vgxness 1.12.0 → 1.13.0

package/dist/mcp/provider-doctor.js

@@ -7,7 +7,7 @@ import { inspectClaudeCodeUserMcpConfig } from './claude-code-user-config.js';
 import { inspectClaudeUserMemory } from './claude-code-user-memory.js';
 import { vgxnessOpenCodeDefaultAgent, vgxnessOpenCodeSddSubagents } from './opencode-default-agent-config.js';
 import { buildCanonicalAgentManifestDiagnostic } from './provider-canonical-agent-manifest.js';
-import { normalizeProviderHealthInput, PROVIDER_HEALTH_SAFETY, CLAUDE_USER_GLOBAL_SCOPE_CAPABILITIES, classifyProviderConfigPaths, providerHealthFailure, providerRuntimeContext, isUserGlobalScope, REQUIRED_PROVIDER_NATIVE_MCP_TOOLS, rollupProviderDoctor, } from './provider-health-types.js';
+import { normalizeProviderHealthInput, PROVIDER_HEALTH_SAFETY, CLAUDE_USER_GLOBAL_SCOPE_CAPABILITIES, classifyProviderConfigPaths, providerEvidence, providerHealthFailure, providerRuntimeContext, isUserGlobalScope, REQUIRED_PROVIDER_NATIVE_MCP_TOOLS, rollupProviderDoctor, } from './provider-health-types.js';
 import { inspectOpenCodeConfigPaths } from './provider-status.js';
 export class ProviderDoctorService {
     deps;
@@ -28,6 +28,7 @@ export class ProviderDoctorService {
         const before = snapshotPaths(paths.map((path) => path.path), normalized.workspaceRoot);
         const readableJson = paths.filter((path) => path.parsed);
         const config = readFirstConfig(readableJson[0]?.path);
+        const evidence = providerEvidence({ staticManifestKnown: true, renderedConfigExpected: true, configPathInspected: paths.length > 0 });
         const checks = [
             {
                 id: 'workspace-root',
@@ -42,7 +43,7 @@ export class ProviderDoctorService {
             subagentsCheck(config),
             delegationCheck(config),
             { id: 'mcp-current-call', status: 'pass', detail: 'Current MCP call reached the VGXNESS control-plane.' },
-            { id: 'mcp-required-tools', status: 'pass', detail: `Required provider-native tools are registered: ${REQUIRED_PROVIDER_NATIVE_MCP_TOOLS.join(', ')}.` },
+            { id: 'mcp-required-tools', status: 'pass', detail: `Static VGXNESS manifest expects provider-native tools: ${REQUIRED_PROVIDER_NATIVE_MCP_TOOLS.join(', ')}. MCP host tool presence was not verified.` },
             promptContractCheck(config, normalized.expectedPromptContractVersion),
             readonlySafetyCheck(before, snapshotPaths(paths.map((path) => path.path), normalized.workspaceRoot)),
         ];
@@ -54,8 +55,8 @@ export class ProviderDoctorService {
             : paths.filter((path) => path.exists || path.status !== 'not-configured').map((path) => path.path);
         const failedChecks = checks.filter((check) => check.status === 'fail').map((check) => check.id);
         const recommendations = checks.flatMap((check) => (check.remediation === undefined ? [] : [check.remediation]));
-        const originalBytes = Buffer.byteLength(JSON.stringify({ checks, checkedPaths: paths.map((path) => path.path) }), 'utf8');
-        const compactBytes = Buffer.byteLength(JSON.stringify({ checks: compactChecksValue, checkedPaths }), 'utf8');
+        const originalBytes = Buffer.byteLength(JSON.stringify({ checks, checkedPaths: paths.map((path) => path.path), providerEvidence: evidence }), 'utf8');
+        const compactBytes = Buffer.byteLength(JSON.stringify({ checks: compactChecksValue, checkedPaths, providerEvidence: evidence }), 'utf8');
         return {
             ok: true,
             value: {
@@ -80,6 +81,7 @@ export class ProviderDoctorService {
                 recommendations,
                 checks: compactChecksValue,
                 checkedPaths,
+                providerEvidence: evidence,
                 bytes: { originalBytes, compactBytes },
                 verboseAvailable: normalized.payloadMode === 'compact',
                 fullContentRef: `provider-doctor:${normalized.providerAdapter}:${normalized.workspaceRoot}`,
@@ -99,6 +101,7 @@ export class ProviderDoctorService {
         const projectMemory = inspectClaudeProjectMemory(normalized.workspaceRoot);
         const advisoryPaths = claudeAdvisoryPaths(normalized.workspaceRoot);
         const checkedPathList = [mcp.path, agents.directoryPath, ...agents.agents.map((agent) => agent.path), projectMemory.path, ...advisoryPaths];
+        const evidence = providerEvidence({ staticManifestKnown: true, renderedConfigExpected: true, configPathInspected: checkedPathList.length > 0 });
         const before = snapshotPaths(checkedPathList, normalized.workspaceRoot);
         const missingAgents = agents.agents.filter((agent) => agent.status === 'missing');
         const blockingAgents = agents.agents.filter((agent) => agent.status === 'conflicting' || agent.status === 'invalid');
@@ -133,13 +136,14 @@ export class ProviderDoctorService {
         const checkedPaths = normalized.payloadMode === 'verbose' ? checkedPathList : checkedPathList.filter((path) => existsSync(path) || path === mcp.path);
         const failedChecks = checks.filter((check) => check.status === 'fail').map((check) => check.id);
         const recommendations = checks.flatMap((check) => (check.remediation === undefined ? [] : [check.remediation]));
-        return { ok: true, value: { version: 1, kind: 'provider-doctor', project: normalized.project, providerAdapter: 'claude', scope: normalized.scope, workspaceRoot: normalized.workspaceRoot, runtimeContext: providerRuntimeContext(normalized), configClassification: externalProjectClassification(checkedPathList), status, payloadMode: normalized.payloadMode, overallStatus: status, checkCount: checks.length, passedCount: checks.filter((check) => check.status === 'pass').length, warningCount: checks.filter((check) => check.status === 'warn' || check.status === 'not-configured').length, errorCount: failedChecks.length, skippedCount: checks.filter((check) => check.status === 'skip').length, failedChecks, summary: summarizeDoctor(status, failedChecks.length, recommendations.length), recommendations, checks: compactChecksValue, checkedPaths, bytes: { originalBytes: Buffer.byteLength(JSON.stringify({ checks, checkedPaths: checkedPathList }), 'utf8'), compactBytes: Buffer.byteLength(JSON.stringify({ checks: compactChecksValue, checkedPaths }), 'utf8') }, verboseAvailable: normalized.payloadMode === 'compact', fullContentRef: `provider-doctor:claude:${normalized.workspaceRoot}`, generatedAt: 'read-only-snapshot', safety: PROVIDER_HEALTH_SAFETY } };
