intentdna 1.6.5 → 1.7.4

package/dist/hooks/state.d.ts

@@ -10,6 +10,7 @@
  * All write operations use atomic temp+rename pattern.
  */
 import type { ArtifactFact, ArtifactKey, ArtifactManifest, CompletedArtifactEntry, HandoffArtifact, HandoffType, VerifierKind, VerifierSeverity, VerifierWhen } from "../schema/types.js";
+import { type RuntimeDecisionEvent } from "../governance/index.js";
 /** Workflow state written by runtime and read by hooks */
 export interface DNAWorkflowState {
     active: boolean;
@@ -136,6 +137,7 @@ export declare function writeSessionReads(projectDir: string, state: SessionRead
  */
 export declare function appendSessionRead(projectDir: string, filePath: string, sessionId?: string): Promise<void>;
 export interface VerifierResultEntry {
+    result_id?: string;
     verifier_id: string;
     when: VerifierWhen;
     severity: VerifierSeverity;
@@ -151,6 +153,7 @@ export interface VerifierResultEntry {
     message?: string;
     timestamp: string;
 }
+export declare function verifierResultId(result: Omit<VerifierResultEntry, "result_id"> | VerifierResultEntry): string;
 export declare function readVerifierResults(projectDir: string, sessionId?: string): Promise<VerifierResultEntry[]>;
 export declare function writeVerifierResults(projectDir: string, results: VerifierResultEntry[], sessionId?: string): Promise<void>;
 export declare function appendVerifierResult(projectDir: string, result: VerifierResultEntry, sessionId?: string): Promise<void>;
@@ -178,16 +181,8 @@ export interface TraceEntry {
  * Fail-open: never throws.
  */
 export declare function appendTrace(projectDir: string, entry: TraceEntry, sessionId?: string): Promise<void>;
-/**
- * Read trace entries.
- *
- * G1 session isolation:
- *   - With sessionId: reads from `.dna/state/sessions/{id}/trace.jsonl`
- *     (falls back to legacy global files with sessionId in name for backward compat)
- *   - Without sessionId: reads from `.dna/state/trace/trace-{date}.jsonl` (global merged view)
- *
- * Returns parsed entries sorted by timestamp.
- */
+export declare function appendRuntimeDecisionEvent(projectDir: string, event: RuntimeDecisionEvent, sessionId?: string): Promise<void>;
+export declare function readRuntimeDecisionEvents(projectDir: string, days?: number, sessionId?: string): Promise<RuntimeDecisionEvent[]>;
 export declare function readTraces(projectDir: string, days?: number, sessionId?: string): Promise<TraceEntry[]>;
 /**
  * List active session directories under `.dna/state/sessions/`.

