weavatrix 0.2.19 → 0.3.0

package/src/analysis/transport-contracts.js

@@ -2,6 +2,7 @@ import { createRepoBoundary } from "../repo-path.js";
 import { lineNumberAt, uniqueBy } from "../util.js";
 import { listRepoFiles, readRepoText } from "./internal-audit/repo-files.js";
 import { affectedForEndpoint, reverseRuntimeImports } from "./http-contracts/graph-context.js";
+import { loadTransportRuntimeEvidence } from "./transport-runtime-evidence.js";
 
 const TEST_RE = /(^|\/)(?:test|tests|__tests__|spec|e2e|fixtures?)(\/|$)|[._-](?:test|spec)\.[a-z0-9]+$/i;
 const SOURCE_RE = /\.(?:[cm]?[jt]sx?|py|go|java|rs|cs|proto|graphql|gql)$/i;
@@ -89,6 +90,31 @@ function eventEvidence(source, role) {
   return { contracts, uncertain };
 }
 
+const contractIdentity = (item) => `${item.transport}|${item.side}|${norm(item.service)}|${item.operation || ""}|${item.name}`;
+
+function mergeRuntimeContracts(staticContracts, observations) {
+  const contracts = staticContracts.map((item) => ({ ...item, evidence: ["STATIC"] }));
+  const byIdentity = new Map(contracts.map((item) => [contractIdentity(item), item]));
+  for (const observation of observations) {
+    const key = contractIdentity(observation);
+    const existing = byIdentity.get(key);
+    if (existing) {
+      existing.runtimeObserved = true;
+      existing.observedCount = (existing.observedCount || 0) + observation.observedCount;
+      existing.evidence = ["STATIC", "RUNTIME"];
+      continue;
+    }
+    const added = { ...observation, evidence: ["RUNTIME"] };
+    contracts.push(added); byIdentity.set(key, added);
+  }
+  return contracts;
+}
+
+function sameRuntimeLocation(uncertain, observation) {
+  return observation.file && observation.line && observation.transport === uncertain.transport &&
+    observation.file === uncertain.file && observation.line === uncertain.line;
+}
+
 function detect(descriptor, role, options) {
   const loaded = sourcesFor(descriptor, options), contracts = [], uncertain = [];
   for (const source of loaded.sources) {
@@ -97,29 +123,52 @@ function detect(descriptor, role, options) {
       contracts.push(...result.contracts); uncertain.push(...result.uncertain);
     }
   }
+  const runtime = loadTransportRuntimeEvidence(descriptor, {
+    file: options.runtimeEvidenceFiles?.[descriptor.id],
+    maxAgeHours: options.runtimeEvidenceMaxAgeHours,
+    transport: options.transport,
+    now: options.now,
+  });
+  const runtimeContracts = runtime.observations.filter((item) => options.transport === "all" || item.transport === options.transport);
+  const resolvedRuntime = uncertain.filter((item) => runtimeContracts.some((observation) => sameRuntimeLocation(item, observation)));
+  const unresolved = uncertain.filter((item) => !runtimeContracts.some((observation) => sameRuntimeLocation(item, observation)));
   return {
-    contracts: uniqueBy(contracts, (item) => `${item.transport}|${item.side}|${item.service || ""}|${item.operation || ""}|${item.name}|${item.file}|${item.line}`),
-    uncertain: uniqueBy(uncertain, (item) => `${item.transport}|${item.file}|${item.line}|${item.reason}`),
-    reasons: loaded.reasons,
+    contracts: mergeRuntimeContracts(
+      uniqueBy(contracts, (item) => `${item.transport}|${item.side}|${item.service || ""}|${item.operation || ""}|${item.name}|${item.file}|${item.line}`),
+      runtimeContracts,
+    ),
+    uncertain: uniqueBy(unresolved, (item) => `${item.transport}|${item.file}|${item.line}|${item.reason}`),
+    resolvedRuntime: uniqueBy(resolvedRuntime, (item) => `${item.transport}|${item.file}|${item.line}|${item.reason}`),
+    reasons: [...loaded.reasons, ...runtime.reasons],
+    runtime,
     filesScanned: loaded.sources.length,
   };
 }
 
 function contractMatch(server, caller, backendServers) {
   if (server.transport !== caller.transport) return null;
-  if (server.transport === "graphql" && caller.side === "client" && server.operation === caller.operation && server.name === caller.name) return { confidence: "high", kind: "operation-field" };
+  const runtime = server.runtimeObserved || caller.runtimeObserved;
+  const match = (kind) => ({ confidence: "high", kind, evidence: runtime ? "RUNTIME_OBSERVED" : "STATIC" });
+  if (server.transport === "graphql" && caller.side === "client" && server.operation === caller.operation && server.name === caller.name) return match("operation-field");
   if (server.transport === "grpc" && caller.side === "client" && norm(server.name) === norm(caller.name)) {
-    if (caller.service && norm(server.service) === norm(caller.service)) return { confidence: "high", kind: "service-method" };
+    if (caller.service && norm(server.service) === norm(caller.service)) return match("service-method");
     const sameMethod = backendServers.filter((item) => item.transport === "grpc" && norm(item.name) === norm(caller.name));
-    if (!caller.service && sameMethod.length === 1) return { confidence: "medium", kind: "unique-method" };
+    if (!caller.service && sameMethod.length === 1) return { confidence: "medium", kind: "unique-method", evidence: runtime ? "RUNTIME_OBSERVED" : "STATIC" };
   }
-  if (server.transport === "event" && server.name === caller.name && server.side !== caller.side) return { confidence: "high", kind: "topic-direction" };
+  if (server.transport === "event" && server.name === caller.name && server.side !== caller.side) return match("topic-direction");
   return null;
 }
 
