From d423551e486508341d2f7b31efb9c16a0c15619d Mon Sep 17 00:00:00 2001 From: KimGLee <05_bolster_inkling@icloud.com> Date: Sat, 22 Aug 2026 13:33:56 +0800 Subject: [PATCH 1/3] Deliver Card activation in budgeted pieces (card-first-readback-v3) K13/19 required an activation payload to have entered a worker's execution context before a runtime may call it running, and the Execution-context Delivery section claimed an admission proved exactly that. It did not. The claim was minted before the result left the server, so a host that externalizes an oversized tool result left the payload outside the model context while the receipt still asserted machine delivery, and no gate could observe the divergence. A 2026-08-22 measurement against a live host made the gap concrete: server delivery was complete and every hash matched, but the 231,164-byte single result was spilled to a file and only a 2KB preview reached the model. The divergence was noticed by accident. v3 stops embedding bytes in the admission result. Admission freezes a piece manifest -- one record per deliverable file with its hash and size -- and the bytes travel afterwards through --deliver-activation-piece, one file per tool result, inside MAX_ACTIVATION_PIECE_ENVELOPE_BYTES. The measured object is the serialized delivery, not the source file: 50,495 bytes of Card source arrived as a 231,164-byte result, so envelope overhead exceeded the payload. Admission fails closed when any frozen piece would exceed the budget, which turns an oversized leaf into a governance problem at its own boundary instead of a transport accident mid-batch. A piece is always a whole file. Splitting one across results would break the only check the receiving end can make: the frozen hash binds the complete file, a model cannot rehash fragments, and no party could prove a reassembly was faithful. Admission now records host-bound or prepared. Neither claims delivery. Completion is earned per piece: each delivery carries a single-use nonce after the content, returned by --ack-activation-piece from the same context. The nonce is one part of three and never the whole -- a host can show a head-and- tail summary, keep structure while externalizing content, or leave an agent reading a spilled file's tail. Only the server hash, a conformant adapter, and the ack together are delivery evidence. The v1/v2 same-session consumption rule at queued -> open is retired. It protected a claim v3 no longer makes there, and keeping it would re-couple the Queue lifecycle to the context lifecycle K13/19 separates. open still proves the frozen Bundle equals current bytes; the context binding moves to the Assignment delivery gate. Sealed v1/v2 receipts replay under their own shape. mcp_server now exports the host's declared clientInfo alongside the execution context id, so delivery evidence can bind the adapter build it ran against rather than inheriting a registration a later update invalidated. Also connected: every capability implementation's SHA is pinned in Tools/compiled/metadata-execution-contract.json, so changing these tools without regenerating the compiled artifacts fails profile-load and cascades through the suite. metadata-execution-contract, cli-contract, mcp-tools and the host-config products are regenerated here; check_queue's producer version moves to 1.25.0 in K00/12 for the changed accept set. Tests: test_card_activation 21/21, full suite 2106 tests with 3 pre-existing failures that belong to an unrelated uncommitted README rewrite. make check passes. Co-Authored-By: Claude Opus 5 --- Tools/README.md | 4 +- Tools/card_activation.py | 422 ++++++++++++++++-- Tools/check_queue.py | 152 ++++++- Tools/compiled/cli-contract.yaml | 65 ++- .../host-configs/claude-code.mcp.json | 2 +- Tools/compiled/host-configs/codex.config.toml | 4 +- .../host-configs/dsh-profile-patch.yaml | 2 +- Tools/compiled/host-configs/dsh.env | 4 +- .../compiled/host-configs/kimi-code.mcp.json | 2 +- Tools/compiled/mcp-tools.json | 2 +- .../compiled/metadata-execution-contract.json | 2 +- Tools/mcp_server.py | 25 ++ Tools/schemas/receipt.template.jsonl | 44 +- Tools/tests/test_card_activation.py | 219 +++++++-- Tools/tests/test_update_queue.py | 19 + Tools/update_queue.py | 17 +- .../12 Control Registry.md | 12 +- ...ntext Activation and Read-back Delivery.md | 90 +++- 18 files changed, 964 insertions(+), 123 deletions(-) diff --git a/Tools/README.md b/Tools/README.md index d064223..e10e0f5 100644 --- a/Tools/README.md +++ b/Tools/README.md @@ -87,7 +87,9 @@ returned Addendum is bound to the parent Bundle and refuses source drift. | `init_state.py` | Create an adopter's empty task runtime (producer 1.4.0), including `work_specs/` and the three task Ledgers. Dry-run by default. A new adopter already has `.cambium/governance/standards_state.yaml` and may have adoption receipts; the writer preserves both and publishes the task directories beside them under the shared lock. Existing `.cambium/state/`, an unsafe namespace, Profile/state drift, or partial publication fails closed and rolls back; no Required work is invented | `python3 Tools/init_state.py . --task-id TASK --objective "Concrete outcome" --exclude "Out-of-scope boundary" --completion-semantics build --scope-version s1 --standards-version VERSION --profile-manifest profiles/my-profile/profile.md --apply` | | `apply_task_plan.py` | Sole writer of the initial planning transaction 1.2.0 (K13/18). `init_state.py` leaves the Task Contract's five selection fields, Coverage, and the Queue empty because it infers nothing; this tool fills the first two from one operator-confirmed restricted-YAML plan under `.cambium/deltas/task-plans/`, so those first values are never hand-edited. Dry-run by default. The plan names routes, not paths: `selected_card_paths`, `selected_read_sets`, and `loaded_module_paths` are resolved from `selected_route_ids` through the same canonical Card/Read Set indexes `check_proof` binds at Terminal, then transitively closed over loading boundaries, because selecting R01 alone reaches every other route and well over a hundred modules and a hand-typed list would be a declaration nobody checked; a path the plan does list is kept and closed over, which is how a profile supplemental Read Set is selected. The derived declaration must then satisfy `check_queue`'s own closure findings, which K00/15 makes an admission judgment rather than a live error precisely because a plan is still writable. It fails closed on an unknown or missing plan field, a `before` SHA-256 that does not match current Coverage/Queue/Progress bytes, a disagreeing task ID, a `task_state` other than `planned`, an already populated Coverage or Queue, an unfilled `TODO(plan)` sentinel, a current runtime that does not validate, a route absent from the registry, a Card whose route is not selected, a Read Set closure that does not resolve, Coverage the Queue compiler rejects, or a proposed after-image that fails `check_queue`. It compiles the Queue in memory only to prove one is derivable and to report its size; it writes no Queue bytes, because before first materialization Coverage and the Contract are adopter inputs while the Queue crossing that line is materialization itself, which `compile_queue --apply` owns. The state it leaves is the unmaterialized runtime that `check_queue`'s own `allow_unmaterialized_queue` names and that `compile_queue` sets to read it; both the dry run and the commit print the exact compiler command with the untouched Queue revision and fingerprint filled in. At founding it derives legacy machine-managed values from the exact page snapshots, records them as `legacy-unverified` Coverage observations, and removes the unauthoritative page copies in the same guarded transaction. Writes Coverage and Progress under the shared state-writer lock after re-verifying the before images, appends