septum 0.1.7 → 0.1.8

package/src/mcp/tools/boundary.ts

@@ -0,0 +1,17 @@
+import type { BoundaryEvaluator } from "../../core/boundary/evaluator.ts";
+import type { ValidatedSeptumConfig } from "../../core/config/schema.ts";
+import type { SeptumRepository } from "../../core/database/repository.ts";
+import type { BoundaryToolArgs } from "../schemas.ts";
+import { handleCheckBoundary } from "./check-boundary.ts";
+
+export type { BoundaryToolArgs };
+
+export async function handleBoundaryTool(
+  evaluator: BoundaryEvaluator,
+  config: ValidatedSeptumConfig,
+  args: BoundaryToolArgs,
+  repo?: SeptumRepository,
+  workspaceRoot?: string
+) {
+  return await handleCheckBoundary(evaluator, config, args as any, repo, workspaceRoot);
+}

package/src/mcp/tools/check-boundary.ts

@@ -3,8 +3,9 @@ import { auditStagedFiles } from "../../core/boundary/staged-auditor.ts";
 import type { BoundaryEvaluator } from "../../core/boundary/evaluator.ts";
 import type { ValidatedSeptumConfig } from "../../core/config/schema.ts";
 import type { SeptumRepository } from "../../core/database/repository.ts";
+import { SessionManager } from "../../core/session/session-manager.ts";
 import type { BoundaryViolation } from "../../types/index.ts";
-import { normalizeBoundaryArgs, type CheckBoundaryArgs } from "../schemas.ts";
+import { CheckBoundarySchema, type CheckBoundaryArgs } from "../schemas.ts";
 
 export type { CheckBoundaryArgs } from "../schemas.ts";
 
@@ -15,11 +16,56 @@ export async function handleCheckBoundary(
   repo?: SeptumRepository,
   workspaceRoot?: string
 ) {
-  const args = (normalizeBoundaryArgs(rawArgs ?? {}) ?? {}) as CheckBoundaryArgs & Record<string, unknown>;
+  const args = CheckBoundarySchema.parse(rawArgs ?? {});
+  if (args.domain) {
+    const domain = Object.keys(config.domains || {}).find(name => name.toLowerCase() === args.domain!.toLowerCase());
+    if (!domain) throw new Error(`Unknown boundary domain '${args.domain}'. Choose a registered domain.`);
+    args.domain = domain;
+  }
   const root = workspaceRoot || args.workspace_path || process.cwd();
   const proposedImports = args.proposed_imports ?? [];
-  const featureKey = args.feature_key;
 