 export function analyzeTransportContracts(input = {}) {
   const transport = ["all", "graphql", "grpc", "event"].includes(input.transport) ? input.transport : "all";
-  const options = { includeTests: input.includeTests === true, maxFiles: Math.max(1, Math.min(10_000, Number(input.maxFiles) || 3_000)) };
+  const options = {
+    includeTests: input.includeTests === true,
+    maxFiles: Math.max(1, Math.min(10_000, Number(input.maxFiles) || 3_000)),
+    transport,
+    runtimeEvidenceFiles: input.runtimeEvidenceFiles || {},
+    runtimeEvidenceMaxAgeHours: input.runtimeEvidenceMaxAgeHours,
+    now: input.now,
+  };
   const backend = detect(input.backend, "backend", options);
   const clients = (input.clients || []).map((descriptor) => ({ descriptor, evidence: detect(descriptor, "client", options), reverse: reverseRuntimeImports(descriptor.graph) }));
   const selected = (item) => transport === "all" || item.transport === transport;
@@ -131,7 +180,7 @@ export function analyzeTransportContracts(input = {}) {
     for (const client of clients) for (const caller of client.evidence.contracts.filter(selected)) {
       const match = contractMatch(server, caller, servers);
       if (!match) continue;
-      callsites.push({ clientRepo: client.descriptor.id, file: caller.file, line: caller.line, detector: caller.detector, match });
+      callsites.push({ clientRepo: client.descriptor.id, file: caller.file, line: caller.line, detector: caller.detector, match, runtimeObserved: caller.runtimeObserved === true, observedCount: caller.observedCount });
     }
     const affected = affectedForEndpoint(callsites, clients.map((item) => ({ id: item.descriptor.id, reverse: item.reverse })), {
       maxImpactDepth: Math.max(0, Math.min(5, Number(input.maxImpactDepth) || 2)),
@@ -145,13 +194,31 @@ export function analyzeTransportContracts(input = {}) {
   ].filter(selected);
   const reasons = [...backend.reasons, ...clients.flatMap((item) => item.evidence.reasons)];
   if (uncertain.length) reasons.push(`${uncertain.length} dynamic/reflection contract expression(s) remain UNKNOWN`);
+  const runtimeReports = [
+    { repository: input.backend.id, ...backend.runtime },
+    ...clients.map((item) => ({ repository: item.descriptor.id, ...item.evidence.runtime })),
+  ];
+  const resolvedRuntime = backend.resolvedRuntime.length + clients.reduce((sum, item) => sum + item.evidence.resolvedRuntime.length, 0);
   return {
-    transportContractsV: 1,
+    transportContractsV: 2,
     transport,
     status: reasons.length ? "PARTIAL" : "COMPLETE",
     completeness: { complete: reasons.length === 0, reasons: [...new Set(reasons)] },
-    totals: { contracts: results.length, matches: results.reduce((sum, item) => sum + item.callsites.length, 0), uncertain: uncertain.length, filesScanned: backend.filesScanned + clients.reduce((sum, item) => sum + item.evidence.filesScanned, 0) },
+    totals: {
+      contracts: results.length,
+      matches: results.reduce((sum, item) => sum + item.callsites.length, 0),
+      uncertain: uncertain.length,
+      filesScanned: backend.filesScanned + clients.reduce((sum, item) => sum + item.evidence.filesScanned, 0),
+      runtimeObservations: runtimeReports.reduce((sum, item) => sum + item.observations.length, 0),
+      runtimeResolved: resolvedRuntime,
+      runtimeReportsComplete: runtimeReports.filter((item) => item.status === "COMPLETE").length,
+    },
     contracts: results,
     uncertain: uncertain.slice(0, 200),
+    runtimeEvidence: {
+      status: runtimeReports.every((item) => item.status === "COMPLETE") ? "COMPLETE" : "PARTIAL",
+      reports: runtimeReports.map(({ observations, reasons: reportReasons, ...report }) => ({ ...report, observationCount: observations.length, reasons: reportReasons })),
+      resolvedUnknowns: resolvedRuntime,
+    },
   };
 }

