slipwai 1.2.1.dev13__tar.gz → 1.3.0.dev8__tar.gz

{slipwai-1.2.1.dev13 → slipwai-1.3.0.dev8}/CHANGELOG.md

@@ -2,6 +2,89 @@
 
 No public releases yet. Release notes are recorded here newest first.
 
+## 1.2.1 — PATCH
+
+**`make check-imports` no longer reads a test of the domain as domain code.** The gate took any file with a
+`domain/` or `application/` segment in its path for that layer, so a Decider spec at
+`tests/domain/<context>.spec.ts` — exactly where `adversarial-testing` and `docs/event-modeling-to-code.md`
+send it — was refused for importing its test runner ("domain imports 'vitest' — only zod may be imported
+here"), and so was a test beside the Decider (`decider.test.ts`, `decider_test.go`, `test_decider.py`,
+`DeciderTest.java`) that named a fake adapter. Test directories (`test/`, `tests/`, `__tests__/`) and test
+files are now left to the level they are; the layer itself is held exactly as before. The path is also read
+relative to `apps/` and `packages/`, so a checkout that happens to sit under a directory called `domain` no
+longer turns every file into domain code.
+
+**A `/cruise` run can no longer make a gate pass by changing the gate.** A run met `check-ux-gates` failing
+because two of the kit's scripts crash where Chrome is not installed, and the bosun patched
+`scripts/check-ux-gates.py` to report that as skipped, committed it, and went on. Its brief now forbids
+touching anything under `scripts/`, the `Makefile`, anything under `tools/`, CI or a harness's hook settings,
+and says what a gate the tree cannot satisfy becomes: a park with the gate's own words as the reason. The rule
+is held in two places rather than said louder. `.claude/settings.json` runs `scripts/agents/cruise.py guard`
+as Claude Code's `PreToolUse` hook on every editing tool, and in a session the runner started it refuses an
+edit to any of those paths before it lands. And the runner takes the content of every gate and control before
+each iteration and compares it after, on every harness: a file modified, deleted or added — a file installed
+under `tools/` excepted — parks the run at once, names the files on the log entry as `controls_changed`, and
+counts the iteration's last line for nothing. A person's own session meets neither.
+
+**`check-ux-gates` runs on Playwright's own Chromium where Chrome is not installed, and never reports a
+crash as a pass or a failure.** The gate now asks once which browser Playwright can open — Chrome, its bundled
+Chromium, or neither — and where only the bundled one opens, starts every render gate with a Node preload that
+retries the kit's `channel: 'chrome'` launch without the channel, so `verify_responsive.mjs` and
+`verify_target_size.mjs` run there like the kit's other three. Where no browser opens, or Playwright is not
+resolvable, the render gates are counted skipped without running one, and a gate that still fails on its launch
+is reported skipped rather than as a finding; `UX_GATES_REQUIRE=1` still makes every skip a failure.
+
+**`stop --now` returns once the runner has gone, not once it was told to go.** The runner ends the iteration's
+session before it exits, which takes a moment, and a `start` typed the moment `stop --now` returned found the old
+runner still alive and declined to start one — after which nobody was running and the watch seat found nobody to
+watch. It now waits for the runner to be gone, up to thirty seconds, and says so if it is still ending after that.
+
+**`/where-are-we` and `/whats-next` answer beside a running `/cruise`.** Both used to answer as if the person's
+session were about to take the next slice — "Run: /drive S13" while the runner was on S13. Each now runs