+  const activeSession = SessionManager.getActiveSession(root);
+
+  let effectiveFeatureKey = args.feature_key;
+  if (activeSession) {
+    if (args.feature_key && args.feature_key !== activeSession.feature_key) {
+      throw new Error(
+        `Active feature lock is '${activeSession.feature_key}' (owner: ${activeSession.owner_id}). Cannot check boundaries for different feature '${args.feature_key}' while another feature is locked.`
+      );
+    }
+    effectiveFeatureKey = activeSession.feature_key;
+    if (!config.features) config.features = {};
+    if (!config.features[activeSession.feature_key]) {
+      config.features[activeSession.feature_key] = {
+        domain: activeSession.domain,
+        description: `Active session: ${activeSession.feature_key}`,
+        allowed_touchpoints: activeSession.touchpoints,
+        reuse_symbols: [],
+        input_contract: {},
+        output_contract: {},
+      };
+    }
+  }
+
+  const syncState = repo?.getMeta("sync_state");
+  const syncError = repo?.getMeta("sync_error");
+  if (!syncState || syncState === "running" || syncState === "error" || syncState !== "complete" || syncError) {
+    return {
+      content: [
+        {
+          type: "text" as const,
+          text: JSON.stringify({
+            status: "unknown",
+            sync_state: syncState || "unindexed",
+            sync_error: syncError || undefined,
+            message: "Boundary audit is incomplete because workspace synchronization has not completed.",
+          }),
+        },
+      ],
+    };
+  }
+  const skipped = JSON.parse(repo?.getMeta("skipped_files") || "[]") as {path: string; reason: string}[];
   const unsupported = JSON.parse(repo?.getMeta("unsupported_files") || "[]") as string[];
   const requested = [...(Array.isArray(args.file_path) ? args.file_path : args.file_path ? [args.file_path] : []), ...(args.file_paths || [])]
     .map(file => relative(root, resolve(root, file)).replace(/\\/g, "/"));
@@ -27,6 +73,13 @@ export async function handleCheckBoundary(
     (!args.domain || evaluator.resolveSourceDomain(file, config) === args.domain) &&
     (requested.length === 0 || requested.includes(file))
   );
+  const relevantSkipped = skipped.filter(file =>
+    (!args.domain || evaluator.resolveSourceDomain(file.path, config) === args.domain) &&
+    (requested.length === 0 || requested.includes(file.path))
+  );
+  if (relevantSkipped.length > 0 && args.scope !== "staged" && !args.staged) {
+    return { content: [{type: "text" as const, text: JSON.stringify({status: "unknown", skipped_files: relevantSkipped, message: "Boundary audit is incomplete because source files exceed resource limits."})}] };
+  }
   if (relevantUnsupported.length > 0 && args.scope !== "staged" && !args.staged) {
     return { content: [{ type: "text" as const, text: JSON.stringify({ status: "unknown", unsupported_files: relevantUnsupported, message: "Boundary audit is incomplete because source files have no supported parser." }) }] };
   }
@@ -48,9 +101,9 @@ export async function handleCheckBoundary(
       args.scope ?? (args.staged ? "staged" : args.domain ? "domain" : "all");
 
     if (effectiveScope === "staged") {
-      const { files: stagedFiles, violations: stagedViolations } = await auditStagedFiles(evaluator, config, root, featureKey, repo);
+      const { files: stagedFiles, violations: stagedViolations } = await auditStagedFiles(evaluator, config, root, effectiveFeatureKey, repo);
 
-      if (stagedFiles.length === 0) {
+      if (stagedFiles.length === 0 && stagedViolations.length === 0) {
         return {
           content: [
             {
@@ -117,6 +170,25 @@ export async function handleCheckBoundary(
     }
 
     // Scope: "all" or "domain"
+    if (args.feature_key) {
+      return {
+        content: [
+          {
+            type: "text" as const,
+            text: JSON.stringify(
+              {
+                status: "rejected",
+                scope: effectiveScope,
+                message: `Scope '${effectiveScope}' is an architectural audit across domains and does not support feature touchpoint validation ('feature_key'). Feature scopes only apply to 'file', 'batch', or 'staged'.`,
+              },
+              null,
+              2
+            ),
+          },
+        ],
+      };
+    }
+
     let violations = evaluator.auditCodebase(config);
     if (args.domain) {
       const targetDom = args.domain.toLowerCase();
@@ -157,7 +229,7 @@ export async function handleCheckBoundary(
                     args.domain ? ` in domain '${args.domain}'` : " across codebase"
                   }.`
                 : domainCount === 0
-                ? "No boundary violations detected. [Septum Notice: Domain catalog is currently unindexed. Run 'septum_register_domain' to initialize bounded contexts.]"
+                ? "No boundary violations detected. [Septum Notice: Domain catalog is currently unindexed. Run 'septum_domain' with action='register' to initialize bounded contexts.]"
                 : `All domain boundaries are clean${
                     args.domain ? ` for domain '${args.domain}'` : ""
                   }. Zero cross-domain leaks or circular dependencies detected.`,
@@ -173,7 +245,7 @@ export async function handleCheckBoundary(
   // Multi-file batch evaluation
   if (filesToCheck.length > 1) {
     const results = filesToCheck.map((filePath) => {
-      const violations = evaluator.evaluate(filePath, proposedImports, featureKey, config);
+      const violations = evaluator.evaluate(filePath, proposedImports, effectiveFeatureKey, config);
       const impact = repo?.getFileInboundImpact(filePath);
       return {
         file: filePath,
@@ -206,7 +278,7 @@ export async function handleCheckBoundary(
               message: hasViolations
                 ? `${totalViolations} boundary violation(s) detected across ${filesToCheck.length} file(s).`
                 : Object.keys(config?.domains || {}).length === 0
-                ? `All ${filesToCheck.length} file(s) approved. [Septum Notice: Domain catalog is currently unindexed. Run 'septum_register_domain' to initialize bounded contexts.]`
+                ? `All ${filesToCheck.length} file(s) approved. [Septum Notice: Domain catalog is currently unindexed. Run 'septum_domain' with action='register' to initialize bounded contexts.]`
                 : `All ${filesToCheck.length} file(s) approved. No boundary violations detected.`,
             },
             null,
@@ -219,7 +291,7 @@ export async function handleCheckBoundary(
 
