imprint-mcp 0.6.5 → 0.6.6

package/src/imprint/audit.ts

@@ -21,6 +21,7 @@ import {
   type AuthVerificationReceiptStatus,
   readAuthVerificationReceiptStatus,
 } from './auth-compile-tools.ts';
+import { workflowHasIrreversibleEffect } from './effects.ts';
 import { type ProviderName, preferredAgentModel } from './llm.ts';
 import { createLog } from './log.ts';
 import { imprintHomeDir } from './paths.ts';
@@ -129,6 +130,7 @@ interface AuditToolPartition {
   eligible: ResolvedTool[];
   nonInteractiveAuthNames: string[];
   skippedInteractiveAuth: SkippedInteractiveAuth[];
+  skippedIrreversible: string[];
 }
 
 interface DetectedButUnemittedTool {
@@ -185,8 +187,13 @@ export function partitionAuditTools(tools: readonly ResolvedTool[]): AuditToolPa
   const eligible: ResolvedTool[] = [];
   const nonInteractiveAuthNames: string[] = [];
   const skippedInteractiveAuth: SkippedInteractiveAuth[] = [];
+  const skippedIrreversible: string[] = [];
 
   for (const tool of tools) {
+    if (workflowHasIrreversibleEffect(tool.workflow)) {
+      skippedIrreversible.push(tool.workflow.toolName);
+      continue;
+    }
     // authConfig is the authoritative capability marker for legacy workflows
     // where the newer optional toolKind field may be absent.
     const auth = tool.workflow.authConfig;
@@ -229,7 +236,7 @@ export function partitionAuditTools(tools: readonly ResolvedTool[]): AuditToolPa
     });
   }
 
-  return { eligible, nonInteractiveAuthNames, skippedInteractiveAuth };
+  return { eligible, nonInteractiveAuthNames, skippedInteractiveAuth, skippedIrreversible };
 }
 
 /**
@@ -566,6 +573,7 @@ export async function runAudit(opts: RunAuditOptions): Promise<AuditScore> {
         eligible: tools,
         nonInteractiveAuthNames,
         skippedInteractiveAuth,
+        skippedIrreversible,
       } = partitionAuditTools(discoveredTools);
       const auditedToolCount = tools.length;
       const detectedButUnemitted = detectedButUnemittedTools(
@@ -603,6 +611,9 @@ export async function runAudit(opts: RunAuditOptions): Promise<AuditScore> {
           `skipping interactive auth ${skipped.name}: ${skipped.reason}; receipt=${skipped.verificationStatus}`,
         );
       }
+      for (const name of skippedIrreversible) {
+        log(`skipping irreversible workflow ${name}: live audit is intentionally disabled`);
+      }
 
       // Parameters that shipped live-unverified at compile time (Fix D). Tell the
       // auditor to probe them especially — these are the most likely to be broken
@@ -648,7 +659,7 @@ export async function runAudit(opts: RunAuditOptions): Promise<AuditScore> {
               tokenDeps,
             });
       if (auditedToolCount === 0) {
-        log('all discovered tools require human-interactive authentication; auditor not spawned');
+        log('all discovered tools are excluded from live audit; auditor not spawned');
       }
       recordLlmUsageSpan(
         'audit.llm_usage',
@@ -747,6 +758,7 @@ export async function runAudit(opts: RunAuditOptions): Promise<AuditScore> {
         'imprint.audit.detected_tool_count': detectedToolCount,
         'imprint.audit.detected_but_unemitted_count': detectedButUnemitted.length,
         'imprint.audit.skipped_interactive_auth_count': skippedInteractiveAuth.length,
+        'imprint.audit.skipped_irreversible_count': skippedIrreversible.length,
         'imprint.audit.verdict': score.verdict,
         'imprint.audit.unverified_and_ungradeable_count': unverifiedAndUngradeable.length,
         'imprint.audit.missing_tool_count': missingToolNames.length,
@@ -766,6 +778,7 @@ export async function runAudit(opts: RunAuditOptions): Promise<AuditScore> {
         detectedToolCount,
         detectedButUnemittedTools: detectedButUnemitted,
         skippedInteractiveAuth,
+        skippedIrreversible,
         ungradeableTools: ungradeableNames,
         /** Connected tools without an invocation record. A partial audit
          *  cannot pass merely because the auditor named an uncalled tool. */
@@ -808,6 +821,7 @@ export async function runAudit(opts: RunAuditOptions): Promise<AuditScore> {
           report: drive.report,
           auditedToolCount,
           skippedInteractiveAuth,
+          skippedIrreversible,
           detectedToolCount,
           detectedButUnemittedTools: detectedButUnemitted,
         });
@@ -1124,19 +1138,19 @@ export function buildUnverifiedParamNote(
     .map((u) => `${u.tool}(${u.params.join(', ')})`)
     .join(
       '; ',
-    )}. Give each one a \`parameters\` verdict (works / no_op / broken / untestable) like any other — do not let an unverified parameter pass without a differential test. Only skip probing when the tool is genuinely state-changing / irreversible, or when repeated paced attempts for that parameter stay blocked by infrastructure. A bot-defended idempotent read is still testable after the warm browser session is established.`;
+    )}. Give each one a \`parameters\` verdict (works / no_op / broken / untestable) like any other — do not let an unverified parameter pass without a differential test. Only skip probing when the connected tool is state-changing, or when repeated paced attempts for that parameter stay blocked by infrastructure. Irreversible tools are excluded before this prompt is built. A bot-defended idempotent read is still testable after the warm browser session is established.`;
 }
 