package/dist/hooks/state.js

@@ -12,6 +12,7 @@
 import { readFile, writeFile, rename, mkdir, appendFile, unlink, readdir, stat } from "node:fs/promises";
 import { createHash } from "node:crypto";
 import { join, dirname } from "node:path";
+import { CASCADE_LAYER_NAMES, RUNTIME_DECISION_EVENT_SCHEMA_VERSION } from "../governance/index.js";
 // ── Constants ──────────────────────────────────────────────
 const WORKFLOW_FILE = "workflow.json";
 const DEFAULT_STALENESS_MS = 2 * 60 * 60 * 1000; // 2 hours
@@ -330,13 +331,34 @@ export async function appendSessionRead(projectDir, filePath, sessionId) {
     }
 }
 const VERIFIER_RESULTS_FILE = "workflow/verifier-results.json";
+export function verifierResultId(result) {
+    return "vr_" + createHash("sha256")
+        .update(JSON.stringify({
+        verifier_id: result.verifier_id,
+        when: result.when,
+        severity: result.severity,
+        kind: result.kind,
+        workflow: result.workflow ?? "",
+        step_id: result.step_id ?? "",
+        status: result.status,
+        target: result.target ?? "",
+        evidence: result.evidence ?? "",
+        artifact: result.artifact ?? "",
+        timestamp: result.timestamp,
+    }))
+        .digest("hex")
+        .slice(0, 16);
+}
+function normalizeVerifierResult(result) {
+    return result.result_id ? result : { ...result, result_id: verifierResultId(result) };
+}
 async function readVerifierResultsFile(projectDir, sessionId) {
     const stateDir = resolveStateDir(projectDir, sessionId);
     const filePath = join(stateDir, VERIFIER_RESULTS_FILE);
     try {
         const raw = await readFile(filePath, "utf-8");
         const parsed = JSON.parse(raw);
-        return Array.isArray(parsed) ? parsed : [];
+        return Array.isArray(parsed) ? parsed.map(normalizeVerifierResult) : [];
     }
     catch {
         return [];
@@ -381,10 +403,11 @@ export async function writeVerifierResults(projectDir, results, sessionId) {
 }
 export async function appendVerifierResult(projectDir, result, sessionId) {
     const results = await readVerifierResultsFile(projectDir, sessionId);
-    results.push(result);
+    results.push(normalizeVerifierResult(result));
     await writeVerifierResults(projectDir, results, sessionId);
 }
 const TRACE_DIR = "trace";
+const RUNTIME_DECISION_DIR = "runtime-decisions";
 const MAX_TRACE_SIZE = 10 * 1024 * 1024; // 10MB
 const TRACE_RETENTION_DAYS = 7;
 /**
@@ -446,6 +469,151 @@ export async function appendTrace(projectDir, entry, sessionId) {
  *
  * Returns parsed entries sorted by timestamp.
  */
+function datedJsonlFileName(prefix, date) {
+    return `${prefix}-${date}.jsonl`;
+}
+function decisionFileName(date) {
+    return datedJsonlFileName("runtime-decision", date);
+}
+export async function appendRuntimeDecisionEvent(projectDir, event, sessionId) {
+    try {
+        const line = JSON.stringify(event) + "\n";
+        const date = new Date().toISOString().slice(0, 10);
+        const globalDir = join(projectDir, ".dna", "state", RUNTIME_DECISION_DIR);
+        await mkdir(globalDir, { recursive: true });
+        await appendFile(join(globalDir, decisionFileName(date)), line, "utf-8");
+        if (sessionId) {
+            const sessionDir = resolveStateDir(projectDir, sessionId);
+            await mkdir(sessionDir, { recursive: true });
+            await appendFile(join(sessionDir, "runtime-decisions.jsonl"), line, "utf-8");
+        }
+    }
+    catch {
+        // Fail-open: evidence write failure never affects hook execution
+    }
+}
+function normalizeRuntimeDecisionEvent(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return null;
+    const record = value;
+    const hasDecision = record.decision === "allow" || record.decision === "warn" || record.decision === "block" || record.decision === "escalate" || record.decision === "validate";
+    const decision = hasDecision ? record.decision : "unknown";
+    const schemaVersion = record.schema_version === RUNTIME_DECISION_EVENT_SCHEMA_VERSION ? RUNTIME_DECISION_EVENT_SCHEMA_VERSION : "unknown";