one commit receipt, and restores the before images plus an abort receipt on any failure after the first replacement. Re-applying the same plan bytes resumes an interruption; a different plan over an already-planned runtime is refused. The initial contract may carry the closed `amendment_authority` block; absent or `user-only` is the safe default, and delegated mode names only registered bounded change classes. The receipt carries no Gate ID: the state it writes is consumed by gates that already exist | `python3 Tools/apply_task_plan.py . --plan .cambium/deltas/task-plans/TP-001.yaml --apply` | | `apply_contract_amendment.py` | Guarded writer 1.1.0 for the two closed non-scope Task Contract fields the runtime supports (K13/06 Contract Amendment; field shape owner K13/02): `policy_exceptions` and `amendment_authority`. Consumes one confirmed restricted-YAML plan under `.cambium/deltas/contract-amendments/`; no pending phase -- it validates the complete after-image (including the K13/02 exception shape and the proposed runtime under `check_queue` with its own commit receipt as the anchor event) and commits Queue + Progress under the shared writer lock, or writes nothing. Advances `contract_version` and the Queue revision exactly once; changes no scope, batch structure, or lifecycle; integrator-only on apply. A schema-2 plan supplies both complete after-images; `changed_contract_fields` records which actually moved. The verified `contract-amendment` row it appends binds plan path/SHA and the commit receipt, and the contract anchor chain follows the fingerprint change instead of failing closed. Every exception for a registered policy must carry the CURRENT effective-policy fingerprint (`kblib.effective_priority_policy`; the refusal prints the expected value -- it is not computable by hand), and the effective ceilings -- exception where granted, standing quota where not -- must jointly stay strictly below 100 (K00/07). Refuses while any batch is `merge-ready` (the Queue-revision bump would strand its `delta_apply` binding); re-resolves the policy and re-verifies the plan bytes inside the commit lock; participates in the generic writer recovery protocol (`receipt_id`/`receipt_path`/`transaction_phase` in the lock metadata), and an uncertain receipt append retains the lock. Re-applying needs a fresh plan against the moved runtime; an exception is removed by confirming a plan whose after list no longer carries it | `python3 Tools/apply_contract_amendment.py . --plan .cambium/deltas/contract-amendments/CA-001.yaml --actor-role integrator --apply` | -| `check_queue.py` | Required Queue Gate producer 1.24.0 (K13/08): validates schema, manifests, Coverage projection, dependencies, lifecycle/task receipts, holds, confirmations, hash-bound complex-batch Work Specs, deltas, concurrency, Progress revisions/fingerprint, paths, readiness, and terminal count. For current Standards revalidation it validates K00/12's closed capability registry, projects semantic leaves to their owner Gates, accepts raw receipts only for the due immediate-owner set, and records native owners as deferred to the transition that already owns them; historical plans and consumed aggregates keep producer-era semantics, including both the raw affected-gate union and boundary-level required gates recorded by pre-1.6 adoption producers. It also derives the live Task Contract's transitive Read Set closure: every referenced Read Set must be declared, kernel/profile types and namespaces must agree with the selected Profile and route IDs, and every ordinary boundary target must occur in `loaded_module_paths`; Profile-owned contract dependencies are authorized by `profile-load` and are not added to that kernel load list. Both the public R01 Queue admission and the lower-level runtime validator require the complete selected-Profile closure by default, so ordinary writers cannot bypass `profile-load`. The sole smaller identity/sentinel escape is an explicit `adopt_standards.py` option for its persisted current/before read; it is rejected for state overrides or pending receipts, and every candidate after-image remains under full `profile-load`. Unsafe or non-UTF-8 inputs fail closed. The hot receipt catalog never deserializes `.cambium/receipts/cold/` (K12/07): the cold manifest and index load instead. What sealing retires is that deserialization, not integrity -- every run re-hashes every sealed segment against the manifest, proves every projection against the exact sealed line it names, proves both cold registers against the seal receipt that wrote them, and fails closed on an unreferenced segment, an unfinished seal transaction, or a sealed row that still has a hot twin. Rows of a seal whose binding does not hold -- including one produced by an unsupported sealing protocol, or whose segment hash failed -- never enter the catalog at all. Cold paths may not traverse a symlink or carry a second hard link, and a close attestation's born-cold candidate evidence is compared against the hash it bound, not just its length. A sealed receipt then satisfies existence and the closed-bundle identity branch through its thin projection, and a consumer needing live field revalidation of a sealed body fails closed unless it has an explicit sealed branch. The Standards-revalidation consumption replay is such a branch: it resolves the aggregate a Queue transition consumed from the segment that receipt's verified projection names, re-proving the record's own hash at the read, because the consumed keys live in `revalidation_bindings` and the retraction test reads `invalidated_by` and no projection carries either. An aggregate a recorded transition consumed but that resolves in neither namespace fails the run closed rather than reopening a discharged obligation. `--require-complete` is the build-closure Queue gate, so a Terminal Proof cannot authorize an under-declared live load set. `--require-maintenance-complete` additionally consumes current budget-manifest-closed, Coverage-ledger-advanced, and watermark-advanced receipts; reconciles the manifest's complete selected/deferred candidate partition with Coverage and the Queue manifest union; enforces consecutive-deferral disposition; and binds the maintenance pass to all three current state objects. `--resume-status` reports objective/exclusions, completion semantics, three live SHAs, checkpoint/task history, Work Spec bindings, maintenance candidate SHA/partition/prior gate, controls, the applicable completion block, locks, and an exact `next_action`. Valid interrupted delta phases become `admit-delta:` or `apply-delta:`; an applied batch without a current close bundle becomes `run-batch-close-gate:`, while a recovered current bundle becomes `close-applied-batch::::` plus an exact copyable close command. Current close attestations also validate the `exact-carry-v1` baseline plus carried/fresh partitions and their born-cold evidence; historical Queue transitions replay producer-era protocols while new ones require update_queue/1.5.0 receipts, and historical closed deltas replay producer-era protocols while new applies require apply_delta/1.6.0. A writer lock always takes recovery priority; inconsistent evidence becomes `repair-runtime` only when no interrupted writer must first be reconciled | `python3 Tools/check_queue.py . --resume-status` | +| `check_queue.py` | Required Queue Gate producer 1.25.0 (K13/08): validates schema, manifests, Coverage projection, dependencies, lifecycle/task receipts, holds, confirmations, hash-bound complex-batch Work Specs, deltas, concurrency, Progress revisions/fingerprint, paths, readiness, and terminal count. For current Standards revalidation it validates K00/12's closed capability registry, projects semantic leaves to their owner Gates, accepts raw receipts only for the due immediate-owner set, and records native