package/src/analysis/transport-runtime-evidence.js

@@ -0,0 +1,155 @@
+import { readFileSync, statSync } from "node:fs";
+import { isAbsolute, relative, resolve } from "node:path";
+import { createRepoBoundary, isPathInside } from "../repo-path.js";
+
+const TRANSPORT_RUNTIME_SCHEMA = "weavatrix.transport-runtime.v1";
+const TRANSPORTS = ["graphql", "grpc", "event"];
+const DEFAULT_REPORTS = [
+  ".weavatrix/transport-runtime.json",
+  ".weavatrix/reports/transport-runtime.json",
+];
+const MAX_REPORT_BYTES = 2 * 1024 * 1024;
+const MAX_OBSERVATIONS = 10_000;
+
+const text = (value, max = 256) => typeof value === "string" ? value.trim().slice(0, max) : "";
+const number = (value) => Number.isFinite(Number(value)) ? Number(value) : undefined;
+
+function requestedTransports(transport) {
+  return TRANSPORTS.includes(transport) ? [transport] : TRANSPORTS;
+}
+
+function reportPath(descriptor, candidate) {
+  const boundary = createRepoBoundary(descriptor.repoRoot);
+  const resolved = boundary.resolve(candidate);
+  return resolved.ok ? { boundary, path: resolved.path } : { boundary, reason: resolved.reason };
+}
+
+function safeSourceFile(descriptor, value) {
+  const raw = text(value, 1024).replace(/\\/g, "/");
+  if (!raw || raw.includes("\0")) return undefined;
+  if (!isAbsolute(raw) && !raw.startsWith("../") && !raw.includes("/../")) return raw.replace(/^\.\//, "");
+  const root = resolve(descriptor.repoRoot);
+  const target = resolve(raw);
+  return isPathInside(root, target) ? relative(root, target).replace(/\\/g, "/") : undefined;
+}
+
+function attributeValue(attribute) {
+  const value = attribute?.value ?? attribute;
+  for (const key of ["stringValue", "intValue", "doubleValue", "boolValue"]) {
+    if (value?.[key] !== undefined) return value[key];
+  }
+  return typeof value === "string" || typeof value === "number" || typeof value === "boolean" ? value : undefined;
+}
+
+function attributes(input) {
+  const out = new Map();
+  for (const item of Array.isArray(input) ? input : []) if (typeof item?.key === "string") out.set(item.key, attributeValue(item));
+  return out;
+}
+
+function spanSide(span, transport) {
+  const kind = String(span?.kind ?? "").toUpperCase();
+  const numeric = Number(span?.kind);
+  if (transport === "event") {
+    if (kind.includes("PRODUCER") || numeric === 4) return "publisher";
+    if (kind.includes("CONSUMER") || numeric === 5) return "subscriber";
+  }
+  if (kind.includes("SERVER") || numeric === 2) return "server";
+  if (kind.includes("CLIENT") || numeric === 3) return "client";
+  return "";
+}
+
+function observationFromSpan(descriptor, span) {
+  const attrs = attributes(span?.attributes);
+  const common = {
+    file: safeSourceFile(descriptor, attrs.get("code.file.path") ?? attrs.get("code.filepath")),
+    line: number(attrs.get("code.line.number") ?? attrs.get("code.lineno")),
+    observedCount: 1,
+    detector: "otlp-span",
+  };
+  const rpcSystem = text(attrs.get("rpc.system")).toLowerCase();
+  if (rpcSystem === "grpc") {
+    const fallback = text(span?.name).split("/").filter(Boolean);
+    return { ...common, transport: "grpc", side: spanSide(span, "grpc"), service: text(attrs.get("rpc.service")) || fallback.at(-2), name: text(attrs.get("rpc.method")) || fallback.at(-1) };
+  }
+  const graphOperation = text(attrs.get("graphql.operation.type")).toUpperCase();
+  const graphField = text(attrs.get("graphql.field.name") ?? attrs.get("graphql.field"));
+  if (graphOperation || graphField) return { ...common, transport: "graphql", side: spanSide(span, "graphql"), operation: graphOperation, name: graphField };
+  const messagingSystem = text(attrs.get("messaging.system")).toLowerCase();
+  const destination = text(attrs.get("messaging.destination.name") ?? attrs.get("messaging.destination"));
+  if (messagingSystem || destination) return { ...common, transport: "event", side: spanSide(span, "event"), kind: text(attrs.get("messaging.operation.type") ?? attrs.get("messaging.operation")), name: destination };
+  return null;
+}
+
+function otlpObservations(descriptor, report) {
+  const root = report.otlp && typeof report.otlp === "object" ? report.otlp : report;
+  const out = [];
+  for (const resource of Array.isArray(root.resourceSpans) ? root.resourceSpans : []) {
+    const scopes = resource.scopeSpans ?? resource.instrumentationLibrarySpans ?? [];
+    for (const scope of scopes) for (const span of Array.isArray(scope.spans) ? scope.spans : []) {
+      const observation = observationFromSpan(descriptor, span);
+      if (observation) out.push(observation);
+    }
+  }
+  return out;
+}
+
+function normalizeObservation(descriptor, raw) {
+  const transport = text(raw?.transport).toLowerCase();
+  const side = text(raw?.side).toLowerCase();
+  const name = text(raw?.name);
+  if (!TRANSPORTS.includes(transport) || !name) return null;
+  const allowedSides = transport === "event" ? ["publisher", "subscriber"] : ["server", "client", "server-call"];
+  if (!allowedSides.includes(side)) return null;
+  const operation = text(raw?.operation).toUpperCase();
+  if (transport === "graphql" && !["QUERY", "MUTATION", "SUBSCRIPTION"].includes(operation)) return null;
+  const line = number(raw?.line);
+  return {
+    transport, side, name,
+    ...(operation ? { operation } : {}),
+    ...(text(raw?.service) ? { service: text(raw.service) } : {}),
+    ...(text(raw?.kind) ? { kind: text(raw.kind) } : {}),
+    ...(safeSourceFile(descriptor, raw?.file) ? { file: safeSourceFile(descriptor, raw.file) } : {}),
+    ...(line > 0 && line <= 10_000_000 ? { line: Math.floor(line) } : {}),
+    observedCount: Math.max(1, Math.min(1_000_000_000, Math.floor(number(raw?.observedCount) || 1))),
+    detector: text(raw?.detector) || "runtime-report",
+    runtimeObserved: true,
+  };
+}
+
+function validateReport(descriptor, report, options, file) {
+  const reasons = [];
+  let usable = true;
+  if (report?.schema !== TRANSPORT_RUNTIME_SCHEMA) { reasons.push(`${descriptor.id}: unsupported runtime evidence schema`); usable = false; }
+  if (!descriptor.graph?.graphRevision || report?.repositoryRevision !== descriptor.graph.graphRevision) { reasons.push(`${descriptor.id}: runtime evidence revision does not match the active graph`); usable = false; }
+  const generatedAt = Date.parse(report?.generatedAt);
+  const now = Number(options.now ?? Date.now());
+  const maxAgeMs = Math.max(1, Math.min(8760, Number(options.maxAgeHours) || 168)) * 3_600_000;
+  if (!Number.isFinite(generatedAt)) { reasons.push(`${descriptor.id}: runtime evidence generatedAt is invalid`); usable = false; }
+  else if (generatedAt > now + 300_000 || now - generatedAt > maxAgeMs) { reasons.push(`${descriptor.id}: runtime evidence is stale or from the future`); usable = false; }
+  const selected = requestedTransports(options.transport);
+  const coverage = Object.fromEntries(selected.map((item) => [item, String(report?.coverage?.[item] || "NOT_CHECKED").toUpperCase()]));
+  for (const [item, status] of Object.entries(coverage)) if (status !== "COMPLETE") reasons.push(`${descriptor.id}: ${item} runtime capture is ${status}`);
+  const raw = [...(Array.isArray(report?.observations) ? report.observations : []), ...otlpObservations(descriptor, report)].slice(0, MAX_OBSERVATIONS);
+  const observations = usable ? raw.map((item) => normalizeObservation(descriptor, item)).filter(Boolean) : [];
+  if (raw.length !== observations.length) reasons.push(`${descriptor.id}: ${raw.length - observations.length} invalid runtime observation(s) were ignored`);
+  return { status: reasons.length ? "PARTIAL" : "COMPLETE", file, generatedAt: report?.generatedAt, repositoryRevision: report?.repositoryRevision, coverage, observations, reasons };
+}
+
+export function loadTransportRuntimeEvidence(descriptor, options = {}) {
+  const candidates = options.file ? [String(options.file)] : DEFAULT_REPORTS;
+  for (const candidate of candidates) {
+    const resolved = reportPath(descriptor, candidate);
+    if (!resolved.path) {
+      if (options.file) return { status: "ERROR", file: candidate, coverage: {}, observations: [], reasons: [`${descriptor.id}: runtime evidence path is ${resolved.reason}`] };
+      continue;
+    }
+    try {
+      if (statSync(resolved.path).size > MAX_REPORT_BYTES) return { status: "ERROR", file: candidate, coverage: {}, observations: [], reasons: [`${descriptor.id}: runtime evidence exceeds ${MAX_REPORT_BYTES} bytes`] };
+      return validateReport(descriptor, JSON.parse(readFileSync(resolved.path, "utf8")), options, candidate);
+    } catch {
+      return { status: "ERROR", file: candidate, coverage: {}, observations: [], reasons: [`${descriptor.id}: runtime evidence is unreadable or invalid JSON`] };
+    }
+  }
+  return { status: "NOT_CHECKED", file: null, coverage: {}, observations: [], reasons: [`${descriptor.id}: no revision-bound runtime transport evidence was found`] };
+}

package/src/child-env.js

@@ -1,5 +1,5 @@
-// Child processes and worker threads do not need the hosted-sync bearer token.
-// Keep it in the MCP process so only sync_graph can attach it to an HTTP request.
+// Child processes and worker threads never need credentials owned by a composing connector.
+// Keep connector secrets in the parent MCP process and out of Git/LSP/test subprocesses.
 export function childProcessEnv(overrides = {}) {
   const env = { ...process.env, ...overrides };
   delete env.WEAVATRIX_SYNC_TOKEN;

