machine-bridge-mcp 3.0.0-beta.206 → 3.0.0-beta.209

package/CHANGELOG.md

@@ -1,26 +1,19 @@
 # Changelog
 
-## 3.0.0-beta.206 - 2026-10-20
+## 3.0.0-beta.209 - 2026-10-23
 
-- Fix minute-boundary calculation in progress reporter elapsed formatting to prevent overflow past 60 seconds.
-- Wire progressToken through Worker MCP HTTP contract handling and streamed response dispatch.
-- Remove redundant duplicate self-comparison import in records test suite.
-- Enforce `package.json`/`package-lock.json` root version parity in the version-sync gate and package test.
-- Run progress reporter unit tests against the shared production module, retaining only a local compatibility re-export.
-- Remove the legacy stdio handshake and metadata-normalization mode, including the CLI option and environment switch.
-- Document that multi-file patch rollback covers ordinary operation failures but is not crash-atomic across files; single-file write/edit visibility remains atomic.
-- Add a child-process regression that reproduces the multi-file patch crash window and verifies retained backup/staging artifacts.
-- Expand recursive-search control-plane filtering tests to cover security, browser-pairing, and service-control roots, and test stdio EOF cancellation and output-write failure.
-- Add regression coverage for bounded stdio error responses and serialized concurrent task-state updates.
-- Expand stdio output queue limit and reservation to safely process concurrent maximum-size tool results without dropping the transport.
-- Implement remote Worker MCP Tasks operations (`tasks/get`, `tasks/update`, `tasks/cancel`) for clients that advertise the Tasks extension; local stdio intentionally does not advertise it, `tasks/list`/`tasks/result` aliases are unsupported, project cleanup/interrupted recovery states as active tasks, and tasks without a persisted terminal result fail explicitly if their backing job record disappears before result capture.
-- Centralize MCP task job-ID validation in the shared task contract so task creation, dispatch and durable-record validation use one pattern.
-- Add actionable error guidance (actionable_remedy) for agent reflexion on tool execution failures.
-- Expand local TypeScript type checking coverage to 74 checked modules with strict JSDoc typing.
-- Consolidate cross-module integer validation helpers into shared runtime modules.
-- Add standard npm test script mapped to the verification runner.
-- Tighten TypeScript compiler checks with noFallthroughCasesInSwitch, noImplicitReturns, and noUncheckedIndexedAccess.
-- Include previously orphaned tests into the check runner plan.
+- Preserve the nearest project instructions when the shared context budget is exhausted, and report omitted guidance with policy-projected paths.
+- Load persistent project memory only on demand (`agent_context` remains strictly read-only), validating versioned metadata, expiry timestamps, and canonical path containment without exposing unreferenced memory-mutation exports.
+- Bound asynchronous symbol-outline traversal, file reads, cancellation, rendered lines, and 16 KiB UTF-8 byte ceiling; omit default parameter values, fix zero-parameter arrow function signature parsing (`() =>`), and enforce per-file policy checks.
+- Require exact editing and patch contexts; add `with_line_numbers` read support, 1-based line-numbered `near_miss` edit candidates, and bounded `conflict_hint` line candidates on `apply_patch` conflicts.
+- Share typed instruction, Git-diff, and skill projections across stdio and Worker prompts. Preserve failures, truncation, and sensitive-file omissions instead of reporting missing data as empty results.
+- Make optional progressive stdio discovery reachable through nine initial tools, canonical groups, and bounded request-scoped catalog subscriptions. Add compact Code Mode TypeScript SDK signature projection (`projectToolCatalogAsTypeScript`) across shared catalog helpers.
+- Share reason-level remedies across transports, surface underlying error reasons in managed-job runner failures (`error_reason`), and add interactive prompt stall detection (`[y/N]`, `Password:`) to process failure advisories.
+- Gate Worker SSE heartbeat comments on complete frame boundaries (`\n\n` / `\r\n\r\n`) via O(1) tail-byte inspection while keeping heartbeats active across multi-step streams.
+- Advance the tool schema generation and bind the catalog digest to its contract (40 verified output schemas and 14 environment-dependent interactive tools across 54 tools).
+- Unify MCP Tasks active/terminal/successful job status sets in `src/shared/mcp-task-contract.mjs`, deduplicate resource-request normalization in `src/local/resource-request-contract.mjs`, and centralize loopback origin parsing in `src/shared/trusted-origin.mjs`.
+- Remove dead barrel re-exports and unused development scripts, enforce static dead-export detection in `tests/architecture/module-boundaries.mjs`, and exempt generated reference documents (`docs/TOOL_REFERENCE.md`, `docs/POLICY.md`) from the hand-written documentation file count cap.
+- Move the native development smoke fixture and tool output-schema contract baseline out of the consumer package; verify nested and deduplicated Wrangler 4.151.3 dependencies at their exact locked locations.
 
