mcp-sluice 0.1.0__tar.gz

mcp_sluice-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,62 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.14"
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v4
+
+      # Dependencies deliberately have lower bounds rather than a committed
+      # lock file. The engine contract tests make CI the forward-compatibility
+      # tripwire for new MCP and DuckDB releases.
+      - name: Install current dependencies
+        run: uv sync --upgrade
+
+      - name: Run tests
+        run: uv run pytest
+
+      - name: Run lint
+        run: uv run ruff check .
+
+      - name: Check formatting
+        run: uv run ruff format --check .
+
+      - name: Run type checks
+        run: uv run mypy src tests
+
+      - name: Build distributions
+        run: uv build
+
+      - name: Smoke-test wheel
+        run: |
+          uv venv --python 3.14 /tmp/sluice-wheel-smoke
+          uv pip install --python /tmp/sluice-wheel-smoke/bin/python dist/*.whl
+          /tmp/sluice-wheel-smoke/bin/python -c 'import importlib.metadata, importlib.resources, sluice; assert importlib.metadata.version("mcp-sluice") == sluice.__version__; assert importlib.resources.files("sluice").joinpath("py.typed").is_file()'
+          /tmp/sluice-wheel-smoke/bin/sluice --help
+
+      - name: Upload distributions
+        uses: actions/upload-artifact@v4
+        with:
+          name: mcp-sluice-dist
+          path: dist/
+          if-no-files-found: error

mcp_sluice-0.1.0/.github/workflows/release.yml

@@ -0,0 +1,103 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v[0-9]+.[0-9]+.[0-9]+"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.14"
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v4
+
+      - name: Install current dependencies
+        run: uv sync --upgrade
+
+      - name: Verify tag matches package version
+        run: |
+          test "${GITHUB_REF_NAME#v}" = "$(uv run python -c 'import tomllib; print(tomllib.load(open("pyproject.toml", "rb"))["project"]["version"])')"
+          test "${GITHUB_REF_NAME#v}" = "$(uv run python -c 'import sluice; print(sluice.__version__)')"
+
+      - name: Run release checks
+        run: |
+          uv run pytest
+          uv run ruff check .
+          uv run ruff format --check .
+          uv run mypy src tests
+
+      - name: Build distributions
+        run: uv build
+
+      - name: Verify distribution metadata
+        run: |
+          test -f "dist/mcp_sluice-${GITHUB_REF_NAME#v}.tar.gz"
+          test -f "dist/mcp_sluice-${GITHUB_REF_NAME#v}-py3-none-any.whl"
+          uvx twine check dist/*
+          unzip -p dist/*.whl 'mcp_sluice-*.dist-info/METADATA' | grep -Fx 'Name: mcp-sluice'
+          unzip -p dist/*.whl 'mcp_sluice-*.dist-info/METADATA' | grep -Fx 'License-Expression: Apache-2.0'
+          unzip -l dist/*.whl | grep -F 'licenses/LICENSE'
+
+      - name: Upload distributions
+        uses: actions/upload-artifact@v4
+        with:
+          name: mcp-sluice-dist
+          path: dist/
+          if-no-files-found: error
+
+  github-release:
+    needs:
+      - build
+      - pypi-publish
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: write
+
+    steps:
+      - name: Download distributions
+        uses: actions/download-artifact@v4
+        with:
+          name: mcp-sluice-dist
+          path: dist
+
+      - name: Create GitHub release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+        run: gh release create "$GITHUB_REF_NAME" dist/* --verify-tag --generate-notes --title "$GITHUB_REF_NAME"
+
+  pypi-publish:
+    needs: build
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    environment: pypi
+    permissions:
+      id-token: write
+
+    steps:
+      - name: Download distributions
+        uses: actions/download-artifact@v4
+        with:
+          name: mcp-sluice-dist
+          path: dist
+
+      - name: Publish package distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1

mcp_sluice-0.1.0/.gitignore

@@ -0,0 +1,11 @@
+.venv/
+__pycache__/
+*.pyc
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+sluice.toml
+uv.lock
+.coverage
+coverage.xml
+htmlcov/

