 /**
  * Spelling 2, bound-element relative. Consumer: a `{ pointer }` operand inside
  * a quantifier predicate. Never an evidence target, because AD-3 computes

package/dist/core/schemas/port-messages.d.ts

@@ -97,6 +97,31 @@ export declare const CommandProbeRequest: z.ZodObject<{
         }, z.core.$strict>], "kind">;
     }, z.core.$strict>;
 }, z.core.$strict>;
+/**
+ * A request to call one tool on an MCP server.
+ *
+ * AD-35 again: `toolName` is the name the server publishes for the tool, and
+ * which server that is comes from the adapter's mapping of `interfaceId`,
+ * outside the contract. No transport URL, no command, no process.
+ *
+ * One channel. A tool call carries an arguments object, which is what
+ * `McpRequestShape` declares, so the request carries the same one channel the
+ * operation could declare keys in.
+ *
+ * `arguments` holds declared JSON values and carries no credential, for the
+ * reason AD-18 gives: authorization material is the adapter's, supplied by the
+ * same mapping that authorizes the target.
+ */
+export declare const McpProbeRequest: z.ZodObject<{
+    probeId: z.ZodString;
+    interfaceId: z.ZodString;
+    operationId: z.ZodString;
+    kind: z.ZodLiteral<"mcp">;
+    toolName: z.ZodString;
+    channels: z.ZodObject<{
+        arguments: z.ZodRecord<z.ZodString, z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
 export declare const ProbeRequest: z.ZodDiscriminatedUnion<[z.ZodObject<{
     probeId: z.ZodString;
     interfaceId: z.ZodString;
@@ -144,6 +169,15 @@ export declare const ProbeRequest: z.ZodDiscriminatedUnion<[z.ZodObject<{
             kind: z.ZodLiteral<"absent">;
         }, z.core.$strict>], "kind">;
     }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    probeId: z.ZodString;
+    interfaceId: z.ZodString;
+    operationId: z.ZodString;
+    kind: z.ZodLiteral<"mcp">;
+    toolName: z.ZodString;
+    channels: z.ZodObject<{
+        arguments: z.ZodRecord<z.ZodString, z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>>;
+    }, z.core.$strict>;
 }, z.core.$strict>], "kind">;
 /**
  * What the adapter observed. Deliberately response content only: no elapsed
@@ -221,6 +255,36 @@ export declare const CommandProbeObservation: z.ZodObject<{
         kind: z.ZodLiteral<"absent">;
     }, z.core.$strict>], "kind">>;
 }, z.core.$strict>;
+/**
+ * What the adapter observed of one tool call: the envelope's error flag and the
+ * structured result.
+ *
+ * `isError` is the tool's own report that the call did not go through, and it
+ * is an observation exactly as a 500 and a non-zero exit are. A JSON-RPC error
+ * answering `tools/call` lands here too, with the error object as `result`: the
+ * server answered, and a server refusing a tool the contract declares is
+ * precisely the defect an oracle should be able to assert on. Only a policy
+ * denial, a cap, an abort, or a failure to establish the session throws.
+ *
+ * `result` is the structured content the tool returned, which is the channel
+ * the operation's response descriptor describes.
+ */
+export declare const McpProbeObservation: z.ZodObject<{
+    probeId: z.ZodString;
+    interfaceId: z.ZodString;
+    operationId: z.ZodString;
+    kind: z.ZodLiteral<"mcp">;
+    isError: z.ZodBoolean;
+    result: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"json">;
+        value: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"text">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"absent">;
+    }, z.core.$strict>], "kind">;
+}, z.core.$strict>;
 export declare const ProbeObservation: z.ZodDiscriminatedUnion<[z.ZodObject<{
     probeId: z.ZodString;
     interfaceId: z.ZodString;
@@ -270,6 +334,21 @@ export declare const ProbeObservation: z.ZodDiscriminatedUnion<[z.ZodObject<{
     }, z.core.$strict>, z.ZodObject<{
         kind: z.ZodLiteral<"absent">;
     }, z.core.$strict>], "kind">>;
+}, z.core.$strict>, z.ZodObject<{
+    probeId: z.ZodString;
+    interfaceId: z.ZodString;
+    operationId: z.ZodString;
+    kind: z.ZodLiteral<"mcp">;
+    isError: z.ZodBoolean;
+    result: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"json">;
+        value: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"text">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"absent">;
+    }, z.core.$strict>], "kind">;
 }, z.core.$strict>], "kind">;
 export type CorpusResolveRequest = z.infer<typeof CorpusResolveRequest>;
 export type CorpusResolveResponse = z.infer<typeof CorpusResolveResponse>;
@@ -281,7 +360,9 @@ export type FileWriteRequest = z.infer<typeof FileWriteRequest>;
 export type FileWriteResponse = z.infer<typeof FileWriteResponse>;
 export type ApiProbeRequest = z.infer<typeof ApiProbeRequest>;
 export type CommandProbeRequest = z.infer<typeof CommandProbeRequest>;
+export type McpProbeRequest = z.infer<typeof McpProbeRequest>;
 export type ProbeRequest = z.infer<typeof ProbeRequest>;
 export type ApiProbeObservation = z.infer<typeof ApiProbeObservation>;
 export type CommandProbeObservation = z.infer<typeof CommandProbeObservation>;
+export type McpProbeObservation = z.infer<typeof McpProbeObservation>;
 export type ProbeObservation = z.infer<typeof ProbeObservation>;