 ## Historical releases
 

package/README.md

@@ -324,8 +324,13 @@ Detailed release-governance instructions are source-repository maintenance mater
 - [Upgrading](docs/UPGRADING.md)
 - [Computer use](docs/COMPUTER_USE.md)
 - [Managed jobs](docs/MANAGED_JOBS.md)
+- [Agent context](docs/AGENT_CONTEXT.md)
 - [Audit status](docs/AUDIT.md)
 - [Privacy hygiene](docs/PRIVACY.md)
+- [Architecture](https://github.com/YuLeiFuYun/machine-bridge-mcp/blob/main/docs/ARCHITECTURE.md)
+- [Engineering](https://github.com/YuLeiFuYun/machine-bridge-mcp/blob/main/docs/ENGINEERING.md)
+- [Project standards](https://github.com/YuLeiFuYun/machine-bridge-mcp/blob/main/docs/PROJECT_STANDARDS.md)
+- [Testing](https://github.com/YuLeiFuYun/machine-bridge-mcp/blob/main/docs/TESTING.md)
 
 Architecture, engineering, testing, project-standard, release-governance, contribution, conduct, and governance documents remain available in the source repository but are not part of the npm consumer payload.
 

package/browser-extension/manifest.json

@@ -29,6 +29,6 @@
   "action": {
     "default_title": "Machine Bridge Browser"
   },
-  "version_name": "3.0.0-beta.206",
+  "version_name": "3.0.0-beta.209",
   "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxryYkpZhq8+VAQLHcGS9BAHQcyKX8RHGIpIwvtIVRU/rcOcE0bNdnM0aZJ/h6xWQsGDHlhvjT2+1aJaAn/9k8473BRWajzVXld961CdHYVFVHoce2hHiSJ0xydWrHMMZhAm0mN0UzjEpgZ0tMw209efcZHIvSwuxhteZMRy4kyiVjwFlOf5oXFCxRuCJnPj3AK9CmCf4XgEBuPIJ0TZmjGHOOdBvJmbCNnAWXYEo5/mf7MfCGhV4IJ1hNuhpoNQfOFKMUcw9/v/IpT62XpfXdGYTfGYCmCjC+gntK1spbkr2P4/2+sYMQtLpse71mpSNGXfcf3abU55Vpn+gncSxRQIDAQAB"
 }

package/docs/AGENT_CONTEXT.md

@@ -7,7 +7,7 @@ This approximates a local coding agent without pretending that the MCP server ow
 ## MCP tools
 
 - `session_bootstrap` returns built-in working agreements, bounded automatic project facts, explicit instruction text, and a refresh fingerprint.
-- `agent_context` returns the complete target-specific instruction chain, skill summaries, and command registry.
+- `agent_context` returns the bounded target-specific instruction chain, skill summaries, and command registry.
 - `resolve_task_capabilities` rescans default/project context, ranks skills/commands and effective-policy-visible tools, returns bounded set-level execution routes with ambiguity/fallback metadata, and optionally loads the best skill. Direct Bash remains available whenever the effective policy permits it.
 - `list_local_skills` searches discovered `SKILL.md` bundles.
 - `load_local_skill` returns one skill entrypoint and bounded file inventory without execution.
@@ -50,7 +50,34 @@ These are behavioral defaults, not hard enforcement. Machine Bridge policy profi
 
 The scanner does not execute commands, inspect dependency values, read package script bodies, summarize source files, or claim that declared commands work. Oversized, invalid-UTF-8, symbolic-link, or unsupported metadata is skipped or described conservatively. The generated block is capped independently at 16 KiB.
 
-This approach follows common guidance across coding agents: keep always-loaded instructions concise, specific, structured, and verifiable; put build/test commands and architecture entrypoints where the agent can find them; use nested files for narrower rules; and keep hard prohibitions in permission or hook mechanisms rather than relying only on prose. Relevant references include the [OpenAI Codex AGENTS.md guide](https://learn.chatgpt.com/docs/agent-configuration/agents-md), [GitHub Copilot repository instructions](https://docs.github.com/en/copilot/how-tos/copilot-on-github/customize-copilot/add-custom-instructions/add-repository-instructions), [Claude Code project memory guidance](https://code.claude.com/docs/en/memory), and the [AGENTS.md open format](https://agents.md/).
+### Cross-session persistent agent memory
+
+`agent_context` reads `.project-local/agent-memory.json` on demand. Automatic project facts may announce that the file exists; `session_bootstrap` and `resolve_task_capabilities` do not load its body. Memory is outside their static refresh fingerprint. It is untrusted project context and never expands execution authority.
+
+Version 1 accepts four optional arrays: `project_insights`, `ci_guidelines`, `user_preferences`, and `notes`. Entries are non-empty strings or objects with `text`, optional finite `importance` from 1 to 10, parseable `updated_at` / `expires_at`, and an optional bounded `source`. An explicit finite millisecond `timestamp` can supply `updated_at`. Prefer ISO timestamps:
+
+```json
+{
+  "version": 1,
+  "project_insights": [{
+    "text": "Preserve Python indentation when editing.",
+    "updated_at": "2026-10-21T00:00:00.000Z",
+    "source": "verified regression"
+  }]
+}
+```
+
+The result contains one canonical object-entry view in source order. Plain strings acquire no invented timestamp or freshness score. Expired entries and duplicate text within a category are omitted. No `scored_memories` copy or research-derived ranking is applied.
+
+Protected, regular-file reads reject symbolic links, multiple hard links, changing identities and canonical parent escapes, and apply the request's path authority. The 64 KiB input ceiling is enforced before allocation or JSON parsing. Each text is at most 2 KiB, each category returns at most 10 entries, and all returned entries share a 16 KiB serialized budget. `truncated` describes output selection. Oversized files return `too_large` without a body; malformed version/metadata returns `invalid`; unsafe or inaccessible paths return `unavailable`. Cancellation propagates. The reader never modifies the file, and Machine Bridge exposes no dedicated memory-mutation tool; users or authorized workspace file tools (`write_file`, `edit_file`, `apply_patch`) maintain `.project-local/agent-memory.json`. Keep memory local and review its content before sharing context.
+
+### Lexical Symbol Outline (Repo Map)
+
+`agent_context` can return a bounded lexical overview with `include_symbol_outline: true` or a specific `symbol_path`. `max_symbol_files` defaults to 30 (maximum 100); `max_symbol_lines` defaults to 300 (maximum 1000), including headers, separators and truncation notices. Rendered text also has a 16 KiB byte ceiling; notices count inside both budgets. Parameter values are omitted rather than copied into the outline. A lexical match is navigation assistance, not an AST-backed semantic guarantee.
+
+Filesystem I/O is asynchronous. Default traversal visits at most 2048 entries and eight directory levels, reads at most 256 KiB per file and 2 MiB in total, and checks cancellation and per-file policy. Protected reads reject nonregular, linked or changing files. Paths use the same display projection as other context. Hitting a budget or omitting a source makes the result explicitly incomplete.
+
+Keep always-loaded instructions short and verifiable; use nested rules and linked topic documents for detail. Prose is guidance, while policy, OS permissions and operation gates enforce authority.
 