mcp_sluice-0.1.0/.hypothesis/.gitignore

@@ -0,0 +1,9 @@
+# This .gitignore file was automatically created by Hypothesis. Hypothesis gitignores
+# .hypothesis by default, because we generally recommend that .hypothesis not be checked
+# into version control.
+#
+# If you *would* like to check .hypothesis into version control, you should delete this
+# file. Hypothesis will not re-create this .gitignore unless .hypothesis is deleted (and
+# if it does, that's a bug - please report it!)
+
+*

mcp_sluice-0.1.0/.hypothesis/constants/03a92850ec05bf96

@@ -0,0 +1,4 @@
+# file: /home/runner/work/sluice/sluice/src/sluice/gate.py
+# hypothesis_version: 6.167.1
+
+[', ', '?', 'BASE_TABLE', 'FUNCTION', 'RECURSIVE_CTE_NODE', 'SELECT', 'SHOW_REF', 'TABLE_FUNCTION', '\\A[0-9a-f]{32}\\Z', 'array_resize', 'bitstring', 'cte_map', 'error', 'format', 'function', 'function_name', 'key', 'left', 'list_resize', 'lpad', 'map', 'nextval', 'no statement found', 'node', 'printf', 'query', 'right', 'rpad', 'schema_name', 'setseed', 'sleep_ms', 'table_name', 'type', 'value', 'write_log']

mcp_sluice-0.1.0/.hypothesis/constants/28ed97e6b732c25b

@@ -0,0 +1,4 @@
+# file: /home/runner/work/sluice/sluice/src/sluice/__init__.py
+# hypothesis_version: 6.167.1
+
+['0.1.0', '__version__']

mcp_sluice-0.1.0/.hypothesis/constants/2ce49e5fccb99c6e

@@ -0,0 +1,4 @@
+# file: /home/runner/work/sluice/sluice/src/sluice/handle.py
+# hypothesis_version: 6.167.1
+
+[' (inexact)', '*', ', ', 'JSON', 'byte_size', 'call_id', 'channel_conflict', 'columns', 'columns: ', 'envelope_table', 'exact', 'flat_reason', 'name', 'preview', 'preview_complete', 'renamed: ', 'renamed_from', 'row_count', 'scope_id', 'source_channel', 'source_path', 'tables', 'text', 'type']

mcp_sluice-0.1.0/.hypothesis/constants/2d25ca6f46e04685

@@ -0,0 +1,4 @@
+# file: /home/runner/work/sluice/sluice/src/sluice/models.py
+# hypothesis_version: 6.167.1
+
+[1000, 'is_error', 'non_text_content', 'none', 'oversize', 'selection_failed', 'structured', 'text']

mcp_sluice-0.1.0/.hypothesis/constants/36d619bad1bddc4e

@@ -0,0 +1,4 @@
+# file: /home/runner/work/sluice/sluice/src/sluice/store.py
+# hypothesis_version: 6.167.1
+
+[512, ', ', ':memory:', '?', 'BEGIN TRANSACTION', 'COMMIT', 'ROLLBACK', 'retention_evicted', 'sluice_calls', 'utf-8']

mcp_sluice-0.1.0/.hypothesis/constants/43910582fbcf1b5d

@@ -0,0 +1,4 @@
+# file: /home/runner/work/sluice/sluice/src/sluice/config.py
+# hypothesis_version: 6.167.1
+
+[10.0, 100, 256, 384, 512, 1000, 1024, 2048, 65536, 1048576, ', ', '1GB', 'SLUICE_CONFIG', 'args', 'command', 'cwd', 'env', 'limits', 'max_cell_bytes', 'max_columns', 'max_payload_bytes', 'max_session_bytes', 'max_session_calls', 'preview_bytes', 'preview_rows', 'query_max_bytes', 'query_max_rows', 'servers', 'sluice.toml', 'url', 'utf-8']

mcp_sluice-0.1.0/.hypothesis/constants/44302d81fc4ea7ad

@@ -0,0 +1,4 @@
+# file: /home/runner/work/sluice/sluice/src/sluice/payload.py
+# hypothesis_version: 6.167.1
+
+['text', 'truncated', 'type', 'unknown', 'utf-8']

