rapier-runtime 0.5.2__tar.gz → 0.5.3__tar.gz

{rapier_runtime-0.5.2 → rapier_runtime-0.5.3}/CHANGELOG.md

@@ -4,6 +4,30 @@ Notable changes to `rapier-runtime`. Earlier releases are summarized in
 [`docs/STATUS.md`](docs/STATUS.md) and on the
 [Releases](https://github.com/muddyone/rapier-runtime/releases) page.
 
+## 0.5.3 — 2026-10-16
+
+### Added: saved runs as MCP resources
+
+MCP clients can now browse saved runs instead of calling tools:
+
+- `rapier://runs`: every saved run, newest first, with its kind, topic and
+  verdict (JSON).
+- `rapier://runs/{run_id}`: a run's report, as the CLI printed it (plain text).
+- `rapier://runs/{run_id}/record`: a run's full record, redacted when it was
+  saved (JSON).
+
+Each saved run also appears in the client's resource list, titled by kind and
+topic, including runs saved after the server started. The `list_runs` and
+`get_run` tools still work.
+
+### Fixed: `rapier mcp` failed on a fresh install
+
+The `[mcp]` extra allowed any `mcp>=1.2`, so a new install got the mcp 2.x SDK,
+which renamed the server API this version uses. `rapier mcp` then exited with a
+message telling you to install the extra you already had. The extra is now
+capped at `mcp<2`, and if a 2.x SDK is present anyway, `rapier mcp` says so and
+gives the command that fixes it.
+
 ## 0.5.2 — 2026-10-16
 
 ### Fixed: the report no longer calls a same-vendor review independent

{rapier_runtime-0.5.2 → rapier_runtime-0.5.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rapier-runtime
-Version: 0.5.2
+Version: 0.5.3
 Summary: A code-orchestrated engine that runs the SPARRING method: grounded, cross-vendor adversarial review for AI-in-the-loop decisions.
 Project-URL: Homepage, https://rapierruntime.com
 Project-URL: Repository, https://github.com/muddyone/rapier-runtime
@@ -25,7 +25,7 @@ Requires-Dist: requests>=2.31
 Provides-Extra: dev
 Requires-Dist: pytest>=8.0; extra == 'dev'
 Provides-Extra: mcp
-Requires-Dist: mcp>=1.2; extra == 'mcp'
+Requires-Dist: mcp<2,>=1.2; extra == 'mcp'
 Description-Content-Type: text/markdown
 
 # Rapier Runtime

{rapier_runtime-0.5.2 → rapier_runtime-0.5.3}/docs/STATUS.md

@@ -1,9 +1,34 @@
 # Rapier — dev status
 
-_Last updated: 2026-10-16 (tag v0.5.1, 230 tests)._ A running "where we are /
+_Last updated: 2026-10-16 (tag v0.5.2, 235 tests)._ A running "where we are /
 what's next" so a new session can continue without reconstructing from git log.
 