package/dist/core/schemas/port-messages.js

@@ -1,7 +1,7 @@
 /** the request and response shape of every AD-28 port method. */
 import { z } from 'zod';
 import { HttpMethod, PathTemplate } from './interface.js';
-import { Identifier, JsonValue, KeyName, Rfc3339Utc } from './primitives.js';
+import { EnvironmentKeyName, Identifier, JsonValue, KeyName, Rfc3339Utc, ToolName, } from './primitives.js';
 import { ProbeObservedBody, ProbeRequestBody, ProbeRequestStdin, } from './probe-body.js';
 export { ProbeObservedBody, ProbeRequestBody } from './probe-body.js';
 // AD-8: the corpus port resolves an opaque reference to bytes from a
@@ -100,14 +100,38 @@ export const CommandProbeRequest = z.strictObject({
         argument: z.record(KeyName, JsonValue),
         option: z.record(KeyName, JsonValue),
         environment: z
-            .record(KeyName, z.string())
-            .describe('String-valued because an environment variable is a string to the process; the other channels carry the declared JSON value.'),
+            .record(EnvironmentKeyName, z.string())
+            .describe('String-valued because an environment variable is a string to the process; the other channels carry the declared JSON value. Keyed more narrowly than the other channels: this one becomes real variables on a real process, where `A=B` as a key would smuggle a second assignment past anyone reading the mapping.'),
         stdin: ProbeRequestStdin,
     }),
 });
+/**
+ * A request to call one tool on an MCP server.
+ *
+ * AD-35 again: `toolName` is the name the server publishes for the tool, and
+ * which server that is comes from the adapter's mapping of `interfaceId`,
+ * outside the contract. No transport URL, no command, no process.
+ *
+ * One channel. A tool call carries an arguments object, which is what
+ * `McpRequestShape` declares, so the request carries the same one channel the
+ * operation could declare keys in.
+ *
+ * `arguments` holds declared JSON values and carries no credential, for the
+ * reason AD-18 gives: authorization material is the adapter's, supplied by the
+ * same mapping that authorizes the target.
+ */
+export const McpProbeRequest = z.strictObject({
+    ...probeCorrelation,
+    kind: z.literal('mcp'),
+    toolName: ToolName.describe("The tool the adapter calls, in the server's own spelling (AD-35). Which server publishes it is the adapter's mapping of `interfaceId`, from configuration outside the contract."),
+    channels: z.strictObject({
+        arguments: z.record(KeyName, JsonValue),
+    }),
+});
 export const ProbeRequest = z.discriminatedUnion('kind', [
     ApiProbeRequest,
     CommandProbeRequest,
+    McpProbeRequest,
 ]);
 /**
  * What the adapter observed. Deliberately response content only: no elapsed
@@ -151,7 +175,30 @@ export const CommandProbeObservation = z.strictObject({
     stderr: ProbeObservedBody,
     artifacts: z.record(Identifier, ProbeObservedBody),
 });
+/**
+ * What the adapter observed of one tool call: the envelope's error flag and the
+ * structured result.
+ *
+ * `isError` is the tool's own report that the call did not go through, and it
+ * is an observation exactly as a 500 and a non-zero exit are. A JSON-RPC error
+ * answering `tools/call` lands here too, with the error object as `result`: the
+ * server answered, and a server refusing a tool the contract declares is
+ * precisely the defect an oracle should be able to assert on. Only a policy
+ * denial, a cap, an abort, or a failure to establish the session throws.
+ *
+ * `result` is the structured content the tool returned, which is the channel
+ * the operation's response descriptor describes.
+ */
+export const McpProbeObservation = z.strictObject({
+    ...probeCorrelation,
+    kind: z.literal('mcp'),
+    isError: z
+        .boolean()
+        .describe("The MCP envelope's own error flag, true when the tool reported the call failed. Sealed evidence carries it as `responseStatus` 1 for true and 0 for false, since a tool call has no transport status of its own."),
+    result: ProbeObservedBody,
+});
 export const ProbeObservation = z.discriminatedUnion('kind', [
     ApiProbeObservation,
     CommandProbeObservation,
+    McpProbeObservation,
 ]);

package/dist/core/schemas/primitives.d.ts

@@ -4,6 +4,8 @@ export declare const IDENTIFIER_PATTERN: RegExp;
 /** the charset spelling 1 embeds; exported so pointer.ts never re-spells it. */
 export declare const IDENTIFIER_CHARSET_SOURCE = "[a-z0-9]+(?:-[a-z0-9]+)*";
 export declare const Identifier: z.ZodString;
+export declare const TOOL_NAME_PATTERN: RegExp;
+export declare const ToolName: z.ZodString;
 export declare const BEHAVIOR_ID_PATTERN: RegExp;
 export declare const ORACLE_ID_PATTERN: RegExp;
 export declare const PROBE_ID_PATTERN: RegExp;
@@ -39,6 +41,22 @@ export declare const JsonTypeName: z.ZodEnum<{
     string: "string";
 }>;
 export declare const KeyName: z.ZodString;
+/**
+ * An environment variable name, at the port boundary where one becomes a real
+ * variable on a real process. `KeyName` is plain text, and a plain-text key is
+ * a smuggling channel here: `A=B` reaches the child as a variable `A` whose
+ * value carries `B=` in front of the declared one, and a key holding a NUL
+ * fails the spawn itself. The charset is the portable one, which is what a
+ * caller reading a mapping's allowlist assumes it is reading.
+ *
+ * This keys the port message, which every request crosses, and the
+ * authorization allowlist, which only a caller who parses their own mapping
+ * crosses: nothing in this package parses `CommandTargetPolicy`. The contract
+ * side keeps `KeyName`, since AD-19's channel shapes are one grammar across
+ * every channel, so a contract declaring a malformed environment key compiles
+ * and fails at this boundary with `schema-parse-failure`.
+ */
+export declare const EnvironmentKeyName: z.ZodString;
 export type JsonValue = string | number | boolean | null | JsonValue[] | {
     [key: string]: JsonValue;
 };