+`scripts/agents/cruise.py where` first, a read that prints the runner's iteration, the checkpoint's slice, stage
+and next step, and a park's reason, and puts those lines in the reply; the step for a person is then the runner's,
+with `/cruise`, `/cruise-tell` and `/cruise-stop` as what they can do. Where no runner is running the verb prints
+nothing and both commands answer exactly as before, so nothing changes outside a run.
+
+**`/cruise-watch` takes the watch seat on its own.** `/cruise-status` reads once and stops, and a session that
+typed it to answer a question had left the seat; the way back was `/cruise`, which reads as starting a run.
+`/cruise-watch` sits back down where the feed left off and starts nothing, with the seat's rules — its words
+and `commands/cruise.md`'s are one text — and `make cruise-watch` stays the same seat from a terminal.
+
+**Catch-up.** `slipwai migrate` brings the hook, the runner, the gate and the command text. A run that already
+carries a patched gate is found by `git log -- scripts/` and reverted by hand; the runner parks on the next
+change, not on the standing one.
+
+**A slice branch run by `/cruise` can pass `make verify` again.** `check-slice-scope` refused two files that
+two other gates require on a slice branch. `specs/<feature>/decisions.md`, which `/cruise` writes where the
+ladder took the decision — during a slice's stages, that is the slice's branch — and which `check-decisions`
+holds to `Written to` paths that exist only there, so the record could pass on neither branch. And
+`docs/event-model/model.drawio`, which `check-drawio` requires to match the `model.yaml` block the slice is
+allowed to advance, and which the scope gate refused as the host's docs. Both are now a slice's to write:
+`decisions.md` beside the other cumulative artifacts the host merges in split order, and the canvas because
+its own gate holds it to the model, so it can carry nothing of the slice's own. `commands/drive.md` and the
+`drive-slice` brief say so, and say the canvas is regenerated again after each merge.
+
+**A slice is compared with the newest `main` the checkout knows, not with `origin/main` first.** Both
+`check-slice-scope` and `check-migrations` took `origin/main` as the base whenever it existed, so a `main`
+that had moved locally and not been pushed — a migration run there, then merged into the slice — put its own
+files into the slice's diff, and the slice stayed red until `main` was pushed, which `/catch-up`'s *green
+before pushed* rule forbids while it is red. Every `main` is now tried and the base that is newest wins.
+`/catch-up` and the upgrading page also say where a migration runs: on `main`, on a clean tree, never on a
+`slice/<id>` branch.
+
+**A decision `/cruise` takes that would cost a migration to reverse is also an ADR.** `commands/cruise.md`
+now puts the `architecture-decisions` skill's one question to every decision entry — an event's schema or
+name, stream identity, tenancy, the store, personal data, identity, a dependency, a contract — and where the
+answer is a migration, the driver writes `docs/adr/NNNN-<title>.md` at `Proposed`, numbered the way `D<n>`
+is, and names it in the entry's `Written to`. The skipper returns the five sections with its entry, or says
+in a line why the decision is reversible. The owner brief and the cruise report say a person accepts them.
+`check-slice-scope` allows a new ADR on a slice branch, and refuses an edit to one that stands.
+
+**Catch-up.** `slipwai migrate` brings the two gates and the command text. A slice branch red on
+`decisions.md` or `model.drawio` passes as it stands after the merge; a migration already run on a slice
+branch is undone with `git reset --hard ORIG_HEAD` there and run again on `main`.
+
 ## 1.2.0 — MINOR
 