+    const hasTimestamp = typeof record.timestamp === "string" && record.timestamp.trim().length > 0;
+    const cascadeLayers = Object.fromEntries(CASCADE_LAYER_NAMES.map((layer) => {
+        const entry = typeof record.cascade_layers === "object" && record.cascade_layers !== null && !Array.isArray(record.cascade_layers)
+            ? record.cascade_layers[layer]
+            : undefined;
+        const layerRecord = typeof entry === "object" && entry !== null && !Array.isArray(entry) ? entry : {};
+        return [layer, {
+                layer,
+                source_id: typeof layerRecord.source_id === "string" ? layerRecord.source_id : "unknown",
+                source_ref: typeof layerRecord.source_ref === "string" ? layerRecord.source_ref : "unknown",
+                fingerprint: typeof layerRecord.fingerprint === "string" ? layerRecord.fingerprint : "unknown",
+                status: layerRecord.status === "active" || layerRecord.status === "unsupported" ? layerRecord.status : "unknown",
+            }];
+    }));
+    const winningConstraint = typeof record.winning_constraint === "object" && record.winning_constraint !== null && !Array.isArray(record.winning_constraint)
+        ? record.winning_constraint
+        : {};
+    const harnessRuntimeContext = typeof record.harness_runtime_context === "object" && record.harness_runtime_context !== null && !Array.isArray(record.harness_runtime_context)
+        ? record.harness_runtime_context
+        : {};
+    const evidenceRefs = Array.isArray(record.evidence_refs)
+        ? record.evidence_refs.filter((ref) => typeof ref === "object" && ref !== null && !Array.isArray(ref) && typeof ref.type === "string" && typeof ref.ref === "string")
+        : [];
+    return {
+        schema_version: schemaVersion,
+        event_id: typeof record.event_id === "string" && record.event_id ? record.event_id : "unknown",
+        timestamp: hasTimestamp ? record.timestamp : "unknown",
+        org_id: typeof record.org_id === "string" ? record.org_id : "unknown",
+        team_id: typeof record.team_id === "string" ? record.team_id : "unknown",
+        user_id: typeof record.user_id === "string" ? record.user_id : "unknown",
+        project_id: typeof record.project_id === "string" ? record.project_id : "unknown",
+        agent_id: typeof record.agent_id === "string" ? record.agent_id : "unknown",
+        agent_role: typeof record.agent_role === "string" ? record.agent_role : "unknown",
+        agent_type: typeof record.agent_type === "string" ? record.agent_type : "unknown",
+        session_agent: typeof record.session_agent === "string" ? record.session_agent : "unknown",
+        harness_adapter: typeof record.harness_adapter === "string" ? record.harness_adapter : "unknown",
+        runtime: typeof record.runtime === "string" ? record.runtime : "unknown",
+        policy_bundle_id: typeof record.policy_bundle_id === "string" ? record.policy_bundle_id : "unknown",
+        policy_bundle_version: typeof record.policy_bundle_version === "string" ? record.policy_bundle_version : "unknown",
+        cascade_layers: cascadeLayers,
+        winning_constraint: {
+            constraint_id: typeof winningConstraint.constraint_id === "string" ? winningConstraint.constraint_id : "unknown",
+            source_layer: typeof winningConstraint.source_layer === "string" && CASCADE_LAYER_NAMES.some((layer) => layer === winningConstraint.source_layer) ? winningConstraint.source_layer : "unknown",
+            source_dna_id: typeof winningConstraint.source_dna_id === "string" ? winningConstraint.source_dna_id : "unknown",
+            gene_id: typeof winningConstraint.gene_id === "string" ? winningConstraint.gene_id : "unknown",
+            codon_type: typeof winningConstraint.codon_type === "string" ? winningConstraint.codon_type : "unknown",
+            action: decision,
+            provenance_reason: typeof winningConstraint.provenance_reason === "string" ? winningConstraint.provenance_reason : "unknown",
+        },