   // Single file evaluation (backward-compatible output)
   const singleFile = filesToCheck[0];
-  const violations = evaluator.evaluate(singleFile, proposedImports, featureKey, config);
+  const violations = evaluator.evaluate(singleFile, proposedImports, effectiveFeatureKey, config);
   const impact = repo?.getFileInboundImpact(singleFile);
 
   if (violations.length > 0) {
@@ -243,7 +315,7 @@ export async function handleCheckBoundary(
                 : undefined,
               message:
                 Object.keys(config?.domains || {}).length === 0
-                  ? "Boundary integrity check failed: Domain catalog is currently unindexed. Run 'septum_register_domain' to initialize bounded contexts."
+                  ? "Boundary integrity check failed: Domain catalog is currently unindexed. Run 'septum_domain' with action='register' to initialize bounded contexts."
                   : violations.some((v) => v.rule === "unmapped_domain")
                   ? "Boundary integrity check failed: File does not belong to any declared bounded context."
                   : "Boundary violation detected. Proposed imports violate bounded context architecture.",
@@ -274,7 +346,7 @@ export async function handleCheckBoundary(
               : undefined,
             message:
               Object.keys(config?.domains || {}).length === 0
-                ? "No boundary violations detected. [Septum Notice: Domain catalog is currently unindexed. Run 'septum_register_domain' to initialize bounded contexts.]"
+                ? "No boundary violations detected. [Septum Notice: Domain catalog is currently unindexed. Run 'septum_domain' with action='register' to initialize bounded contexts.]"
                 : impact && impact.direct_dependents_count > 0
                 ? `No boundary violations detected. Caution: ${impact.direct_dependents_count} dependent file(s) consume this file.`
                 : "No boundary violations detected. Proposed imports are permissible.",

package/src/mcp/tools/domain.ts

@@ -0,0 +1,40 @@
+import type { ValidatedSeptumConfig } from "../../core/config/schema.ts";
+import type { SeptumRepository } from "../../core/database/repository.ts";
+import type { DomainToolArgs } from "../schemas.ts";
+import { handleGetDomainCatalog } from "./get-domain-catalog.ts";
+import { handleRegisterDomain } from "./register-domain.ts";
+import { handleGetEnvironmentTopology } from "./get-environment-topology.ts";
+
+export type { DomainToolArgs };
+
+export async function handleDomainTool(
+  repo: SeptumRepository,
+  config: ValidatedSeptumConfig,
+  args: DomainToolArgs,
+  workspaceRoot?: string,
+  signal?: AbortSignal
+) {
+  const action = args.action || "catalog";
+
+  switch (action) {
+    case "register":
+      return await handleRegisterDomain(repo, config, args, workspaceRoot, signal);
+
+    case "topology":
+      return handleGetEnvironmentTopology(
+        repo,
+        config,
+        {
+          resolve: args.resolve,
+          resolveNode: args.resolve_node,
+          refresh: args.refresh,
+          workspace_path: args.workspace_path,
+        },
+        workspaceRoot || args.workspace_path || process.cwd()
+      );
+
+    case "catalog":
+    default:
+      return handleGetDomainCatalog(repo, config, args, workspaceRoot);
+  }
+}