 export function buildAuditInitialPrompt(opts: DriveAuditOptions, unverifiedNote: string): string {
   const nonInteractiveAuthNames = opts.nonInteractiveAuthNames ?? [];
   const authNote = nonInteractiveAuthNames.length
-    ? `\n\nThe following authentication tool(s) are eligible because every action completes without a human pause: ${nonInteractiveAuthNames.join(', ')}. Call each exactly once with one safe baseline. Never differentially probe or retry authentication actions. If any DATA tool returns AUTH_EXPIRED, classify that invocation as infra/inconclusive evidence; do not call an authentication tool in response.`
+    ? `\n\nEligible unattended authentication tool(s): ${nonInteractiveAuthNames.join(', ')}. Apply the unattended authentication rules only to these tools, with at most one recovery authentication call total across this audit.`
     : '\n\nNo authentication tool is eligible in this audit. If a DATA tool returns AUTH_EXPIRED, classify that invocation as infra/inconclusive evidence; do not attempt to authenticate.';
   return `Audit every MCP tool connected to you for the site "${opts.site}".
 
 There are ${opts.toolNames.length} connected tool(s). For each one: read its description and input schema, invoke it with a realistic parameter set, judge the result, and classify each invocation as correct | tool_broken | infra | bad_params per your system prompt.
 
-Parameter coverage is mandatory for idempotent read tools. A cold cdp-replay/browser-backed first call may be slow because it launches or warms a trusted browser session, but later calls usually reuse that warm session and are much cheaper. Do NOT use the first call's cold-start latency as a reason to skip parameter probes. For search/list/calendar/lookup/quote/read tools, keep making paced sequential differential calls until each advertised parameter has a verdict, unless the same parameter remains blocked by infrastructure after repeated paced retries. For genuinely state-changing or irreversible tools (book/pay/send/cancel/delete/order), make only the safe baseline call and mark parameters untestable with that state-changing reason.
+Parameter coverage is mandatory for idempotent read tools. A cold cdp-replay/browser-backed first call may be slow because it launches or warms a trusted browser session, but later calls usually reuse that warm session and are much cheaper. Do NOT use the first call's cold-start latency as a reason to skip parameter probes. For search/list/calendar/lookup/quote/read tools, keep making paced sequential differential calls until each advertised parameter has a verdict, unless the same parameter remains blocked by infrastructure after repeated paced retries. For connected state-changing but reversible tools, make only one safe baseline call and mark parameters untestable with that state-changing reason. Irreversible workflows are never connected to this audit.
 
 Promo/coupon/voucher/discount-code parameters require a known valid code to prove a visible effect. If neither the schema nor another tool output gives you a valid code, classify that parameter as untestable; do not invent a random code and call an unchanged response no_op.
 