 ### Disable either automatic layer
 
@@ -101,6 +128,8 @@ In remote mode, selected instruction text and enabled automatic project facts ne
 
 ## Instruction precedence
 
+Explicit files retain global-to-nearest precedence in the result. When the shared byte budget is exceeded, nearer project guidance takes priority over earlier global/root files; omitted paths and budget reasons appear in `instruction_warnings`. An individually oversized file is omitted with a warning. Inspect these warnings before assuming the inventory is complete.
+
 For a target path, Machine Bridge chooses the nearest Git ancestor as scope root, falling back to the configured workspace or target directory. The default candidate priority in each directory is:
 
 ```json
@@ -190,6 +219,8 @@ No persistent skill or project-context index is trusted as authoritative. `sessi
 
 ## Progressive disclosure and task selection
 
+The default tool catalog remains full. Opt-in stdio mode `MBM_PROGRESSIVE_TOOLS=1` starts with nine tools, including the discoverable `resolve_task_capabilities` entry point. Call that listed tool to request `activate_tool_groups`: `browser`, `app`, `jobs`, `git`, `process`, `diagnostics`, `skills`, or `files`. Only policy-visible tools activate. Hidden names are not a discovery shortcut. Progressive mode advertises `tools.listChanged=true`; notifications are delivered only to an accepted `subscriptions/listen` request with `toolsListChanged=true`, carrying that subscription's ID. Full mode remains static. Mode is selected at process startup, not by an ad hoc `tools/list` parameter.
+
 `agent_context` returns bounded skill metadata. `load_local_skill` returns full instructions only for one selected bundle. `resolve_task_capabilities` tokenizes the current task, ranks skill names/descriptions, command names/descriptions/argv, and public tool definitions, then scores compatible execution surfaces as sets. It returns a schema-versioned envelope with the primary route, alternatives, ambiguity, fallback routes, ranked tools, and failure-aware guidance. Scores are relative within the current response, not probabilities or values to compare across package versions. Registered commands, direct Bash/argv, interactive sessions, durable jobs, files/Git, browser, applications, protected resources, and diagnostics remain separate choices; the advice does not hide or disable any effective-policy-visible tool.
 
 The resolver compares the task with cached installed-application names for every authenticated policy profile. An exact full application name may match directly; weaker lexical name fragments require an application-operation intent such as opening, inspecting, focusing, or operating an application. Repository/version words that merely overlap an installed application name are therefore not application intent. This is an intentional read-only inventory surface: delegated roles may see application names and launcher/bundle identifiers, while external paths remain projected. Action routes are still filtered through the authenticated account/daemon policy intersection, so a delegated reviewer connected to a full daemon can discover an installed application without acquiring launch, Accessibility, browser, shell, or write authority.

package/docs/AUDIT.md

@@ -12,28 +12,17 @@ This review is scoped to source contracts, risk-bearing control paths, isolated
 
 ## Current conclusions
 
-- **Delegated content paths are filtered before reads.** Search, project instructions, skills, and structured Git content omit sensitive paths; hard-linked text inputs are rejected. Empty Git path enumeration returns empty content without an unfiltered second command. Search reports omitted candidate files as incomplete and bounds surrounding text and serialized output. Filename classification cannot identify credentials stored under arbitrary ordinary filenames.
-- **Arbitrary remote execution is owner-only.** Workspace isolation alone cannot prevent an executable from reading in-workspace credentials and exporting them. Local role gates and Worker discovery/dispatch enforce the same restriction. Fatal process events log only fixed event/error classes and terminate even when rejection inspection or logging throws; raw rejection content is not operational log data.
-- **Refresh retries cannot recreate consumed replacements.** A retry may return only the still-active derived token pair. Revoked families and consumed replacements are rejected, and access-token authorization checks family revocation. Local regression fixtures do not replace deployed OAuth acceptance.
-- **Branch and prerelease identities have different evidence.** Explicit branch requests match exact case-sensitive names despite pending version edits; explicit prerelease requests still reject contradictory package generations. Resolver regressions cover both paths.
-- **Output budgets include producer backing retention.** Diagnostic and continuation buffers trim before allocating retained bytes and copy independent snapshots. Stdio response writes are serialized through an 8 MiB queue; input is paused as backlog rises, and exceeding the hard cap closes input rather than allowing unbounded queued responses. Allocation/aliasing regressions, backpressure integration, and partition properties supplement the existing UTF-8 and continuation tests.
-- **Successful settlement terminates retry classification.** Application stdout/stderr cannot cause a successful release command to run again. Failures retain bounded transient classification, while npm pre-lifecycle errors remain observable.
-- **Workspace replacement retries remain bounded and atomic.** Transient sharing errors retry the staging-file rename without unlinking the visible destination. The expected content digest is rechecked before each attempt, so an external change after a sharing failure returns a conflict and preserves that generation. Exhausted and non-transient failures preserve the original error. Injected success/exhaustion/non-transient and retry-generation regressions supplement the concurrent-reader fixture; Windows CI remains the provider-level proof. This optimistic check does not provide an operating-system compare-and-swap against uncoordinated external writers.
-
-- **Authority remains an intersection, never an accumulation.** Effective MCP authority is bounded by authenticated account role, daemon capability ceiling, and tool-specific policy. Reconnects, retries, stale host schemas, browser focus changes, or recovery metadata do not expand authority.
-- **Removed protocol behavior stays removed.** Remote HTTP and stdio use the current MCP protocol only. `initialize` is rejected, `notifications/initialized` has no handshake effect, and neither a CLI option nor an environment variable can normalize missing request metadata. Clients must supply the current protocol version and capability metadata on every supported request.