+        return { ok: true, value: { version: 1, kind: 'provider-doctor', project: normalized.project, providerAdapter: 'claude', scope: normalized.scope, workspaceRoot: normalized.workspaceRoot, runtimeContext: providerRuntimeContext(normalized), configClassification: externalProjectClassification(checkedPathList), status, payloadMode: normalized.payloadMode, overallStatus: status, checkCount: checks.length, passedCount: checks.filter((check) => check.status === 'pass').length, warningCount: checks.filter((check) => check.status === 'warn' || check.status === 'not-configured').length, errorCount: failedChecks.length, skippedCount: checks.filter((check) => check.status === 'skip').length, failedChecks, summary: summarizeDoctor(status, failedChecks.length, recommendations.length), recommendations, checks: compactChecksValue, checkedPaths, providerEvidence: evidence, bytes: { originalBytes: Buffer.byteLength(JSON.stringify({ checks, checkedPaths: checkedPathList, providerEvidence: evidence }), 'utf8'), compactBytes: Buffer.byteLength(JSON.stringify({ checks: compactChecksValue, checkedPaths, providerEvidence: evidence }), 'utf8') }, verboseAvailable: normalized.payloadMode === 'compact', fullContentRef: `provider-doctor:claude:${normalized.workspaceRoot}`, generatedAt: 'read-only-snapshot', safety: PROVIDER_HEALTH_SAFETY } };
     }
     getClaudeUserGlobalDoctor(normalized, canonicalScope = 'user', scopeWarnings = []) {
         const mcp = inspectClaudeCodeUserMcpConfig(normalized.env);
         const agents = inspectClaudeCodeAgents({ workspaceRoot: normalized.workspaceRoot, scope: 'user', env: normalized.env });
         const userMemory = inspectClaudeUserMemory(normalized.env);
         const checkedPathList = [mcp.path, agents.directoryPath, ...agents.agents.map((agent) => agent.path), userMemory.path];
+        const evidence = providerEvidence({ staticManifestKnown: true, renderedConfigExpected: true, configPathInspected: checkedPathList.length > 0 });
         const before = snapshotPaths(checkedPathList, normalized.workspaceRoot);
         const missingAgents = agents.agents.filter((agent) => agent.status === 'missing');
         const blockingAgents = agents.agents.filter((agent) => agent.status === 'conflicting' || agent.status === 'invalid');
@@ -164,7 +168,7 @@ export class ProviderDoctorService {
         const failedChecks = checks.filter((check) => check.status === 'fail').map((check) => check.id);
         const recommendations = checks.flatMap((check) => (check.remediation === undefined ? [] : [check.remediation]));
         const checkedPaths = normalized.payloadMode === 'verbose' ? checkedPathList : checkedPathList.filter((path) => existsSync(path) || path === mcp.path || path === userMemory.path);
-        return { ok: true, value: { version: 1, kind: 'provider-doctor', project: normalized.project, providerAdapter: 'claude', scope: normalized.scope, workspaceRoot: normalized.workspaceRoot, runtimeContext: providerRuntimeContext(normalized), configClassification: managedUserGlobalClassification(checkedPathList), status, payloadMode: normalized.payloadMode, overallStatus: status, checkCount: checks.length, passedCount: checks.filter((check) => check.status === 'pass').length, warningCount: checks.filter((check) => check.status === 'warn' || check.status === 'not-configured').length, errorCount: failedChecks.length, skippedCount: checks.filter((check) => check.status === 'skip').length, failedChecks, summary: summarizeDoctor(status, failedChecks.length, recommendations.length), recommendations, checks: compactChecksValue, checkedPaths, bytes: { originalBytes: Buffer.byteLength(JSON.stringify({ checks, checkedPaths: checkedPathList }), 'utf8'), compactBytes: Buffer.byteLength(JSON.stringify({ checks: compactChecksValue, checkedPaths }), 'utf8') }, verboseAvailable: normalized.payloadMode === 'compact', fullContentRef: `provider-doctor:claude:${canonicalScope}:${normalized.workspaceRoot}`, generatedAt: 'read-only-snapshot', safety: { ...PROVIDER_HEALTH_SAFETY, scopeCapabilities: CLAUDE_USER_GLOBAL_SCOPE_CAPABILITIES } } };
+        return { ok: true, value: { version: 1, kind: 'provider-doctor', project: normalized.project, providerAdapter: 'claude', scope: normalized.scope, workspaceRoot: normalized.workspaceRoot, runtimeContext: providerRuntimeContext(normalized), configClassification: managedUserGlobalClassification(checkedPathList), status, payloadMode: normalized.payloadMode, overallStatus: status, checkCount: checks.length, passedCount: checks.filter((check) => check.status === 'pass').length, warningCount: checks.filter((check) => check.status === 'warn' || check.status === 'not-configured').length, errorCount: failedChecks.length, skippedCount: checks.filter((check) => check.status === 'skip').length, failedChecks, summary: summarizeDoctor(status, failedChecks.length, recommendations.length), recommendations, checks: compactChecksValue, checkedPaths, providerEvidence: evidence, bytes: { originalBytes: Buffer.byteLength(JSON.stringify({ checks, checkedPaths: checkedPathList, providerEvidence: evidence }), 'utf8'), compactBytes: Buffer.byteLength(JSON.stringify({ checks: compactChecksValue, checkedPaths, providerEvidence: evidence }), 'utf8') }, verboseAvailable: normalized.payloadMode === 'compact', fullContentRef: `provider-doctor:claude:${canonicalScope}:${normalized.workspaceRoot}`, generatedAt: 'read-only-snapshot', safety: { ...PROVIDER_HEALTH_SAFETY, scopeCapabilities: CLAUDE_USER_GLOBAL_SCOPE_CAPABILITIES } } };
     }
 }
 function externalProjectClassification(paths) {