@@ -1592,6 +1606,7 @@ function printSummary(
     report: AuditReport;
     auditedToolCount: number;
     skippedInteractiveAuth: SkippedInteractiveAuth[];
+    skippedIrreversible: string[];
     detectedToolCount: number;
     detectedButUnemittedTools: DetectedButUnemittedTool[];
   },
@@ -1614,6 +1629,9 @@ function printSummary(
       `[imprint]   skipped interactive auth ${skipped.name} — ${skipped.reason}; verification receipt: ${skipped.verificationStatus}`,
     );
   }
+  for (const name of extra.skippedIrreversible) {
+    console.log(`[imprint]   skipped irreversible workflow ${name} — live audit disabled`);
+  }
   if (extra.detectedButUnemittedTools.length > 0) {
     console.log(
       `[imprint]   ${extra.detectedButUnemittedTools.length}/${extra.detectedToolCount} detected tool(s) were not emitted and are excluded from scoring: ${extra.detectedButUnemittedTools.map((tool) => tool.name).join(', ')}`,

package/src/imprint/auth-compile-agent.ts

@@ -27,6 +27,7 @@ import {
   AUTH_COMPILE_TOOL_NAMES,
   AUTH_VERIFICATION_ATTEMPT_SENTINEL,
   authExternalVerification,
+  authLivePreflightFailures,
   authWorkflowHash,
   authWorkflowPreflightFailures,
   buildAuthCompileTools,
@@ -85,20 +86,21 @@ function buildAuthInitialMessage(opts: {
   authToolPlan: NonNullable<AuthToolPlan>;
 }): string {
   const { site, toolName, toolDir, authToolPlan } = opts;
-  const headerCaptures = (authToolPlan.captures ?? []).filter((c) => {
+  const durableCaptures = (authToolPlan.captures ?? []).filter((c) => {
     const u = (c.usedAs ?? '').toLowerCase();
-    // Cookies persist automatically — only surface NON-cookie header contracts.
-    return u.startsWith('header:') && u !== 'header:cookie' && u !== 'header:set-cookie';
+    // Cookies persist automatically. Every other downstream transport needs a
+    // durable credential contract, including JSON/form body fields.
+    return u.length > 0 && u !== 'header:cookie' && u !== 'header:set-cookie';
   });
   const durableCaptureNote =
-    headerCaptures.length > 0
-      ? `\n- durable credential contracts (data tools consume these as \${credential.<name>}): ${headerCaptures
+    durableCaptures.length > 0
+      ? `\n- durable credential contracts (data tools consume these as \${credential.<name>}): ${durableCaptures
           .map(
             (c) => `${c.name} (used as ${c.usedAs}; seed source ${c.source}, locator ${c.locator})`,
           )
           .join(
             '; ',
-          )}\n  → Capture each value on the recording-grounded producing request and include its name in authConfig.persist. The seed source/locator is only a hint.`
+          )}\n  → These names are downstream credential interface names, not required internal capture names. Capture each value on the recording-grounded producing request and include the interface name in authConfig.persist. If you choose a different capture name, declare authConfig.persistBindings[interfaceName] = captureName. The seed source/locator is only a hint.`
       : '';
   return `A new auth compile task is starting.
 
@@ -456,10 +458,12 @@ async function runAuthSegmentLoop(opts: AuthSegmentLoopOptions): Promise<Compile
       const checkpointStartedAt = Date.now();
       try {
         if (cp.kind === 'run_verification') {
-          const preflightFailures = authWorkflowPreflightFailures(
+          const preflightFailures = await authLivePreflightFailures(
             opts.toolDir,
             opts.session,
             opts.authToolPlan.credentialNames,
+            [...opts.authToolPlan.credentialRequestSeqs, ...opts.authToolPlan.authRequestSeqs],
+            opts.sessionPath,
           );
           if (Date.now() >= activeDeadlineMs) {
             resultMsg =

package/src/imprint/auth-compile-tools.ts

@@ -10,17 +10,21 @@ import { join as pathJoin } from 'node:path';
 import type { AgentTool } from './agent.ts';
 import {
   type CompileToolContext,
+  bodyEncodingContractFailures,
   buildReadFileTool,
   buildReadRequestTool,
   buildReadResponseBodyTool,
   buildReadSessionSummaryTool,
-  buildRunBashTool,
+  buildRunTestsTool,
   buildSearchRequestsTool,
   buildWriteFileTool,
+  irreversibleProvenanceFailures,
+  requestEncodingTestContractFailures,
 } from './compile-tools.ts';
+import { isIrreversibleRequest, workflowHasIrreversibleEffect } from './effects.ts';
 import { recordedRequestMatchesWorkflow } from './recording-request.ts';
-import { captureHeader, captureValueMatches, jsonpath } from './request-capture.ts';
-import { type Session, type Workflow, WorkflowSchema } from './types.ts';
+import { captureHeader, captureValueMatches, resolveJsonCapture } from './request-capture.ts';
+import { type Session, type Workflow, WorkflowSchema, persistedCaptureName } from './types.ts';
 
 type TeachCredentials = { site: string; values: Record<string, string> };
 