 **A benchmark bracket now counts only its own lines, an entry a session leaves open is cut off rather than left

{slipwai-1.2.1.dev13 → slipwai-1.3.0.dev8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: slipwai
-Version: 1.2.1.dev13
+Version: 1.3.0.dev8
 Summary: One-shot scaffolder for product monorepos: a walking skeleton, a verify gate, a path to production, and a repository set up for coding agents.
 Project-URL: Homepage, https://github.com/ROBCOATVG/slipwai
 Project-URL: Repository, https://git.treyco.dev/ROBCOATVG/slipwai

slipwai-1.3.0.dev8/VERSION

@@ -0,0 +1 @@
+1.3.0.dev8

{slipwai-1.2.1.dev13 → slipwai-1.3.0.dev8}/assets/targets/aws/README.md

@@ -227,6 +227,41 @@ when it starts a task and the task role is untouched, while the agent runs insid
 task role. `infra/service/flags.tf` has the whole argument, including why the stack owns the AppConfig
 profile but not the document in it.
 
+## Changing the stacks
+
+### Adding IAM to the service stack
+
+The deploy role applies `service/`, and it may create and delete only what `bootstrap/main.tf` grants it:
+PowerUserAccess, which excludes IAM, and IAM back on roles named `<project>-*`. An IAM user, a managed
+policy, an instance profile or anything else outside roles is refused by AWS at the production apply,
+part-way, after the apply has changed what it reached first. `make check-deploy-role` — part of `make
+verify` — reads both stacks and fails first, naming each `aws_iam_*` resource whose create or delete action
+the role is not granted on that kind of resource. The fix is never in `service/` and never in the IAM
+console: add the actions to a statement of `data.aws_iam_policy_document.deploy_iam` in `bootstrap/main.tf`,
+scoped to this project's names the way the role statement is, and have a person with administrator
+credentials run `make bootstrap` before the change merges. A deploy refused on an `iam:` action anyway says
+the same thing.
+
+### Renaming or retiring a resource
+
+OpenTofu keys state by address, so renaming a resource block, or moving it into a `for_each` or a module,
+reads as destroying the old address and creating a new one — unless a `moved` block says the two are one:
+
+```hcl
+moved {
+  from = aws_cloudfront_response_headers_policy.web_noindex
+  to   = aws_cloudfront_response_headers_policy.web
+}
+```
+
+With it, the rename is an in-place update. Without it the apply creates the new resource, then destroys the
+old one — and the old one's destroy is not ordered after the in-place update of whatever still uses it, so a
+provider that refuses to delete something in use (CloudFront answers 409) fails the apply part-way, in every
+environment it reaches. A block that is only being dropped from the code, while what it made carries on
+existing or is removed by hand, is a `removed` block (`removed { from = … lifecycle { destroy = false } }`),
+which forgets it rather than deleting it. Both stay in the stack until every environment has been applied
+past them; `tofu plan` showing `has moved to` or `will no longer be managed`, and no destroy, is the check.
+
 ## What lives where
 