package/dist/mcp/provider-health-types.js

@@ -34,6 +34,26 @@ export function classifyProviderConfigPaths(paths) {
         detectedExternalUserConfig: paths.filter((path) => path.diagnostics.ownership === 'external-user' && path.exists).map((path) => path.path),
     };
 }
+export function providerEvidence(input) {
+    const hostIntrospectionAvailable = input.hostIntrospectionAvailable ?? false;
+    const hostToolPresenceVerified = input.hostToolPresenceVerified ?? false;
+    return {
+        staticManifestKnown: input.staticManifestKnown,
+        renderedConfigExpected: input.renderedConfigExpected,
+        configPathInspected: input.configPathInspected,
+        hostIntrospectionAvailable,
+        hostToolPresenceVerified,
+        evidenceLevel: hostIntrospectionAvailable ? 'host-introspection' : input.configPathInspected ? 'config-inspection' : 'static-manifest',
+        notes: [
+            'VGXNESS inspected static provider manifests and expected provider configuration metadata only.',
+            input.configPathInspected
+                ? 'VGXNESS inspected provider config paths as read-only diagnostics.'
+                : 'VGXNESS did not inspect provider config paths; evidence is limited to static manifests.',
+            'No provider host process was launched during this diagnostic.',
+            'MCP host tool presence is not verified by provider status/doctor.',
+        ],
+    };
+}
 export const REQUIRED_PROVIDER_MCP_TOOLS = ['vgxness_provider_status', 'vgxness_provider_doctor', 'vgxness_provider_change_plan'];
 export const REQUIRED_PROVIDER_NATIVE_MCP_TOOLS = [
     'vgxness_provider_status',