package/src/mcp/tools/feature.ts

@@ -0,0 +1,67 @@
+import type { ValidatedSeptumConfig } from "../../core/config/schema.ts";
+import type { SeptumRepository } from "../../core/database/repository.ts";
+import type { FeatureToolArgs } from "../schemas.ts";
+import { handleGetFeatureContext, handleClearFeatureContext } from "./get-feature-context.ts";
+import { handleRegisterFeature } from "./register-feature.ts";
+
+export type { FeatureToolArgs };
+
+export async function handleFeatureTool(
+  repo: SeptumRepository,
+  config: ValidatedSeptumConfig,
+  args: FeatureToolArgs,
+  workspaceRoot?: string
+) {
+  const action = args.action || "get";
+
+  switch (action) {
+    case "lock":
+      return await handleRegisterFeature(
+        repo,
+        config,
+        {
+          feature_key: args.feature_key || args.feature || "",
+          feature: args.feature || args.feature_key || "",
+          domain: args.domain || args.domain_name || "",
+          domain_name: args.domain_name || args.domain || "",
+          description: args.description,
+          allowed_touchpoints: args.allowed_touchpoints,
+          reuse_symbols: args.reuse_symbols,
+          input_contract: args.input_contract,
+          output_contract: args.output_contract,
+          workspace_path: args.workspace_path,
+        },
+        workspaceRoot || args.workspace_path || process.cwd()
+      );
+
+    case "release": {
+      const cleared = handleClearFeatureContext(
+        workspaceRoot || args.workspace_path || process.cwd(),
+        Boolean(args.force)
+      );
+      return {
+        content: [
+          {
+            type: "text" as const,
+            text: cleared
+              ? "Active feature session successfully released."
+              : "No active feature session found to release.",
+          },
+        ],
+      };
+    }
+
+    case "get":
+    default:
+      return handleGetFeatureContext(
+        repo,
+        config,
+        {
+          feature_key: args.feature_key || args.feature,
+          feature: args.feature || args.feature_key,
+          workspace_path: args.workspace_path,
+        },
+        workspaceRoot || args.workspace_path || process.cwd()
+      );
+  }
+}

package/src/mcp/tools/get-domain-catalog.ts

@@ -18,6 +18,8 @@ export function handleGetDomainCatalog(
   const indexStatus = {
     unsupported_files: JSON.parse(repo.getMeta("unsupported_files") || "[]"),
     watcher_mode: repo.getMeta("watcher_mode") || "manual",
+    sync_state: repo.getMeta("sync_state") || "unknown",
+    skipped_files: JSON.parse(repo.getMeta("skipped_files") || "[]"),
   };
 
   if (!domainName) {
@@ -29,15 +31,16 @@ export function handleGetDomainCatalog(
         total_domains: 0,
         message: `Workspace '${root}' belum memiliki domain terdaftar dalam Septum catalog.`,
         suggested_action: {
-          tool: "septum_register_domain",
+          tool: "septum_domain",
           params: {
+            action: "register",
             name: "core",
             root: "src",
             ingest_now: true,
           },
         },
         agent_guidance:
-          "Panggil tool 'septum_register_domain(name: \"core\", root: \"src\", ingest_now: true)' untuk mendaftarkan dan mengindeks domain utama secara otomatis, atau jalankan 'septum init' di terminal workspace.",
+          "Panggil tool 'septum_domain(action: \"register\", name: \"core\", root: \"src\", ingest_now: true)' untuk mendaftarkan dan mengindeks domain utama secara otomatis, atau jalankan 'septum init' di terminal workspace.",
       };
       return {
         content: [
@@ -75,7 +78,7 @@ export function handleGetDomainCatalog(
         forbidden_dependencies: JSON.parse(d.forbidden_deps_json || "[]"),
       })),
       agent_instruction:
-        "Macro semantic map loaded from SQLite SSOT. Use 'septum_get_domain_catalog' with domain='<name>' for granular file/symbol catalogs, or 'septum_trace_vertical_slice' with query='<route|command|intent>' for end-to-end execution flow.",
+        "Macro semantic map loaded from SQLite SSOT. Use 'septum_domain' with domain='<name>' for granular file/symbol catalogs, or 'septum_slice' with query='<route|command|intent>' for end-to-end execution flow.",
     };
 