 ## Done
+- **RELEASED (2026-10-16) — `rapier-runtime` 0.5.2 on PyPI. The report stops
+  calling a same-vendor review independent.** Git tag `v0.5.2`;
+  https://pypi.org/project/rapier-runtime/0.5.2/. A live 0.5.1 run with only an
+  OpenAI key (author and reviewer both `gpt-6-sol`) showed three defects. The
+  report said "an independent, different-vendor reviewer" raised the objections
+  while its own trust section said the review was not independent. The progress
+  warning blamed a missing OpenAI key that was set. LaTeX arithmetic printed raw.
+  All three are fixed (`compose.py`, `cross_review.py`; the vendored reviewer is
+  untouched) and re-checked on a second live run. 235 tests. The same day the
+  repo gained the Loom secret-scan gate: the GitHub gitleaks workflow, the
+  pre-commit hook and `.gitleaks.toml`.
+  The live runs confirmed `gpt-6-sol` works, including the framing step at its
+  1,024-token limit. **OpenRouter confirmed end to end (2026-10-16)** with only
+  an OpenRouter key set: `frame` (1 call) and a full `spar` (8 calls) all went
+  to `openrouter` / `openai/gpt-6-sol` with no empty responses, and the 0.5.2
+  single-vendor wording held. Keys: 1Password, Sparring Framework vault, item
+  `OpenRouter` (field `rapier-runtime-test` for tests).
+  **Gemini default `gemini-3.5-flash-lite` confirmed live (2026-10-16):** one
+  `frame` call with only the stored Gemini key returned a complete answer.
+  **DeepSeek default `deepseek-flash` confirmed live (2026-10-16):** DeepSeek's
+  own model list for the key is `deepseek-flash` and `deepseek-v4-pro`, and one
+  `frame` call with only the DeepSeek key returned a complete answer. Key:
+  1Password, Sparring Framework vault, item `DeepSeek`.
+  Still never called live: the Groq and Together `openai/gpt-oss-120b`
+  defaults (no keys).
 - **RELEASED (2026-10-16) — `rapier-runtime` 0.5.1 on PyPI. Default models for
   five vendors replaced.** Git tag `v0.5.1`;
   https://pypi.org/project/rapier-runtime/0.5.1/. OpenRouter's default
@@ -144,8 +169,15 @@ what's next" so a new session can continue without reconstructing from git log.
 2. **Paper 2 (the Proposer)** stays parked until the engine is fully shipped.
    Note: the Proposer study runs *on* this engine — Frame, seeded generation, and
    the depth knob are the instrument it will exercise.
-3. **Optional polish, if worth it:** expose runs as MCP *resources* rather than
-   tools; a landing line advertising the front door / `--depth` / `--seed`.
+3. ~~**Optional polish:** runs as MCP resources; a landing line for the front
+   door / `--depth` / `--seed`.~~ **DONE (2026-10-16).** The landing line is live.
+   Saved runs are MCP resources (`rapier://runs`, `rapier://runs/{run_id}`,
+   `rapier://runs/{run_id}/record`); the `list_runs` / `get_run` tools stay for
+   tool-only clients. Not yet released: ships with the next version, together
+   with the `mcp<2` cap that makes a fresh `pip install "rapier-runtime[mcp]"`
+   start again (mcp 2.0 renamed FastMCP).
+4. **Port the MCP server to the mcp 2.x SDK** (`FastMCP` → `MCPServer`, per the
+   SDK's migration guide), then lift the `<2` cap.
 
 _(M4 publish is **DONE** — v0.4.0 on PyPI + the full landing live; see Done above.
 Loom submodule pin bumped to the v0.4.0 release commit `514df56`.)_

{rapier_runtime-0.5.2 → rapier_runtime-0.5.3}/docs/mcp-server-scope.md

@@ -97,7 +97,15 @@ existing redaction on every tool result. No new secret surface — keys stay in
   **THE RECORD** section naming the run directory, so a Desktop user can see the
   audit trail exists and where — governance is only real if the record is visible.
 
-Follow-ups: consider exposing runs as MCP *resources* (currently tools).
+Saved runs are also MCP **resources** (2026-10-16): `rapier://runs` (index,
+JSON), `rapier://runs/{run_id}` (the report, plain text) and
+`rapier://runs/{run_id}/record` (the full redacted envelope, JSON). Each saved
+run is listed as its own resource every time a client asks, including runs saved
+after the server started. The `list_runs` / `get_run` tools remain for clients
+that only call tools.
+
+Follow-ups: port to the mcp 2.x SDK (`FastMCP` was renamed `MCPServer`); until
+then the `[mcp]` extra is capped at `mcp<2`.
 