package/dist/mcp/provider-status.js

@@ -9,7 +9,7 @@ import { inspectClaudeUserMemory } from './claude-code-user-memory.js';
 import { resolveOpenCodeMcpInstallTarget } from './client-install-opencode-contract.js';
 import { vgxnessOpenCodeDefaultAgent, vgxnessOpenCodePromptContractVersion, vgxnessOpenCodeSddSubagents } from './opencode-default-agent-config.js';
 import { buildCanonicalAgentManifestDiagnostic } from './provider-canonical-agent-manifest.js';
-import { normalizeProviderHealthInput, PROVIDER_HEALTH_SAFETY, CLAUDE_USER_GLOBAL_SCOPE_CAPABILITIES, classifyProviderConfigPaths, providerConfigPathDiagnostics, providerRuntimeContext, providerHealthFailure, isUserGlobalScope, REQUIRED_PROVIDER_MCP_TOOLS, rollupProviderHealth, } from './provider-health-types.js';
+import { normalizeProviderHealthInput, PROVIDER_HEALTH_SAFETY, CLAUDE_USER_GLOBAL_SCOPE_CAPABILITIES, classifyProviderConfigPaths, providerConfigPathDiagnostics, providerRuntimeContext, providerEvidence, providerHealthFailure, isUserGlobalScope, REQUIRED_PROVIDER_MCP_TOOLS, rollupProviderHealth, } from './provider-health-types.js';
 const projectConfigTargets = ['.opencode/opencode.json', 'opencode.json', '.opencode/opencode.jsonc', 'opencode.jsonc'];
 export class ProviderStatusService {
     deps;
@@ -29,6 +29,7 @@ export class ProviderStatusService {
         const managerConfigured = hasConfiguredManager(providerConfig);
         const subagentsConfigured = hasConfiguredSubagents(providerConfig);
         const tools = requiredToolPresence();
+        const evidence = providerEvidence({ staticManifestKnown: true, renderedConfigExpected: true, configPathInspected: paths.length > 0 });
         const configStatus = resolveConfigStatus(paths, mcpEntry, managerConfigured, subagentsConfigured);
         const status = rollupProviderHealth([canonicalAgentManifest.status, configStatus, ...tools.map((tool) => (tool.present ? 'pass' : 'fail'))]);
         const sdd = normalized.change.length > 0 ? this.readSdd(normalized.project, normalized.change) : undefined;
@@ -39,12 +40,14 @@ export class ProviderStatusService {
         const verboseShape = {
             config: { status: configStatus, paths, mcpEntry },
             canonicalAgentManifest,
+            providerEvidence: evidence,
             sdd,
             mcpRequiredTools: tools,
         };
         const compactShape = {
             config: { status: configStatus, paths: compactPaths(paths, 'compact'), mcpEntry: compactMcpEntry(mcpEntry, 'compact') },
             canonicalAgentManifest,
+            providerEvidence: evidence,
             sdd: sdd === undefined ? undefined : compactSdd(sdd, 'compact'),
             mcpRequiredTools: tools,
         };
@@ -70,6 +73,7 @@ export class ProviderStatusService {
             nextAction: nextActionFor(status, mcpEntry, sdd?.next),
             checkedPaths,
             canonicalAgentManifest,
+            providerEvidence: evidence,
             ...(sdd === undefined ? {} : { sdd: compactSdd(sdd, normalized.payloadMode) }),
             mcpRequiredTools: tools,
             originalBytes,
@@ -112,8 +116,9 @@ export class ProviderStatusService {
         const sdd = normalized.change.length > 0 ? this.readSdd(normalized.project, normalized.change) : undefined;
         const checkedPaths = normalized.payloadMode === 'verbose' ? [mcpState.path, agents.directoryPath, ...agents.agents.map((agent) => agent.path), projectMemory.path, ...claudeAdvisoryPaths(normalized.workspaceRoot)] : [mcpState.path, projectMemory.path, ...agents.agents.filter((agent) => agent.exists || agent.status !== 'missing').map((agent) => agent.path), ...advisory];
         const tools = [...requiredToolPresence(), { tool: 'claude-cli', present: false, diagnostic: 'Read-only status does not execute `claude --version`; CLI presence is checked during explicit apply/preflight only.' }];
-        const verboseShape = { config: { status: configStatus, paths, mcpEntry }, canonicalAgentManifest, agents, projectMemory, advisory, sdd, mcpRequiredTools: tools };
-        const compactShape = { config: { status: configStatus, paths: compactPaths(paths, 'compact'), mcpEntry: compactMcpEntry(mcpEntry, 'compact') }, canonicalAgentManifest, agentSummary: summarizeClaudeAgents(agents), projectMemory: { status: projectMemory.status, action: projectMemory.action }, advisory, sdd: sdd === undefined ? undefined : compactSdd(sdd, 'compact'), mcpRequiredTools: tools };
+        const evidence = providerEvidence({ staticManifestKnown: true, renderedConfigExpected: true, configPathInspected: paths.length > 0 });
+        const verboseShape = { config: { status: configStatus, paths, mcpEntry }, canonicalAgentManifest, providerEvidence: evidence, agents, projectMemory, advisory, sdd, mcpRequiredTools: tools };
+        const compactShape = { config: { status: configStatus, paths: compactPaths(paths, 'compact'), mcpEntry: compactMcpEntry(mcpEntry, 'compact') }, canonicalAgentManifest, providerEvidence: evidence, agentSummary: summarizeClaudeAgents(agents), projectMemory: { status: projectMemory.status, action: projectMemory.action }, advisory, sdd: sdd === undefined ? undefined : compactSdd(sdd, 'compact'), mcpRequiredTools: tools };
         const originalBytes = Buffer.byteLength(JSON.stringify(verboseShape), 'utf8');
         const compactBytes = Buffer.byteLength(JSON.stringify(compactShape), 'utf8');
         const issueCount = [canonicalAgentManifest.status, configStatus, ...agentStatuses].filter((item) => item === 'fail' || item === 'not-configured').length;
@@ -136,6 +141,7 @@ export class ProviderStatusService {
             nextAction: nextActionFor(status, mcpEntry, sdd?.next),
             checkedPaths,
             canonicalAgentManifest,
+            providerEvidence: evidence,
             ...(sdd === undefined ? {} : { sdd: compactSdd(sdd, normalized.payloadMode) }),
             mcpRequiredTools: tools,
             originalBytes,
@@ -163,11 +169,12 @@ export class ProviderStatusService {
         const agentStatuses = agents.agents.map((agent) => (agent.status === 'managed' ? 'pass' : agent.status === 'missing' ? 'not-configured' : 'fail'));
         const configStatus = claudeConfigHealthStatus([...paths.map((path) => path.status), ...agentStatuses]);
         const tools = [...requiredToolPresence(), { tool: 'claude-cli', present: false, diagnostic: 'Read-only status does not execute `claude --version`; no Claude Code process was launched.' }];
+        const evidence = providerEvidence({ staticManifestKnown: true, renderedConfigExpected: true, configPathInspected: paths.length > 0 });
         const status = rollupProviderHealth([canonicalAgentManifest.status, configStatus]);
         const sdd = normalized.change.length > 0 ? this.readSdd(normalized.project, normalized.change) : undefined;
         const checkedPaths = normalized.payloadMode === 'verbose' ? [mcpState.path, agents.directoryPath, ...agents.agents.map((agent) => agent.path), userMemory.path] : [mcpState.path, userMemory.path, ...agents.agents.filter((agent) => agent.exists || agent.status !== 'missing').map((agent) => agent.path)];
-        const verboseShape = { config: { status: configStatus, paths, mcpEntry }, canonicalAgentManifest, agents, userMemory: { status: userMemory.status, action: userMemory.action }, scopeCapabilities: CLAUDE_USER_GLOBAL_SCOPE_CAPABILITIES, scopeWarnings, sdd, mcpRequiredTools: tools };
-        const compactShape = { config: { status: configStatus, paths: compactPaths(paths, 'compact'), mcpEntry: compactMcpEntry(mcpEntry, 'compact') }, canonicalAgentManifest, agentSummary: summarizeClaudeAgents(agents), userMemory: { status: userMemory.status, action: userMemory.action }, scopeCapabilities: CLAUDE_USER_GLOBAL_SCOPE_CAPABILITIES, sdd: sdd === undefined ? undefined : compactSdd(sdd, 'compact'), mcpRequiredTools: tools };
+        const verboseShape = { config: { status: configStatus, paths, mcpEntry }, canonicalAgentManifest, providerEvidence: evidence, agents, userMemory: { status: userMemory.status, action: userMemory.action }, scopeCapabilities: CLAUDE_USER_GLOBAL_SCOPE_CAPABILITIES, scopeWarnings, sdd, mcpRequiredTools: tools };
+        const compactShape = { config: { status: configStatus, paths: compactPaths(paths, 'compact'), mcpEntry: compactMcpEntry(mcpEntry, 'compact') }, canonicalAgentManifest, providerEvidence: evidence, agentSummary: summarizeClaudeAgents(agents), userMemory: { status: userMemory.status, action: userMemory.action }, scopeCapabilities: CLAUDE_USER_GLOBAL_SCOPE_CAPABILITIES, sdd: sdd === undefined ? undefined : compactSdd(sdd, 'compact'), mcpRequiredTools: tools };
         const originalBytes = Buffer.byteLength(JSON.stringify(verboseShape), 'utf8');
         const compactBytes = Buffer.byteLength(JSON.stringify(compactShape), 'utf8');
         const reportBase = {
@@ -188,6 +195,7 @@ export class ProviderStatusService {
             nextAction: nextActionFor(status, mcpEntry, sdd?.next),
             checkedPaths,
             canonicalAgentManifest,
+            providerEvidence: evidence,
             ...(sdd === undefined ? {} : { sdd: compactSdd(sdd, normalized.payloadMode) }),
             mcpRequiredTools: tools,
             originalBytes,
@@ -335,7 +343,11 @@ function inspectOpenCodeMcpEntry(paths) {
     }
 }
 function requiredToolPresence() {
-    return REQUIRED_PROVIDER_MCP_TOOLS.map((tool) => ({ tool, present: true }));
+    return REQUIRED_PROVIDER_MCP_TOOLS.map((tool) => ({
+        tool,
+        present: true,
+        diagnostic: 'Static VGXNESS manifest expects this MCP tool; provider host tool presence was not verified.',
+    }));
 }
 function resolveConfigStatus(paths, mcpEntry, managerConfigured, subagentsConfigured) {
     if (paths.some((path) => path.status === 'fail') || mcpEntry.status === 'fail')