     return {
@@ -111,8 +114,8 @@ export function handleGetDomainCatalog(
       available_domains: available,
       suggestions: suggestions.length > 0 ? suggestions : available,
       suggested_action: {
-        tool: "septum_register_domain",
-        params: { domain: domainName, root: `src/domains/${domainName}` },
+        tool: "septum_domain",
+        params: { action: "register", domain: domainName, root: `src/domains/${domainName}` },
       },
     };
     return {
@@ -144,7 +147,7 @@ function recordCatalogAccess(domain: string, projectRoot: string = process.cwd()
   try {
     const septumDir = path.resolve(projectRoot, ".septum");
     if (!fs.existsSync(septumDir)) {
-      fs.mkdirSync(septumDir, { recursive: true });
+      return;
     }
     const logPath = path.join(septumDir, "catalog_access.json");
     let log: { domains?: Record<string, string>; features?: Record<string, string> } = {};

package/src/mcp/tools/get-environment-topology.ts

@@ -122,9 +122,9 @@ export function handleGetEnvironmentTopology(
       output += `- ${q}\n`;
     }
     output += `\n*Untuk mengunci jawaban pengguna ke SQLite SSOT, panggil kembali tool ini dengan argumen:*\n`;
-    output += `\`septum_get_environment_topology(resolve: { layer: "<layer_name>", platform: "<platform_name>" })\`\n`;
+    output += `\`septum_domain(action: "topology", resolve: { layer: "<layer_name>", platform: "<platform_name>" })\`\n`;
     output += `*atau untuk entitas terdistribusi:*\n`;
-    output += `\`septum_get_environment_topology(resolveNode: { id: "<node_id>", layer: "<layer>", name: "<name>", platform: "<platform>", domain_or_ip: "<domain_or_ip>", role: "<role>" })\`\n`;
+    output += `\`septum_domain(action: "topology", resolve_node: { id: "<node_id>", layer: "<layer>", name: "<name>", platform: "<platform>", domain_or_ip: "<domain_or_ip>", role: "<role>" })\`\n`;
   }
 
   return {

package/src/mcp/tools/get-feature-context.ts

@@ -8,8 +8,11 @@ import type { GetFeatureContextArgs } from "../schemas.ts";
 
 export type { GetFeatureContextArgs } from "../schemas.ts";
 
-export function handleClearFeatureContext(workspaceRoot: string = process.cwd()): boolean {
-  return SessionManager.clearActiveSession(workspaceRoot);
+export function handleClearFeatureContext(
+  workspaceRoot: string = process.cwd(),
+  force: boolean = false
+): boolean {
+  return SessionManager.clearActiveSession(workspaceRoot, undefined, force);
 }
 
 export function handleGetFeatureContext(
@@ -41,7 +44,7 @@ export function handleGetFeatureContext(
               status: "prompt",
               message: "No feature specified. Please specify 'feature_key' from the registered features below or trace routes.",
               available_features: available.length > 0 ? available : [],
-              instructions: "Call 'septum_get_feature_context({ feature_key: \"<name>\" })' or register a new feature with 'septum_register_feature'.",
+              instructions: "Call 'septum_feature({ action: \"get\", feature_key: \"<name>\" })' or lock a feature with 'septum_feature({ action: \"lock\", feature_key: \"<name>\", domain: \"<domain>\" })'.",
             },
             null,
             2
@@ -127,8 +130,8 @@ export function handleGetFeatureContext(
                 feature_key: featureKey,
                 message: `Feature '${featureKey}' not found in configuration or vertical slices. Available features: [${availableStr}].`,
                 recovery_options: [
-                  `septum_register_feature({ feature_key: "${featureKey}", domain: "<domain_name>", allowed_touchpoints: ["path/to/file"] })`,
-                  `septum_trace_vertical_slice({ entry_file: "routes/web.php" })`,
+                  `septum_feature({ action: "lock", feature_key: "${featureKey}", domain: "<domain_name>", allowed_touchpoints: ["path/to/file"] })`,
+                  `septum_slice({ query: "routes/web.php" })`,
                 ],
               },
               null,
@@ -140,13 +143,7 @@ export function handleGetFeatureContext(
     }
   }
 