 ## Open decisions
 1. `rapier mcp` subcommand (recommended) vs a separate `rapier-mcp` entry point.

{rapier_runtime-0.5.2 → rapier_runtime-0.5.3}/pyproject.toml

@@ -9,7 +9,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "rapier-runtime"
-version = "0.5.2"
+version = "0.5.3"
 description = "A code-orchestrated engine that runs the SPARRING method: grounded, cross-vendor adversarial review for AI-in-the-loop decisions."
 readme = "README.md"
 requires-python = ">=3.10"
@@ -50,7 +50,9 @@ Paper = "https://doi.org/10.5281/zenodo.21210264"
 dev = ["pytest>=8.0"]
 # The MCP server (`rapier mcp`) — kept out of the core so the tiny runtime stays
 # `requests` + `pyyaml`. Install with: pip install "rapier-runtime[mcp]".
-mcp = ["mcp>=1.2"]
+# Capped below 2: mcp 2.0 renamed FastMCP (to MCPServer) and changed other APIs
+# the server uses, so an uncapped install broke `rapier mcp`.
+mcp = ["mcp>=1.2,<2"]
 
 [project.scripts]
 rapier = "rapier.cli:main"

{rapier_runtime-0.5.2 → rapier_runtime-0.5.3}/site/README.md

@@ -11,7 +11,7 @@ fonts. `index.html` is **light-only** and serves the logo master
   Kept as a rollback target; **not** what is deployed.
 - **`index.html`** — the full MVP landing page. **This is what is live** at
   rapierruntime.com (swapped in at launch, 2026-07-16; verified byte-identical
-  2026-08-28).
+  2026-10-16, after adding the quickstart line for `frame`, `--depth` and `--seed`).
 
 ## Status: LAUNCHED 2026-07-16 — the full landing is live
 

{rapier_runtime-0.5.2 → rapier_runtime-0.5.3}/site/index.html

@@ -301,6 +301,7 @@ pip install <b>rapier-runtime</b>
 rapier <span class="p">spar</span> --request <span class="s">"Should we drop Postgres for DynamoDB?"</span>
       </div>
       <p class="qs-note">Bring your own API keys — Rapier calls the AI vendors you configure, and nothing runs on our servers. Want the full four-phase ceremony instead of the resolver? <span class="gold">rapier sparring</span>.</p>
+      <p class="qs-note">Not sure if you have a decision or still a question? <span class="gold">rapier frame</span> tells you which, and which command fits: an open question needs options generated first (<span class="gold">sparring</span>); a well-argued decision can go straight to the challenge (<span class="gold">spar</span>). In <span class="gold">sparring</span>, <span class="gold">--depth shallow|standard|deep</span> sets how widely it explores options, and <span class="gold">--seed</span> adds one you already favor &mdash; it gets no head start and survives only on its merits.</p>
     </div>
   </section>
 

{rapier_runtime-0.5.2 → rapier_runtime-0.5.3}/src/rapier/mcp/server.py

@@ -1,4 +1,6 @@
-"""The ``rapier mcp`` stdio server — frame / proposer / spar / sparring / doctor as MCP tools.
+"""The ``rapier mcp`` stdio server — frame / proposer / spar / sparring / doctor as MCP tools,
+and saved runs as MCP resources (``rapier://runs``, ``rapier://runs/{run_id}``,
+``rapier://runs/{run_id}/record``).
 
 Optional: requires the ``mcp`` extra (``pip install "rapier-runtime[mcp]"``). The
 SDK is imported lazily inside :func:`build_server`, so importing this module (and
@@ -18,10 +20,15 @@ annotations`` — FastMCP evaluates each tool's signature, and the lazily-import
 ``Context`` annotation must be a real class object at definition time, not a
 string it cannot resolve.
 """
+import json
 import os
 import sys
 from typing import Any, Callable
 
+# Cap on runs listed individually in resources/list; every run stays readable by URI
+# and is indexed in rapier://runs.
+_MAX_LISTED_RUNS = 200
+
 
 async def _run_with_progress(
     fn: Callable[..., dict],
@@ -208,29 +215,86 @@ def build_server():
         values) and whether cross-vendor review is available."""
         return tools.doctor()
 
+    # Kept for clients that only call tools; the resources below are the browsable form.
     @server.tool()
     def list_runs() -> dict:
-        """List persisted run ids (requires the server's RAPIER_MCP_LEDGER)."""
+        """List persisted run ids. Clients that support resources can browse rapier://runs instead."""
         return tools.list_runs(ledger_root)
 