mcp_sluice-0.1.0/.hypothesis/constants/5b63440f1497986b

@@ -0,0 +1,4 @@
+# file: /home/runner/work/sluice/sluice/src/sluice/scope.py
+# hypothesis_version: 6.167.1
+
+['__dict__', 'conversationId', 'conversation_id', 'sessionId', 'session_id', 'threadId', 'thread_id', 'utf-8']

mcp_sluice-0.1.0/.hypothesis/constants/7483b75bcf1c815e

@@ -0,0 +1,4 @@
+# file: /home/runner/work/sluice/sluice/src/sluice/infer.py
+# hypothesis_version: 6.167.1
+
+[127, 'BIGINT', 'BOOLEAN', 'DOUBLE', 'HUGEINT', 'JSON', 'VARCHAR', 'false', 'true']

mcp_sluice-0.1.0/.hypothesis/constants/75de9f9bfb03fafb

@@ -0,0 +1,4 @@
+# file: /home/runner/work/sluice/sluice/src/sluice/proxy.py
+# hypothesis_version: 6.167.1
+
+[1000, 'description', 'name', 'output schema', 'output_schema', 'structured content']

mcp_sluice-0.1.0/.hypothesis/constants/9ead00bae9fc6e82

@@ -0,0 +1,4 @@
+# file: /home/runner/work/sluice/sluice/.venv/bin/pytest
+# hypothesis_version: 6.167.1
+
+['-script.pyw', '.exe', '__main__']

mcp_sluice-0.1.0/.hypothesis/constants/a5359a1d63075933

@@ -0,0 +1,4 @@
+# file: /home/runner/work/sluice/sluice/src/sluice/query.py
+# hypothesis_version: 6.167.1
+
+[' |', ' | ', "''", '(no columns)', '---', 'NULL', '\\', '\\\\', '\\n', '\\|', 'additionalProperties', 'description', 'integer', 'max_rows', 'minimum', 'object', 'properties', 'query', 'required', 'sql', 'string', 'type', 'utf-8', '|', '| ', '…']

mcp_sluice-0.1.0/.hypothesis/constants/a88b472d44e25d12

@@ -0,0 +1,4 @@
+# file: /home/runner/work/sluice/sluice/demo/__init__.py
+# hypothesis_version: 6.167.1
+
+[]

mcp_sluice-0.1.0/.hypothesis/constants/aba7595b54e25bc8

@@ -0,0 +1,4 @@
+# file: /home/runner/work/sluice/sluice/src/sluice/errors.py
+# hypothesis_version: 6.167.1
+
+['output_schema', 'protocol', 'text', 'tool_error', 'transport']

mcp_sluice-0.1.0/.hypothesis/constants/b930103efb1873de

@@ -0,0 +1,4 @@
+# file: /home/runner/work/sluice/sluice/demo/median.py
+# hypothesis_version: 6.167.1
+
+[1e-06, 0.005, 180.0, 400, '\n--- stderr ---\n', '%Y%m%dT%H%M%SZ', ',', '--allowedTools', '--config', '--dry-run', '--max-turns', '--mcp-config', '--model', '--out-dir', '--output-format', '--permission-mode', '--rows', '--strict-mcp-config', '--timeout', '--tolerance-abs', '--tolerance-rel', '--tools', '--verbose', '-?\\d+(?:\\.\\d+)?', '-m', '-p', 'AKIA[0-9A-Z]{16}', 'ToolSearch', '[REDACTED]', '__main__', 'abs_tol', 'args', 'baseline', 'baseline.mcp.json', 'claude', 'command', 'conditions', 'cwd', 'demo', 'dontAsk', 'expected', 'expected_median', 'fake', 'generated_at_utc', 'max_turns', 'mcpServers', 'mcp__fake__rows', 'mcp__sluice__query', 'message', 'model', 'model_requested', 'non_determinism_note', 'ok', 'out_dir', 'pending', 'prompt', 'rel_tol', 'replace', 'report.json', 'result', 'rows', 'score', 'sk-[A-Za-z0-9]{20,}', 'sluice', 'sluice-demo-', 'sluice.toml', 'sonnet', 'status', 'store_true', 'stream-json', 'tests.fake_server', 'timeout', 'tolerance', 'tolerance_abs', 'tolerance_rel', 'transcripts', 'treatment', 'treatment.mcp.json', 'type', 'utf-8']