@@ -40,7 +44,7 @@ export const AUTH_COMPILE_TOOL_NAMES = [
   'read_response_body',
   'write_file',
   'read_file',
-  'run_bash',
+  'run_tests',
   'run_verification',
   'inspect_verification_page',
   'prompt_user',
@@ -50,7 +54,7 @@ export const AUTH_COMPILE_TOOL_NAMES = [
 export function buildAuthCompileTools(
   session: Session,
   toolDir: string,
-  _sessionPath: string,
+  sessionPath: string,
   teachCredentials: TeachCredentials,
 ): AgentTool[] {
   const context: CompileToolContext = { teachCredentials };
@@ -61,7 +65,19 @@ export function buildAuthCompileTools(
     buildReadResponseBodyTool(session),
     buildWriteFileTool(toolDir),
     buildReadFileTool(toolDir),
-    buildRunBashTool(toolDir),
+    buildRunTestsTool(
+      toolDir,
+      sessionPath,
+      {
+        // Auth request/capture tests are offline and use synthetic credentials.
+        // Explicitly mask any inherited teach payload so agent-authored test
+        // output cannot expose real credentials to the compile model.
+        IMPRINT_TEACH_CREDENTIALS: '',
+      },
+      {
+        networkDisabled: session.requests.some(isIrreversibleRequest),
+      },
+    ),
   ];
 }
 
@@ -75,9 +91,57 @@ export function authWorkflowPreflightFailures(
   return parseWorkflow(workflowPath, requiredCredentialNames, session).failures;
 }
 
+export async function authLivePreflightFailures(
+  toolDir: string,
+  session?: Session,
+  requiredCredentialNames: readonly string[] = [],
+  authRequestSeqs: readonly number[] = [],
+  sessionPath = '',
+): Promise<string[]> {
+  const failures = authWorkflowPreflightFailures(toolDir, session, requiredCredentialNames);
+  if (failures.length > 0) return failures;
+  const parsed = parseWorkflow(
+    pathJoin(toolDir, 'workflow.json'),
+    requiredCredentialNames,
+    session,
+  );
+  if (!parsed.workflow) return parsed.failures;
+  const requestTestPath = pathJoin(toolDir, 'request.test.ts');
+  failures.push(
+    ...bodyEncodingContractFailures(parsed.workflow),
+    ...requestEncodingTestContractFailures(
+      parsed.workflow,
+      existsSync(requestTestPath) ? readFileSync(requestTestPath, 'utf8') : undefined,
+    ),
+    ...persistedCaptureTestContractFailures(
+      parsed.workflow,
+      existsSync(requestTestPath) ? readFileSync(requestTestPath, 'utf8') : undefined,
+    ),
+  );
+  if (session) {
+    failures.push(
+      ...irreversibleProvenanceFailures(session, parsed.workflow, {
+        candidateRequestSeqs: [...authRequestSeqs],
+      }),
+    );
+  }
+  if (workflowHasIrreversibleEffect(parsed.workflow)) {
+    failures.push('auth live verification is disabled for workflows with irreversible requests');
+  }
+  if (failures.length === 0 && existsSync(requestTestPath)) {
+    const testResult = await buildRunTestsTool(toolDir, sessionPath, undefined, {
+      networkDisabled: workflowHasIrreversibleEffect(parsed.workflow),
+    }).handler({});
+    if (testResult.isError) {
+      failures.push(`agent-authored request tests failed: ${testResult.result}`);
+    }
+  }
+  return failures;
+}
+
 export function authExternalVerification(
   toolDir: string,
-  requiredSessionCaptures: Array<{ name: string; usedAs?: string }> = [],
+  requiredDurableCredentials: Array<{ name: string; usedAs?: string }> = [],
   options: { requireLiveAttempt?: boolean; requiredCredentialNames?: readonly string[] } = {},
 ): string[] {
   const workflowPath = pathJoin(toolDir, 'workflow.json');
@@ -87,12 +151,27 @@ export function authExternalVerification(
   if (!parsed.workflow) return parsed.failures;
   const failures = [...parsed.failures];
   const workflow = parsed.workflow;
+  failures.push(...bodyEncodingContractFailures(workflow));
+  failures.push(
+    ...requestEncodingTestContractFailures(
+      workflow,
+      existsSync(pathJoin(toolDir, 'request.test.ts'))
+        ? readFileSync(pathJoin(toolDir, 'request.test.ts'), 'utf8')
+        : undefined,
+    ),
+    ...persistedCaptureTestContractFailures(
+      workflow,
+      existsSync(pathJoin(toolDir, 'request.test.ts'))
+        ? readFileSync(pathJoin(toolDir, 'request.test.ts'), 'utf8')
+        : undefined,
+    ),
+  );
   const persisted = new Set(workflow.authConfig?.persist ?? []);
 