+        compiled_ir_hash: typeof record.compiled_ir_hash === "string" ? record.compiled_ir_hash : "unknown",
+        decision: decision,
+        decision_reason: typeof record.decision_reason === "string" ? record.decision_reason : "unknown",
+        enforcement_point: typeof record.enforcement_point === "string" ? record.enforcement_point : "unknown",
+        harness_runtime_context: {
+            agent_id: typeof harnessRuntimeContext.agent_id === "string" ? harnessRuntimeContext.agent_id : typeof record.agent_id === "string" ? record.agent_id : "unknown",
+            agent_role: typeof harnessRuntimeContext.agent_role === "string" ? harnessRuntimeContext.agent_role : typeof record.agent_role === "string" ? record.agent_role : "unknown",
+            agent_type: typeof harnessRuntimeContext.agent_type === "string" ? harnessRuntimeContext.agent_type : typeof record.agent_type === "string" ? record.agent_type : "unknown",
+            session_agent: typeof harnessRuntimeContext.session_agent === "string" ? harnessRuntimeContext.session_agent : typeof record.session_agent === "string" ? record.session_agent : "unknown",
+            harness_adapter: typeof harnessRuntimeContext.harness_adapter === "string" ? harnessRuntimeContext.harness_adapter : typeof record.harness_adapter === "string" ? record.harness_adapter : "unknown",
+            runtime: typeof harnessRuntimeContext.runtime === "string" ? harnessRuntimeContext.runtime : typeof record.runtime === "string" ? record.runtime : "unknown",
+        },
+        session_id: typeof record.session_id === "string" ? record.session_id : "unknown",
+        run_id: typeof record.run_id === "string" ? record.run_id : "unknown",
+        step_id: typeof record.step_id === "string" ? record.step_id : "unknown",
+        tool_name: typeof record.tool_name === "string" ? record.tool_name : "unknown",
+        action_kind: typeof record.action_kind === "string" ? record.action_kind : "unknown",
+        resource_ref: typeof record.resource_ref === "string" ? record.resource_ref : "unknown",
+        evidence_refs: evidenceRefs.length > 0 ? evidenceRefs : [{ type: "unknown", ref: "unknown" }],
+    };
+}
+export async function readRuntimeDecisionEvents(projectDir, days = 1, sessionId) {
+    const entries = [];
+    if (sessionId) {
+        entries.push(...await readRuntimeDecisionFile(join(resolveStateDir(projectDir, sessionId), "runtime-decisions.jsonl")));
+    }
+    else {
+        entries.push(...await readGlobalRuntimeDecisionEvents(projectDir, days));
+    }
+    return entries.sort((a, b) => a.timestamp.localeCompare(b.timestamp));
+}
+async function readRuntimeDecisionFile(filePath) {
+    const entries = [];
+    try {
+        const content = await readFile(filePath, "utf-8");
+        for (const line of content.trim().split("\n")) {
+            if (!line)
+                continue;
+            try {
+                const event = normalizeRuntimeDecisionEvent(JSON.parse(line));
+                if (event)
+                    entries.push(event);
+            }
+            catch { /* skip malformed JSON */ }
+        }
+    }
+    catch { /* file doesn't exist */ }
+    return entries;
+}
+async function readGlobalRuntimeDecisionEvents(projectDir, days) {
+    const dir = join(projectDir, ".dna", "state", RUNTIME_DECISION_DIR);
+    const entries = [];
+    const cutoff = new Date();
+    cutoff.setDate(cutoff.getDate() - days);
+    const cutoffDate = cutoff.toISOString().slice(0, 10);
+    try {
+        const files = (await readdir(dir))
+            .filter(f => f.startsWith("runtime-decision-") && f.endsWith(".jsonl"))
+            .filter(f => f.slice("runtime-decision-".length, "runtime-decision-".length + 10) >= cutoffDate)
+            .sort();
+        for (const file of files)
+            entries.push(...await readRuntimeDecisionFile(join(dir, file)));
+    }
+    catch { /* no decisions yet */ }
+    return entries;
+}
 export async function readTraces(projectDir, days = 1, sessionId) {
     const entries = [];
     if (sessionId) {