-  // Record Active Feature Session Lease (.septum/session.json)
-  SessionManager.saveActiveSession(workspaceRoot, {
-    feature_key: featureKey,
-    domain: featureConfig.domain,
-    touchpoints: featureConfig.allowed_touchpoints ?? [],
-    locked_at: new Date().toISOString(),
-  });
+  // MCP-14: handleGetFeatureContext is strictly read-only and does not mutate session leases
 
   // Deterministically fetch signatures, methods, and properties for reuse_symbols from SQLite
   const reuseSymbolsWithMeta: FeatureContextResponse["reuse_symbols"] = [];

package/src/mcp/tools/get-symbol-impact.ts

@@ -6,7 +6,7 @@ export function handleGetSymbolImpact(
   repo: SeptumRepository,
   _config: ValidatedSeptumConfig,
   args: GetSymbolImpactArgs,
-  _workspaceRoot?: string
+  workspaceRoot?: string
 ) {
   const symbol = (args.symbol || (args as unknown as Record<string, unknown>).query || "").toString().trim();
   if (!symbol) {
@@ -15,7 +15,10 @@ export function handleGetSymbolImpact(
     );
   }
 
-  const impact = repo.getSymbolImpact(symbol);
+  const impact = repo.getSymbolImpact(symbol, {
+    domain: args.domain,
+    workspaceRoot: workspaceRoot || args.workspace_path,
+  });
 
   return {
     content: [

package/src/mcp/tools/get-symbol.ts

@@ -7,7 +7,7 @@ export function handleGetSymbol(
   repo: SeptumRepository,
   _config: ValidatedSeptumConfig,
   args: GetSymbolArgs,
-  _workspaceRoot?: string
+  workspaceRoot?: string
 ) {
   const symbol = (args.symbol || (args as unknown as Record<string, unknown>).query || "").toString().trim();
   if (!symbol) {
@@ -19,6 +19,7 @@ export function handleGetSymbol(
   const details = repo.getSymbolDetails(symbol, {
     domain: args.domain,
     includeDependencies: args.include_dependencies,
+    workspaceRoot: workspaceRoot || args.workspace_path,
   });
 
   if (details) {

package/src/mcp/tools/locate-symbol.ts

@@ -43,11 +43,11 @@ export async function handleLocateSymbol(
         query,
         message: `Workspace '${root}' belum terindeks dalam Septum catalog.`,
         suggested_action: {
-          tool: "septum_register_domain",
-          params: { name: "core", root: "src", ingest_now: true },
+          tool: "septum_domain",
+          params: { action: "register", name: "core", root: "src", ingest_now: true },
         },
         agent_guidance:
-          "Panggil tool 'septum_register_domain(name: \"core\", root: \"src\", ingest_now: true)' untuk mendaftarkan dan mengindeks codebase ini, atau jalankan 'septum init' di terminal workspace.",
+          "Panggil tool 'septum_domain(action: \"register\", name: \"core\", root: \"src\", ingest_now: true)' untuk mendaftarkan dan mengindeks codebase ini, atau jalankan 'septum init' di terminal workspace.",
       };
 