owners as deferred to the transition that already owns them; historical plans and consumed aggregates keep producer-era semantics, including both the raw affected-gate union and boundary-level required gates recorded by pre-1.6 adoption producers. It also derives the live Task Contract's transitive Read Set closure: every referenced Read Set must be declared, kernel/profile types and namespaces must agree with the selected Profile and route IDs, and every ordinary boundary target must occur in `loaded_module_paths`; Profile-owned contract dependencies are authorized by `profile-load` and are not added to that kernel load list. Both the public R01 Queue admission and the lower-level runtime validator require the complete selected-Profile closure by default, so ordinary writers cannot bypass `profile-load`. The sole smaller identity/sentinel escape is an explicit `adopt_standards.py` option for its persisted current/before read; it is rejected for state overrides or pending receipts, and every candidate after-image remains under full `profile-load`. Unsafe or non-UTF-8 inputs fail closed. The hot receipt catalog never deserializes `.cambium/receipts/cold/` (K12/07): the cold manifest and index load instead. What sealing retires is that deserialization, not integrity -- every run re-hashes every sealed segment against the manifest, proves every projection against the exact sealed line it names, proves both cold registers against the seal receipt that wrote them, and fails closed on an unreferenced segment, an unfinished seal transaction, or a sealed row that still has a hot twin. Rows of a seal whose binding does not hold -- including one produced by an unsupported sealing protocol, or whose segment hash failed -- never enter the catalog at all. Cold paths may not traverse a symlink or carry a second hard link, and a close attestation's born-cold candidate evidence is compared against the hash it bound, not just its length. A sealed receipt then satisfies existence and the closed-bundle identity branch through its thin projection, and a consumer needing live field revalidation of a sealed body fails closed unless it has an explicit sealed branch. The Standards-revalidation consumption replay is such a branch: it resolves the aggregate a Queue transition consumed from the segment that receipt's verified projection names, re-proving the record's own hash at the read, because the consumed keys live in `revalidation_bindings` and the retraction test reads `invalidated_by` and no projection carries either. An aggregate a recorded transition consumed but that resolves in neither namespace fails the run closed rather than reopening a discharged obligation. `--require-complete` is the build-closure Queue gate, so a Terminal Proof cannot authorize an under-declared live load set. `--require-maintenance-complete` additionally consumes current budget-manifest-closed, Coverage-ledger-advanced, and watermark-advanced receipts; reconciles the manifest's complete selected/deferred candidate partition with Coverage and the Queue manifest union; enforces consecutive-deferral disposition; and binds the maintenance pass to all three current state objects. `--resume-status` reports objective/exclusions, completion semantics, three live SHAs, checkpoint/task history, Work Spec bindings, maintenance candidate SHA/partition/prior gate, controls, the applicable completion block, locks, and an exact `next_action`. Valid interrupted delta phases become `admit-delta:` or `apply-delta:`; an applied batch without a current close bundle becomes `run-batch-close-gate:`, while a recovered current bundle becomes `close-applied-batch::::` plus an exact copyable close command. Current close attestations also validate the `exact-carry-v1` baseline plus carried/fresh partitions and their born-cold evidence; historical Queue transitions replay producer-era protocols while new ones require update_queue/1.5.0 receipts, and historical closed deltas replay producer-era protocols while new applies require apply_delta/1.6.0. A writer lock always takes recovery priority; inconsistent evidence becomes `repair-runtime` only when no interrupted writer must first be reconciled | `python3 Tools/check_queue.py . --resume-status` | +| `tests/inline_probe_server.py` | Standalone stdio MCP server that returns a payload of an exact requested size with a nonce at its very end. It touches no corpus: the subject under test is the Host Adapter, not Cambium state | `python3 Tools/tests/host_conformance_probe.py . --emit-plan` | +| `tests/host_conformance_probe.py` | Inline-delivery conformance measurement for one Host Adapter build (K13/19). Emits the exact two-control procedure, then judges the observations. Both controls are mandatory: a within-budget payload must arrive whole, and a larger one must be OBSERVED to be externalized -- a probe that cannot fail cannot certify. Passing builds are registered in `Tools/host-conformance.yaml` | `python3 Tools/tests/host_conformance_probe.py . --positive-tail --negative-tail ` | | `check_batch_close.py` | Sole supported producer contract 1.12.0 for the K12/09 merged-snapshot close bundle. Under the shared runtime lock it first runs the complete `profile-load` producer for the selected manifest—identity, all 14 slots, package snapshot, and typed secondary closure—and compiles the required Registered Scan from that exact authorized in-memory contract. A valid Audit/Scan subgraph cannot execute when any other Profile slot is broken. Scan identity, verifier, optional explicit config, predicate, semantics, and Judgment Item bindings therefore share the same authority as admission; the Cambium residual scanner requires its Profile-owned config, while a registered custom verifier may validly declare no `--config`. For one `merge-ready` batch with a current `apply_delta` receipt, it recomputes real repository bytes before/after the Closed List checks and receipt publication; runs `check_links`, Cambium-owned YAML/Markdown structure, a deterministic in-memory Markdown/Wiki-link graph JSON projection plus basename candidates, Coverage file-count, guidance/contract continuity, the selected profile's registered verifier, and `check_vocab` (excluding `kernel/Cards` and `profiles/` — profile directories are control plane, and shipped example instances carry their own vocabularies); invokes the same registered verifier first with the additional standard `--positive-controls-only` flag and then as its unchanged production command, requiring both final pass summaries to bind exactly the same producer, check, scan/config identity, positive-control result/mode/count, and canonical control fingerprint. It also compares each self-report to the admitted contract: `scan_id` must equal the Registered Scan ID, and an explicit config fingerprint must equal the SHA-256 of the admitted config bytes. It records an explicit reviewer attestation with a reviewer label different from the integrator label, then emits one exact-content `page_review_acceptance` child per manifest page. Each child binds the semantic page hash, its own checked-at UTC date, the selected Profile identity, and the Metadata Execution Contract; a final inode-and-byte CAS precedes append. It creates the canonical `check_queue` consistency receipt through that checker's shared producer and emits the exact three IDs consumed by close. Candidate detail is written once per attempt as a born-cold evidence file under `.cambium/receipts/cold/close-evidence/`; the attestation binds it by path/hash/bytes/records and carries counts, per-type counts, the accepted-set fingerprint, and only the policy-exception dispositions inline, while member and failure receipts bind the same evidence instead of repeating rows (K12/09). Version 1.12.0 is the only producer protocol a current close action or recovery may consume. Versions 