-- **State publication is atomic, type-exact and identity-sensitive.** Security-sensitive state readers reject symlinks, unexpected hard links, malformed content, permission failures, persistent identity changes, and coercible PID/token/timestamp fields. Persisted strings, arrays, booleans or objects cannot become process, cleanup, lock, lease, waiter or termination authority through JavaScript conversion. Bounded retries are reserved for explicitly classified atomic-publication races; durable state is complete before it becomes visible.
-- **Durable execution owns continuity explicitly.** Managed jobs persist recovery state independently of the hosted MCP response. Idempotency keys bind uncertain acceptance retries only while the retained record exists; cancellation, dependency state, cleanup, output budgets, and terminal persistence have explicit fail-closed boundaries. Terminal evidence validation is bound to stable status/result file generations, and a live runner retains ownership of its final cleanup-status write. Routine inventory throttles full retention scans to 30 seconds, while capacity pressure, unreadable state, expired staged plans, and dependency-bearing active/staged jobs force maintenance. Callers recover the same accepted job instead of replaying its side effect.
-- **Daemon-owned Node children use a verified runtime launcher.** A live concrete runtime executable is preferred; if it disappears after a package-manager upgrade, only the original absolute Node launcher is eligible as fallback. Diagnostics expose provenance booleans rather than executable paths, and an unavailable launcher requires service restart instead of PATH guessing.
-- **Relay recovery separates transport, execution and quota pacing.** Authenticated WebSocket/HTTPS state is scoped to the current transport generation; ended-generation controls are discarded, and protocol violations affect their originating transport. Ambiguous side effects are not replayed. Cancellation removes ownership, terminal retention is bounded, and reconnects cannot accumulate execution time or delivery grace. Diagnostics retain sanitized classifications rather than peer text. The quota evidence and polling limits below distinguish repository mechanisms from provider usage.
-- **Operating-system sleep is an observable suspension boundary, not a network guarantee.** On supported macOS hosts, diagnostics correlate bounded sleep history with runtime stalls and recovered relay outages. Machine Bridge cannot keep JavaScript or a socket executing while the machine is suspended, and sleep correlation does not identify unrelated upstream network causes.
-- **Browser automation remains existing-profile and snapshot-bound.** The extension controls an already installed Chromium profile; hosted calls bind explicit tab identity, and later Computer Use actions bind the exact observation snapshot. Mutation response loss, timeout, extension replacement, or ambiguous trusted-input settlement yields an unknown/non-retryable boundary that must be inspected before any retry.
-- **Desktop automation is permission- and evidence-bound.** Application actions use structured Accessibility operations or an explicitly enabled snapshot-bound visual backend. The runtime does not silently substitute arbitrary scripting or unverified pixel guessing when required authority/evidence is unavailable.
-- **Logging and diagnostics are privacy-minimized by contract.** Runtime logs are structured and must not contain tool arguments, command output, credentials, account identity, arbitrary URLs, private paths, or other user content. Explicit local CLI/tool results are a separate user-requested output surface. Security-audit telemetry is content-free, bounded, and hash-chained; diagnostics expose coarse provenance/health rather than secrets or private values.
-- **Effect-settlement evidence is time-scoped.** Audit events retain the settlement state observed when a tool response was recorded. Recent `unknown_effect_settlements_last_15m` and `pending_effect_settlements_last_15m` are historical event counts, not a live queue. Current local process termination is reported separately by `runtime.processes.terminating_processes` and `termination_escalations_pending`; a later process exit does not rewrite the append-only audit event.
-- **Resource admission is cooperative scheduling, not a hostile-code sandbox.** CPU, memory, I/O, disk-reserve, queue, and result budgets protect service continuity, but ordinary execution still has the daemon OS user's ambient authority unless a dedicated low-privilege account or VM/container supplies the stronger boundary.
-- **Deployment audits cover bundled code as well as the dependency graph.** The consumer runtime excludes cf, Wrangler, and Miniflare. Deployment uses an exact private toolchain whose registry signatures, dependency audit, and artifact bytes are checked before execution. A zero-vulnerability dependency audit is insufficient for bundled code: the unchanged upstream cf bundle is hash-bound and its custom connector and TLS-verification preservation are exercised offline. No third-party bundle rewriting or standalone network-library substitution remains. Unknown artifact bytes fail closed. Structured cf authentication must be positive before unattended activation can mutate the Worker or service; source snapshots, generated manifests, Worker identity, SQLite export, preserved secrets, and typed rate-limit bindings with exact parameters are validated before upload. Module paths, counts and aggregate bytes are bounded; staging cleanup preserves the primary failure. These local controls still require candidate-bound deployed-edge acceptance.
-- **Release and package evidence remain separate from audit prose.** Shipped-source or packed-document changes require synchronized package identity and fresh verification. Candidate acceptance, publication, activation, and stable promotion must be proven by their dedicated records and external systems; no sentence in this audit summary inherits or confers release authority.
+- **Authority is an intersection.** Account role, daemon capability ceiling, and tool policy apply on every call. Remote arbitrary execution is owner-only; reconnects, discovery and recovery cannot expand access. Current request-scoped MCP metadata is mandatory; removed handshakes remain rejected.
+- **Reads and persistence fail closed.** Protected readers enforce canonical paths, regular-file identity, hard-link rejection, encoding and byte budgets. Sensitive-path filtering covers delegated content; filename checks cannot recognize secrets stored under arbitrary names. State-authority failures are never interpreted as empty records, and coercible values cannot become PID, lock or lease authority.
+- **Writes retain their generation.** Atomic claims are complete before publication. Bounded sharing-error retries preserve the visible destination and recheck the expected digest. Cross-process optimistic checks do not provide an OS compare-and-swap against uncoordinated external writers; Windows CI supplies provider evidence.