package/dist/index.d.ts

@@ -1,3 +1,4 @@
 export * from "./schema/index.js";
 export * from "./compiler/index.js";
 export * from "./runtime/index.js";
+export * from "./governance/index.js";

package/dist/index.js

@@ -1,3 +1,4 @@
 export * from "./schema/index.js";
 export * from "./compiler/index.js";
 export * from "./runtime/index.js";
+export * from "./governance/index.js";

package/dist/mcp/index.js

@@ -15,6 +15,7 @@ import { createStateTools } from "./tools-state.js";
 import { createCompileTools } from "./tools-compile.js";
 import { createEnforceTools } from "./tools-enforce.js";
 import { createObservabilityTools } from "./tools-observability.js";
+import { createContextTools } from "./tools-context.js";
 // Parse args
 const args = process.argv.slice(2);
 let projectDir = process.cwd();
@@ -36,6 +37,7 @@ catch { /* use default */ }
 const tools = [
     ...createStateTools(projectDir),
     ...createCompileTools(projectDir),
+    ...createContextTools(projectDir),
     ...createEnforceTools(projectDir),
     ...createObservabilityTools(projectDir),
 ];

package/dist/mcp/tools-compile.js

@@ -7,45 +7,8 @@
  *   - dna_sync: Run full sync pipeline (compile + inject + hooks)
  */
 import { resolve } from "node:path";
-import { stat } from "node:fs/promises";
-import { loadDNA, compileFromFiles } from "../compiler/index.js";
+import { compileFromFiles, detectDNAConfigs, expandDNAInputFiles, formatDiagnostic, loadDNAWithDiagnostics } from "../compiler/index.js";
 import { textResult, errorResult } from "./server.js";
-async function fileExists(path) {
-    try {
-        await stat(path);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-/** Auto-detect DNA config files in the project directory. */
-async function detectConfigs(projectDir) {
-    const { readdir } = await import("node:fs/promises");
-    // Multi-config: .dna/configs/*.yaml
-    const configsDir = resolve(projectDir, ".dna", "configs");
-    try {
-        const files = await readdir(configsDir);
-        const yamls = files
-            .filter(f => f.endsWith(".yaml") || f.endsWith(".yml"))
-            .sort()
-            .map(f => resolve(configsDir, f));
-        if (yamls.length > 0)
-            return yamls;
-    }
-    catch { /* dir doesn't exist */ }
-    // Legacy single-config
-    const candidates = [
-        ".dna/config.yaml", ".dna/config.yml", ".dna/config.json",
-        ".dna.yaml", ".dna.yml", ".dna.json",
-    ];
-    for (const name of candidates) {
-        const path = resolve(projectDir, name);
-        if (await fileExists(path))
-            return [path];
-    }
-    return [];
-}
 export function createCompileTools(projectDir) {
     return [
         // ── dna_validate ─────────────────────────────────────
@@ -62,20 +25,23 @@ export function createCompileTools(projectDir) {
                 const configPath = typeof args.config_path === "string"
                     ? resolve(projectDir, args.config_path)
                     : undefined;
-                const files = configPath ? [configPath] : await detectConfigs(projectDir);
+                const files = configPath ? [configPath] : await detectDNAConfigs(projectDir);
                 if (files.length === 0)
                     return errorResult("No DNA config files found.");
                 const results = [];
                 let allValid = true;
                 for (const file of files) {
-                    try {
-                        // loadDNA calls validateDNA internally — throws on invalid
-                        await loadDNA(file);
+                    const result = await loadDNAWithDiagnostics(file);
+                    const errors = result.diagnostics.filter((diagnostic) => diagnostic.severity === "error");
+                    if (errors.length > 0 || !result.dna) {
+                        allValid = false;
+                        results.push(`${file}: INVALID`);
+                    }
+                    else {
                         results.push(`${file}: valid`);
                     }
-                    catch (err) {
-                        allValid = false;
-                        results.push(`${file}: INVALID — ${err instanceof Error ? err.message : String(err)}`);
+                    for (const diagnostic of result.diagnostics) {
+                        results.push(`  ${formatDiagnostic(diagnostic)}`);
                     }
                 }
                 results.unshift(allValid ? "All configs valid." : "Validation errors found.");
@@ -98,11 +64,12 @@ export function createCompileTools(projectDir) {
                 const configPath = typeof args.config_path === "string"
                     ? resolve(projectDir, args.config_path)
                     : undefined;
-                const files = configPath ? [configPath] : await detectConfigs(projectDir);
+                const files = configPath ? [configPath] : await detectDNAConfigs(projectDir);
                 if (files.length === 0)
                     return errorResult("No DNA config files found.");
                 try {
-                    const ir = await compileFromFiles(files, {
+                    const expandedFiles = await expandDNAInputFiles(files);
+                    const ir = await compileFromFiles(expandedFiles, {
                         context: typeof args.context === "string" ? args.context : undefined,
                         role: typeof args.role === "string" ? args.role : undefined,
                     });
@@ -142,12 +109,13 @@ export function createCompileTools(projectDir) {
                     evolve: { type: "boolean", description: "Run evolution engine before compiling (default false)" },
                     context: { type: "string", description: "Active context name" },
                     role: { type: "string", description: "Active role name" },
+                    mode: { type: "string", enum: ["auto", "plugin", "bin"], description: "Sync mode (default auto)" },
                 },
             },
             handler: async (args) => {
                 // Import sync command dynamically to avoid circular deps
-                const { runSync, autoDetectConfigs: detectAll } = await import("../cli/commands/sync.js");
-                const files = await detectAll();
+                const { runSync } = await import("../cli/commands/sync.js");
+                const files = await detectDNAConfigs(projectDir);
                 if (files.length === 0)
                     return errorResult("No DNA config files found.");
                 const exitCode = await runSync({
@@ -160,6 +128,7 @@ export function createCompileTools(projectDir) {
                     skillsDir: resolve(projectDir, ".claude", "skills"),
                     settingsPath: resolve(projectDir, ".claude", "settings.json"),
                     remove: false,
+                    mode: typeof args.mode === "string" && ["auto", "plugin", "bin"].includes(args.mode) ? args.mode : "auto",
                 });
                 if (exitCode === 0) {
                     return textResult("Sync completed successfully.");