mcp_sluice-0.1.0/.hypothesis/constants/cc1232942d7e2bcc

@@ -0,0 +1,4 @@
+# file: /home/runner/work/sluice/sluice/src/sluice/server.py
+# hypothesis_version: 6.167.1
+
+['max_rows', 'sluice', 'sql', 'text', 'unknown']

mcp_sluice-0.1.0/.hypothesis/constants/e55a5401d33ff5d1

@@ -0,0 +1,4 @@
+# file: /home/runner/work/sluice/sluice/src/sluice/naming.py
+# hypothesis_version: 6.167.1
+
+[128, '"', '""', '[^a-z0-9]+', '_', 'utf-8', 'x']

mcp_sluice-0.1.0/.hypothesis/constants/ec9ac0b980d68864

@@ -0,0 +1,4 @@
+# file: /home/runner/work/sluice/sluice/src/sluice/intercept.py
+# hypothesis_version: 6.167.1
+
+['content', 'text', 'tool_error']

mcp_sluice-0.1.0/.hypothesis/constants/f4184698165767bc

@@ -0,0 +1,4 @@
+# file: /home/runner/work/sluice/sluice/src/sluice/shape.py
+# hypothesis_version: 6.167.1
+
+[10000, '$', ', ', '_call_id', '_extra', '_row', 'value']

mcp_sluice-0.1.0/.hypothesis/constants/f6384783b6a5db4f

@@ -0,0 +1,4 @@
+# file: /home/runner/work/sluice/sluice/src/sluice/__main__.py
+# hypothesis_version: 6.167.1
+
+[130, '--config', '--log-level', 'INFO', '__main__', 'path to sluice.toml', 'sluice']

mcp_sluice-0.1.0/CHANGELOG.md

@@ -0,0 +1,69 @@
+# Changelog
+
+This tracks what has landed against the milestones in
+`plan/001-scratch-db.md`.
+
+## 0.1.0 — 2026-09-01
+
+- **M1 — proxy.** Sluice starts, connects to one configured downstream MCP
+  server over stdio, mounts its tools under injective names, and forwards
+  calls unmodified. Paginated `tools/list`, whole-object tool cloning,
+  multi-round-trip relay, and the four-class failure taxonomy (§8).
+- **M2 — envelope, scope, handle.** Every proxied call gets one `sluice_calls`
+  row in an in-memory DuckDB database, under the §6.1 engine lockdown. Scope
+  is derived from a client-supplied conversation id when present, minted
+  per call otherwise. Eligible results are replaced with a handle; channel
+  selection and conflict detection between `structuredContent` and text
+  content are implemented per §5.1.
+- **M3 — flattening and inference.** Depth-1 projection extracts every
+  candidate row set from a result (§5.2), Sluice's own type inference assigns
+  a column type and an `exact` flag per §5.5 without going through DuckDB's
+  JSON inference, and tables are created file-free via explicit DDL plus
+  `executemany`.
+- **M4 — the `query` tool.** The three-layer read-only gate (statement type,
+  engine lockdown, AST object allowlist), a per-query DuckDB connection with a
+  timer-based interrupt, and defined result shaping (row cap, byte cap,
+  per-cell truncation, markdown escaping) are implemented and covered by
+  `test_query_safety.py` and `test_query_limits.py`. Two review passes closed
+  a gate bypass and several other failures after initial implementation (see
+  commit history).
+- Full test suite passes: proxy, passthrough, envelope, scope, shape,
+  inference, store, handle, config, CLI, engine-contract, query safety,
+  query limits, and concurrency.
+
+### M5 — correctness property
+
+- The end-to-end Hypothesis suite covers normalized aggregate correctness,
+  1–500-row boundaries, bounded floating-point regression evidence, and the
+  mandatory counterexamples. Adversarial review found cancellation inside the
+  former floating-point guarantee, so every `DOUBLE` column is now marked
+  inexact and per-aggregate exactness is left for future design.
+- The reproducible live-model median demo is implemented outside CI. Its
+  committed sampled run recorded a wrong baseline answer (71.5) and the exact
+  Sluice-backed answer (72.5), with transcripts and a non-determinism warning.
+
+### Runtime bounds and adversarial review
+
+- Whole-pipeline admission, deterministic logical session retention, and
+  metadata/catalog cardinality limits bound Sluice's own continued work.
+- Post-fix calibration across flat, nested, wide, and mixed 1 MiB dual-channel
+  payloads at concurrency 2 supports the conservative 1 MiB v0 admission
+  default; a 15-call run records long-session behavior.
+- Final review closed CTE binding-order isolation, scalar memory amplification,
+  queued-worker timeout, truncation-reporting, dual-channel sizing, failure
+  envelope, and dead-transport reuse defects.
+
+### M6 — documentation and packaging
+
+- Installation, client configuration, architecture, usage, exactness,
+  isolation, resource bounds, limitations, troubleshooting, and release notes
+  are documented. The wheel includes `py.typed` and is validated by CI.
+
+### Release verification
+
+- The end-to-end canary against a real configured GitHub MCP server passed; see
+  `review/canary-v0.1.0.md` for the observed handle, query, envelope, and
+  isolation checks.
+- The distribution name is `mcp-sluice`; the import package and console command
+  remain `sluice`.
+- Source and distributions are licensed under Apache-2.0.