package/src/extension/local-services.mjs

@@ -0,0 +1,75 @@
+import {readFileSync, statSync} from 'node:fs'
+import {createHash} from 'node:crypto'
+import {basename} from 'node:path'
+import {graphStaleness} from '../mcp/graph-context.mjs'
+import {createSyncPayload, createSyncPayloadV3, MAX_SYNC_BODY_BYTES} from '../mcp/sync-payload.mjs'
+import {createEvidenceSnapshot} from '../mcp/evidence-snapshot.mjs'
+import {graphHomeDir, graphOutDirForRepo} from '../graph/layout.js'
+import {registerRepository, repositoryRecord} from '../graph/repo-registry.js'
+import {writeCachedArchitectureContract} from '../analysis/architecture-contract.js'
+import {collectInstalled} from '../security/installed.js'
+import {toolResult} from '../mcp/tool-result.mjs'
+import {
+    commitAdvisoryRefresh, createAdvisoryQueryPlan, DEFAULT_STORE, storeMeta,
+} from '../security/advisory-store.js'
+
+const MAX_GRAPH_FILE_BYTES = 64 * 1024 * 1024
+
+const repositoryLabel = (repoRoot) => {
+    const safe = basename(String(repoRoot || '')).normalize('NFKC').replace(/[^a-z0-9._-]+/gi, '-').replace(/^-+|-+$/g, '')
+    return (safe || 'repo').slice(0, 128)
+}
+
+const identityFor = (repoRoot) => repositoryRecord(repoRoot, graphHomeDir())
+    || registerRepository({repoPath: repoRoot, graphDir: graphOutDirForRepo(repoRoot), graphHome: graphHomeDir()})
+
+// Produces the exact source-free wire material locally. It reads no credentials and performs no
+// network I/O; the caller owns destination policy, consent, authentication and transport.
+export async function createSourceFreeSyncMaterial(graph, {payloadVersion = 3} = {}, ctx = {}) {
+    if (!graph) throw new Error('No graph loaded — build one first (open_repo / rebuild_graph).')
+    if (!ctx.graphPath || !ctx.repoRoot) throw new Error('No active repository graph — open_repo first.')
+    const size = statSync(ctx.graphPath).size
+    if (size > MAX_GRAPH_FILE_BYTES) throw new Error(`graph.json exceeds the ${MAX_GRAPH_FILE_BYTES / 1024 / 1024} MB local safety limit`)
+    const raw = JSON.parse(readFileSync(ctx.graphPath, 'utf8'))
+    let payload
+    if (Number(payloadVersion) === 2) {
+        payload = createSyncPayload(raw)
+    } else {
+        if (graphStaleness(ctx).stale) throw new Error('Cannot produce synchronized evidence from a stale graph. Run rebuild_graph first.')
+        payload = createSyncPayloadV3(raw, await createEvidenceSnapshot({repoRoot: ctx.repoRoot, graph: raw}))
+    }
+    const body = JSON.stringify(payload)
+    const bodyBytes = Buffer.byteLength(body)
+    if (bodyBytes > MAX_SYNC_BODY_BYTES) throw new Error(`source-free payload exceeds the ${MAX_SYNC_BODY_BYTES / 1024} KB safety limit`)
+    const identity = identityFor(ctx.repoRoot)
+    return Object.freeze({
+        payload,
+        body,
+        bodyBytes,
+        bodyHash: createHash('sha256').update(body).digest('hex'),
+        repoName: repositoryLabel(ctx.repoRoot),
+        repositoryId: identity.repositoryId,
+        graphPath: ctx.graphPath,
+    })
+}
+
+export function activeRepositoryIdentity(ctx = {}) {
+    if (!ctx.repoRoot || !ctx.graphPath) throw new Error('No active repository graph — open_repo first.')
+    const identity = identityFor(ctx.repoRoot)
+    return Object.freeze({repositoryId: identity.repositoryId, repoName: repositoryLabel(ctx.repoRoot), graphPath: ctx.graphPath})
+}
+
+export const cacheArchitectureContract = (graphPath, contract) => writeCachedArchitectureContract(graphPath, contract)
+
+export function installedPackageCoordinates(repoRoot) {
+    if (!repoRoot) throw new Error('No repository root is active.')
+    return collectInstalled(repoRoot).installed
+}
+
+export const advisoryCacheMetadata = (storePath = DEFAULT_STORE) => ({
+    path: storePath,
+    ...storeMeta(storePath),
+})
+
+export {commitAdvisoryRefresh, createAdvisoryQueryPlan}
+export {toolResult}

package/src/graph/internal-builder.langs.js

@@ -50,6 +50,7 @@ const isDataFile = (p) => DATA_EXT.has(extname(p)) || INFRA_NAME.test(String(p))
 // Claude Code / Codex node. AGENT_DOTFILE lets a few AI-agent instruction dotfiles past the dotfile skip below.
 const DOC_EXT = new Set([".md", ".mdx", ".markdown", ".mdown", ".mkd", ".mkdn", ".rst", ".adoc", ".asciidoc"]);
 const AGENT_DOTFILE = /^\.(cursorrules|windsurfrules|clinerules)$/i;
+const RUNTIME_EVIDENCE = /^\.weavatrix\/(?:reports\/)?transport-runtime\.json$/i;
 const isDocFile = (p) => DOC_EXT.has(extname(p)) || AGENT_DOTFILE.test(String(p).split(/[\\/]/).pop() || "");
 const SKIP = new Set(["node_modules", ".git", "dist", "build", "coverage", "vendor", "weavatrix-graphs", "weavatrix-graphs", ".next", "out", "__pycache__", ".venv", "venv", "env", ".tox", "site-packages", ".mypy_cache", ".pytest_cache"]);
 const MAX_PARSE_BYTES = 1_500_000;   // skip parsing files above this (minified bundles / generated blobs wedge tree-sitter)
@@ -139,6 +140,7 @@ function gitFileUniverse(dir) {
   const files = [];
   for (const rel of raw.split("\0")) {
     if (!rel) continue;
+    if (RUNTIME_EVIDENCE.test(rel.replace(/\\/g, "/"))) continue; // runtime output must not change the source revision it attests
     const full = join(dir, rel);
     let real; try { real = realpathSync.native(full); } catch { continue; } // deleted index entry
     if (!isPathInside(rootReal, real)) continue; // tracked symlink/junction escaping the repo