package/dist/mcp/tools-context.d.ts

@@ -0,0 +1,2 @@
+import type { ToolDef } from "./server.js";
+export declare function createContextTools(projectDir: string): ToolDef[];

package/dist/mcp/tools-context.js

@@ -0,0 +1,85 @@
+import { resolve } from "node:path";
+import { findContextSource, formatContextSource, loadContextSourceIndex, readContextSourceDocument, searchContextSources, } from "../runtime/context-sources.js";
+import { errorResult, textResult } from "./server.js";
+function filesArg(args, projectDir) {
+    if (typeof args.config_path === "string")
+        return [resolve(projectDir, args.config_path)];
+    return undefined;
+}
+export function createContextTools(projectDir) {
+    return [
+        {
+            name: "dna_context_sources",
+            description: "List explicitly declared planning-only advisory context sources",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    config_path: { type: "string", description: "Path to DNA config (auto-detected if omitted)" },
+                },
+            },
+            handler: async (args) => {
+                const index = await loadContextSourceIndex(projectDir, filesArg(args, projectDir));
+                if (index.sources.length === 0)
+                    return textResult("No advisory context sources declared.");
+                const lines = index.sources.map(formatContextSource);
+                if (index.planning_instructions.length > 0) {
+                    lines.push("", "Planning instructions:");
+                    for (const instruction of index.planning_instructions)
+                        lines.push(`- ${instruction}`);
+                }
+                return textResult(lines.join("\n"));
+            },
+        },
+        {
+            name: "dna_context_search",
+            description: "Search advisory context source metadata. This does not search repository files.",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    query: { type: "string", description: "Metadata query" },
+                    config_path: { type: "string", description: "Path to DNA config (auto-detected if omitted)" },
+                },
+                required: ["query"],
+            },
+            handler: async (args) => {
+                const query = typeof args.query === "string" ? args.query : "";
+                const index = await loadContextSourceIndex(projectDir, filesArg(args, projectDir));
+                const matches = searchContextSources(index, query);
+                if (matches.length === 0)
+                    return errorResult(`No advisory context sources matched '${query}'.`);
+                return textResult(matches.map(formatContextSource).join("\n"));
+            },
+        },
+        {
+            name: "dna_get_context",
+            description: "Read a declared local advisory context document by source id",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    id: { type: "string", description: "Context source id" },
+                    config_path: { type: "string", description: "Path to DNA config (auto-detected if omitted)" },
+                },
+                required: ["id"],
+            },
+            handler: async (args) => {
+                const id = typeof args.id === "string" ? args.id : "";
+                const index = await loadContextSourceIndex(projectDir, filesArg(args, projectDir));
+                const source = findContextSource(index, id);
+                if (!source)
+                    return errorResult(`Unknown advisory context source '${id}'.`);
+                const doc = await readContextSourceDocument(projectDir, source);
+                const lines = [
+                    formatContextSource(source),
+                    "Planning-only advisory context; does not satisfy enforcement, handoff, or ArtifactManifest requirements.",
+                ];
+                if (doc.content !== undefined) {
+                    lines.push("", "---", doc.content);
+                }
+                else {
+                    lines.push("No local document body is available for this source type.");
+                }
+                return textResult(lines.join("\n"));
+            },
+        },
+    ];
+}