mcp_sluice-0.1.0/CLAUDE.md

@@ -0,0 +1,128 @@
+# CLAUDE.md - Sluice
+
+Passthrough MCP server. Proxies **exactly one** downstream MCP server in v0
+(namespacing is built for fan-out, deferred), materializes every tool result into
+a DuckDB scratch DB, and returns a preview plus a table handle instead of the
+payload. Exposes one tool of its own, `query`, for read-only SQL over those
+tables.
+
+Read `spec/001-scratch-db.md` before changing behavior; `intent/` records why the
+non-goals are non-goals; `plan/001-notes-m0.md` is the measured evidence behind
+the rules below.
+
+## Commands
+
+```bash
+uv sync                       # install
+uv run sluice --config sluice.toml   # run as an MCP stdio server
+uv run pytest                 # full suite
+uv run pytest -m "not slow"   # skip timing-sensitive tests (concurrency, timeouts)
+uv run ruff check . && uv run ruff format --check .
+uv run mypy src tests
+```
+
+The M5 Hypothesis correctness property is `tests/test_property_aggregates.py`.
+The non-deterministic model-eval harness is `uv run python -m demo.median`; use
+`--dry-run` to validate its setup without spending a model call. It is evidence,
+never a CI gate.
+
+## Python version rules
+
+- `requires-python = ">=3.14"`. **Do not write compatibility shims for older
+  versions.** No `sys.version_info` branches, no backport imports.
+- PEP 604 unions: `X | None`, never `typing.Optional[X]`.
+- PEP 585 builtin generics: `list[str]`, `dict[str, int]`, never `typing.List`.
+- `type` statements for aliases, never `TypeAlias`.
+- Type hints on every function signature. `mypy` is not optional.
+- Python 3.15 releases 2026-10-01. Moving the floor to 3.15 is an **open
+  question, not a decision**. The gating factor is DuckDB cp315 wheel
+  availability, since DuckDB is a compiled extension and a source build is not an
+  acceptable install path.
+
+## Conventions
+
+- Idiomatic modern Python of the FastAPI and Postgres kind. Dataclasses for value
+  objects, `pathlib`, structured logging **to stderr** (stdout is the MCP
+  transport and must never be written to).
+- `shape.py`, `infer.py`, `naming.py` are pure: no DuckDB, no MCP, no IO. They
+  hold the logic most likely to be wrong and are cheapest to test. Keep them pure.
+- DuckDB calls are blocking: dispatch through `anyio.to_thread.run_sync`,
+  serialize writes behind an `anyio.Lock`, one connection per in-flight query.
+- pytest, function-style tests, and Hypothesis for the M5 correctness property.
+
+## Architecture
+
+```
+client --stdio--> server.py  tools/list = downstream union + query
+                  proxy.py   downstream session, paginated list, round-trip relay
+                  gate.py    the query tool's three-layer read-only gate
+                  shape.py   extract rows -> depth-1 projection        (pure)
+                  infer.py   column types + the `exact` flag           (pure)
+                  naming.py  injective names, quoting, collisions      (pure)
+                  scope.py   scope ids; stale handles fail loudly
+                  store.py   envelope row + typed tables
+                  handle.py  preview + tables + columns -> the agent
+                  query.py   per-query connection, timeout, result shaping
+```
+
+Data model: one `sluice_calls` envelope row per call. Plus one typed table per
+candidate array, never appended to, named
+`<server>__<tool>__<hash>__<scope>__<seq>`. There is no `__latest` view: with
+scope minted per call it would name one table, and reaching a table whose name