 - **Environment variables the services are given** — `service/main.tf`, composed from what each answer

{slipwai-1.2.1.dev13 → slipwai-1.3.0.dev8}/assets/targets/aws/bootstrap/main.tf

@@ -240,7 +240,9 @@ resource "aws_iam_role" "deploy" {
 
 # PowerUserAccess is everything but IAM, and the service stack has to create the three roles ECS runs under
 # — so the deploy role gets IAM back, scoped to roles carrying this project's name. Narrow this further once
-# the service stack has settled: `tofu plan` lists exactly what it touches.
+# the service stack has settled: `tofu plan` lists exactly what it touches. `make check-deploy-role` holds
+# every `aws_iam_*` resource in infra/service/ to the statements below; IAM of another kind (a user, a
+# policy) is a statement added here and a `make bootstrap`, which the pipeline cannot do for itself.
 resource "aws_iam_role_policy_attachment" "deploy_power_user" {
   role       = aws_iam_role.deploy.name
   policy_arn = "arn:aws:iam::aws:policy/PowerUserAccess"

slipwai-1.3.0.dev8/assets/targets/aws/scripts/check-deploy-role.py

@@ -0,0 +1,169 @@
+#!/usr/bin/env python3
+"""Fail when the service stack declares IAM the deploy role is not allowed to create or delete.
+
+Two stacks meet at the deploy role, and nothing else connects them. `infra/bootstrap/` makes the role once,
+applied by a person with admin credentials (`make bootstrap`): PowerUserAccess, which is everything but IAM,
+and IAM back on roles carrying this project's name. `infra/service/` is applied by that role on every push to
+`main`, and is free to declare any `aws_iam_*` resource. So a slice that adds an IAM user, a managed policy or
+an instance profile passes every gate, merges, and the first place the two stacks meet is the production
+apply — which is refused part-way, after it has changed whatever it reached first, on an action the
+pipeline cannot grant itself. The person who reads that failure goes looking for the permission in the
+console, when the answer is a statement in `infra/bootstrap/main.tf` and a `make bootstrap`.
+
+This reads both stacks and holds each `aws_iam_*` resource under `infra/service/` to the policies the
+bootstrap stack attaches to `aws_iam_role.deploy`: the action that creates it and the one that deletes it,
+each granted on a resource of the same kind (`role/`, `user/`, `policy/`, …) or on `*`. It reads files, runs
+no `tofu` and no `aws`, and needs nothing running.
+
+What it does not see, said so a pass is not over-read: the name a resource is given against the name the
+grant is scoped to (both are usually interpolated, and the answer is in the plan, not the text); the read,
+tag and update actions an apply also calls (PowerUserAccess covers none of them, so the bootstrap policy
+lists them beside each create); and IAM declared inside a module. A resource type it has no row for is a
+failure, never a pass, and the message says where the row goes.
+"""
+from __future__ import annotations
+
+import re
+import sys
+from fnmatch import fnmatchcase
+from pathlib import Path
+
+
+def project_root(script: Path, depth: int) -> Path:
+    for candidate in script.parents:
+        if (candidate / "project.json").is_file():
+            return candidate
+    return script.parents[depth]
+
+
+ROOT = project_root(Path(__file__).resolve(), 1)
+BOOTSTRAP = ROOT / "infra/bootstrap"
+SERVICE = ROOT / "infra/service"
+
+# What tofu calls to create and to delete each IAM resource type, and the kind of IAM resource ARN the call
+# is authorised against. The kind is the segment after the account in the ARN: `arn:aws:iam::<account>:<kind>/…`.
+TYPES: dict[str, tuple[str, tuple[str, str]]] = {
+    "aws_iam_role": ("role", ("iam:CreateRole", "iam:DeleteRole")),
+    "aws_iam_role_policy": ("role", ("iam:PutRolePolicy", "iam:DeleteRolePolicy")),
+    "aws_iam_role_policy_attachment": ("role", ("iam:AttachRolePolicy", "iam:DetachRolePolicy")),
+    "aws_iam_service_linked_role": ("role", ("iam:CreateServiceLinkedRole", "iam:DeleteServiceLinkedRole")),
+    "aws_iam_user": ("user", ("iam:CreateUser", "iam:DeleteUser")),
+    "aws_iam_user_policy": ("user", ("iam:PutUserPolicy", "iam:DeleteUserPolicy")),
+    "aws_iam_user_policy_attachment": ("user", ("iam:AttachUserPolicy", "iam:DetachUserPolicy")),
+    "aws_iam_access_key": ("user", ("iam:CreateAccessKey", "iam:DeleteAccessKey")),
+    "aws_iam_user_login_profile": ("user", ("iam:CreateLoginProfile", "iam:DeleteLoginProfile")),
+    "aws_iam_user_group_membership": ("group", ("iam:AddUserToGroup", "iam:RemoveUserFromGroup")),
+    "aws_iam_group": ("group", ("iam:CreateGroup", "iam:DeleteGroup")),
+    "aws_iam_group_policy": ("group", ("iam:PutGroupPolicy", "iam:DeleteGroupPolicy")),
+    "aws_iam_group_policy_attachment": ("group", ("iam:AttachGroupPolicy", "iam:DetachGroupPolicy")),
+    "aws_iam_group_membership": ("group", ("iam:AddUserToGroup", "iam:RemoveUserFromGroup")),
+    "aws_iam_policy": ("policy", ("iam:CreatePolicy", "iam:DeletePolicy")),
+    "aws_iam_instance_profile": ("instance-profile", ("iam:CreateInstanceProfile", "iam:DeleteInstanceProfile")),
+    "aws_iam_openid_connect_provider": ("oidc-provider",
+                                        ("iam:CreateOpenIDConnectProvider", "iam:DeleteOpenIDConnectProvider")),