+- **Budgets cover allocation and work.** Output buffers trim before retaining backing bytes and copy independent snapshots. The stdio writer has an 8 MiB queue with backpressure and closes input at the hard cap. Context indexing and subscriptions separately bound traversal, input, rendering, retained IDs and count.
+- **Durable execution owns continuity.** Managed jobs retain recovery independently of MCP delivery. Idempotency deduplicates only while the original record is retained. Callers recover the same job after ambiguous acceptance. Cancellation, dependencies, terminal persistence, stable file generations and cleanup have distinct ownership. Successful settlement terminates retry classification.
+- **Relay generations do not confer replay authority.** Ended transport controls are discarded, reconnects cannot accumulate execution or delivery grace, and unknown mutations are not repeated. Routine retention scans are throttled; pressure and risky retained states force maintenance. Node children use a verified runtime launcher; unavailable executable identity requires service recovery rather than PATH guessing.
+- **UI actions consume exact evidence.** Browser actions bind the existing profile, explicit tab and observation generation; desktop actions bind process/window identity and an authorized backend. Timeout, response loss or ambiguous dispatch becomes non-retryable unknown settlement requiring observation. No arbitrary browser/application evaluation is substituted.
+- **Diagnostics preserve privacy and time scope.** Logs exclude tool inputs, output, credentials and private identifiers. Audit events retain the settlement observed at recording time; recent unknown/pending counts are historical, while process termination counters describe current state. OS sleep can explain suspension but cannot prove an unrelated network cause or uninterrupted execution.
+- **OAuth replay evidence remains narrow.** Refresh retries return only an active derived pair; consumed replacements and revoked families fail. Local regression fixtures do not establish deployed OAuth persistence, which requires the candidate-bound canary.
+- **Supply-chain checks include actual bytes.** Consumer runtime excludes cf/Wrangler/Miniflare. The private toolchain checks exact locks, installation policy, registry signatures, audit and the unchanged pinned cf artifact before execution. Authentication must be positive before deployment; deployment identity, snapshot paths/bytes, preserved state and rate-limit bindings remain validated. A zero-vulnerability audit cannot certify bundled code or deployed behavior.
+- **Identity and release authority are explicit.** Branch routing and prerelease routing use their own evidence, not directory names or dirty package metadata. Full verification, package integrity, activation, observed acceptance, external checks, publication and soak each require their dedicated records. Audit prose grants none of that authority.
 
 ## Relay quota incident evidence boundary
 
@@ -59,3 +48,27 @@ The fast SARIF regression now loads both real checked-in exception documents aga
 ## Historical findings
 
 Historical incidents, closed hypotheses, release-by-release evidence, and superseded candidate details belong in Git history/tags and the [changelog](../CHANGELOG.md), not in this current summary. Inspect the file at the corresponding historical revision when reconstructing an old incident or release decision.
+
+## 2026-10-21 follow-up dispositions
+
+The follow-up rechecked 31 findings against the dirty development tree and the deployed runtime boundary. These are implementation dispositions, not a claim of published or live release acceptance. The numbered evidence remains traceable to the retained audit report; native verification and live acceptance have separate records.
+
+| Findings | Disposition and executable evidence |
+| --- | --- |
+| 01 | Nearest instruction precedence and explicit omission reasons; `agent-audit:test`, `agent-context:test`. |
+| 02–03, 14–16 | On-demand protected memory reads, strict entries, bounded input/text/result, no duplicate scores; memory boundary and budget fixtures in `agent-audit:test`. |
+| 04–06 | Asynchronous bounded outline traversal, per-file policy and path projection, complete rendering budget; `symbol-outline:test`, `agent-audit:test`. |
+| 07 | Exact-only editing and patch contexts; negative indentation/CRLF cases in `atomic-fs:test`. |
+| 08–09 | Shared typed projections use real producer fields; real Git/stdin integration and `worker-prompts:test`. |
+| 10–11 | Reachable resolver, canonical groups, advertised bounded subscriptions with cancellation; `catalog:test`, `stdio:integration-test`. |
+| 12–13 | Shared reason guidance gives recovery and unknown settlement priority; `agent-audit:test`. |
+| 17–20 | Remove unused configuration duplicate; correct obsolete compatibility, JSON storage, concurrency, Linux isolation, and pinned comparison claims. |
+| 21–22 | Consumer link points to source testing guide; native fixture is repository-only; `package:test`, `macos-native-build:test`. |
+| 23 | Monotonic tool generation plus actual catalog digest; `architecture:test`, `catalog:test`. |
+| 24–26 | Shared strict parser, selected behavioral replacements, cohesive helper merges, pure effect verification; existing architecture and Computer Use trajectory fixtures remain required. Further source-string replacements and browser-domain decomposition are incremental maintenance, not proof of existing runtime defects. |
+| 27–28 | Short automation entry point, corrected topic contracts, advisory dependency-aware `check:changed`; `affected-checks:test` verifies conservative fallback and reports uncovered evidence classes. Large specialist references remain for operational detail. |
+| 29 | Wrangler 4.151.3 in both locked toolchains. Registry, signatures, package, private-toolchain and Worker dry-run evidence must pass before release; used production dependencies remain. |
+| 30 | Deterministic final-state workflows cover stale edits and accepted-job continuity; `agent-workflows:test`. These fixtures do not measure model task success rates. |
+| 31 | **Delivery-boundary hardening.** `mcp-response-proxy.ts` gates SSE heartbeat comments on complete frame boundaries (`\n\n` / `\r\n\r\n`) so heartbeats cannot split partial upstream chunks; idempotency-key job recovery remains the authoritative settlement path (`mcp-response-proxy:test`). |
+
+The research comparison records 51 unique pinned upstreams and seven primary papers in [COMPARATIVE_REVIEW.md](https://github.com/YuLeiFuYun/machine-bridge-mcp/blob/main/docs/COMPARATIVE_REVIEW.md). This is selected design/documentation evidence with explicit adoption boundaries, not an exhaustive source audit or transferred benchmark score.

package/docs/CLIENTS.md

@@ -116,12 +116,17 @@ Claude Desktop, Cursor, and many generic clients use a shape similar to:
         "/path/to/project",
         "--profile",
         "full"
-      ]
+      ],
+      "env": {
+        "MBM_PROGRESSIVE_TOOLS": "1"
+      }
     }
   }
 }
 ```
 