package/src/graph/repo-registry.js

@@ -1,5 +1,5 @@
-// Global local registry for repository graphs. Absolute paths never leave the machine; hosted sync
-// uses the opaque UUID. Identity is anchored in each canonical graph folder so simultaneous MCP
+// Global local registry for repository graphs. Absolute paths never leave the machine; composing
+// extensions may use the opaque UUID. Identity is anchored in each canonical graph folder so simultaneous MCP
 // processes cannot mint different IDs for the same repository.
 import {randomUUID} from 'node:crypto'
 import {existsSync, mkdirSync, readFileSync, realpathSync, statSync, writeFileSync} from 'node:fs'

package/src/mcp/catalog.mjs

@@ -8,21 +8,18 @@ import {fileURLToPath} from 'node:url'
 import {resolveNode, isSymbol, stalenessLine, resetStalenessCache} from './graph-context.mjs'
 import {createRgResolver} from '../mcp-rg.mjs'
 import {readSource, searchCode} from '../mcp-source-tools.mjs'
+import {extensionRuntimeSummary, normalizeWeavatrixExtensions} from './extension-api.mjs'
 
 const SELF_DIR = dirname(fileURLToPath(import.meta.url))
 const resolveRg = createRgResolver(SELF_DIR)
-// The default profile is fully offline and includes explicit local repository retargeting. Operators
-// who want a hard single-repository boundary can select the `pinned` profile instead. HTTP tools are
-// split into explicit `advisories` and `hosted` capabilities; the old `online` name remains an alias
-// for both so existing registrations keep working.
+// The core artifact has only local profiles. Online packages compose their own profiles through the
+// public extension API; the MIT package never contains a capability alias that can enable HTTP.
 export const DEFAULT_CAPS = Object.freeze(['graph', 'search', 'source', 'health', 'build', 'retarget', 'crossrepo'])
 const PROFILE_CAPS = Object.freeze({
     offline: DEFAULT_CAPS,
     pinned: ['graph', 'search', 'source', 'health', 'build'],
-    osv: [...DEFAULT_CAPS, 'advisories'],
-    hosted: [...DEFAULT_CAPS, 'advisories', 'hosted'],
-    full: [...DEFAULT_CAPS, 'advisories', 'hosted'],
 })
+const MOVED_PROFILES = new Set(['online', 'osv', 'hosted', 'full'])
 