+you lost is discovery, which isolation blocks. Tables and the envelope row are
+written in one transaction.
+
+Verified baseline: MCP protocol `2026-07-28`, `mcp` 2.1.1, DuckDB 1.5.5. Every
+normative claim in the spec is against those; dependencies have lower bounds
+rather than exact pins, so do not generalize across revisions.
+
+## Rules that are load-bearing
+
+Each of these was a bug before it was a rule. Spec section in parentheses.
+
+- **Sluice never turns a working tool call into a failed one** (§8). Failures
+  degrade to an envelope-only handle. Two boundaries: OOM, and a connection-wide
+  interrupt.
+- **The handle rides in `content`** (§4.1); `structuredContent` mirrors it.
+  **On the way in, `structuredContent` wins** (§5.1): a tool may put data there
+  and prose in `content`, and flattening the prose discards the data.
+- **Exactness is domain-bounded** (§5.6). Integer columns within ±2^53 can claim
+  exact aggregate results; larger integers and every `DOUBLE` column are
+  marked inexact. `avg` and float `sum` have only bounded regression evidence.
+  Never state the claim without its domain.
+- **Materialization is file-free** (§5.4). The lockdown is database-global and
+  blocks DuckDB's own readers. Do not "fix" a load failure by relaxing it.
+- **Sluice owns type inference** (§5.5), because of the above. Never infer
+  `TIMESTAMP` from a string; mixed scalars become `VARCHAR`, never `JSON`
+  (`median()` on `JSON` returns a lexicographic answer).
+- **Read-only means three layers** (§6.1): statement gate, engine lockdown, and
+  an **allowlist** over the parsed AST. Not a denylist: an allowlist is closed by
+  construction. The statement gate does NOT stop `SHOW`, `DESCRIBE`, or
+  `PRAGMA` — DuckDB types all of them as SELECT. CTE names are honoured by
+  lexical scope; collecting them globally is a complete bypass.
+- **The physical `sluice_calls` is never queryable** (§3.3). It lists every
+  scope's tables. Each scope gets a filtered view instead.
+- **No table discovery** (§12). Enumeration is what isolation blocks. Do not add
+  a `sluice_schema` view back.
+- **Sluice never answers an elicitation** (§11). Round trips are relayed
+  untouched; `request_state` is opaque.
+- **Clone the whole downstream tool object** (FR-3), mutating only name,
+  description, and `outputSchema`. Rebuilding it field by field drops
+  `annotations.destructiveHint`.
+- **Every truncation is reported** (§6.3). Silent truncation is a correctness bug
+  in a tool that sells determinism.
+- **Agent-sized allocation functions are blocked** (§6.1). Table functions and
+  scalar constructors such as `range`, `lpad`, `list_resize`, and `bitstring`
+  can allocate before output rendering applies its cap.
+- **Admission covers the whole interception pipeline** (§7). Selection, parse,
+  projection, commit, and handle rendering all run under the same semaphore.
+- **Session retention is bounded** (§7). `max_session_bytes` evicts oldest calls
+  deterministically, dropping their tables and payload columns while preserving
+  envelope metadata; handles never advertise a table after its call is evicted.
+  `max_session_calls` separately bounds metadata rows and scope views.
+
+## Out of scope for v0
+
+No cross-session persistence, cross-server joins, entity resolution, auth,
+policy, redaction, audit layer, hosted service, UI, or table discovery. Recorded
+as choices in `intent/` §Non-goals, not as backlog.