+Setting `MBM_PROGRESSIVE_TOOLS: "1"` selects opt-in progressive stdio discovery at startup. The initial nine tools include `resolve_task_capabilities`; use its validated `activate_tool_groups` names (`browser`, `app`, `jobs`, `git`, `process`, `diagnostics`, `skills`, `files`) to expose relevant policy-visible groups. Discovery advertises `tools.listChanged=true`. A client requesting `subscriptions/listen` with `notifications.toolsListChanged=true` receives an acknowledgement and subsequent `notifications/tools/list_changed` messages bound to that subscription ID; cancel the request to complete it. Without a subscription no unsolicited change notification is sent. The default full catalog remains static. Token savings depend on client formatting and tokenizer; no fixed savings claim is made.
+
 Use the exact output of `client-config`; application-specific configuration locations and UI flows can change.
 
 ## Codex configuration

package/docs/OPERATIONS.md

@@ -989,44 +989,11 @@ The elasticity marker remains process-local and never enters the waiter/lease sc
 Verification plans use the same rule through `MBM_CHECK_CONCURRENCY`; because their memory reservation is explicitly derived from fan-out, it contracts with the fitted worker count down to the plan's 2048 MiB floor instead of retaining a stale larger-worker reservation.
 An empty `MBM_CHECK_CONCURRENCY` has the runner's normal implicit/default meaning and may be replaced by the fitted worker count; a non-empty value outside the runner's `1..16` integer contract is preserved and classified unbounded rather than silently rewritten or charged as the default.
 Explicit worker counts and valid `CARGO_BUILD_JOBS`/`CMAKE_BUILD_PARALLEL_LEVEL` values are never shrunk; they are preserved and charged at their declared concurrency.
-Cargo's current jobs syntax is modeled exactly for explicit values: negative `--jobs`/`CARGO_BUILD_JOBS` values mean logical CPUs plus the negative offset, `default` means the logical-CPU default, CLI jobs override the environment, and arguments after Cargo's `--` separator do not alter build fan-out.
-Invalid, zero, nonpositive-after-offset, or out-of-contract values remain conservatively unbounded.
-When Cargo has no explicit jobs setting, Machine Bridge still keeps its own elastic ceiling rather than inheriting Cargo's unrestricted logical-CPU default.
-Maven thread settings include the 3.9+ `MAVEN_ARGS` environment layer as well as argv.
-Because Maven prepends `MAVEN_ARGS` before the user's CLI arguments and Commons CLI returns the first thread-option value, a thread option there is authoritative even if a later argv `-T` differs; Machine Bridge charges and preserves that first value instead of injecting a later ineffective cap.
-Core-multiplier forms such as `-T2.5C` are translated to Maven's current integer `multiplier × available processors` degree for admission accounting.
-Visible GNU make configuration in `GNUMAKEFLAGS`/`MAKEFLAGS` (including make's implicit leading dash, compact short-option clusters, and jobserver state) is likewise charged without injecting a higher-precedence replacement flag.
-Gradle fan-out follows its current configuration layers: `JAVA_OPTS` is applied before `GRADLE_OPTS` by the launcher, direct `-Dorg.gradle.workers.max=...`/`--system-prop=...` updates the system-property map after those JVM options, and `--max-workers` is the final build-option override.
-The last system-property value is charged when it is valid; a valid CLI `--max-workers` then supersedes that bound.
-Invalid final worker properties fail before the CLI build-option converter can recover them, while repeated or invalid `--max-workers` values also fail during command-line/build-option validation, so those forms use the lightweight pre-build validation profile rather than waiting for heavy capacity.
-Malformed JVM-option quoting and valid worker counts above Machine Bridge's modeled maximum remain fail-closed as unbounded.
-Go fan-out follows the current go command's own ordering and validation semantics: quoted `GOFLAGS` is applied first, direct `-p`/`--p` values then override it, and repeated numeric settings use the final effective value.
-`go test` build flags remain recognizable through its package-list parser but stop at `-args`/`--args`/`--` or once positional test arguments begin; ordinary `go build` stops flag parsing at its first package operand.
-A final nonpositive numeric `-p` is treated as lightweight pre-build validation because the go command rejects it before compiler fan-out, while malformed/non-numeric `GOFLAGS` is fatal before a later CLI value can recover it.
-If a direct `-p` could instead be the value of a preceding flag whose arity is not provable from the command shape, Machine Bridge fails closed as unbounded rather than using the validation fast path.
-SwiftPM fan-out now follows its scalar `UInt32` `@Option(.shortAndLong)` semantics: repeated `-j`/`--jobs` settings use the final value; `-j N`, `-j=N`, `--jobs N`, and `--jobs=N` are modeled, including `+N` values accepted by `UInt32`.
-A final zero remains unbounded because SwiftPM forwards zero to llbuild and llbuild substitutes hardware concurrency; a valid count above the modeled maximum is likewise unbounded unless a later scalar option replaces it.
-Direct missing, non-UInt32, or unsupported joined-short forms such as `-j8` use the lightweight pre-build validation profile, while shell-composed Swift is bounded only when the shell contains a single provable Swift segment; multi-segment or otherwise ambiguous compositions remain unbounded.
-Xcodebuild now distinguishes actual build/test invocations from its independent query, package-resolution, export/import, platform/component-maintenance, and other non-build modes before build-root handling, so commands such as `-help`, `-usage`, `-resolvePackageDependencies`, `-showBuildSettings`, and `-exportArchive` are never polluted by injected `-jobs` or `-derivedDataPath`.