package/dist/mcp/schema.js

@@ -109,7 +109,125 @@ const contextCockpitLevels = ['compact', 'expanded', 'verbose'];
 const providerChangePlanProviders = ['opencode', 'claude', 'antigravity', 'custom'];
 const providerChangePlanTypes = ['opencode-mcp-install', 'claude-mcp-install', 'setup', 'install', 'config-preparation'];
 const sddPhaseInputSchema = z.union([z.enum(sddPhases), z.literal('apply')]);
+const sddPhaseSchema = z.enum(sddPhases);
 const jsonValueSchema = z.lazy(() => z.union([z.string(), z.number().finite(), z.boolean(), z.null(), z.array(jsonValueSchema), z.record(z.string(), jsonValueSchema)]));
+const providerEvidenceOutputSchema = z
+    .object({
+    staticManifestKnown: z.boolean(),
+    renderedConfigExpected: z.boolean(),
+    configPathInspected: z.boolean(),
+    hostIntrospectionAvailable: z.boolean(),
+    hostToolPresenceVerified: z.boolean(),
+    evidenceLevel: z.enum(['static-manifest', 'config-inspection', 'host-introspection']),
+    notes: z.array(z.string()),
+})
+    .passthrough();
+const sddPhaseGateOutputSchema = z
+    .object({
+    phase: sddPhaseSchema,
+    topicKey: z.string(),
+    artifactPresent: z.boolean(),
+    artifactStatus: z.enum(['missing', 'draft', 'accepted', 'rejected', 'superseded']),
+    artifactState: z.enum(['missing', 'draft', 'accepted', 'rejected', 'superseded', 'legacy']),
+    accepted: z.boolean(),
+    acceptedByHuman: z.boolean(),
+    agentCallable: z.boolean(),
+    requiresHumanAcceptance: z.boolean(),
+    draftPresent: z.boolean(),
+    contentFrozen: z.boolean(),
+    runnable: z.boolean(),
+    blocked: z.boolean(),
+    blockedReasons: z.array(z.string()),
+    humanOnly: z.boolean(),
+    preflightRequired: z.boolean(),
+    requiresPreflight: z.boolean(),
+    requiresProviderWriteConsent: z.boolean(),
+    canDraft: z.boolean(),
+    canMarkReady: z.boolean(),
+    canAccept: z.boolean(),
+    canReopen: z.boolean(),
+    nextAllowedActions: z.array(z.string()),
+    requiredPriorPhase: sddPhaseSchema.optional(),
+    blockerReason: z.enum(['missing', 'draft', 'accepted', 'legacy', 'rejected', 'superseded']).optional(),
+})
+    .passthrough();
+const sddReadinessGatesOutputSchema = z
+    .object({
+    phase: sddPhaseGateOutputSchema,
+    prerequisites: z.array(sddPhaseGateOutputSchema),
+    runnable: z.boolean(),
+    blocked: z.boolean(),
+    blockedReasons: z.array(z.string()),
+    humanOnly: z.boolean(),
+    preflightRequired: z.boolean(),
+    agentCallable: z.boolean(),
+    canDraft: z.boolean(),
+    canMarkReady: z.boolean(),
+    canAccept: z.boolean(),
+    canReopen: z.boolean(),
+    nextAllowedActions: z.array(z.string()),
+    requiresProviderWriteConsent: z.boolean(),
+})
+    .passthrough();
+const sddCockpitGatesOutputSchema = z
+    .object({
+    phases: z.array(sddPhaseGateOutputSchema),
+    changeComplete: z.boolean(),
+    nextPhase: sddPhaseSchema.optional(),
+    nextPhaseRunnable: z.boolean(),
+    runnableNextPhases: z.array(sddPhaseSchema),
+    blockedTransitions: z.array(sddPhaseGateOutputSchema),
+    blockedReasons: z.array(z.string()),
+    requiresHumanAcceptance: z.boolean(),
+    humanOnly: z.boolean(),
+    preflightRequired: z.boolean(),
+    agentCallable: z.boolean(),
+    canDraft: z.boolean(),
+    canMarkReady: z.boolean(),
+    canAccept: z.boolean(),
+    canReopen: z.boolean(),
+    nextAllowedActions: z.array(z.string()),
+    requiresProviderWriteConsent: z.boolean(),
+})
+    .passthrough();
+const sddRecommendedActionOutputSchema = z
+    .object({
+    id: z.string(),
+    label: z.string(),
+    title: z.string(),
+    description: z.string(),
+    kind: z.enum(['inspect', 'draft-phase', 'mark-ready', 'accept-human', 'reopen-human']),
+    category: z.enum(['inspection', 'sdd-phase', 'human-governance']),
+    phase: sddPhaseSchema.optional(),
+    targetTool: z.string(),
+    suggestedArgs: z.record(z.string(), jsonValueSchema),
+    readOnly: z.boolean(),
+    mutating: z.boolean(),
+    agentCallable: z.boolean(),
+    humanOnly: z.boolean(),
+    requiresHumanApproval: z.boolean(),
+    requiresHumanConfirmation: z.boolean(),
+    requiresPreflight: z.boolean(),
+    requiresProviderWriteConsent: z.boolean(),
+    reason: z.string(),
+    rationale: z.string(),
+    blockingPrerequisites: z.array(z
+        .object({
+        phase: sddPhaseSchema,
+        topicKey: z.string(),
+        reason: z.string(),
+        artifactId: z.string().optional(),
+    })
+        .passthrough()),
+})
+    .passthrough();
+const mcpSuccessOutputSchema = (value) => z
+    .object({
+    ok: z.literal(true),
+    tool: z.enum(SUPPORTED_VGX_MCP_TOOL_NAMES),
+    value,
+})
+    .passthrough();
 export const VGX_MCP_TOOL_INPUT_SCHEMAS = {
     vgxness_sdd_status: z
         .object({
@@ -503,6 +621,64 @@ export const VGX_MCP_TOOL_INPUT_SCHEMAS = {
     })
         .passthrough(),
 };
+export const VGX_MCP_TOOL_OUTPUT_SCHEMAS = {
+    vgxness_sdd_ready: mcpSuccessOutputSchema(z
+        .object({
+        change: z.string(),
+        phase: sddPhaseSchema,
+        ready: z.boolean(),
+        gates: sddReadinessGatesOutputSchema.optional(),
+    })
+        .passthrough()),
+    vgxness_sdd_get_readiness: mcpSuccessOutputSchema(z
+        .object({
+        change: z.string(),
+        phase: sddPhaseSchema,
+        ready: z.boolean(),
+        gates: sddReadinessGatesOutputSchema.optional(),
+    })
+        .passthrough()),
+    vgxness_sdd_cockpit: mcpSuccessOutputSchema(z
+        .object({
+        project: z.string(),
+        change: z.string(),
+        gates: sddCockpitGatesOutputSchema.optional(),
+        readModel: z
+            .object({
+            project: z.string(),
+            change: z.string(),
+            gates: sddCockpitGatesOutputSchema.optional(),
+            phases: z.array(z
+                .object({
+                phase: sddPhaseSchema,
+                gates: sddPhaseGateOutputSchema.optional(),
+            })
+                .passthrough()),
+        })
+            .passthrough(),
+    })
+        .passthrough()),
+    vgxness_sdd_continue: mcpSuccessOutputSchema(z
+        .object({
+        kind: z.literal('sdd-continuation-plan'),
+        project: z.string(),
+        change: z.string(),
+        recommendedActions: z.array(sddRecommendedActionOutputSchema),
+    })
+        .passthrough()),
+    vgxness_provider_status: mcpSuccessOutputSchema(z
+        .object({
+        kind: z.literal('provider-status'),
+        providerEvidence: providerEvidenceOutputSchema,
+    })
+        .passthrough()),
+    vgxness_provider_doctor: mcpSuccessOutputSchema(z
+        .object({
+        kind: z.literal('provider-doctor'),
+        providerEvidence: providerEvidenceOutputSchema,
+    })
+        .passthrough()),
+};
 export function successEnvelope(tool, value) {
     return { ok: true, tool, value };
 }