+    "aws_iam_saml_provider": ("saml-provider", ("iam:CreateSAMLProvider", "iam:DeleteSAMLProvider")),
+}
+STRING = r'"(?:\\.|[^"\\])*"'
+LITERAL = re.compile(STRING)
+COMMENT = re.compile(rf"({STRING})|#[^\n]*|//[^\n]*|/\*.*?\*/", re.DOTALL)
+RESOURCE = re.compile(r'\bresource\s+"(aws_iam_[a-z0-9_]+)"\s+"([^"]+)"')
+ARN_KIND = re.compile(r"^arn:[^:]*:iam::[^:]*:([a-z-]+)/")
+
+
+def uncommented(text: str) -> str:
+    """HCL without its comments; a `#` inside a string is part of the string."""
+    return COMMENT.sub(lambda match: match.group(1) or "", text)
+
+
+def body(text: str, opening: int) -> str:
+    """What is between the brace at `opening` and the one that closes it, stepping over strings — whose
+    `${…}` interpolations carry braces of their own."""
+    depth, index = 0, opening
+    while index < len(text):
+        character = text[index]
+        if character == '"':
+            literal = LITERAL.match(text, index)
+            index = literal.end() if literal else len(text)  # an unterminated string runs to the end
+            continue
+        depth += {"{": 1, "}": -1}.get(character, 0)
+        if depth == 0:
+            return text[opening + 1:index]
+        index += 1
+    return text[opening + 1:]
+
+
+def blocks(text: str, header: str) -> list[tuple[re.Match[str], str]]:
+    return [(match, body(text, match.end() - 1)) for match in re.finditer(header + r"\s*\{", text)]
+
+
+def strings(listing: str) -> list[str]:
+    return [literal[1:-1] for literal in LITERAL.findall(listing)]
+
+
+def deploy_grants(text: str) -> list[tuple[list[str], list[str]]]:
+    """Every Allow statement of every policy document the bootstrap stack attaches to `aws_iam_role.deploy`."""
+    attached = set()
+    for _, inline in blocks(text, r'\bresource\s+"aws_iam_role_policy"\s+"[^"]+"'):
+        if re.search(r"\brole\s*=\s*aws_iam_role\.deploy\.(?:id|name)\b", inline):
+            attached |= set(re.findall(r"\bpolicy\s*=\s*data\.aws_iam_policy_document\.([A-Za-z0-9_-]+)\.json", inline))
+    grants = []
+    for match, document in blocks(text, r'\bdata\s+"aws_iam_policy_document"\s+"([^"]+)"'):
+        if match.group(1) not in attached:
+            continue
+        for _, statement in blocks(document, r"\bstatement"):
+            if re.search(r'\beffect\s*=\s*"Deny"', statement):
+                continue
+            actions = re.search(r"\bactions\s*=\s*\[(.*?)\]", statement, re.DOTALL)
+            resources = re.search(r"\bresources\s*=\s*\[(.*?)\]", statement, re.DOTALL)
+            if actions and resources:
+                grants.append((strings(actions.group(1)), strings(resources.group(1))))
+    return grants
+
+
+def granted(action: str, kind: str, grants: list[tuple[list[str], list[str]]]) -> bool:
+    for actions, resources in grants:
+        if not any(fnmatchcase(action.lower(), pattern.lower()) for pattern in actions):
+            continue
+        for resource in resources:
+            found = ARN_KIND.match(resource)
+            if resource == "*" or (found and found.group(1) == kind):
+                return True
+    return False
+
+
+def main() -> int:
+    if not (BOOTSTRAP / "main.tf").is_file() or not SERVICE.is_dir():
+        print("check-deploy-role: no infra/bootstrap/main.tf and infra/service/ here; nothing to compare")
+        return 0
+    grants = deploy_grants("\n".join(uncommented(path.read_text()) for path in sorted(BOOTSTRAP.glob("*.tf"))))
+    problems, checked = [], 0
+    for path in sorted(SERVICE.rglob("*.tf")):
+        relative = path.relative_to(ROOT).as_posix()
+        for match in RESOURCE.finditer(uncommented(path.read_text())):
+            kind_actions = TYPES.get(match.group(1))
+            address = f"{match.group(1)}.{match.group(2)}"
+            if kind_actions is None:
+                problems.append(f"{relative}: {address} is an IAM type this gate has no row for, so it cannot say "
+                                "whether the deploy role may create it — add its create and delete actions to TYPES "
+                                "in scripts/check-deploy-role.py, and to the bootstrap policy if they are missing")
+                continue
+            checked += 1
+            kind, actions = kind_actions
+            for action in actions:
+                if not granted(action, kind, grants):
+                    problems.append(f"{relative}: {address} needs {action} on {kind}/…, and the deploy role is "
+                                    f"granted it on no {kind}")
+    if problems:
+        print("check-deploy-role: FAILED — the service stack declares IAM the deploy role cannot manage, so the "
+              "production apply would be refused part-way\n  - " + "\n  - ".join(problems))
+        print("The fix is not in infra/service/ and not in the pipeline: add the actions to a statement of "
+              "`data.aws_iam_policy_document.deploy_iam` in infra/bootstrap/main.tf, scoped the way the role "
+              "statement is (`arn:aws:iam::${local.account}:<kind>/${var.project}-*`), and have someone with "
+              "admin AWS credentials run `make bootstrap`. The deploy role cannot grant itself what it lacks.")
+        return 1
+    print(f"check-deploy-role: {checked} IAM resource(s) in infra/service/, each within the deploy role's grants")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