-  const missingContracts = requiredSessionCaptures.filter((capture) => {
+  const missingContracts = requiredDurableCredentials.filter((capture) => {
     const target = (capture.usedAs ?? '').toLowerCase();
     return (
-      target.startsWith('header:') &&
+      target.length > 0 &&
       target !== 'header:cookie' &&
       target !== 'header:set-cookie' &&
       !persisted.has(capture.name)
@@ -100,7 +179,7 @@ export function authExternalVerification(
   });
   if (missingContracts.length > 0) {
     failures.push(
-      `authConfig.persist must include downstream credential capture(s): ${missingContracts
+      `authConfig.persist must include downstream credential interface(s): ${missingContracts
         .map((capture) => capture.name)
         .join(', ')}`,
     );
@@ -112,6 +191,25 @@ export function authExternalVerification(
   return failures;
 }
 
+function persistedCaptureTestContractFailures(
+  workflow: Workflow,
+  source: string | undefined,
+): string[] {
+  const persisted = workflow.authConfig?.persist ?? [];
+  if (persisted.length === 0) return [];
+  if (source === undefined) {
+    return [
+      'request.test.ts is required to prove persisted auth captures against their exact recorded response fields',
+    ];
+  }
+  return persisted
+    .filter((name) => !source.includes(`persisted-capture:${name}`))
+    .map(
+      (name) =>
+        `request.test.ts must include a passing "persisted-capture:${name}" test that independently decodes the recorded producer response and asserts the compiled capture equals that exact structured value`,
+    );
+}
+
 function parseWorkflow(
   path: string,
   requiredCredentialNames: readonly string[] = [],
@@ -274,17 +372,28 @@ function authProgramFailures(
   }
 
   if (!hasSuccess) failures.push('authConfig.actions has no success outcome');
+  const persistedCredentials = new Set(config.persist);
+  for (const credentialName of Object.keys(config.persistBindings ?? {})) {
+    if (!persistedCredentials.has(credentialName)) {
+      failures.push(
+        `authConfig.persistBindings declares unused credential ${JSON.stringify(credentialName)}`,
+      );
+    }
+  }
   for (const name of config.persist) {
-    if (!captures.has(name)) {
-      failures.push(`authConfig.persist references unknown capture ${JSON.stringify(name)}`);
+    const captureName = persistedCaptureName(config, name);
+    if (!captures.has(captureName)) {
+      failures.push(
+        `authConfig.persist credential ${JSON.stringify(name)} references unknown capture ${JSON.stringify(captureName)}`,
+      );
       continue;
     }
-    const owner = captureOwners.get(name);
+    const owner = captureOwners.get(captureName);
     if (!owner) continue;
     const { request, capture } = owner;
     if (request.recordingRequestSeq === undefined) {
       failures.push(
-        `persisted capture ${JSON.stringify(name)} must declare recordingRequestSeq on its producing request`,
+        `persisted capture ${JSON.stringify(captureName)} must declare recordingRequestSeq on its producing request`,
       );
     } else if (session) {
       const recorded = session.requests.find(
@@ -292,16 +401,16 @@ function authProgramFailures(
       );
       if (!recorded) {
         failures.push(
-          `persisted capture ${JSON.stringify(name)} references missing recorded request seq ${request.recordingRequestSeq}`,
+          `persisted capture ${JSON.stringify(captureName)} references missing recorded request seq ${request.recordingRequestSeq}`,
         );
       } else if (!recordedRequestMatchesWorkflow(recorded, request)) {
         failures.push(
-          `persisted capture ${JSON.stringify(name)} recordingRequestSeq ${request.recordingRequestSeq} does not match its workflow request`,
+          `persisted capture ${JSON.stringify(captureName)} recordingRequestSeq ${request.recordingRequestSeq} does not match its workflow request`,
         );
       } else {
         if (!recordedResponseProducesCapture(recorded, capture)) {
           failures.push(
-            `persisted capture ${JSON.stringify(name)} is not produced by recorded request seq ${request.recordingRequestSeq}`,
+            `persisted capture ${JSON.stringify(captureName)} is not produced by recorded request seq ${request.recordingRequestSeq}`,
           );
         }
       }
@@ -323,7 +432,7 @@ function recordedResponseProducesCapture(
   let value: unknown;
   if (capture.source === 'json') {
     try {
-      value = jsonpath(JSON.parse(body), capture.path);
+      value = resolveJsonCapture(JSON.parse(body), capture.path, capture.decodeJsonPath);
     } catch {
       return false;
     }