       return {

package/src/mcp/tools/register-domain.ts

@@ -1,6 +1,7 @@
 import type { ValidatedSeptumConfig } from "../../core/config/schema.ts";
 import type { SeptumRepository } from "../../core/database/repository.ts";
 import { IngestionPipeline, type IngestionMetrics } from "../../core/ingestion/pipeline.ts";
+import { assertPathContained } from "../../core/resolver/path-resolver.ts";
 import type { RegisterDomainArgs } from "../schemas.ts";
 
 export type { RegisterDomainArgs } from "../schemas.ts";
@@ -9,24 +10,39 @@ export async function handleRegisterDomain(
   repo: SeptumRepository,
   config: ValidatedSeptumConfig,
   args: Partial<RegisterDomainArgs>,
-  workspaceRoot: string = process.cwd()
+  workspaceRoot: string = process.cwd(),
+  signal?: AbortSignal
 ) {
+  signal?.throwIfAborted();
   const domainName = (args.domain || args.name || "").trim();
   if (!domainName || !args.root) {
     throw new Error("Missing required arguments: 'domain' (or 'name') and 'root' are required.");
   }
 
+  // SV-02: Enforce workspace containment (reject traversal/absolute/symlink escape)
+  assertPathContained(args.root, workspaceRoot, "Domain root");
+  signal?.throwIfAborted();
+
   const domainConfig = {
     root: args.root,
     description: args.description || `Domain: ${domainName}`,
-    allowed_dependencies: args.allowed_dependencies || [],
-    forbidden_dependencies: args.forbidden_dependencies || [],
-    archetypes: args.archetypes || {},
+    allowed_dependencies: args.allowed_dependencies,
+    forbidden_dependencies: args.forbidden_dependencies,
+    archetypes: args.archetypes,
   };
 
   const domainId = repo.domains.upsertDomain(domainName, domainConfig);
+  const stored = repo.domains.getDomainByName(domainName);
+  const canonicalName = stored?.name || domainName;
+  const finalConfig = {
+    root: stored?.root_path || domainConfig.root,
+    description: domainConfig.description,
+    allowed_dependencies: stored ? JSON.parse(stored.allowed_deps_json || "[]") : (domainConfig.allowed_dependencies || []),
+    forbidden_dependencies: stored ? JSON.parse(stored.forbidden_deps_json || "[]") : (domainConfig.forbidden_dependencies || []),
+    archetypes: stored ? JSON.parse(stored.archetypes_json || "{}") : (domainConfig.archetypes || {}),
+  };
 
-  config.domains[domainName] = domainConfig;
+  config.domains[canonicalName] = finalConfig;
 
   let ingestionMetrics: IngestionMetrics | null = null;
   if (args.ingest_now) {
@@ -41,13 +57,13 @@ export async function handleRegisterDomain(
         text: JSON.stringify(
           {
             status: "success",
-            message: `Domain '${domainName}' successfully registered in SQLite SSOT.${
+            message: `Domain '${canonicalName}' successfully registered in SQLite SSOT.${
               args.ingest_now ? " Initial ingestion completed." : ""
             }`,
             domain_id: domainId,
-            domain: domainName,
-            name: domainName,
-            config: domainConfig,
+            domain: canonicalName,
+            name: canonicalName,
+            config: finalConfig,
             ...(ingestionMetrics ? { ingestion_metrics: ingestionMetrics } : {}),
           },
           null,

package/src/mcp/tools/register-feature.ts

@@ -18,6 +18,16 @@ export async function handleRegisterFeature(
     throw new Error("Missing required arguments: 'feature_key' and 'domain' are required.");
   }
 
+  // MCP-15: Validate domain is registered in DB or config
+  const registeredDomain = repo.getDomainByName(domain);
+  const configDomain = Object.keys(config.domains || {}).find(
+    (d) => d.toLowerCase() === domain.toLowerCase()
+  );
+  if (!registeredDomain && !configDomain) {
+    throw new Error(`Domain '${domain}' is not registered. Cannot lock feature to an unknown domain.`);
+  }
+  const canonicalDomain = registeredDomain?.name || configDomain || domain;
+
   const rawTouchpoints = args.allowed_touchpoints ?? [];
   const allowedTouchpoints = Array.isArray(rawTouchpoints)
     ? rawTouchpoints
@@ -25,6 +35,18 @@ export async function handleRegisterFeature(
     ? [rawTouchpoints]
     : [];
 