1.4.0 through 1.11.0 remain recognized only while replaying already-sealed closed history; 1.4.0 keeps its seven-member Closed List shape, and no historical version can authorize a new close. Labels and attestations remain assertions under the Evidence trust boundary. Item 3 does not scan ordinary repository JSON or fenced JSON examples; item 1 alone owns missing/ambiguous/heading verdicts. Every run still performs the complete scan. An ordinary finding may carry from only the immediately preceding verified close when its prior disposition was `accept-while-unchanged`, its stable ID, exact observation hash, and producer version still match, and it is not manifest-local page-contract debt; legacy evidence grants no carry, a disappearance breaks continuity, and a type selector expands only the exact fresh rows present now. Fresh findings use the current-only selectors or `--accept-while-unchanged-id/type`. Candidate prose alone is insufficient. A priority-quota candidate cannot use those generic selectors: it is consumed only through a currently valid bounded contract policy exception (K00/07), compared with exact rational arithmetic over the candidate's structured share, judged against the effective-policy fingerprint from one resolver call shared with the quotas handed to `check_vocab`, and sealed into the disposition as decision facts so the receipt replays after revocation. A failed run emits only a failed attempt, while an uncertain append retains the lock | `python3 Tools/check_batch_close.py . --batch B1 --integrator alice --reviewer bob --review-attestation "Reviewed the exact listed candidates and merged snapshot."` | | `seal_receipts.py` | Receipt cold-chain writer 1.4.0 (K12/07 Receipt Sealing). **`--apply` is a maintenance-window operation**: run it only in a declared quiet window, after confirming no other Cambium or adopter writer, checker or receipt appender is active against the repository. Moves verified frozen rows of closed batches -- each batch's close-bundle trio as one unit, whole per-batch registers, page-contract snapshots -- verbatim into `.cambium/receipts/cold/segments/`, appends one manifest entry per segment and one thin projection per receipt, rewrites the hot registers without the sealed rows, and adopts into the manifest only those born-cold close-evidence files a current attestation binds by hash. Refuses to run unless the complete runtime validation passes with zero errors, no writer lock is active, and no delta application is pending; every byte the plan was computed from is re-compared inside the locks. The shared receipt append mutex (`.cambium/tmp/receipt-append.free`/`.held`, a rename because mounts that refuse `unlink` cannot release a lock directory) is a guard against the accident of running a writer beside a seal, not a proof of mutual exclusion under arbitrary concurrency -- it is re-entrant per process and binds only appenders using the shared primitive. Publication is journalled -- a `begin` row and a hash-bound pending record before the first segment byte, a `complete` row only after every postcondition is re-proved -- so an interrupted seal fails every later run closed; `--reconcile --apply` automatically finishes the publication paths this tool implements and refuses a live writer's lock or a drifted pending record, while any other interruption is resolved by the runbook below. What sealing retires is deserialization, not integrity: `check_queue` re-hashes every segment, re-proves every projection against the sealed line it names, and re-proves both cold registers against this tool's receipt on every run. Never seals: transition history, Standards adoptions, amendments, its own register, activation/confirmation gates, batch-review wrappers, the Standards-revalidation aggregate a recorded Queue transition consumed (its replay reads `revalidation_bindings` and `invalidated_by`, which no projection carries), anything bound to a non-closed batch, or a receipt currently named by Coverage `property_state`. A live page review keeps its reviewer attestation hot; a live Delta pointer keeps its close trio and the full body-level replay closure hot until a later owner transition supersedes it | `python3 Tools/seal_receipts.py . --apply` | | `compile_queue.py` | Queue compiler 1.5.0 deterministically compiles Queue structure from explicit Required Coverage assignments plus top-level `batch_specs`; never infers semantic dependencies or backlinks. Every spec explicitly declares both Work Spec fields: null/null for a simple batch, or one exact `.cambium/work_specs/*.yaml` path/SHA pair for a complex batch. Initial `--apply` is integrator-only and writes the unique origin receipt into Progress. A same-scope replan consumes a complete `.cambium/deltas/replans/*.coverage.yaml` proposal—never pre-edited canonical Coverage—and a matching current registration written by `register_amendment.py`; it commits Coverage/Queue/Progress under one shared lock after exact three-file CAS, registration/Amendment/diff binding, and conflict checks. Registration binds either explicit-user authority or the Task Contract's exact delegated change classes, which are re-derived before write. Terminal history remains immutable; interrupted/incompletely rolled-back writes retain the lock | `python3 Tools/compile_queue.py . --coverage-proposal .cambium/deltas/replans/A1.coverage.yaml --output .cambium/tmp/queue-replan.yaml` | diff --git a/Tools/card_activation.py b/Tools/card_activation.py index 65ae353..3b8aac6 100644 --- a/Tools/card_activation.py +++ b/Tools/card_activation.py @@ -24,10 +24,28 @@ # Batch Review Requirement expansion at admission and carries its set hash, so # `open` can bind the exact judgment obligations the batch was activated with. # Sealed v1 receipts replay under their own era and never gain the field. -ACTIVATION_PROTOCOL = "card-first-readback-v2" +# v3 stops embedding Card and read-back bytes in the admission result. A +# host that externalizes an oversized tool result leaves the payload outside +# the model context while the receipt still claims delivery, and nothing in +# v1/v2 could detect that divergence. v3 therefore freezes a small piece +# manifest at admission, delivers one file per tool result inside a protocol +# byte budget, and leaves `machine-delivery-complete` to be earned by the +# Assignment delivery gate rather than asserted here. +ACTIVATION_PROTOCOL = "card-first-readback-v3" +V2_ACTIVATION_PROTOCOL = "card-first-readback-v2" LEGACY_ACTIVATION_PROTOCOL = "card-first-readback-v1" SUPPORTED_ACTIVATION_PROTOCOLS = frozenset(( - LEGACY_ACTIVATION_PROTOCOL, ACTIVATION_PROTOCOL)) + LEGACY_ACTIVATION_PROTOCOL, V2_ACTIVATION_PROTOCOL, ACTIVATION_PROTOCOL)) +EMBEDDED_PAYLOAD_PROTOCOLS = frozenset(( + LEGACY_ACTIVATION_PROTOCOL, V2_ACTIVATION_PROTOCOL)) +PIECE_PROTOCOL = "activation-piece-v1" +PIECE_ACK_PROTOCOL = "activation-piece-ack-v1" +# One delivered piece must fit one tool result. The measured object is the +# canonical serialization of the whole delivery, not the source file: the +# 2026-08-22 host measurement saw 50,495 bytes of Card source arrive as a +# 231,164-byte result, so envelope overhead exceeded the payload itself. +MAX_ACTIVATION_PIECE_ENVELOPE_BYTES = 49152 +PIECE_KINDS = frozenset(("card", "activation-readback")) BATCH_REVIEW_PLAN_PROTOCOL = "batch-review-plan-v1" READBACK_PROTOCOL = "card-readback-addendum-v1" EXECUTION_CONTEXT_ENV = "CAMBIUM_EXECUTION_CONTEXT_ID" @@ -190,19 +208,41 @@ def _runtime_bindings(runtime_state): return bindings -def _delivery_binding(execution_context_id=None): +def _delivery_binding(execution_context_id=None, *, protocol=None): + """Record what this result is, not what a later reader will receive. + + Under v1/v2 an admission that reached a bound host context claimed + `machine-delivered` outright. That claim was minted before the