package/src/imprint/auth-verifier.ts

@@ -59,7 +59,7 @@ export class AuthVerifier {
   async runAction(
     action: string,
     parameters: Record<string, string | number | boolean> = {},
-    options: { freshSession?: boolean; cleanSession?: boolean } = {},
+    options: { freshSession?: boolean; cleanSession?: boolean; signal?: AbortSignal } = {},
   ): Promise<AuthActionResult> {
     if (options.freshSession || options.cleanSession) await this.reset();
     this.rememberSensitiveValues(parameters);
@@ -74,6 +74,7 @@ export class AuthVerifier {
       cdpPool: this.cdpPool,
       forceBackend: 'cdp-replay',
       initialState: this.continuation,
+      signal: options.signal,
     });
     const durationMs = Date.now() - startedAt;
     const result = ladder.result;

package/src/imprint/backend-ladder.ts

@@ -340,6 +340,8 @@ export async function runWithLadder(
     initialState?: Record<string, unknown>;
     /** Optional credential override used by auth verification. */
     credentials?: CredentialStore;
+    /** Caller cancellation for bounded verification work. */
+    signal?: AbortSignal;
   },
 ): Promise<LadderResult> {
   if (ladder.length === 0) {
@@ -437,6 +439,7 @@ export async function runWithLadder(
             options?.cdpPool,
             options?.initialState,
             options?.credentials,
+            options?.signal,
           );
           break;
         case 'stealth-fetch': {
@@ -1036,6 +1039,7 @@ async function runCdpReplay(
   cdpPool?: Map<string, CdpBrowserFetch>,
   callerState?: Record<string, unknown>,
   credentialOverride?: CredentialStore,
+  signal?: AbortSignal,
 ): Promise<ToolResult> {
   let baseUrl: string;
   try {
@@ -1105,6 +1109,9 @@ async function runCdpReplay(
       // declares it — never a blanket default. See AuthConfig.crossOriginCookieReinjection.
       reinjectCrossOriginCookies: tool.workflow.authConfig?.crossOriginCookieReinjection ?? false,
     });
+    // Register immediately so caller cancellation can close a browser that is
+    // still launching or minting its first jar.
+    if (cdpPool) cdpPool.set(poolKey, cf);
   }
 
   try {
@@ -1148,6 +1155,7 @@ async function runCdpReplay(
               snapshotCookies: cf.snapshotCookies.bind(cf),
             }
           : undefined,
+      signal,
     });
 
     if (result.ok) {
@@ -1597,6 +1605,8 @@ export async function runWorkflowWithLadder(opts: {
   /** Pin execution to a single rung, bypassing the parallel probe AND the winner
    *  memo. AuthVerifier pins `cdp-replay` so all actions share one browser. */
   forceBackend?: ConcreteBackend;
+  /** Caller cancellation for bounded verification work. */
+  signal?: AbortSignal;
 }): Promise<LadderResult> {
   if (!existsSync(opts.workflowPath)) {
     throw new Error(`runWorkflowWithLadder: workflow.json not found at ${opts.workflowPath}`);
@@ -1674,6 +1684,7 @@ export async function runWorkflowWithLadder(opts: {
         cdpPool,
         initialState: opts.initialState,
         credentials: opts.credentials,
+        signal: opts.signal,
       });
     }
 