 // The files whose mtime the stdio shell watches for hot reload — keep in sync with the imports in
 // loadHotApi below (catalog.mjs itself is last: a change here re-derives the whole table).
@@ -36,8 +33,7 @@ const HOT_OWNERS = [
     'graph/tools-core.mjs', 'graph/tools-query.mjs', 'tools-graph-hubs.mjs',
     'health/duplicates.mjs', 'health/dead-code.mjs', 'health/audit-format.mjs',
     'health/audit.mjs', 'health/structure.mjs', 'health/endpoints.mjs',
-    'actions/graph-lifecycle.mjs', 'actions/advisories.mjs',
-    'actions/hosted-architecture.mjs', 'actions/graph-sync.mjs',
+    'actions/graph-lifecycle.mjs',
     'architecture-starter.mjs', 'architecture-bootstrap.mjs',
     'company-contract-verdict.mjs',
 ]
@@ -76,13 +72,13 @@ function buildTools({tg, ti, th, ts, tb, te, ta, tar, thi, tc, tv, caps}) {
         {
             cap: 'crossrepo',
             name: 'trace_api_contract',
-            description: 'Cross-repository HTTP, GraphQL, gRPC and event/topic contract, handler-liveness and blast-radius evidence. Joins static backend contracts to registered client repositories; dynamic URLs/topics, reflection and unresolved runtime configuration remain explicit UNKNOWN evidence. Medium/high-confidence external matches mark a handler/contract NOT_DEAD_EXTERNAL_USE. Repository paths stay local and cannot be supplied through this tool.',
+            description: 'Cross-repository HTTP, GraphQL, gRPC and event/topic contract, handler-liveness and blast-radius evidence. Joins static models with optional revision-bound runtime/OTLP evidence; unobserved dynamic URLs/topics/reflection remain explicit UNKNOWN. Medium/high-confidence external matches mark a handler/contract NOT_DEAD_EXTERNAL_USE. Repository paths stay local and runtime report paths are repository-contained.',
             inputSchema: {
                 type: 'object',
                 properties: {
                     backend: {type: 'string', description: 'Backend repository UUID or exact unambiguous registry label'},
                     clients: {type: 'array', items: {type: 'string'}, minItems: 1, maxItems: 20, description: 'Client repository UUIDs or exact unambiguous registry labels'},
-                    transport: {type: 'string', enum: ['all', 'http', 'graphql', 'grpc', 'event'], default: 'all', description: 'Contract family to trace; all runs every supported static detector'},
+                    transport: {type: 'string', enum: ['all', 'http', 'graphql', 'grpc', 'event'], default: 'all', description: 'Contract family to trace; all runs static and revision-bound runtime evidence for every supported transport'},
                     method: {type: 'string', enum: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS']},
                     path: {type: 'string', maxLength: 2048, description: 'Optional full route or segment-aligned route fragment; /query matches /edgeAnalytics/query/... and {id}, :id and concrete parameter values are normalized'},
                     changed_files: {type: 'array', items: {type: 'string'}, maxItems: 500, description: 'Optional backend repo-relative changed files; only endpoints declared in those files are traced'},
@@ -107,6 +103,8 @@ function buildTools({tg, ti, th, ts, tb, te, ta, tar, thi, tc, tv, caps}) {
                     },
                     auto_discover_wrappers: {type: 'boolean', default: true, description: 'Discover only simple unambiguous functions that forward a URL parameter directly to a known object-style HTTP client'},
                     runtime_config: {type: 'object', maxProperties: 50, additionalProperties: {type: 'string', maxLength: 2048}, description: 'Optional non-secret static bindings for runtime URL prefixes, e.g. process.env.API_BASE. Values are used locally for this call and are not returned.'},
+                    runtime_evidence_files: {type: 'object', maxProperties: 21, additionalProperties: {type: 'string', maxLength: 512}, description: 'Optional repository-label/UUID to repository-relative weavatrix.transport-runtime.v1 JSON path. Defaults to .weavatrix/transport-runtime.json or .weavatrix/reports/transport-runtime.json in each repository.'},
+                    runtime_evidence_max_age_hours: {type: 'integer', minimum: 1, maximum: 8760, default: 168, description: 'Maximum accepted age for a revision-matched runtime evidence report'},
                     include_tests: {type: 'boolean', default: false},
                     max_impact_depth: {type: 'integer', minimum: 0, maximum: 5, default: 2},
                     max_endpoints: {type: 'integer', minimum: 1, maximum: 500, default: 250},
@@ -123,7 +121,7 @@ function buildTools({tg, ti, th, ts, tb, te, ta, tar, thi, tc, tv, caps}) {
           {cap: 'source', name: 'read_source', description: "Read the actual source of a node (by label/ID) or a repo-relative file path — the symbol's lines with context. The graph stores only locations, not source text. For a path read, pass start_line to anchor the window anywhere in the file (otherwise it shows the head).", inputSchema: {type: 'object', properties: {label: {type: 'string', description: 'node label or ID'}, path: {type: 'string', description: 'or a repo-relative file path'}, start_line: {type: 'integer', description: 'anchor line: window = start_line-before .. start_line+after'}, before: {type: 'integer', default: 3}, after: {type: 'integer', default: 40}}}, run: (g, a, ctx) => readSource({repoRoot: ctx.repoRoot, resolveNode, isSymbol}, g, a)},
           {cap: 'source', refreshGraph: true, name: 'inspect_symbol', description: 'Inspect one exact symbol with an on-demand TypeScript/JavaScript LSP reference query, grouped occurrence containers, graph blast radius, complexity facts and bounded local source context. Ambiguous labels fail closed; point queries never replace the broad precision overlay.', inputSchema: {type: 'object', properties: {label: {type: 'string', description: 'Exact node ID or unambiguous symbol label'}, precision: {type: 'string', enum: ['auto', 'graph', 'lsp'], default: 'auto'}, max_references: {type: 'integer', minimum: 1, maximum: 5000, default: 1000}, max_containers: {type: 'integer', minimum: 1, maximum: 50, default: 15}, context_lines: {type: 'integer', minimum: 0, maximum: 40, default: 8}, timeout_ms: {type: 'integer', minimum: 1000, maximum: 60000, default: 30000}}, required: ['label']}, run: (g, a, ctx) => ts.tInspectSymbol(g, a, ctx)},
           {cap: 'source', refreshGraph: true, name: 'context_bundle', description: 'Return one compact, bounded source bundle for an exact symbol: definition, production-first inbound/outbound containers, exact re-export sites, on-demand TS/JS reference evidence and diverse excerpts around call sites. Use before an edit when query_graph would be too broad.', inputSchema: {type: 'object', properties: {label: {type: 'string', description: 'Exact node ID or unambiguous symbol label'}, precision: {type: 'string', enum: ['auto', 'graph', 'lsp'], default: 'auto'}, max_references: {type: 'integer', minimum: 1, maximum: 5000, default: 1000}, max_related: {type: 'integer', minimum: 1, maximum: 30, default: 10}, max_reexports: {type: 'integer', minimum: 1, maximum: 100, default: 20}, max_source_files: {type: 'integer', minimum: 1, maximum: 8, default: 4}, context_lines: {type: 'integer', minimum: 0, maximum: 12, default: 4}, include_classified: {type: 'boolean', default: false, description: 'Include test/e2e/generated/mock/story/docs/benchmark/temp callers after production callers'}, timeout_ms: {type: 'integer', minimum: 1000, maximum: 60000, default: 30000}}, required: ['label']}, run: (g, a, ctx) => tb.tContextBundle(g, a, ctx, ts.tInspectSymbol)},
-        {cap: 'health', name: 'find_duplicates', description: "Content-based clone detection over production code (MOSS winnowing over method bodies). Supports high-confidence small clones down to 12 tokens when min_tokens is lowered. Tests, classified non-product paths, and all-router framework boilerplate clone groups are excluded by default; opt them in explicitly.", inputSchema: {type: 'object', properties: {min_similarity: {type: 'integer', description: '50-100, default 80 (ignored in semantic mode)'}, min_tokens: {type: 'integer', minimum: 12, maximum: 400, description: 'min fragment size, 12-400; default 50'}, mode: {type: 'string', enum: ['renamed', 'strict', 'semantic'], default: 'renamed'}, include_tests: {type: 'boolean', default: false}, include_classified: {type: 'boolean', default: false, description: 'Include generated/mock/story/docs/benchmark/temp and paths explicitly classified as excluded; tests still require include_tests'}, include_boilerplate: {type: 'boolean', default: false, description: 'Include clone groups made entirely of conventional *.router.js/ts router symbols'}, include_strings: {type: 'boolean', description: 'Also clone-check large multi-line string literals', default: false}, top_n: {type: 'integer', default: 15}}}, run: (g, a, ctx) => th.tFindDuplicates(g, a, ctx)},
+        {cap: 'health', name: 'find_duplicates', description: "Content-based clone detection over production code (MOSS winnowing over method bodies). Supports high-confidence small clones down to 12 tokens when min_tokens is lowered. Tests, classified non-product paths, all-router framework boilerplate and immutable declarative catalogs are excluded by default; opt them in explicitly.", inputSchema: {type: 'object', properties: {min_similarity: {type: 'integer', description: '50-100, default 80 (ignored in semantic mode)'}, min_tokens: {type: 'integer', minimum: 12, maximum: 400, description: 'min fragment size, 12-400; default 50'}, mode: {type: 'string', enum: ['renamed', 'strict', 'semantic'], default: 'renamed'}, include_tests: {type: 'boolean', default: false}, include_classified: {type: 'boolean', default: false, description: 'Include generated/mock/story/docs/benchmark/temp and paths explicitly classified as excluded; tests still require include_tests'}, include_boilerplate: {type: 'boolean', default: false, description: 'Include clone groups made entirely of conventional *.router.js/ts router symbols'}, include_declarative: {type: 'boolean', default: false, description: 'Include repeated immutable array/object catalogs that contain no executable control flow'}, include_strings: {type: 'boolean', description: 'Also clone-check large multi-line string literals', default: false}, top_n: {type: 'integer', default: 15}}}, run: (g, a, ctx) => th.tFindDuplicates(g, a, ctx)},
         {cap: 'health', name: 'find_dead_code', description: 'Conservative review queue for statically unreferenced files, functions, methods and symbols. Returns confidence, reason, bounded evidence and explicit framework/dynamic/reflection/public-API caveats; never an auto-delete verdict. Tests, generated code, mocks, stories, docs, benchmarks and temporary roots are excluded by default.', inputSchema: {type: 'object', properties: {path: {type: 'string', maxLength: 1024, description: 'Optional repo-relative path prefix'}, kinds: {type: 'array', items: {type: 'string', enum: ['file', 'function', 'method', 'symbol']}, maxItems: 4, uniqueItems: true, description: 'Optional candidate kinds; defaults to all'}, min_confidence: {type: 'string', enum: ['high', 'medium', 'low'], default: 'medium', description: 'Minimum confidence to include. low explicitly includes public/framework/dynamic review candidates'}, include_tests: {type: 'boolean', default: false}, include_classified: {type: 'boolean', default: false, description: 'Include generated/mock/story/docs/benchmark/temp and paths explicitly classified as excluded; tests still require include_tests'}, top_n: {type: 'integer', minimum: 1, maximum: 100, default: 30}}}, run: (g, a, ctx) => th.tFindDeadCode(g, a, ctx)},