package/dist/mcp/tools-enforce.d.ts

@@ -1,8 +1,8 @@
 /**
  * Intent DNA — MCP Enforce Tools (U2)
  *
- * Provides enforcement via MCP server with in-memory IR cache.
- * Zero cold-start: IR is loaded once and cached with mtime-based invalidation.
+ * Provides enforcement via a persistent MCP server with in-memory IR cache.
+ * MCP calls reuse the full hook runtime without reloading IR on every request.
  *
  * Tools:
  *   - dna_enforce: Run enforcement for a hook event (PreToolUse, PostToolUse, etc.)

package/dist/mcp/tools-enforce.js

@@ -1,16 +1,18 @@
 /**
  * Intent DNA — MCP Enforce Tools (U2)
  *
- * Provides enforcement via MCP server with in-memory IR cache.
- * Zero cold-start: IR is loaded once and cached with mtime-based invalidation.
+ * Provides enforcement via a persistent MCP server with in-memory IR cache.
+ * MCP calls reuse the full hook runtime without reloading IR on every request.
  *
  * Tools:
  *   - dna_enforce: Run enforcement for a hook event (PreToolUse, PostToolUse, etc.)
  */
 import { resolve } from "node:path";
 import { stat, readFile } from "node:fs/promises";
-import { enforcePreToolUse, enforcePostToolUse, enforceUserPromptSubmit, enforceSubagentStop, enforcePreCompact, enforceNotification, enforceSessionStart, } from "../hooks/enforce.js";
+import { silentOutput } from "../hooks/protocol.js";
 import { hookEventsForSurface } from "../hooks/event-registry.js";
+import { validateHookInput } from "../hooks/schema.js";
+import { runHookEvent } from "../hooks/cli.js";
 import { textResult, errorResult } from "./server.js";
 // ── IR Cache ────────────────────────────────────────────────
 /** In-memory IR cache with mtime-based invalidation. */
@@ -63,49 +65,17 @@ export class IRCache {
     }
 }
 const VALID_EVENTS = new Set(hookEventsForSurface("mcp"));
-function dispatchEnforce(event, ir, input, roles) {
-    const result = dispatchEnforceInner(event, ir, input, roles);
-    return result?.output ?? { continue: true, suppressOutput: true };
-}
-function dispatchEnforceInner(event, ir, input, roles) {
-    switch (event) {
-        case "PreToolUse":
-            return enforcePreToolUse(ir, {
-                tool_name: String(input.tool_name ?? ""),
-                tool_input: (input.tool_input ?? {}),
-                agent_type: typeof input.agent_type === "string" ? input.agent_type : undefined,
-                cwd: typeof input.cwd === "string" ? input.cwd : undefined,
-            }, undefined, roles);
-        case "PostToolUse":
-            return enforcePostToolUse(ir, {
-                tool_name: String(input.tool_name ?? ""),
-                tool_input: (input.tool_input ?? {}),
-                tool_output: typeof input.tool_output === "string" ? input.tool_output : undefined,
-                agent_type: typeof input.agent_type === "string" ? input.agent_type : undefined,
-            });
-        case "UserPromptSubmit":
-            return enforceUserPromptSubmit(ir, {
-                prompt: typeof input.prompt === "string" ? input.prompt : undefined,
-            });
-        case "SubagentStop":
-            return enforceSubagentStop(ir, {
-                agent_name: typeof input.agent_name === "string" ? input.agent_name : undefined,
-                agent_type: typeof input.agent_type === "string" ? input.agent_type : undefined,
-            });
-        case "PreCompact":
-            return enforcePreCompact(ir);
-        case "Notification":
-            return enforceNotification(ir, {
-                title: typeof input.title === "string" ? input.title : undefined,
-                message: typeof input.message === "string" ? input.message : undefined,
-            });
-        case "SessionStart":
-            return enforceSessionStart(ir, {
-                cwd: typeof input.cwd === "string" ? input.cwd : undefined,
-                sessionId: typeof input.session_id === "string" ? input.session_id : undefined,
-            });
-        default:
-            return null;
+async function dispatchEnforce(event, ir, input, projectDir, roles) {
+    try {
+        const validation = validateHookInput(event, input);
+        if (!validation.valid)
+            return silentOutput();
+        const rawInput = validation.normalized;
+        const sessionId = typeof rawInput.sessionId === "string" ? rawInput.sessionId : undefined;
+        return await runHookEvent({ event, ir, rawInput, projectDir, sessionId, roles });
+    }
+    catch {
+        return silentOutput();
     }
 }
 // ── Tool Registration ───────────────────────────────────────
@@ -114,8 +84,8 @@ export function createEnforceTools(projectDir) {
     return [
         {
             name: "dna_enforce",
-            description: "Run DNA enforcement for a hook event. Uses in-memory cached IR for zero cold-start. " +
-                "Returns the same result as the dna-hook binary but without spawning a new process.",
+            description: "Run DNA enforcement for a hook event inside the persistent MCP server. " +
+                "Uses cached IR and the same runtime path as the dna-hook binary.",
             inputSchema: {
                 type: "object",
                 properties: {
@@ -141,7 +111,7 @@ export function createEnforceTools(projectDir) {
                     return errorResult("No compiled IR found. Run `dna sync` to compile your DNA config.");
                 }
                 const input = (args.input ?? {});
-                const result = dispatchEnforce(event, cached.ir, input, cached.roles);
+                const result = await dispatchEnforce(event, cached.ir, input, projectDir, cached.roles);
                 // Format as human-readable text
                 const lines = [];
                 lines.push(`Decision: ${result.continue ? "allow" : "BLOCK"}`);