@@ -1731,6 +1742,7 @@ export async function runWorkflowWithLadder(opts: {
             cdpPool,
             initialState: opts.initialState,
             credentials: opts.credentials,
+            signal: opts.signal,
           });
           const r = await settleProbeWithDeadline(inner, PROBE_TIMEOUT_MS, {
             result: { ok: false, error: 'NETWORK', message: 'probe deadline exceeded' },
@@ -1781,6 +1793,7 @@ export async function runWorkflowWithLadder(opts: {
         cdpPool,
         initialState: opts.initialState,
         credentials: opts.credentials,
+        signal: opts.signal,
       });
       if (probeReachable(seqResult.result)) {
         compileWinningBackend.set(memoKey, seqResult.usedBackend);
@@ -1804,6 +1817,7 @@ export async function runWorkflowWithLadder(opts: {
       cdpPool,
       initialState: opts.initialState,
       credentials: opts.credentials,
+      signal: opts.signal,
     });
     if (isProbeReachable(result.result)) {
       compileWinningBackend.set(memoKey, result.usedBackend);
@@ -1849,6 +1863,7 @@ export function resolveWorkflowTool(
             browser?: BrowserNavigationTransport;
             initialState?: Record<string, unknown>;
             credentials?: CredentialStore;
+            signal?: AbortSignal;
           }
         | undefined;
       return executeWorkflow({
@@ -1859,6 +1874,7 @@ export function resolveWorkflowTool(
         fetchImpl: o?.fetchImpl,
         browser: o?.browser,
         initialState: o?.initialState,
+        signal: o?.signal,
       });
     },
   };
@@ -1896,6 +1912,8 @@ export async function renderWorkflowRequests(opts: {
   params: Record<string, string | number | boolean>;
   workflowPath?: string;
   credentials?: CredentialStore;
+  /** Synthetic captured state for offline request tests. */
+  initialState?: Record<string, unknown>;
   recordedResponseFor?: (
     method: string,
     url: string,
@@ -1930,7 +1948,9 @@ export async function renderWorkflowRequests(opts: {
     params: opts.params,
     credentials: opts.credentials,
     workflowPath: opts.workflowPath,
+    initialState: opts.initialState,
     fetchImpl,
+    persistAuthState: false,
   });
   return { requests: captured, result };
 }

package/src/imprint/build-plan.ts

@@ -183,6 +183,8 @@ type DynamicValueFinding = z.infer<typeof DynamicValueFindingSchema>;
 
 const PerToolPlanSchema = z.object({
   toolName: z.string().regex(/^[a-z][a-z0-9_]*$/),
+  /** Callable prerequisite tools chosen by candidate detection. */
+  dependsOnTools: z.array(z.string().regex(/^[a-z][a-z0-9_]*$/)).default([]),
   usesSharedModules: z.array(z.string()).default([]),
   loadBearingSeqs: z.array(z.number().int().nonnegative()).default([]),
   parserGuidance: z.string().default(''),
@@ -692,6 +694,8 @@ export function topoLevelsForTools<T extends { toolName: string }>(
     (t) => {
       if (!plan) return [];
       const deps = new Set<string>();
+      const toolPlan = plan.perTool.find((candidate) => candidate.toolName === t.toolName);
+      for (const dependency of toolPlan?.dependsOnTools ?? []) deps.add(dependency);
       for (const tp of resolveTokenParams(plan, t.toolName)) deps.add(tp.sourceTool);
       // General contract edges: a producer_tool input depends on its producer; any
       // auth input depends on the authenticate tool (filtered out by kahnLevels
@@ -862,6 +866,20 @@ export function validateBuildPlan(
   const plan = BuildPlanSchema.parse(normalizeRawPlan(input));
   if (selected && selected.length > 0) {
     const names = new Set(selected.map((t) => (typeof t === 'string' ? t : t.toolName)));
+    const dependenciesByName = new Map(
+      selected.flatMap((candidate) =>
+        typeof candidate === 'string'
+          ? []
+          : [
+              [
+                candidate.toolName,
+                candidate.dependsOnTools.filter(
+                  (dependency) => names.has(dependency) && dependency !== candidate.toolName,
+                ),
+              ] as const,
+            ],
+      ),
+    );
     plan.perTool = plan.perTool.filter((t) => names.has(t.toolName));
     for (const name of names) {
       if (!plan.perTool.some((t) => t.toolName === name)) {
@@ -873,6 +891,9 @@ export function validateBuildPlan(
     if (plan.perTool.length === 0) {
       throw new Error('Build plan has no perTool entries for the selected tools.');
     }
+    for (const tool of plan.perTool) {
+      tool.dependsOnTools = dependenciesByName.get(tool.toolName) ?? [];
+    }
   }
   // Deterministic requiredInputs ordering for stable sidecar JSON.
   for (const t of plan.perTool) {