     @server.tool()
     def get_run(run_id: str) -> dict:
-        """Fetch a persisted run's report + verdict by id (requires RAPIER_MCP_LEDGER)."""
+        """Fetch a persisted run's report + verdict by id. Also readable as rapier://runs/{run_id}."""
         return tools.get_run(ledger_root, run_id)
 
+    # ── saved runs as resources ──────────────────────────────────────────────
+    @server.resource("rapier://runs", name="runs", mime_type="application/json",
+                     description="Every saved run, newest first: kind, topic, verdict, and "
+                                 "the URIs of its report and full record.")
+    def runs_index() -> str:
+        return json.dumps(tools.run_index(ledger_root), indent=2)
+
+    @server.resource("rapier://runs/{run_id}", name="run-report", mime_type="text/plain",
+                     description="A saved run's report, as the CLI printed it.")
+    def run_report(run_id: str) -> str:
+        return tools.run_report(ledger_root, run_id)
+
+    @server.resource("rapier://runs/{run_id}/record", name="run-record",
+                     mime_type="application/json",
+                     description="A saved run's full record (redacted on write): request, "
+                                 "recommendation, trust rider, verdict, trace, meta.")
+    def run_record(run_id: str) -> str:
+        return json.dumps(tools.run_record(ledger_root, run_id), indent=2, default=str)
+
+    # FastMCP lists only resources registered at startup, so runs saved after the
+    # server started would never appear. Replace the list handler with one that adds
+    # each saved run's report as a concrete resource every time a client asks.
+    from mcp.types import Resource
+
+    async def _list_resources():
+        listed = await server.list_resources()
+        index = tools.run_index(ledger_root)
+        for run in (index.get("runs") or [])[:_MAX_LISTED_RUNS]:
+            listed.append(Resource(
+                uri=run["report_uri"],
+                name=run["run_id"],
+                title=f"{run['kind']}: {run['topic']}" if run["topic"] else run["run_id"],
+                description=f"verdict: {run['verdict']}" if run["verdict"] else None,
+                mimeType="text/plain",
+            ))
+        return listed
+
+    server._mcp_server.list_resources()(_list_resources)
+
     return server
 
 
+def _installed_mcp_version() -> str | None:
+    try:
+        from importlib.metadata import PackageNotFoundError, version
+        return version("mcp")
+    except PackageNotFoundError:
+        return None
+
+
 def serve() -> int:
     """Run the stdio MCP server. Returns non-zero with a hint if the SDK is absent."""
     try:
         server = build_server()
     except ImportError:
-        print(
-            'The MCP server needs the optional "mcp" extra:\n'
-            '    pip install "rapier-runtime[mcp]"',
-            file=sys.stderr,
-        )
+        installed = _installed_mcp_version()
+        if installed and installed.split(".")[0].isdigit() and int(installed.split(".")[0]) >= 2:
+            print(
+                f"The MCP server needs the mcp SDK 1.x, but {installed} is installed\n"
+                "(mcp 2.0 renamed the server API this version uses). Install a 1.x SDK:\n"
+                '    pip install "mcp>=1.2,<2"',
+                file=sys.stderr,
+            )
+        else:
+            print(
+                'The MCP server needs the optional "mcp" extra:\n'
+                '    pip install "rapier-runtime[mcp]"',
+                file=sys.stderr,
+            )
         return 1
     server.run()  # stdio transport by default
     return 0

{rapier_runtime-0.5.2 → rapier_runtime-0.5.3}/src/rapier/mcp/tools.py

@@ -162,6 +162,57 @@ def list_runs(ledger_root: str | None) -> dict[str, Any]:
     return {"ok": True, "runs": runs, "ledger_root": ledger_root}
 