package/dist/mcp/stdio-server.js

@@ -2,7 +2,7 @@ import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { runBootAgentSeedUpgrade } from '../agents/boot-upgrade.js';
 import { createVgxMcpControlPlane } from './control-plane.js';
-import { EXPOSED_VGX_MCP_TOOL_NAMES, toInternalVgxMcpToolName, VGX_MCP_TOOL_INPUT_SCHEMAS, } from './schema.js';
+import { EXPOSED_VGX_MCP_TOOL_NAMES, toInternalVgxMcpToolName, VGX_MCP_TOOL_INPUT_SCHEMAS, VGX_MCP_TOOL_OUTPUT_SCHEMAS, } from './schema.js';
 export async function startVgxMcpStdioServer(options = {}) {
     const controlPlane = createVgxMcpControlPlane(options.databasePath === undefined ? {} : { databasePath: options.databasePath });
     runBootAgentSeedUpgrade(controlPlane.database);
@@ -39,18 +39,20 @@ export async function startVgxMcpStdioServer(options = {}) {
 function registerVgxTools(server, controlPlane) {
     for (const publicToolName of EXPOSED_VGX_MCP_TOOL_NAMES) {
         const toolName = toInternalVgxMcpToolName(publicToolName);
+        const outputSchema = VGX_MCP_TOOL_OUTPUT_SCHEMAS[toolName];
         server.registerTool(publicToolName, {
             title: publicToolName,
             description: descriptionForTool(publicToolName),
             inputSchema: VGX_MCP_TOOL_INPUT_SCHEMAS[toolName],
+            ...(outputSchema === undefined ? {} : { outputSchema }),
         }, async (args) => toMcpTextResult(controlPlane.callVgxTool(toolName, argsForTool(args))));
     }
 }
 function descriptionForTool(publicToolName) {
     if (publicToolName === 'provider_status')
-        return 'Read-only provider status report; inspects OpenCode config paths without installing, repairing, or writing files.';
+        return 'Agent-callable read-only provider status report; inspects expected config paths without installing, repairing, or writing provider config, and does not verify true host tool presence. Use it to decide whether to inspect doctor output or request explicit setup consent.';
     if (publicToolName === 'provider_doctor')
-        return 'Read-only provider doctor checks; reports OpenCode MCP configuration health without repair/install side effects.';
+        return 'Agent-callable read-only provider doctor advisory; checks VGXNESS-known provider config health without install/repair/config writes and without proving true host tool presence. Use it to decide the next setup or troubleshooting recommendation.';
     if (publicToolName === 'provider_change_plan')
         return 'Read-only provider change plan preview; composes status, doctor, and OpenCode install planning without writing provider config.';
     if (publicToolName === 'opencode_handoff_preview')
@@ -66,9 +68,21 @@ function descriptionForTool(publicToolName) {
     if (publicToolName === 'context_cockpit')
         return 'Read-only context cockpit for start/resume/recovery; returns latest restorable session plus bounded memory previews without traces, provider config writes, repository writes, runs, artifacts, or session mutations.';
     if (publicToolName === 'sdd_cockpit')
-        return 'Read-only SDD cockpit summary with raw compatibility fields plus additive readModel; metadata-only artifact summaries, no artifact bodies, and explicit human acceptance semantics.';
+        return 'Agent-callable read-only SDD cockpit summary; returns phase metadata/readModel without artifact bodies or state changes and preserves explicit human acceptance semantics. Use it to decide the next safe SDD action or blocker.';
     if (publicToolName === 'sdd_continue')
-        return 'Read-only SDD continuation planner; returns blocker actions, safe suggested commands, related interrupted run context, and safety notes without provider execution, run creation, artifact mutation, provider config writes, or openspec writes.';
+        return 'Agent-callable read-only SDD continuation advisory; returns blocker actions, suggested next steps, interrupted-run context, and safety notes without provider execution, run creation, artifact mutation, provider config writes, or openspec writes. Use it to choose the next manual or agent-safe action.';
+    if (publicToolName === 'sdd_status')
+        return 'Agent-callable read-only SDD status summary; reports phase presence/state and next ready phase without creating, accepting, or mutating artifacts. Use it to decide whether to inspect, draft, mark ready, or wait for human acceptance.';
+    if (publicToolName === 'sdd_get_readiness')
+        return 'Agent-callable read-only SDD readiness check; reports whether a phase can proceed and why, without marking ready or changing artifacts. Use it to decide whether to call sdd_ready or resolve prerequisites first.';
+    if (publicToolName === 'sdd_ready')
+        return 'Agent-callable state-changing SDD readiness marker; marks an existing phase artifact ready when prerequisites allow, but does not human-accept it. Use only after readiness is clear, then ask a human to accept when governance requires acceptance.';
+    if (publicToolName === 'sdd_accept_artifact')
+        return 'Human-only mutating SDD acceptance gate; records explicit human acceptance for an artifact and must not be called by agents on their own behalf. Use only after a human approval decision, then continue to the next phase.';
+    if (publicToolName === 'sdd_reopen_artifact')
+        return 'Human-only mutating SDD reopen gate; records an explicit human decision to reopen an artifact and must not be called by agents on their own behalf. Use only after human instruction, then revise or re-review the phase.';
+    if (publicToolName === 'run_preflight')
+        return 'Agent-callable advisory/planning-only run preflight; evaluates permissions and records a plan but does not execute the checked shell/git/install/network/provider/secrets operation. Use it to decide whether human approval or a separate executor step is required.';
     const toolName = toInternalVgxMcpToolName(publicToolName);
     return `VGX control-plane tool ${toolName}`;
 }
@@ -78,6 +92,7 @@ function argsForTool(args) {
 function toMcpTextResult(envelope) {
     const result = {
         content: [{ type: 'text', text: JSON.stringify(envelope, null, 2) }],
+        structuredContent: envelope,
     };
     if (!envelope.ok)
         result.isError = true;

package/dist/sdd/cockpit-read-model.js

@@ -30,6 +30,7 @@ export function buildSddCockpitReadModel(cockpit) {
         phases,
         nextAction,
         blockers,
+        ...(cockpit.gates === undefined ? {} : { gates: cockpit.gates }),
         guidance: guidanceFor(cockpit, nextAction, blockers),
         summary: summarize(phases),
         contentIncluded: false,
@@ -68,6 +69,7 @@ function toPhaseReadModel(phase) {
             blocked: !phase.readiness.ready || phase.blockers.length > 0,
             reasons,
         },
+        ...(phase.gates === undefined ? {} : { gates: phase.gates }),
         guidance: guidanceForPhase(phase, status, canAccept),
     };
 }