-Non-build resource admission is workload-specific rather than the generic 0.5-CPU adaptive fallback: metadata/settings queries use a small adaptive profile; package resolution is a project-serialized mixed workload with a 4 GiB disk safety reservation; archive/localization/xcframework import-export is project-serialized I/O with an 8 GiB reservation; platform/component install/download/prepare operations are unbounded high-I/O with an 8 GiB minimum safety reservation; component deletion remains I/O-heavy but does not invent future disk consumption or receive the privileged disk-reclaim bypass.
-These disk figures are admission safety reservations, not claims that the native operation cannot consume more space.
-For build concurrency, current Xcode uses separated `-jobs NUMBER` for the native jobs option and accepts a leading `+` there.
-Lookalike `-jobs=...` tokens do not receive the same native jobs validation, so Machine Bridge never treats them as hard concurrency bounds.
-Canonical zero/negative separated values fail before building, and a second real `-jobs` option is rejected outright; those proven validation failures use the lightweight pre-build profile.
-Canonical positive separated values within the modeled range are charged exactly, while equals forms, noncanonical values that Xcode may parse by numeric prefix, and oversized values remain conservatively unbounded rather than being guessed into a hard ceiling.
-Xcode test/test-without-building remains overall unbounded even when build-phase `-jobs` is known, because the native command exposes independent destination concurrency and parallel-testing runner counts; a known/default build-phase cap is still enforced separately without pretending it bounds test execution.
-Direct Ninja `-j` now follows current getopt semantics rather than generic first-match parsing: repeated `-j` options use the final value, `-j0` is effectively infinite/unbounded, and negative/non-numeric jobs or the unsupported `--jobs` spelling use the lightweight pre-build validation path because Ninja exits before starting the build.
-Any valid positive direct `-jN` is an exact local worker bound and disables inherited jobserver participation.
-Ninja 1.13+ jobserver coordination is preserved when no direct `-j` is present and `MAKEFLAGS` contains a jobserver form Ninja actually supports: FIFO authentication on POSIX or semaphore authentication on Windows.
-A jobserver-aware Ninja root is treated as cooperative/unbounded for admission even when `MAKEFLAGS` also exposes `-jN`, because current Ninja can fail to initialize the inherited jobserver and then continue with its native local parallelism; Machine Bridge therefore does not claim that inherited token count is a hard execution ceiling or inject a local `-j`.
-The jobserver parser follows Ninja's current MAKEFLAGS rules: dry-run flag letters disable jobserver use, the last recognized auth/fds descriptor wins, negative descriptors disable the feature, POSIX pipe descriptors are rejected, and FIFO/semaphore modes are platform-specific.
-The preservation marker is process-local and never enters the schema-1 coordinator record.
-For pytest-xdist, explicit numeric `-n` is charged directly, `-n 0` is treated as single-process execution, and dynamic `-n auto`/`logical` remains unbounded unless an explicit `--maxprocesses=N` supplies a hard worker ceiling; environment auto-worker hints are not treated as hard limits because project hooks can override them.
-CMake build concurrency follows the current build-driver precedence rather than generic first-match parsing: repeated `-j`/`--parallel` options use the final CMake-level value, a positive CLI value overrides `CMAKE_BUILD_PARALLEL_LEVEL`, and invalid/zero/too-large pure CLI or environment values use the lightweight pre-build validation path because CMake rejects them before invoking the native build tool.
-A value-less `-j`/`--parallel` or defined-empty parallel environment remains unbounded because it delegates to the native tool.
-An uninspected `--preset` build or any native-tool arguments after CMake's `--` separator are also conservatively unbounded and are not rewritten with an injected worker cap: build presets can supply `jobs` and `nativeToolOptions`, while native options are generator-specific and can change fan-out independently of the CMake-level setting.
-Explicit concurrency forms that cannot be bounded safely (for example unlimited/value-less or out-of-contract fan-out) are treated conservatively as unbounded instead of being under-accounted.
-Shell-wrapped implicit Swift and generic builds that cannot be safely rewritten likewise remain unbounded; on POSIX, unbounded heavy work runs at a small positive nice increment to protect interactive responsiveness, while background heavy work uses the stronger background nice increment.
+Each supported build driver (`cargo`, `mvn`/`MAVEN_ARGS`, `gradle`/`JAVA_OPTS`/`GRADLE_OPTS`, `go`/`GOFLAGS`, `swift`, `xcodebuild`, `ninja`/`MAKEFLAGS`, `pytest-xdist`, and `cmake`) follows its native CLI/environment precedence:
+- Provable pre-build validation errors (for example negative/invalid worker flags or duplicate Xcode `-jobs` options) use the lightweight pre-build validation profile so they fail fast without waiting for heavy capacity.
+- Valid explicit worker counts within the modeled ceiling are charged at their effective concurrency; implicit builds without explicit concurrency use the coordinator's elastic ceiling.
+- Non-build `xcodebuild` invocations (`-help`, `-resolvePackageDependencies`, `-showBuildSettings`, `-exportArchive`, and component maintenance) are classified before build-root injection with workload-appropriate CPU/I/O/disk safety reservations.
+- Ambiguous, value-less, preset-driven, jobserver-inherited, or out-of-contract concurrency forms fail closed as `unbounded` rather than being under-accounted or rewritten; on POSIX, unbounded heavy roots run with a small positive `nice` increment, and background heavy roots use the stronger background `nice` increment.
 