 
+def _load_envelope(ledger_root: str | None, run_id: str) -> dict[str, Any]:
+    """A run's persisted envelope (already redacted on write); ``LookupError`` if absent."""
+    if not ledger_root:
+        raise LookupError("run persistence is disabled (RAPIER_NO_PERSIST is set)")
+    if not _safe_run_id(run_id):
+        raise LookupError("invalid run id")
+    path = os.path.join(ledger_root, run_id, "envelope.json")
+    if not os.path.isfile(path):
+        raise LookupError(f"run '{run_id}' not found")
+    with open(path, encoding="utf-8") as fh:
+        return json.load(fh)
+
+
+def run_index(ledger_root: str | None) -> dict[str, Any]:
+    """Every persisted run with enough to choose one: kind, topic, verdict (newest first).
+
+    Backs the ``rapier://runs`` resource. A run id is ``<YYYYmmddHHMMSS>-<kind>``.
+    """
+    listed = list_runs(ledger_root)
+    if not listed.get("ok"):
+        return listed
+    runs = []
+    for run_id in reversed(listed["runs"]):
+        try:
+            env = _load_envelope(ledger_root, run_id)
+        except (LookupError, ValueError, OSError):
+            continue  # an in-progress or foreign dir has no envelope; it isn't a run yet
+        request = (env.get("request") or "").strip()
+        runs.append({
+            "run_id": run_id,
+            "kind": run_id.split("-", 1)[1] if "-" in run_id else "",
+            "topic": request.splitlines()[0][:120] if request else "",
+            "verdict": env.get("verdict"),
+            "report_uri": f"rapier://runs/{run_id}",
+            "record_uri": f"rapier://runs/{run_id}/record",
+        })
+    return {"ok": True, "ledger_root": ledger_root, "runs": runs}
+
+
+def run_report(ledger_root: str | None, run_id: str) -> str:
+    """A run's plain-text report, as the CLI printed it. ``LookupError`` if absent."""
+    env = _load_envelope(ledger_root, run_id)
+    meta = env.get("meta") or {}
+    return meta.get("report_md") or meta.get("report") or env.get("recommendation") or ""
+
+
+def run_record(ledger_root: str | None, run_id: str) -> dict[str, Any]:
+    """A run's full persisted record (the redacted envelope). ``LookupError`` if absent."""
+    return _load_envelope(ledger_root, run_id)
+
+
 def get_run(ledger_root: str | None, run_id: str) -> dict[str, Any]:
     """Return a persisted run's report + verdict by id (from its envelope.json)."""
     if not ledger_root:

{rapier_runtime-0.5.2 → rapier_runtime-0.5.3}/tests/test_mcp.py

@@ -169,3 +169,14 @@ def test_runs_disabled_without_ledger():
 
     assert tools.list_runs(None)["ok"] is False
     assert tools.get_run(None, "x")["ok"] is False
+
+
+def test_serve_names_mcp_2_when_that_is_why_import_failed(monkeypatch, capsys):
+    def _raise():
+        raise ImportError("No module named 'mcp.server.fastmcp'")
+
+    monkeypatch.setattr(server, "build_server", _raise)
+    monkeypatch.setattr(server, "_installed_mcp_version", lambda: "2.3.0")
+    assert server.serve() == 1
+    err = capsys.readouterr().err
+    assert "2.3.0 is installed" in err and 'pip install "mcp>=1.2,<2"' in err