package/src/imprint/claude-cli-compile.ts

@@ -51,6 +51,7 @@ import {
   traceLlmIoEnabled,
   traced,
 } from './tracing.ts';
+import type { SharedTriageSelection } from './triage-selection.ts';
 import type { Session } from './types.ts';
 
 const log = createLog('compile-claude-cli');
@@ -127,7 +128,7 @@ interface CompileViaClaudeCliOptions {
   onProgress?: (p: CompileAgentProgress) => void;
   /** Called when wall-clock deadline is reached; return ms to extend or null to time out. */
   onDeadlineReached?: OnDeadlineReached;
-  /** Retain parser.test.ts after successful verification. Mirrors the
+  /** Retain agent-generated tests after successful verification. Mirrors the
    *  in-process loop's `keepTest`. */
   keepTest?: boolean;
   candidate?: ToolCandidate;
@@ -140,6 +141,8 @@ interface CompileViaClaudeCliOptions {
   toolPlan?: string;
   /** Revise existing generated artifacts from durable verification feedback. */
   revisionMode?: boolean;
+  /** Shared triage result for irreversible-effect propagation in the MCP server. */
+  sharedTriageSelection?: SharedTriageSelection;
   /** Present → drive an auth compile rather than a data compile. */
   authMode?: AuthCliCompileMode;
   /** Auth segments only: resume a prior segment's claude session with a new user
@@ -377,6 +380,9 @@ async function runClaudeCliAttempt(opts: CompileViaClaudeCliOptions): Promise<Co
       ...(opts.buildPlanPath ? ['--build-plan-path', opts.buildPlanPath] : []),
       ...(opts.sharedModules ? ['--shared-modules-json', JSON.stringify(opts.sharedModules)] : []),
       ...(opts.revisionMode ? ['--revision-mode'] : []),
+      ...(opts.sharedTriageSelection
+        ? ['--shared-triage-json', JSON.stringify(opts.sharedTriageSelection)]
+        : []),
     ];
     allowedToolNames = [
       'read_session_summary',

package/src/imprint/codex-cli-compile.ts

@@ -34,6 +34,7 @@ import {
   traceToolIoEnabled,
   traced,
 } from './tracing.ts';
+import type { SharedTriageSelection } from './triage-selection.ts';
 import type { Session } from './types.ts';
 
 const log = createLog('compile-codex-cli');
@@ -143,6 +144,8 @@ interface CompileViaCodexCliOptions {
   toolPlan?: string;
   /** Revise existing generated artifacts from durable verification feedback. */
   revisionMode?: boolean;
+  /** Shared triage result for irreversible-effect propagation in the MCP server. */
+  sharedTriageSelection?: SharedTriageSelection;
   /** Present → drive an auth compile rather than a data compile. */
   authMode?: AuthCliCompileMode;
   /** Auth segments only: resume the same non-interactive Codex session. */
@@ -302,6 +305,9 @@ async function compileViaCodexCliImpl(
       ...(opts.buildPlanPath ? ['--build-plan-path', opts.buildPlanPath] : []),
       ...(opts.sharedModules ? ['--shared-modules-json', JSON.stringify(opts.sharedModules)] : []),
       ...(opts.revisionMode ? ['--revision-mode'] : []),
+      ...(opts.sharedTriageSelection
+        ? ['--shared-triage-json', JSON.stringify(opts.sharedTriageSelection)]
+        : []),
     ];
     const { assignedSharedModules } = resolvePlanSliceFromFile(
       opts.buildPlanPath,