{slipwai-1.2.1.dev13 → slipwai-1.3.0.dev8}/assets/targets/aws/scripts/deploy.py

@@ -28,6 +28,7 @@ from __future__ import annotations
 
 import json
 import os
+import re
 import shutil
 import subprocess
 import sys
@@ -52,6 +53,10 @@ HEALTH_PATH = "/health"
 # How long a migrate task may run before it is stopped and the deploy fails. Generous for a real migration
 # on the smallest RDS instance; short enough that a task that is serving instead of migrating is caught.
 MIGRATION_MINUTES = 15
+# How AWS words a call the deploy role has no grant for, as `tofu apply` prints it. An IAM action refused
+# here is not the pipeline's to fix: the role's grants are `infra/bootstrap/`, applied by `make bootstrap`
+# with admin credentials, and the console is where somebody reading the error will otherwise go looking.
+DENIED_IAM = re.compile(r"not authorized to perform: (iam:[A-Za-z]+)")
 # How many times a failed task's log stream is read before it is called empty. A task reported STOPPED has
 # usually flushed, but not always, and the lines that explain the failure are the last ones written.
 LOG_ATTEMPTS = 4
@@ -265,12 +270,30 @@ def outputs() -> dict:
 
 
 def apply(environment: str, images: dict[str, str], *targets: str) -> dict:
-    tofu(
-        "apply", "-input=false", "-auto-approve",
+    """The service stack applied, its stderr passed through as it comes and read for an IAM refusal, which is
+    turned into the one thing that fixes it: `make bootstrap`, by a person, with admin credentials."""
+    command = [
+        "tofu", f"-chdir={INFRA}", "apply", "-input=false", "-auto-approve",
         f"-var-file={environment}.tfvars",
         f"-var=images={json.dumps(images)}",
         *(f"-target={target}" for target in targets),
-    )
+    ]
+    print("+", " ".join(command), file=sys.stderr, flush=True)
+    process = subprocess.Popen(command, text=True, stdout=sys.stderr, stderr=subprocess.PIPE)
+    denied: list[str] = []
+    for line in process.stderr or ():
+        sys.stderr.write(line)
+        denied += [action for action in DENIED_IAM.findall(line) if action not in denied]
+    if process.wait() != 0 and denied:
+        raise Failure(
+            f"the apply was refused {', '.join(denied)}, which the deploy role is not granted. The role's grants "
+            "are infra/bootstrap/main.tf (`data.aws_iam_policy_document.deploy_iam`), not the service stack and not "
+            "the IAM console: add the action there, scoped to this project's names, and have someone with admin "
+            "AWS credentials run `make bootstrap`; then re-run the deploy. The apply stopped part-way, so this "
+            "environment is between releases until it does."
+        )
+    if process.returncode != 0:
+        raise Failure(f"`tofu apply` exited {process.returncode}")
     return outputs()
 
 

{slipwai-1.2.1.dev13 → slipwai-1.3.0.dev8}/assets/targets/azure/README.md

@@ -275,6 +275,28 @@ the platform resolves the values before the process starts and the app never tal
 free tier of App Configuration allows **one store per subscription per region**, so a second environment
 opting in needs the standard tier at roughly $36 a month. `infra/service/flags.tf` has the whole argument.
 
+## Changing the stacks
+
+### Renaming or retiring a resource
+
+OpenTofu keys state by address, so renaming a resource block, or moving it into a `for_each` or a module,
+reads as destroying the old address and creating a new one — unless a `moved` block says the two are one:
+
+```hcl
+moved {
+  from = azurerm_container_app.api
+  to   = azurerm_container_app.service
+}
+```
+
+With it, the rename is an in-place update. Without it the apply creates the new resource, then destroys the
+old one — and the old one's destroy is not ordered after the in-place update of whatever still uses it, so a
+provider that refuses to delete something in use fails the apply part-way, in every
+environment it reaches. A block that is only being dropped from the code, while what it made carries on
+existing or is removed by hand, is a `removed` block (`removed { from = … lifecycle { destroy = false } }`),
+which forgets it rather than deleting it. Both stay in the stack until every environment has been applied
+past them; `tofu plan` showing `has moved to` or `will no longer be managed`, and no destroy, is the check.
+
 ## What lives where
 
 - **Environment variables the services are given** — `service/main.tf`, composed from what each answer

{slipwai-1.2.1.dev13 → slipwai-1.3.0.dev8}/assets/toolkit/docs/agent-harnesses.md

@@ -86,8 +86,10 @@ project with no index. Both lists name the route back (`mcp_*` on Gemini, one `<
 this project's extensions install on Copilot), which costs nothing that was being held, because both already
 carry the whole shell. The other four reach the session's servers whatever the file says — Claude Code and
 Codex inherit them, Cursor inherits every tool, opencode's `permission` map is a denylist — and on Claude Code
-the tool arrives *deferred*, a bare name the delegate has to load through the harness's own tool-search step
-before it can call it. `registry.json` records all of that under `agentFile.mcp`, with the source and the date
+an MCP tool arrives *deferred*, a bare name the delegate has to load through the harness's own tool-search step
+before it can call it — unless the server's `.mcp.json` entry carries `alwaysLoad: true`, which the registry's
+`projectMcp.serverFields` has the CodeGraph extension write, so its tool is loaded at session start. Every
+harness also has `scripts/codegraph`, the pinned CLI, through the shell. `registry.json` records all of that under `agentFile.mcp`, with the source and the date
 it was read, and every projection's stamp carries it, so a route a harness withholds is one somebody can read.
 
 Because the model lives in these files on five of the six harnesses, `/model-delegation-settings` rewrites them as part of the