package/dist/sdd/sdd-continuation-plan.js

@@ -5,6 +5,7 @@ export function sddContinuationPlanFrom(input) {
     const suggestedCommand = suggestedContinuationCommand(input.project, input.next, inspectCommand, dbFlag);
     const blockerGuidance = input.next.blockerGuidance ?? [];
     const blockerActions = blockerGuidance.map((blocker) => continuationBlockerAction(input.project, input.next.change, blocker, dbFlag));
+    const recommendedActions = continuationRecommendedActions(input.project, input.next, blockerGuidance);
     const relatedRunContext = relatedRunContextView(input.project, input.relatedRunContext, dbFlag);
     return {
         kind: 'sdd-continuation-plan',
@@ -18,6 +19,7 @@ export function sddContinuationPlanFrom(input) {
         suggestedCommand,
         inspectCommand,
         blockerActions,
+        recommendedActions,
         ...(relatedRunContext === undefined ? {} : { relatedRunContext }),
         ...(input.explicitDatabasePath === undefined ? {} : { explicitDatabasePath: input.explicitDatabasePath }),
         safety: [
@@ -28,6 +30,153 @@ export function sddContinuationPlanFrom(input) {
         ],
     };
 }
+function continuationRecommendedActions(project, next, blockerGuidance) {
+    const actions = [inspectCockpitAction(project, next.change)];
+    if (next.status === 'runnable' && next.nextPhase !== undefined)
+        actions.push(draftPhaseAction(project, next.change, next.nextPhase, next.reason));
+    for (const blocker of blockerGuidance) {
+        const action = recommendedActionForBlocker(project, next.change, blocker);
+        if (action !== undefined)
+            actions.push(action);
+    }
+    return actions;
+}
+function inspectCockpitAction(project, change) {
+    return {
+        id: `sdd.${change}.inspect-cockpit`,
+        label: 'Inspect SDD cockpit',
+        title: 'Inspect SDD cockpit',
+        description: 'Read the current SDD cockpit/read model before choosing the next action.',
+        kind: 'inspect',
+        category: 'inspection',
+        targetTool: 'vgxness_sdd_cockpit',
+        suggestedArgs: { project, change },
+        readOnly: true,
+        mutating: false,
+        agentCallable: true,
+        humanOnly: false,
+        requiresHumanApproval: false,
+        requiresHumanConfirmation: false,
+        requiresPreflight: false,
+        requiresProviderWriteConsent: false,
+        reason: 'Continuation plans are advisory; cockpit inspection is a safe MCP-native way to refresh state.',
+        rationale: 'Keeps agents grounded in current artifact states without mutating SDD state or provider configuration.',
+        blockingPrerequisites: [],
+    };
+}
+function draftPhaseAction(project, change, phase, reason) {
+    return {
+        id: `sdd.${change}.${phase}.draft`,
+        label: `Prepare ${phase} draft through normal SDD phase flow`,
+        title: `Prepare ${phase} draft`,
+        description: 'The next SDD phase appears runnable; draft generation must still use the normal phase workflow and any required preflight/confirmation gates.',
+        kind: 'draft-phase',
+        category: 'sdd-phase',
+        phase,
+        targetTool: 'vgxness_sdd_get_readiness',
+        suggestedArgs: { project, change, phase },
+        readOnly: false,
+        mutating: true,
+        agentCallable: true,
+        humanOnly: false,
+        requiresHumanApproval: false,
+        requiresHumanConfirmation: false,
+        requiresPreflight: true,
+        requiresProviderWriteConsent: false,
+        reason,
+        rationale: 'This continuation tool is read-only, so it can recommend the next phase but cannot execute providers or save artifacts itself.',
+        blockingPrerequisites: [],
+    };
+}
+function recommendedActionForBlocker(project, change, blocker) {
+    if (blocker.reason === 'draft' || blocker.reason === 'legacy')
+        return humanAcceptAction(project, change, blocker);
+    if (blocker.reason === 'rejected')
+        return humanReopenAction(project, change, blocker);
+    if (blocker.reason === 'missing')
+        return draftPhaseAction(project, change, blocker.phase, blocker.action);
+    return inspectArtifactAction(project, change, blocker);
+}
+function humanAcceptAction(project, change, blocker) {
+    return {
+        id: `sdd.${change}.${blocker.phase}.accept-human`,
+        label: `Human review and acceptance required for ${blocker.phase}`,
+        title: `Accept ${blocker.phase} artifact as a human`,
+        description: 'A human must explicitly accept this artifact before it counts as accepted; agents must not accept on the human’s behalf.',
+        kind: 'accept-human',
+        category: 'human-governance',
+        phase: blocker.phase,
+        targetTool: 'vgxness_sdd_accept_artifact',
+        suggestedArgs: { project, change, phase: blocker.phase },
+        readOnly: false,
+        mutating: true,
+        agentCallable: false,
+        humanOnly: true,
+        requiresHumanApproval: true,
+        requiresHumanConfirmation: true,
+        requiresPreflight: true,
+        requiresProviderWriteConsent: false,
+        reason: blocker.action,
+        rationale: 'Human-only acceptance is an explicit governance event and cannot be inferred from draft content, readiness, or artifact presence.',
+        blockingPrerequisites: [blockingPrerequisite(blocker)],
+    };
+}
+function humanReopenAction(project, change, blocker) {
+    return {
+        id: `sdd.${change}.${blocker.phase}.reopen-human`,
+        label: `Human reopen required for rejected ${blocker.phase}`,
+        title: `Reopen ${blocker.phase} artifact as a human`,
+        description: 'A human may reopen the rejected artifact to draft; agents must not perform this governance action on the human’s behalf.',
+        kind: 'reopen-human',
+        category: 'human-governance',
+        phase: blocker.phase,
+        targetTool: 'vgxness_sdd_reopen_artifact',
+        suggestedArgs: { project, change, phase: blocker.phase },
+        readOnly: false,
+        mutating: true,
+        agentCallable: false,
+        humanOnly: true,
+        requiresHumanApproval: true,
+        requiresHumanConfirmation: true,
+        requiresPreflight: true,
+        requiresProviderWriteConsent: false,
+        reason: blocker.action,
+        rationale: 'Reopen is a human governance transition from rejected back to draft and remains outside this read-only planner.',
+        blockingPrerequisites: [blockingPrerequisite(blocker)],
+    };
+}
+function inspectArtifactAction(project, change, blocker) {
+    return {
+        id: `sdd.${change}.${blocker.phase}.inspect`,
+        label: `Inspect ${blocker.phase} artifact`,
+        title: `Inspect ${blocker.phase} artifact`,
+        description: 'Inspect the blocking artifact before deciding whether human governance or phase work is needed.',
+        kind: 'inspect',
+        category: 'inspection',
+        phase: blocker.phase,
+        targetTool: 'vgxness_sdd_get_artifact',
+        suggestedArgs: { project, change, phase: blocker.phase, payloadMode: 'compact' },
+        readOnly: true,
+        mutating: false,
+        agentCallable: true,
+        humanOnly: false,
+        requiresHumanApproval: false,
+        requiresHumanConfirmation: false,
+        requiresPreflight: false,
+        requiresProviderWriteConsent: false,
+        reason: blocker.action,
+        rationale: 'Artifact inspection is read-only and helps agents understand the blocker without changing SDD state.',
+        blockingPrerequisites: [blockingPrerequisite(blocker)],
+    };
+}
+function blockingPrerequisite(blocker) {
+    return {
+        phase: blocker.phase,
+        topicKey: blocker.topicKey,
+        reason: blocker.reason,
+        ...(blocker.artifactId === undefined ? {} : { artifactId: blocker.artifactId }),
+    };
+}
 function relatedRunContextView(project, relatedRunContext, dbFlag) {
     if (relatedRunContext === undefined)
         return undefined;