+  // MCP-15: Validate supported touchpoint glob patterns (exact, /*, /**)
+  for (const tp of allowedTouchpoints) {
+    const normalized = tp.replace(/\\/g, "/");
+    if (normalized.includes("*")) {
+      if (!normalized.endsWith("/*") && !normalized.endsWith("/**") && normalized !== "*" && normalized !== "**") {
+        throw new Error(
+          `Unsupported touchpoint glob pattern '${tp}'. Septum touchpoints support exact paths, '/*', and '/**'.`
+        );
+      }
+    }
+  }
+
   const rawReuse = args.reuse_symbols;
   const reuseSymbols: string[] = Array.isArray(rawReuse)
     ? rawReuse
@@ -33,7 +55,7 @@ export async function handleRegisterFeature(
     : [];
 
   const featureConfig = {
-    domain,
+    domain: canonicalDomain,
     description: args.description || `Feature: ${featureKey}`,
     allowed_touchpoints: allowedTouchpoints,
     reuse_symbols: reuseSymbols,
@@ -41,32 +63,27 @@ export async function handleRegisterFeature(
     output_contract: args.output_contract || {},
   };
 
-  // Record Active Feature Session Lease (.septum/session.json)
   SessionManager.saveActiveSession(workspaceRoot, {
     feature_key: featureKey,
-    domain,
+    domain: canonicalDomain,
     touchpoints: featureConfig.allowed_touchpoints,
     locked_at: new Date().toISOString(),
+  }, SessionManager.getOwnerId(), {
+    repo,
+    save: () => {
+      const existingRaw = repo.getMeta("features_json");
+      const featuresMap = existingRaw ? JSON.parse(existingRaw) : {};
+      featuresMap[featureKey] = featureConfig;
+      repo.setMeta("features_json", JSON.stringify(featuresMap));
+    },
   });
 
+  // 3. Update in-memory config only after both SQLite and session lease succeeded
   if (!config.features) {
     config.features = {};
   }
   config.features[featureKey] = featureConfig;
 
-  if (typeof (repo as any)?.upsertFeature === "function") {
-    (repo as any).upsertFeature(featureKey, featureConfig);
-  } else if (typeof repo?.setMeta === "function") {
-    try {
-      const existingRaw = repo.getMeta("features_json");
-      const featuresMap = existingRaw ? JSON.parse(existingRaw) : {};
-      featuresMap[featureKey] = featureConfig;
-      repo.setMeta("features_json", JSON.stringify(featuresMap));
-    } catch {
-      // Ignore meta persistence errors on mock repositories
-    }
-  }
-
 
 
   return {
@@ -79,7 +96,7 @@ export async function handleRegisterFeature(
             message: `Feature '${featureKey}' successfully registered in SQLite SSOT and session lease established.`,
             feature_key: featureKey,
             feature: featureKey,
-            domain,
+            domain: canonicalDomain,
             touchpoints: featureConfig.allowed_touchpoints,
             reuse_symbols: featureConfig.reuse_symbols,
           },

package/src/mcp/tools/slice.ts

@@ -0,0 +1,15 @@
+import type { ValidatedSeptumConfig } from "../../core/config/schema.ts";
+import type { SeptumRepository } from "../../core/database/repository.ts";
+import type { SliceToolArgs } from "../schemas.ts";
+import { handleTraceVerticalSlice } from "./trace-vertical-slice.ts";
+
+export type { SliceToolArgs };
+
+export function handleSliceTool(
+  repo: SeptumRepository,
+  config: ValidatedSeptumConfig,
+  args: SliceToolArgs,
+  workspaceRoot?: string
+) {
+  return handleTraceVerticalSlice(repo, config, args, workspaceRoot);
+}