rapier_runtime-0.5.3/tests/test_mcp_resources.py

@@ -0,0 +1,98 @@
+"""Saved runs as MCP resources: rapier://runs, rapier://runs/{id}, rapier://runs/{id}/record.
+
+The index/report/record logic is plain Python and always runs. The protocol test
+needs the optional ``mcp`` extra and is skipped without it.
+"""
+from __future__ import annotations
+
+import json
+import os
+
+import pytest
+
+from rapier.mcp import tools
+
+
+def _save_run(root, run_id, request="Should we ship?", verdict="PASS", report="REPORT TEXT"):
+    d = os.path.join(root, run_id)
+    os.makedirs(d)
+    with open(os.path.join(d, "envelope.json"), "w", encoding="utf-8") as fh:
+        json.dump({"request": request, "verdict": verdict,
+                   "recommendation": "do it", "meta": {"report_md": report}}, fh)
+
+
+@pytest.fixture
+def ledger(tmp_path):
+    root = str(tmp_path / "runs")
+    os.makedirs(root)
+    _save_run(root, "20261016095019-frame", request="Is this a question?\nsecond line",
+              verdict=None, report="FRAME REPORT")
+    _save_run(root, "20261016095044-spar", report="SPAR REPORT")
+    os.makedirs(os.path.join(root, "20261016100000-spar"))  # in progress: no envelope yet
+    return root
+
+
+def test_index_lists_runs_newest_first_and_skips_unfinished(ledger):
+    out = tools.run_index(ledger)
+    assert out["ok"] is True
+    assert [r["run_id"] for r in out["runs"]] == ["20261016095044-spar", "20261016095019-frame"]
+    spar, frame = out["runs"]
+    assert spar["kind"] == "spar" and spar["verdict"] == "PASS"
+    assert frame["topic"] == "Is this a question?"
+    assert spar["report_uri"] == "rapier://runs/20261016095044-spar"
+    assert spar["record_uri"] == "rapier://runs/20261016095044-spar/record"
+
+
+def test_index_when_persistence_is_off_or_nothing_saved(tmp_path):
+    assert tools.run_index(None)["ok"] is False
+    assert tools.run_index(str(tmp_path / "absent"))["runs"] == []
+
+
+def test_report_and_record_read_the_saved_run(ledger):
+    assert tools.run_report(ledger, "20261016095044-spar") == "SPAR REPORT"
+    assert tools.run_record(ledger, "20261016095044-spar")["verdict"] == "PASS"
+
+
+@pytest.mark.parametrize("bad", ["../etc", "a/b", "", "nope-spar"])
+def test_report_rejects_traversal_and_unknown_ids(ledger, bad):
+    with pytest.raises(LookupError):
+        tools.run_report(ledger, bad)
+
+
+def test_resources_over_the_protocol(ledger, monkeypatch):
+    pytest.importorskip("mcp.server.fastmcp")
+    anyio = pytest.importorskip("anyio")
+    from mcp.shared.memory import create_connected_server_and_client_session
+
+    from rapier.mcp.server import build_server
+
+    monkeypatch.delenv("RAPIER_NO_PERSIST", raising=False)
+    monkeypatch.setenv("RAPIER_MCP_LEDGER", ledger)
+    server = build_server()
+
+    async def go():
+        async with create_connected_server_and_client_session(server._mcp_server) as client:
+            listed = {str(r.uri): r for r in (await client.list_resources()).resources}
+            templates = {t.uriTemplate for t in
+                         (await client.list_resource_templates()).resourceTemplates}
+
+            # A run saved after the server started still shows up in the next listing.
+            _save_run(ledger, "20261016110000-sparring", request="Later run")
+            relisted = {str(r.uri) for r in (await client.list_resources()).resources}
+
+            index = json.loads((await client.read_resource("rapier://runs")).contents[0].text)
+            report = (await client.read_resource("rapier://runs/20261016095044-spar")).contents[0]
+            record = (await client.read_resource(
+                "rapier://runs/20261016095044-spar/record")).contents[0]
+            return listed, templates, relisted, index, report, record
+
+    listed, templates, relisted, index, report, record = anyio.run(go)
+
+    assert "rapier://runs" in listed
+    assert listed["rapier://runs/20261016095044-spar"].mimeType == "text/plain"
+    assert "rapier://runs/20261016100000-spar" not in listed  # unfinished run not listed
+    assert {"rapier://runs/{run_id}", "rapier://runs/{run_id}/record"} <= templates
+    assert "rapier://runs/20261016110000-sparring" in relisted
+    assert [r["run_id"] for r in index["runs"]][-1] == "20261016095019-frame"
+    assert report.text == "SPAR REPORT"
+    assert json.loads(record.text)["verdict"] == "PASS"