         {cap: 'health', name: 'run_audit', description: 'Core production-first repository Health review with an explicit capability/completeness matrix for structure, dependencies, bounded runtime-correctness/concurrency patterns, advisories, malware and coverage. Unsupported Maven/Gradle import verification is NOT_SUPPORTED/PARTIAL, never a clean zero. Findings whose evidence is entirely test/e2e/generated/mock/story/docs/benchmark/temp or explicitly excluded are suppressed by default; opt them in with include_classified. category=dependencies is a dedicated dependency-health projection across missing, unused and duplicate declarations while preserving each finding\'s native category. With base_ref, builds and audits an immutable Git checkout and compares stable deterministic finding IDs; debt defaults to genuinely new findings. Supply-chain checks remain explicitly uncomparable across the source-only baseline. changed_files without base_ref is only changed-scope, never a new-debt claim.', inputSchema: {type: 'object', properties: {category: {type: 'string', enum: ['dependencies', 'unused', 'structure', 'vulnerability', 'malware'], description: 'Only findings of this category; dependencies selects dependency manifest/import findings across native categories'}, min_severity: {type: 'string', enum: ['critical', 'high', 'medium', 'low', 'info'], description: 'Minimum severity to include'}, max_findings: {type: 'integer', description: 'Max findings to list, default 30'}, include_classified: {type: 'boolean', default: false, description: 'Include findings whose evidence is entirely tests/e2e/generated/mocks/stories/docs/benchmarks/temp or explicitly excluded'}, include_malware_scan: {type: 'boolean', description: 'Also grep installed packages for malware heuristics (slow)', default: false}, base_ref: {type: 'string', maxLength: 200, description: 'Optional immutable Git baseline (for example HEAD~1 or origin/main). Enables honest new/existing/fixed debt comparison'}, changed_files: {type: 'array', items: {type: 'string'}, minItems: 1, maxItems: 500, description: 'Optional explicit repo-relative scope. Without base_ref this is changed-scope only; when omitted with base_ref, files are derived from the Git diff'}, debt: {type: 'string', enum: ['new', 'existing', 'all'], default: 'new', description: 'Baseline comparison view. Defaults to genuinely new deterministic findings when base_ref is present'}}}, run: (g, a, ctx) => th.tRunAudit(g, a, ctx)},
         {cap: 'health', name: 'coverage_map', description: 'Map a real existing coverage report onto the graph. If no report exists, return clearly labelled static test reachability (a test imports/reaches a source file) with actualCoverage=NOT_AVAILABLE; reachability is never presented as measured coverage.', inputSchema: {type: 'object', properties: {top_n: {type: 'integer', description: 'Max risk hotspots to list, default 15'}, path: {type: 'string', description: 'Optional repo-relative path prefix filter, e.g. src/query'}}}, run: (g, a, ctx) => th.tCoverageMap(g, a, ctx)},
@@ -141,10 +139,6 @@ function buildTools({tg, ti, th, ts, tb, te, ta, tar, thi, tc, tv, caps}) {
         {cap: 'health', name: 'propose_architecture_exception', description: 'Prepare, but never apply, a bounded exception proposal for human review.', inputSchema: {type: 'object', properties: {fingerprint: {type: 'string'}, reason: {type: 'string'}, expires: {type: 'string', description: 'Optional YYYY-MM-DD'}}, required: ['fingerprint', 'reason']}, run: (g, a, ctx) => tar.tProposeArchitectureException(g, a, ctx)},
         {cap: 'retarget', name: 'open_repo', description: 'OFFLINE RETARGET: switch this server to another local Git repository, building its graph when missing. This explicit tool call changes the active repository boundary; pass build:false to probe without building. Omitted mode/precision preserve an existing graph; a new graph uses full and the startup precision setting (lsp unless WEAVATRIX_PRECISION=off). Omit the retarget capability at registration to pin one repository.', inputSchema: {type: 'object', properties: {path: {type: 'string', description: 'Absolute path to a Git working tree'}, build: {type: 'boolean', description: 'Build the graph when missing (default true)', default: true}, mode: {type: 'string', enum: ['full', 'no-tests', 'tests-only'], description: 'Optional build mode override; omit to preserve an existing graph'}, precision: {type: 'string', enum: ['lsp', 'off'], description: 'Optional semantic precision override; omit to preserve an existing graph or use the startup setting for a new graph'}} , required: ['path']}, run: (g, a, ctx) => ta.tOpenRepo(g, a, ctx)},
         {cap: 'retarget', name: 'list_known_repos', description: 'OFFLINE RETARGET: list every registered local repository graph from the global per-user registry, regardless of parent folder.', inputSchema: {type: 'object', properties: {}}, run: (g, a, ctx) => ta.tListKnownRepos(g, a, ctx)},
-        {cap: 'advisories', name: 'refresh_advisories', description: "NETWORK / explicit advisories profile: refresh the local OSV advisory store for this repo's concrete npm/PyPI/Go/Maven/Gradle/Cargo package versions. Sends package names + versions to OSV.dev — never automatic, never source code. Afterwards run_audit reads the refreshed store fully offline (~/.weavatrix/advisories.json).", inputSchema: {type: 'object', properties: {timeout_ms: {type: 'integer', description: 'Per-request timeout, default 20000'}}}, run: (g, a, ctx) => ta.tRefreshAdvisories(g, a, ctx)},
-        {cap: 'hosted', name: 'pull_architecture_contract', description: 'NETWORK / explicit hosted profile: fetch the owner-approved target architecture for the active stable repository UUID, validate it and cache it locally. Sends only the opaque UUID with bearer auth; never source or paths. HTTP failures are returned as actionable AUTH_REQUIRED/FORBIDDEN/NOT_FOUND/REPOSITORY_NOT_READY states.', inputSchema: {type: 'object', properties: {timeout_ms: {type: 'integer', minimum: 1000, maximum: 120000, default: 30000}}}, run: (g, a, ctx) => ta.tPullArchitectureContract(g, a, ctx)},
-        {cap: 'hosted', name: 'preview_sync', description: 'LOCAL SAFETY PREVIEW / no network: serialize the exact bounded hosted payload, validate the HTTPS destination, and show hostname/path, repository UUID, fields, sections, node/edge counts, bytes and body hash. Returns a five-minute confirmation token for sync_graph. Source bodies, snippets, absolute paths, environment values, credentials, Git remotes and unknown fields are excluded.', inputSchema: {type: 'object', properties: {payload_version: {type: 'integer', enum: [2, 3], default: 3, description: '3 includes bounded architecture/health/stack/package evidence; 2 is explicit graph-only compatibility'}}}, run: (g, a, ctx) => ta.tPreviewSyncGraph(g, a, ctx)},
-        {cap: 'hosted', name: 'sync_graph', description: 'NETWORK / explicit hosted profile. Uploads only the exact payload created by preview_sync and requires dry_run:false plus its short-lived confirm_token after user approval. Calling without dry_run:false remains a no-network preview compatibility alias. Source bodies, snippets, absolute paths and unknown fields are never uploaded.', inputSchema: {type: 'object', properties: {payload_version: {type: 'integer', enum: [2, 3], default: 3, description: 'Used only when producing a compatibility preview; the approved token pins the exact serialized payload'}, dry_run: {type: 'boolean', default: true, description: 'Compatibility safety switch. Must be explicitly false to send.'}, confirm_token: {type: 'string', maxLength: 64, description: 'Short-lived token returned by preview_sync for the exact destination and payload'}, timeout_ms: {type: 'integer', minimum: 1000, maximum: 120000, default: 30000, description: 'Network timeout in milliseconds'}}}, run: (g, a, ctx) => ta.tSyncGraph(g, a, ctx)},
     ]
     // Every tool supports the same machine-output switch. Text mode is TextContent-only so large
     // analysis payloads are not duplicated into an agent's context; JSON opts into structuredContent
@@ -170,7 +164,7 @@ function buildTools({tg, ti, th, ts, tb, te, ta, tar, thi, tc, tv, caps}) {
 // Import the tool modules (cache-busted when version > 0), build the catalog, apply the caps filter.
 // capsArg semantics: undefined/null = offline defaults; a
 // present string (even '') is an explicit selection, so "select nothing" really exposes nothing.
-export async function loadHotApi(version, capsArg) {
+export async function loadHotApi(version, capsArg, {extensions: extensionDefinitions = []} = {}) {
     const v = version ? `?v=${version}` : ''
     const [tg, ti, th, ts, tb, te, ta, tar, thi, tc, tv] = await Promise.all([
         import(new URL(`./tools-graph.mjs${v}`, import.meta.url).href),
@@ -185,18 +179,50 @@ export async function loadHotApi(version, capsArg) {
         import(new URL(`./tools-company.mjs${v}`, import.meta.url).href),
         import(new URL(`./tools-verified-change.mjs${v}`, import.meta.url).href),
     ])
+    const extensions = normalizeWeavatrixExtensions(extensionDefinitions)
+    const extensionProfiles = Object.assign({}, ...extensions.map((extension) => extension.profiles))
+    for (const name of Object.keys(extensionProfiles)) {
+        if (Object.hasOwn(PROFILE_CAPS, name)) throw new TypeError(`extension profile collides with core profile: ${name}`)
+    }
+    const profiles = {...PROFILE_CAPS, ...extensionProfiles}
     const raw = capsArg == null ? 'offline' : String(capsArg).trim()
-    const profile = Object.hasOwn(PROFILE_CAPS, raw) ? raw : 'custom'
-    const selected = PROFILE_CAPS[raw] || raw.split(',').map((s) => s.trim()).filter(Boolean)
-        .flatMap((cap) => cap === 'online' ? ['advisories', 'hosted'] : [cap])
+    if (MOVED_PROFILES.has(raw) && !Object.hasOwn(extensionProfiles, raw)) {
+        throw new Error(`MCP profile "${raw}" moved to weavatrix-online; the MIT core exposes only offline network-free profiles`)
+    }
+    const profile = Object.hasOwn(profiles, raw) ? raw : 'custom'
+    const selected = profiles[raw] || raw.split(',').map((s) => s.trim()).filter(Boolean)
     const caps = new Set(selected)
-    const all = buildTools({tg, ti, th, ts, tb, te, ta, tar, thi, tc, tv, caps})
+    const coreTools = buildTools({tg, ti, th, ts, tb, te, ta, tar, thi, tc, tv, caps})
+    const extensionTools = extensions.flatMap((extension) => extension.tools.map((tool) => ({...tool, extension: extension.name})))
+    const all = [...coreTools, ...extensionTools.map((tool) => ({
+        ...tool,
+        inputSchema: {
+            ...(tool.inputSchema || {type: 'object'}),
+            properties: {
+                ...(tool.inputSchema?.properties || {}),
+                output_format: {
+                    type: 'string', enum: ['text', 'json'], default: 'text',
+                    description: 'text returns concise TextContent; json also returns the stable structuredContent envelope',
+                },
+            },
+        },
+    }))]
+    const toolNames = new Set()
+    for (const tool of all) {
+        if (toolNames.has(tool.name)) throw new TypeError(`extension tool collides with an existing tool: ${tool.name}`)
+        toolNames.add(tool.name)
+    }
     const tools = all.filter((t) => caps.has(t.cap))
     return {
         tools,
         byName: new Map(tools.map((t) => [t.name, t])),
         caps,
         profile,
+        extensions: {
+            items: extensionRuntimeSummary(extensions),
+            auditProviders: extensions.flatMap((extension) => extension.auditProviders.map((provider) => ({...provider, extension: extension.name}))),
+            skills: extensions.flatMap((extension) => extension.skills.map((skill) => ({...skill, extension: extension.name}))),
+        },
         stalenessLine,
         resetStalenessCache,
     }