 ## Upgrade behavior
 

package/docs/THREAT_MODEL.md

@@ -44,7 +44,7 @@ A client registration is not authority. Authority begins only after successful a
 
 Capability discovery is also an authorization boundary. Task routing and application/browser metadata are built from the effective account/daemon policy intersection, not from the daemon ceiling. Route scores and fallbacks are advisory and cannot manufacture authority; direct Bash remains available only when the effective policy already exposes it. A restricted account must not learn hidden local application inventory or receive names of unavailable execution tools through the resolver.
 
-Mirrored MCP headers are an intermediary-routing boundary. The Worker compares every required native current header with the JSON-RPC body before authorization-dependent dispatch; a mismatch fails with `-32020` before the daemon can observe the call. The reserved mirror namespace is closed as well: an inapplicable `Mcp-Name` or a `Mcp-Param-*` header that is not declared by the selected tool schema is rejected rather than ignored. Tool schemas are compiled from a bounded JSON Schema 2020-12 subset at startup and runtime traversal charges every array item and own object property to a fixed work budget. Open request metadata/capability JSON also has a fixed structural-node/depth/key budget. Remote HTTP advertises `tools.listChanged=true`. A supported `toolsListChanged` subscription receives the correlated acknowledgement and an initial list-change notification, then retains only bounded authority-scoped in-memory stream state until cancellation, revocation, observable abort, or the advertised ten-second lease. A request with no supported notification filter is acknowledged with an empty subset and completed immediately. Stdio advertises `listChanged=false` and completes validated subscription requests immediately. Unsupported dialects or keywords fail closed, external network `$ref` values are not dereferenced, and validation diagnostics omit argument values and unbounded caller identifiers.
+Mirrored MCP headers are an intermediary-routing boundary. The Worker compares every required native current header with the JSON-RPC body before authorization-dependent dispatch; a mismatch fails with `-32020` before the daemon can observe the call. The reserved mirror namespace is closed as well: an inapplicable `Mcp-Name` or a `Mcp-Param-*` header that is not declared by the selected tool schema is rejected rather than ignored. Tool schemas are compiled from a bounded JSON Schema 2020-12 subset at startup and runtime traversal charges every array item and own object property to a fixed work budget. Open request metadata/capability JSON also has a fixed structural-node/depth/key budget. Remote HTTP advertises `tools.listChanged=true`. A supported `toolsListChanged` subscription receives the correlated acknowledgement and an initial list-change notification, then retains only bounded authority-scoped in-memory stream state until cancellation, revocation, observable abort, or the advertised ten-second lease. A request with no supported notification filter is acknowledged with an empty subset and completed immediately. Default full stdio advertises `listChanged=false` and completes validated subscription requests immediately. Opt-in progressive stdio advertises list changes, bounds active subscriptions to 32, correlates notifications to accepted subscription IDs and completes them on cancellation or EOF. Unsupported dialects or keywords fail closed, external network `$ref` values are not dereferenced, and validation diagnostics omit argument values and unbounded caller identifiers.
 
 Current response-stream cancellation deliberately crosses the OAuth boundary only through an unguessable internal stream capability. The public Worker strips caller-provided control headers before the service binding, the cancellation request contains no bearer token or DPoP proof, and the Durable Object consumes the capability before OAuth only to cancel a currently indexed call. Guessing remains bounded by 256-bit randomness; a compromised service binding or Worker runtime is already inside this trust boundary.
 
@@ -165,6 +165,10 @@ Machine Bridge does not claim to provide:
 - third-party public binary-store identity or independent distributor attestations;
 - independent human review while the project has only one active maintainer.
 
+### Untrusted project memory and lexical indexing
+
+Memory and symbol outlines use bounded protected regular-file reads, request-scoped path authority and cancellation. Memory must remain canonically inside its project scope; symbolic/hard links, changing identities, oversized inputs and invalid metadata fail closed or return an explicit unavailable/invalid status without a body. It is loaded only on demand and does not become execution authority. Lexical indexing bounds traversal entries, depth, per-file bytes, aggregate bytes and rendered lines; parameter values and hidden external paths are not copied into its output. These controls do not certify that user-authored instructions, skill content or memory are trustworthy.
+
 ## Residual risks
 
 ### Owner and canonical `full`