package/dist/mcp/tools-observability.js

@@ -1,10 +1,11 @@
 import { textResult } from "./server.js";
 import { buildKernelReport, formatKernelReport } from "../report/kernel-report.js";
+import { buildReportPackage } from "../report/report-package.js";
 export function createObservabilityTools(projectDir) {
     return [
         {
             name: "dna_kernel_report",
-            description: "Observability-only local kernel report. Reads traces/verifier results and optional preview-only marker changes; does not execute verifiers or mutate state.",
+            description: "Observability-only local kernel report. Reads RuntimeDecisionEvent as primary enterprise evidence; legacy traces/verifier results are diagnostic-only. Does not execute verifiers or mutate state.",
             inputSchema: {
                 type: "object",
                 properties: {
@@ -27,7 +28,30 @@ export function createObservabilityTools(projectDir) {
                     return textResult(JSON.stringify(report, null, 2));
                 }
                 return textResult(formatKernelReport(report) +
-                    "\nMCP observability only: this tool does not execute verifiers, does not enforce hook parity, and does not mutate state or markers.\n");
+                    "\nMCP observability only: RuntimeDecisionEvent is primary enterprise evidence; legacy traces/verifiers are diagnostic-only. This tool does not execute verifiers, does not enforce hook parity, and does not mutate state or markers.\n");
+            },
+        },
+        {
+            name: "dna_report_package",
+            description: "Read-only local evidence package with RuntimeDecisionEvent primary evidence, diagnostic legacy traces/verifier results/handoffs, deferrals, and fact-backed critical decisions.",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    days: { type: "number", description: "Days to look back (default 7)" },
+                    session_id: { type: "string", description: "Session ID filter" },
+                    dna_id: { type: "string", description: "DNA ID for marker preview; derived from compiled IR if omitted and unambiguous" },
+                    include_marker_preview: { type: "boolean", description: "Include preview-only marker changes (default false)" },
+                },
+            },
+            handler: async (args) => {
+                const reportPackage = await buildReportPackage({
+                    projectDir,
+                    days: typeof args.days === "number" ? args.days : 7,
+                    sessionId: typeof args.session_id === "string" ? args.session_id : undefined,
+                    dnaId: typeof args.dna_id === "string" ? args.dna_id : undefined,
+                    includeMarkerPreview: typeof args.include_marker_preview === "boolean" ? args.include_marker_preview : false,
+                });
+                return textResult(JSON.stringify(reportPackage, null, 2));
             },
         },
     ];