package/src/mcp/evidence/duplicate-member-order.mjs

@@ -1,6 +1,6 @@
 const compareText = (left, right) => String(left).localeCompare(String(right), 'en')
 
-// Snapshot construction and hosted-payload validation must use the same stable
+// Snapshot construction and source-free payload validation must use the same stable
 // member order or equivalent evidence can hash differently across the boundary.
 export function compareDuplicateMember(left, right) {
     return compareText(left.file, right.file) || left.startLine - right.startLine ||

package/src/mcp/evidence-snapshot.health.mjs

@@ -54,9 +54,9 @@ export function buildHealthSection(graph, audit, repoRoot = null) {
             complexity: {thresholds: COMPLEXITY_THRESHOLDS, analyzed: 0, hotspots: []},
         }
     }
-    // Public/private hosted evidence follows the same production-first path policy as
+    // Source-free extension evidence follows the same production-first path policy as
     // run_audit. Classified-only findings remain available locally through
-    // include_classified:true, but must not turn a hosted production snapshot red.
+    // include_classified:true, but must not turn a production snapshot red.
     const scopedFindings = auditFindingPathScope(audit.findings, {repoRoot}).findings
     const scopedSummary = summarizeFindings(scopedFindings)
     const findings = bounded(scopedFindings.map(sanitizeFinding).filter(Boolean)