package/dist/sdd/sdd-workflow-service.js

@@ -40,16 +40,18 @@ export class SddWorkflowService {
         const validated = this.validatePhaseInput(input);
         if (!validated.ok)
             return validated;
-        const phases = this.getPhaseStatuses(validated.value.project, validated.value.change);
-        if (!phases.ok)
-            return phases;
-        const readiness = getReadinessFromStatuses(validated.value.change, validated.value.phase, phases.value, this.options);
+        const snapshot = this.loadPhaseSnapshot(validated.value.project, validated.value.change);
+        if (!snapshot.ok)
+            return snapshot;
+        const phases = snapshot.value.phases;
+        const readiness = getReadinessFromStatuses(validated.value.change, validated.value.phase, phases, this.options);
         return {
             ok: true,
             value: {
                 change: validated.value.change,
                 phase: validated.value.phase,
                 ...readiness,
+                gates: readinessGatesForPhase(validated.value.change, validated.value.phase, phases, readiness),
             },
         };
     }
@@ -88,6 +90,7 @@ export class SddWorkflowService {
             };
             const artifact = phaseStatus.present ? cockpitArtifactSummaryFromSnapshotItem(phaseStatus) : undefined;
             const blockers = cockpitBlockersForPhase(phaseStatus, readiness);
+            const gates = phaseGateFromStatus(phaseStatus, readiness);
             return {
                 phase: phaseStatus.phase,
                 topicKey: phaseStatus.topicKey,
@@ -98,6 +101,7 @@ export class SddWorkflowService {
                 readiness,
                 ...(artifact === undefined ? {} : { artifact }),
                 blockers,
+                gates,
             };
         });
         const artifacts = cockpitPhases.map((phase) => phase.artifact).filter((artifact) => artifact !== undefined);
@@ -123,6 +127,7 @@ export class SddWorkflowService {
             acceptedCount: cockpitPhases.filter((phase) => phase.accepted).length,
             legacyCount: cockpitPhases.filter((phase) => phase.legacy).length,
             aggregateBlockers,
+            gates: cockpitGatesFromPhases(cockpitPhases, next),
             inspectCommand: `vgxness sdd cockpit --project ${validated.value.project} --change ${validated.value.change} --json`,
         };
         return ok(cockpit);
@@ -518,6 +523,124 @@ function cockpitArtifactSummaryFromSnapshotItem(item) {
         updatedAt: item.updatedAt,
     };
 }
+function readinessGatesForPhase(change, phase, phases, readiness) {
+    const targetStatus = phases.find((candidate) => candidate.phase === phase) ?? { phase, topicKey: sddTopicKey(change, phase), present: false, state: 'missing', accepted: false, legacy: false, warnings: [] };
+    const targetGate = phaseGateFromStatus(targetStatus, readiness);
+    const prerequisites = sddPrerequisites[phase].map((prerequisite) => {
+        const prerequisiteStatus = phases.find((candidate) => candidate.phase === prerequisite) ?? {
+            phase: prerequisite,
+            topicKey: sddTopicKey(change, prerequisite),
+            present: false,
+            state: 'missing',
+            accepted: false,
+            legacy: false,
+            warnings: [],
+        };
+        const blocker = readiness.blockedPrerequisites?.find((candidate) => candidate.phase === prerequisite);
+        return phaseGateFromStatus(prerequisiteStatus, {
+            ready: blocker === undefined,
+            blockedPrerequisites: blocker === undefined ? [] : [blocker],
+        });
+    });
+    const blockedReasons = [...targetGate.blockedReasons, ...prerequisites.flatMap((gate) => gate.blockedReasons)];
+    return {
+        phase: targetGate,
+        prerequisites,
+        runnable: readiness.ready,
+        blocked: !readiness.ready,
+        blockedReasons: [...new Set(blockedReasons)],
+        humanOnly: targetGate.humanOnly || prerequisites.some((gate) => gate.humanOnly),
+        preflightRequired: targetGate.preflightRequired,
+        agentCallable: true,
+        canDraft: targetGate.canDraft,
+        canMarkReady: targetGate.canMarkReady,
+        canAccept: targetGate.canAccept || prerequisites.some((gate) => gate.canAccept),
+        canReopen: targetGate.canReopen || prerequisites.some((gate) => gate.canReopen),
+        nextAllowedActions: [...new Set([targetGate, ...prerequisites].flatMap((gate) => gate.nextAllowedActions))],
+        requiresProviderWriteConsent: false,
+    };
+}
+function cockpitGatesFromPhases(phases, next) {
+    const phaseGates = phases.map((phase) => phase.gates ?? phaseGateFromStatus(phase, phase.readiness));
+    const blockedTransitions = phaseGates.filter((gate) => gate.blocked);
+    const blockedReasons = [...new Set(blockedTransitions.flatMap((gate) => gate.blockedReasons))];
+    const runnableNextPhases = phaseGates.filter((gate) => gate.runnable && !gate.artifactPresent).map((gate) => gate.phase);
+    return {
+        phases: phaseGates,
+        changeComplete: phases.length === sddPhases.length && phases.every((phase) => phase.accepted),
+        ...(next.nextPhase === undefined ? {} : { nextPhase: next.nextPhase }),
+        nextPhaseRunnable: next.status === 'runnable',
+        runnableNextPhases,
+        blockedTransitions,
+        blockedReasons,
+        requiresHumanAcceptance: phaseGates.some((gate) => gate.requiresHumanAcceptance),
+        humanOnly: phaseGates.some((gate) => gate.humanOnly),
+        preflightRequired: next.status === 'runnable',
+        agentCallable: true,
+        canDraft: phaseGates.some((gate) => gate.canDraft),
+        canMarkReady: phaseGates.some((gate) => gate.canMarkReady),
+        canAccept: phaseGates.some((gate) => gate.canAccept),
+        canReopen: phaseGates.some((gate) => gate.canReopen),
+        nextAllowedActions: [...new Set(phaseGates.flatMap((gate) => gate.nextAllowedActions))],
+        requiresProviderWriteConsent: false,
+    };
+}
+function phaseGateFromStatus(status, readiness) {
+    const artifactStatus = status.state ?? (status.present ? 'draft' : 'missing');
+    const acceptedByHuman = status.accepted === true && status.acceptance?.actor.type === 'human';
+    const blockedPrerequisite = readiness.blockedPrerequisites?.[0];
+    const blockedReasons = [
+        ...((readiness.blockedPrerequisites ?? []).map((blocker) => `${blocker.phase}:${blocker.reason}`)),
+        ...(status.present && status.accepted !== true ? [`${status.phase}:${blockerReasonForStatus(status)}`] : []),
+        ...(status.legacy === true ? [`${status.phase}:legacy`] : []),
+    ];
+    const requiresHumanAcceptance = status.present && !acceptedByHuman && artifactStatus !== 'missing';
+    const canDraft = readiness.ready && !status.present;
+    const canMarkReady = readiness.ready;
+    const canAccept = status.present && !acceptedByHuman && status.legacy !== true && (artifactStatus === 'draft' || artifactStatus === 'accepted');
+    const canReopen = status.present && artifactStatus === 'rejected';
+    const nextAllowedActions = phaseNextAllowedActions({ canDraft, canMarkReady, canAccept, canReopen, present: status.present });
+    return {
+        phase: status.phase,
+        topicKey: status.topicKey,
+        artifactPresent: status.present,
+        artifactStatus,
+        artifactState: status.legacy === true ? 'legacy' : artifactStatus,
+        accepted: status.accepted === true,
+        acceptedByHuman,
+        agentCallable: true,
+        requiresHumanAcceptance,
+        draftPresent: artifactStatus === 'draft',
+        contentFrozen: acceptedByHuman,
+        runnable: readiness.ready && !status.present,
+        blocked: !readiness.ready || status.legacy === true || (status.present && status.accepted !== true),
+        blockedReasons: [...new Set(blockedReasons)],
+        humanOnly: requiresHumanAcceptance,
+        preflightRequired: readiness.ready && !status.present,
+        requiresPreflight: readiness.ready && !status.present,
+        requiresProviderWriteConsent: false,
+        canDraft,
+        canMarkReady,
+        canAccept,
+        canReopen,
+        nextAllowedActions,
+        ...(blockedPrerequisite === undefined ? {} : { requiredPriorPhase: blockedPrerequisite.phase, blockerReason: blockedPrerequisite.reason }),
+    };
+}
+function phaseNextAllowedActions(input) {
+    const actions = ['vgxness_sdd_get_readiness', 'vgxness_sdd_cockpit'];
+    if (input.canDraft)
+        actions.push('vgxness_sdd_save_artifact');
+    if (input.canMarkReady)
+        actions.push('vgxness_sdd_ready');
+    if (input.present)
+        actions.push('vgxness_sdd_get_artifact');
+    if (input.canAccept)
+        actions.push('vgxness_sdd_accept_artifact');
+    if (input.canReopen)
+        actions.push('vgxness_sdd_reopen_artifact');
+    return [...new Set(actions)];
+}
 function compactGovernanceArtifact(artifact) {
     return {
         id: artifact.id,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vgxness",
-  "version": "1.12.0",
+  "version": "1.13.0",
   "description": "CLI and MCP control plane for guided AI-agent workflows, SDD, memory, and OpenCode setup.",
   "license": "SEE LICENSE IN LICENSE",
   "repository": {