result + left the server, so it survived a host that never put the bytes in the + model context. v3 records only the preparation state: `host-bound` when + an execution context is bound, `prepared` otherwise. Completion is + earned per piece and recorded by the Assignment delivery gate. + """ context_id = execution_context_id if context_id is None: context_id = os.environ.get(EXECUTION_CONTEXT_ENV) - if isinstance(context_id, str) and context_id: + bound = isinstance(context_id, str) and bool(context_id) + if protocol in EMBEDDED_PAYLOAD_PROTOCOLS: + if bound: + return { + "delivery_mode": "host-context-injection", + "delivery_assurance": "machine-delivered", + "execution_context_id": context_id, + } + return { + "delivery_mode": "cli-tool-result", + "delivery_assurance": "degraded", + "execution_context_id": None, + } + if bound: return { "delivery_mode": "host-context-injection", - "delivery_assurance": "machine-delivered", + "delivery_assurance": "host-bound", "execution_context_id": context_id, } return { "delivery_mode": "cli-tool-result", - "delivery_assurance": "degraded", + "delivery_assurance": "prepared", "execution_context_id": None, } @@ -268,7 +308,7 @@ def _card_record(root, route_id, registered, declared_path): def _activation_bundle_manifest(bundle): - """Project a delivery payload into its small content-addressed manifest.""" + """Project a v1/v2 delivery payload into its content-addressed manifest.""" manifest = { key: value for key, value in bundle.items() if key not in ("cards", "startup_readbacks") @@ -284,6 +324,52 @@ def _activation_bundle_manifest(bundle): return manifest +def _piece_envelope_bytes(piece): + """Measure one delivery exactly as it will be serialized to the host.""" + return len(kblib.canonical_json_bytes(piece)) + + +def _piece_records(cards, startup): + """Freeze one addressable record per deliverable file. + + A piece is always a whole file. Splitting one file across results would + break the only verification the receiving end can perform: the frozen + SHA binds the complete file, a model cannot rehash fragments, and no + party could then prove a reassembly was faithful. + """ + pieces = [] + for card in cards: + pieces.append({ + "piece_id": "card:%s" % card["route_id"], + "kind": "card", + "path": card["path"], + "sha256": card["sha256"], + "bytes": len(card["content"].encode("utf-8")), + "route_id": card["route_id"], + "read_set": card["read_set"], + "read_set_sha256": card["read_set_sha256"], + "source_hash": card["source_hash"], + "compiled_source_hash": card["compiled_source_hash"], + "readback_policy": card["readback_policy"], + "readback_sources": list(card["readback_sources"]), + }) + for row in startup: + pieces.append({ + "piece_id": "readback:%s" % row["rule_id"], + "kind": "activation-readback", + "path": row["path"], + "sha256": row["sha256"], + "bytes": len(row["content"].encode("utf-8")), + "route_id": row["route_id"], + "rule_id": row["rule_id"], + }) + pieces.sort(key=lambda row: row["piece_id"]) + identifiers = [row["piece_id"] for row in pieces] + if len(identifiers) != len(set(identifiers)): + raise ActivationError("activation piece identifiers are not unique") + return pieces + + def expand_batch_review_requirements(profile_contract, item): """Expand the Profile's requirements against one frozen batch manifest. @@ -479,7 +565,8 @@ def build_activation_context(root, progress, item, *, runtime_state, kblib.canonical_json_bytes(readback_plan)) review_records = expand_batch_review_requirements(profile_contract, item) review_set_sha = review_requirement_set_sha256(review_records) - bundle = { + pieces = _piece_records(cards, startup) + manifest = { "activation_protocol": ACTIVATION_PROTOCOL, "task_id": progress.get("task_id"), "batch_id": batch_id, @@ -492,8 +579,9 @@ def build_activation_context(root, progress, item, *, runtime_state, "reading_plan_sha256": reading_plan_sha, "readback_plan_sha256": readback_plan_sha, "reading_plan": reading_plan, - "cards": cards, - "startup_readbacks": startup, + "pieces": pieces, + "piece_count": len(pieces), + "max_piece_envelope_bytes": MAX_ACTIVATION_PIECE_ENVELOPE_BYTES, "readback_plan": readback_plan, "batch_review_plan": { "protocol": BATCH_REVIEW_PLAN_PROTOCOL, @@ -501,7 +589,26 @@ def build_activation_context(root, progress, item, *, runtime_state, "requirements": review_records, }, } - manifest = _activation_bundle_manifest(bundle) + # Fail closed at admission rather than at delivery: a manifest that + # cannot be delivered inside the budget is a governance problem for the + # oversized leaf, not a transport accident to discover mid-batch. + oversized = [] + # The stand-ins are length-exact: the real delivery carries a 71-character + # bundle hash, a 32-character nonce and a 32-character attempt id, so + # measuring with None here would under-report the envelope and let a piece + # on the boundary pass admission and fail delivery. + sha_placeholder = "sha256:" + ("0" * 64) + for record, text in zip(pieces, _piece_texts(cards, startup, pieces)): + envelope = _piece_envelope_bytes( + _piece_delivery_payload(manifest, record, text, nonce="0" * 32, + delivery_attempt_id="0" * 32, + card_bundle_sha256=sha_placeholder)) + if envelope > MAX_ACTIVATION_PIECE_ENVELOPE_BYTES: + oversized.append("%s (%d bytes)" % (record["piece_id"], envelope)) + if oversized: + raise ActivationError( + "activation piece(s) exceed the %d-byte delivery budget: %s" % + (MAX_ACTIVATION_PIECE_ENVELOPE_BYTES, ", ".join(oversized))) bundle_sha = kblib.sha256_bytes(kblib.canonical_json_bytes(manifest)) return { "activation_protocol": ACTIVATION_PROTOCOL, @@ -511,8 +618,45 @@ def build_activation_context(root, progress, item, *, runtime_state, "review_requirement_set_sha256": review_set_sha, "card_bundle_sha256": bundle_sha, "activation_bundle_manifest": manifest, - "activation_delivery_payload": bundle, - **_delivery_binding(execution_context_id), + **_delivery_binding(execution_context_id, + protocol=ACTIVATION_PROTOCOL), + } + + +def _piece_texts(cards, startup, pieces): + """Return each piece's exact text in the frozen piece order.""" + by_id = {} + for card in cards: + by_id["card:%s" % card["route_id"]] = card["content"] + for row in startup: + by_id["readback:%s" % row["rule_id"]] = row["content"] + return [by_id[record["piece_id"]] for record in pieces] + + +def _piece_delivery_payload(manifest, record, text, *, nonce, + delivery_attempt_id, card_bundle_sha256=None): + """Assemble one piece delivery exactly as the host will receive it. + + The nonce sits after the content. That placement is defence in depth + against the specific failure this protocol exists to catch -- a host that + shows only a leading preview -- and nothing more: an ack proves the + delivery reached this context, never that the whole body was read. The + complete guarantee needs the server SHA, a conformant Host Adapter, and + this ack together. + """ + return { + "piece_protocol": PIECE_PROTOCOL, + "card_bundle_sha256": card_bundle_sha256, + "batch_id": manifest.get("batch_id"), + "task_id": manifest.get("task_id"), + "piece_id": record["piece_id"], + "kind": record["kind"], + "path": record["path"], + "sha256": record["sha256"], + "bytes": record["bytes"], + "delivery_attempt_id": delivery_attempt_id, + "content": text, + "delivery_nonce": nonce, } @@ -592,28 +736,44 @@ def activation_context_errors(context): elif manifest.get("readback_plan_sha256") != kblib.sha256_bytes( kblib.canonical_json_bytes(plan)): errors.append("readback_plan_sha256 does not bind readback_plan") - cards = manifest.get("cards") - if not isinstance(cards, list) or not cards: - errors.append("activation bundle must carry at least one Card") + if protocol == ACTIVATION_PROTOCOL: + errors.extend(_piece_manifest_errors(manifest)) + for field in ("cards", "startup_readbacks"): + if field in manifest: + errors.append( + "a %s bundle must not embed %s; content travels as " + "budgeted pieces" % (ACTIVATION_PROTOCOL, field)) + if "activation_delivery_payload" in context: + errors.append( + "a %s admission must not carry an embedded delivery payload" % + ACTIVATION_PROTOCOL) else: - routes = [] - for index, card in enumerate(cards): - if not isinstance(card, dict): - errors.append("activation Card %d must be a mapping" % index) - continue - routes.append(card.get("route_id")) - if "content" in card or not isinstance(card.get("sha256"), str): - errors.append("activation Card %d manifest is malformed" % - index) - if card.get("source_hash") != card.get("compiled_source_hash"): - errors.append("activation Card %d semantic hashes disagree" % - index) - if "R01" not in routes: - errors.append("activation bundle omits R01") - for index, row in enumerate(manifest.get("startup_readbacks") or []): - if (not isinstance(row, dict) or "content" in row or - not isinstance(row.get("sha256"), str)): - errors.append("startup readback %d manifest is malformed" % index) + cards = manifest.get("cards") + if not isinstance(cards, list) or not cards: + errors.append("activation bundle must carry at least one Card") + else: + routes = [] + for index, card in enumerate(cards): + if not isinstance(card, dict): + errors.append("activation Card %d must be a mapping" % + index) + continue + routes.append(card.get("route_id")) + if "content" in card or not isinstance(card.get("sha256"), + str): + errors.append( + "activation Card %d manifest is malformed" % index) + if card.get("source_hash") != card.get( + "compiled_source_hash"): + errors.append( + "activation Card %d semantic hashes disagree" % index) + if "R01" not in routes: + errors.append("activation bundle omits R01") + for index, row in enumerate(manifest.get("startup_readbacks") or []): + if (not isinstance(row, dict) or "content" in row or + not isinstance(row.get("sha256"), str)): + errors.append( + "startup readback %d manifest is malformed" % index) payload = context.get("activation_delivery_payload") if payload is not None: @@ -637,7 +797,22 @@ def activation_context_errors(context): assurance = context.get("delivery_assurance") mode = context.get("delivery_mode") context_id = context.get("execution_context_id") - if assurance == "machine-delivered": + if protocol == ACTIVATION_PROTOCOL: + if assurance == "host-bound": + if mode != "host-context-injection" or not isinstance( + context_id, str) or not context_id: + errors.append( + "host-bound admission requires one execution context") + elif assurance == "prepared": + if mode != "cli-tool-result" or context_id is not None: + errors.append( + "prepared admission must be an unbound CLI result") + else: + errors.append( + "a %s admission records host-bound or prepared; delivery " + "completion is earned by the Assignment delivery gate" % + ACTIVATION_PROTOCOL) + elif assurance == "machine-delivered": if mode != "host-context-injection" or not isinstance( context_id, str) or not context_id: errors.append("machine delivery requires one execution context") @@ -649,6 +824,53 @@ def activation_context_errors(context): return errors +def _piece_manifest_errors(manifest): + """Validate the frozen piece set of a v3 bundle.""" + errors = [] + pieces = manifest.get("pieces") + if not isinstance(pieces, list) or not pieces: + return ["activation bundle must freeze at least one piece"] + budget = manifest.get("max_piece_envelope_bytes") + if budget != MAX_ACTIVATION_PIECE_ENVELOPE_BYTES: + errors.append("activation bundle binds a foreign delivery budget") + if manifest.get("piece_count") != len(pieces): + errors.append("piece_count does not match the frozen piece list") + seen = set() + routes = [] + for index, row in enumerate(pieces): + if not isinstance(row, dict): + errors.append("activation piece %d must be a mapping" % index) + continue + piece_id = row.get("piece_id") + if not isinstance(piece_id, str) or not piece_id: + errors.append("activation piece %d has no identity" % index) + continue + if piece_id in seen: + errors.append("activation piece %s is duplicated" % piece_id) + seen.add(piece_id) + if row.get("kind") not in PIECE_KINDS: + errors.append("activation piece %s has an unregistered kind" % + piece_id) + if "content" in row: + errors.append("activation piece %s must not embed content" % + piece_id) + if not isinstance(row.get("sha256"), str) or not isinstance( + row.get("bytes"), int): + errors.append("activation piece %s manifest is malformed" % + piece_id) + if row.get("kind") == "card": + routes.append(row.get("route_id")) + if row.get("source_hash") != row.get("compiled_source_hash"): + errors.append("activation piece %s semantic hashes disagree" % + piece_id) + if sorted(seen) != [row.get("piece_id") for row in pieces + if isinstance(row, dict)]: + errors.append("activation pieces are not in canonical order") + if "R01" not in routes: + errors.append("activation bundle omits R01") + return errors + + def activation_receipt_binding(context): """Return the closed manifest fields persisted in receipt JSONL.""" return {field: context.get(field) @@ -749,3 +971,133 @@ def build_readback_addendum(root, activation_context, rule_id, *, def readback_receipt_binding(context): """Return the content-addressed Addendum manifest stored in JSONL.""" return {field: context.get(field) for field in READBACK_CONTEXT_FIELDS} + + +def build_activation_piece(root, activation_context, piece_id, *, + execution_context_id=None, + delivery_attempt_id=None, nonce=None): + """Deliver one frozen piece as its own budgeted tool result.""" + errors = activation_context_errors(activation_context) + if errors: + raise ActivationError("activation context is invalid: %s" % + "; ".join(errors)) + if activation_context.get("activation_protocol") != ACTIVATION_PROTOCOL: + raise ActivationError( + "piece delivery requires a %s activation" % ACTIVATION_PROTOCOL) + manifest = activation_context["activation_bundle_manifest"] + records = [row for row in manifest.get("pieces") or [] + if isinstance(row, dict) and row.get("piece_id") == piece_id] + if len(records) != 1: + raise ActivationError("activation piece %s is not uniquely frozen" % + piece_id) + record = records[0] + # Re-prove the object against current bytes. v1/v2 performed this + # equality once, at `queued -> open`; delivering file by file moves the + # same check onto every piece, so a source that drifts mid-delivery is + # refused instead of silently shipped. + snapshot, text = _snapshot_text(root, record["path"]) + if snapshot.sha256 != record["sha256"]: + raise ActivationError( + "activation piece %s drifted since admission (%s)" % + (piece_id, record["path"])) + attempt = delivery_attempt_id or kblib.sha256_bytes( + kblib.canonical_json_bytes([ + activation_context["card_bundle_sha256"], + execution_context_id or os.environ.get(EXECUTION_CONTEXT_ENV), + ]))[7:39] + payload = _piece_delivery_payload( + manifest, record, text, nonce=nonce or _mint_nonce(), + delivery_attempt_id=attempt, + card_bundle_sha256=activation_context["card_bundle_sha256"]) + envelope = _piece_envelope_bytes(payload) + if envelope > MAX_ACTIVATION_PIECE_ENVELOPE_BYTES: + raise ActivationError( + "activation piece %s serializes to %d bytes, over the %d-byte " + "delivery budget" % + (piece_id, envelope, MAX_ACTIVATION_PIECE_ENVELOPE_BYTES)) + return { + "piece_protocol": PIECE_PROTOCOL, + "card_bundle_sha256": activation_context["card_bundle_sha256"], + "piece_id": piece_id, + "piece_sha256": record["sha256"], + "piece_envelope_bytes": envelope, + "delivery_attempt_id": attempt, + "delivery_nonce": payload["delivery_nonce"], + "activation_piece_payload": payload, + **_delivery_binding(execution_context_id, + protocol=ACTIVATION_PROTOCOL), + } + + +def _mint_nonce(): + return os.urandom(16).hex() + + +PIECE_RECEIPT_FIELDS = ( + "piece_protocol", "card_bundle_sha256", "piece_id", "piece_sha256", + "piece_envelope_bytes", "delivery_attempt_id", "delivery_nonce", + "delivery_mode", "delivery_assurance", "execution_context_id", +) +PIECE_ACK_RECEIPT_FIELDS = ( + "piece_ack_protocol", "card_bundle_sha256", "piece_id", "piece_sha256", + "delivery_attempt_id", "acked_nonce", "delivery_receipt_id", + "delivery_mode", "delivery_assurance", "execution_context_id", +) + + +def piece_receipt_binding(context): + """Return the closed piece-delivery fields persisted in receipt JSONL.""" + return {field: context.get(field) for field in PIECE_RECEIPT_FIELDS} + + +def build_piece_ack(delivery_receipt, nonce, *, execution_context_id=None): + """Turn one returned nonce into same-context delivery evidence. + + This is the third of three parts, never the whole proof. It shows the + delivery was consumed by this execution context; it cannot show that the + body ahead of the nonce entered the model context. Only a Host Adapter + that has passed inline-delivery conformance supplies that half. + """ + if not isinstance(delivery_receipt, dict): + raise ActivationError("piece ack requires one delivery receipt") + if delivery_receipt.get("piece_protocol") != PIECE_PROTOCOL: + raise ActivationError("piece ack requires a %s delivery" % + PIECE_PROTOCOL) + expected = delivery_receipt.get("delivery_nonce") + if not isinstance(expected, str) or not expected or nonce != expected: + raise ActivationError( + "piece ack nonce does not match delivery %s" % + delivery_receipt.get("piece_id")) + bound = delivery_receipt.get("execution_context_id") + current = execution_context_id + if current is None: + current = os.environ.get(EXECUTION_CONTEXT_ENV) + if bound != current: + raise ActivationError( + "piece ack must return to the delivering execution context") + return { + "piece_ack_protocol": PIECE_ACK_PROTOCOL, + "card_bundle_sha256": delivery_receipt.get("card_bundle_sha256"), + "piece_id": delivery_receipt.get("piece_id"), + "piece_sha256": delivery_receipt.get("piece_sha256"), + "delivery_attempt_id": delivery_receipt.get("delivery_attempt_id"), + "acked_nonce": nonce, + "delivery_receipt_id": delivery_receipt.get("receipt_id"), + **_delivery_binding(execution_context_id, + protocol=ACTIVATION_PROTOCOL), + } + + +def piece_ack_receipt_binding(context): + """Return the closed ack fields persisted in receipt JSONL.""" + return {field: context.get(field) for field in PIECE_ACK_RECEIPT_FIELDS} + + +def frozen_piece_ids(activation_context): + """Return the exact piece identity set one activation must deliver.""" + manifest = (activation_context or {}).get("activation_bundle_manifest") + if not isinstance(manifest, dict): + return [] + return sorted( + row.get("piece_id") for row in manifest.get("pieces") or [] + if isinstance(row, dict) and isinstance(row.get("piece_id"), str)) diff --git a/Tools/check_queue.py b/Tools/check_queue.py index 2f24623..4d2592f 100644 --- a/Tools/check_queue.py +++ b/Tools/check_queue.py @@ -46,12 +46,12 @@ import standards_state TOOL = "check_queue" -TOOL_VERSION = "1.24.0" +TOOL_VERSION = "1.25.0" # 1.20.1 remains a producer-era identity for already-consumed maintenance -# gates. Current gate production and all live gate admission use 1.24.0; +# gates. Current gate production and all live gate admission use 1.25.0; # historical consumption replays the older receipt's own promised shape. SUPPORTED_CHECK_QUEUE_TOOL_VERSIONS = frozenset(( - "1.20.1", "1.21.0", "1.22.0", "1.23.0", "1.24.0", + "1.20.1", "1.21.0", "1.22.0", "1.23.0", "1.24.0", "1.25.0", )) # The `Check` cell K00/12 registers for every Gate this tool produces; each # such Gate is distinguished by `Mode`, not by a second check name. @@ -15208,6 +15208,8 @@ def make_check_receipt(result, outcome, details, mode, hub_page_candidates=None, activation_context=None, readback_context=None, + piece_context=None, + piece_ack_context=None, resume_activation_contexts=None): """Build the canonical receipt for one already-evaluated Queue result. @@ -15247,6 +15249,12 @@ def make_check_receipt(result, outcome, details, mode, if activation_context: receipt.update(card_activation.activation_receipt_binding( activation_context)) + if mode.startswith("deliver-activation-piece:") and piece_context: + receipt.update(card_activation.piece_receipt_binding( + piece_context)) + if mode.startswith("ack-activation-piece:") and piece_ack_context: + receipt.update(card_activation.piece_ack_receipt_binding( + piece_ack_context)) if mode.startswith("deliver-readback:") and readback_context: receipt.update(card_activation.readback_receipt_binding( readback_context)) @@ -15350,22 +15358,30 @@ def _emit_json_receipts(receipts): def _delivery_result(receipt, activation_context=None, readback_context=None, - resume_activation_contexts=None): + piece_context=None, resume_activation_contexts=None): """Attach transient bytes to the tool result, never the receipt register.""" emitted = dict(receipt) - if activation_context: - emitted["activation_delivery_payload"] = activation_context.get( - "activation_delivery_payload") + if activation_context and "activation_delivery_payload" in \ + activation_context: + emitted["activation_delivery_payload"] = activation_context[ + "activation_delivery_payload"] if readback_context: emitted["readback_delivery_payload"] = readback_context.get( "readback_delivery_payload") + if piece_context: + emitted["activation_piece_payload"] = piece_context.get( + "activation_piece_payload") if resume_activation_contexts: persisted = emitted.get("active_card_context_deliveries") or [] emitted["active_card_context_deliveries"] = [ { **dict(binding), - "activation_delivery_payload": delivery.get( - "activation_delivery_payload"), + # A v3 resume re-freezes the manifest for the new context and + # names the pieces it must pull; the bytes travel one budgeted + # piece at a time, never inside this status result. + **({"activation_delivery_payload": delivery[ + "activation_delivery_payload"]} + if "activation_delivery_payload" in delivery else {}), } for binding, delivery in zip( persisted, resume_activation_contexts) @@ -15378,7 +15394,8 @@ def _write_receipt(root, relative_path, result, outcome, details, mode, maintenance_context=None, standards_revalidation_context=None, hub_page_candidates=None, activation_context=None, - readback_context=None, resume_activation_contexts=None, + readback_context=None, piece_context=None, + piece_ack_context=None, resume_activation_contexts=None, build_unwritten=False): """Append the small receipt and return its delivery-enriched tool result. @@ -15400,10 +15417,12 @@ def _write_receipt(root, relative_path, result, outcome, details, mode, hub_page_candidates=hub_page_candidates, activation_context=activation_context, readback_context=readback_context, + piece_context=piece_context, + piece_ack_context=piece_ack_context, resume_activation_contexts=resume_activation_contexts, ) return _delivery_result( - receipt, activation_context, readback_context, + receipt, activation_context, readback_context, piece_context, resume_activation_contexts) path = kblib.managed_repository_path( root, relative_path, ".cambium/receipts", @@ -15418,11 +15437,13 @@ def _write_receipt(root, relative_path, result, outcome, details, mode, hub_page_candidates=hub_page_candidates, activation_context=activation_context, readback_context=readback_context, + piece_context=piece_context, + piece_ack_context=piece_ack_context, resume_activation_contexts=resume_activation_contexts, ) kblib.write_receipts(path, [receipt]) return _delivery_result( - receipt, activation_context, readback_context, + receipt, activation_context, readback_context, piece_context, resume_activation_contexts) @@ -16242,9 +16263,29 @@ def main(argv=None): "--deliver-readback", metavar="BATCH_ID", help="deliver one registered conditional Card read-back source for an " "already-open batch") + group.add_argument( + "--deliver-activation-piece", metavar="BATCH_ID", + help="deliver one frozen activation piece of BATCH_ID inside the " + "protocol delivery budget") + group.add_argument( + "--ack-activation-piece", metavar="BATCH_ID", + help="return one delivered piece nonce as same-context delivery " + "evidence") parser.add_argument( "--readback-rule", metavar="RULE_ID", help="registered rule selected with --deliver-readback") + parser.add_argument( + "--piece", metavar="PIECE_ID", + help="frozen activation piece selected with " + "--deliver-activation-piece or --ack-activation-piece") + parser.add_argument( + "--piece-nonce", metavar="NONCE", + help="nonce returned from the delivered piece, supplied to " + "--ack-activation-piece") + parser.add_argument( + "--piece-delivery-receipt", metavar="RECEIPT_ID", + help="delivery receipt the acknowledged nonce came from, supplied to " + "--ack-activation-piece") parser.add_argument("--confirmation-receipt", help="confirmation evidence supplied to --require-ready") parser.add_argument( @@ -16292,6 +16333,8 @@ def _run(args, produced): revalidation_context = None activation_context = None readback_context = None + piece_context = None + piece_ack_context = None resume_activation_contexts = [] if args.confirmation_receipt and not args.require_ready: @@ -16303,6 +16346,23 @@ def _run(args, produced): errors.append("--readback-rule is only valid with --deliver-readback") if args.deliver_readback and not args.readback_rule: errors.append("--deliver-readback requires --readback-rule") + if args.piece and not (args.deliver_activation_piece or + args.ack_activation_piece): + errors.append("--piece is only valid with --deliver-activation-piece " + "or --ack-activation-piece") + if args.deliver_activation_piece and not args.piece: + errors.append("--deliver-activation-piece requires --piece") + if args.ack_activation_piece and not ( + args.piece and args.piece_nonce and args.piece_delivery_receipt): + errors.append( + "--ack-activation-piece requires --piece, --piece-nonce and " + "--piece-delivery-receipt") + for flag, value in (("--piece-nonce", args.piece_nonce), + ("--piece-delivery-receipt", + args.piece_delivery_receipt)): + if value and not args.ack_activation_piece: + errors.append("%s is only valid with --ack-activation-piece" % + flag) maintenance_evidence = ( args.budget_manifest_receipt, args.ledger_advance_receipt, args.watermark_advance_receipt, @@ -16434,6 +16494,63 @@ def _run(args, produced): ) except (OSError, UnicodeError, ValueError) as exc: errors.append("cannot deliver Card read-back: %s" % exc) + elif not errors and (args.deliver_activation_piece or + args.ack_activation_piece): + batch_id = args.deliver_activation_piece or args.ack_activation_piece + item = result.get("items_by_id", {}).get(batch_id) + activation_receipt = None + if item is None: + errors.append("requested batch %s does not exist" % batch_id) + elif item.get("state") not in ("open", "merge-ready"): + errors.append( + "activation piece delivery requires an open or merge-ready " + "batch; %s is %s" % (batch_id, item.get("state"))) + else: + catalog = result.get( + "current_receipt_catalog", result.get("receipt_catalog", {})) + entry = catalog.get(item.get("activation_receipt")) + activation_receipt = entry[1] if entry is not None else None + if (not isinstance(activation_receipt, dict) or + activation_receipt.get("tool") != TOOL or + activation_receipt.get("tool_version") != TOOL_VERSION): + errors.append( + "batch %s has no current Card-first activation receipt; " + "reopen it before piece delivery" % batch_id) + activation_receipt = None + if activation_receipt is not None and args.deliver_activation_piece: + try: + piece_context = card_activation.build_activation_piece( + result["root"], + card_activation.context_from_receipt(activation_receipt), + args.piece) + except (OSError, UnicodeError, ValueError) as exc: + errors.append("cannot deliver activation piece: %s" % exc) + elif activation_receipt is not None: + catalog = result.get( + "current_receipt_catalog", result.get("receipt_catalog", {})) + delivery_entry = catalog.get(args.piece_delivery_receipt) + delivery = delivery_entry[1] if delivery_entry is not None else None + if not isinstance(delivery, dict): + errors.append( + "piece delivery receipt %s is absent from the current " + "catalog" % args.piece_delivery_receipt) + elif delivery.get("piece_id") != args.piece: + errors.append( + "piece delivery receipt %s does not deliver %s" % + (args.piece_delivery_receipt, args.piece)) + elif delivery.get("card_bundle_sha256") != activation_receipt.get( + "card_bundle_sha256"): + errors.append( + "piece delivery receipt %s belongs to another activation " + "bundle" % args.piece_delivery_receipt) + else: + try: + piece_ack_context = card_activation.build_piece_ack( + dict(delivery, receipt_id=args.piece_delivery_receipt), + args.piece_nonce) + except (OSError, UnicodeError, ValueError) as exc: + errors.append("cannot acknowledge activation piece: %s" % + exc) elif not errors and args.require_maintenance_complete: maintenance_errors, maintenance_context = \ _maintenance_completion_gate_errors( @@ -16587,10 +16704,17 @@ def _run(args, produced): ("deliver-readback:%s:%s" % ( args.deliver_readback, args.readback_rule) if args.deliver_readback else + ("deliver-activation-piece:%s:%s" % ( + args.deliver_activation_piece, args.piece) + if args.deliver_activation_piece else + ("ack-activation-piece:%s:%s" % ( + args.ack_activation_piece, args.piece) + if args.ack_activation_piece else ("require-complete" if args.require_complete else ("require-maintenance-complete" if args.require_maintenance_complete else - ("resume-status" if args.resume_status else "consistency")))))) + ("resume-status" if args.resume_status else + "consistency")))))))) try: receipt = _write_receipt( args.root, args.receipts, result, outcome, details, mode, @@ -16601,6 +16725,8 @@ def _run(args, produced): standards_revalidation_context=revalidation_context, activation_context=activation_context, readback_context=readback_context, + piece_context=piece_context, + piece_ack_context=piece_ack_context, resume_activation_contexts=resume_activation_contexts, build_unwritten=produced is not None, ) diff --git a/Tools/compiled/cli-contract.yaml b/Tools/compiled/cli-contract.yaml index 7f4ed32..85e92e9 100644 --- a/Tools/compiled/cli-contract.yaml +++ b/Tools/compiled/cli-contract.yaml @@ -66,7 +66,7 @@ source_files: - Tools/stamp_cards.py - Tools/update_queue.py - Tools/update_task.py -source_hash: sha256:817a50981c3a7a36947af4811ab753c2791e691e5c3f474c9f62185fca5ba4de +source_hash: sha256:4f4385918e933e211b3676c0f85df847388ee7318fb76f208eae061ec40a476f receipt_shape: base_fields: - receipt_id @@ -1752,7 +1752,7 @@ tools: receipt_extensions_extraction: partial - tool: check_queue module: Tools/check_queue.py - source_hash: sha256:1ecaec9019b013358f2afda142585d3ca48360eebf90633da7b6d149ebc5c523 + source_hash: sha256:4ec7f2dc3727c35688ec89105a396d4421ae52568b14e8b7db7c373b870f7904 description: Validate canonical Required Queue state arguments: - dest: root @@ -1831,6 +1831,28 @@ tools: action: store type: null help: deliver one registered conditional Card read-back source for an already-open batch + - dest: deliver_activation_piece + option_strings: + - --deliver-activation-piece + required: false + default: null + default_type: NoneType + choices: null + nargs: null + action: store + type: null + help: deliver one frozen activation piece of BATCH_ID inside the protocol delivery budget + - dest: ack_activation_piece + option_strings: + - --ack-activation-piece + required: false + default: null + default_type: NoneType + choices: null + nargs: null + action: store + type: null + help: return one delivered piece nonce as same-context delivery evidence - dest: readback_rule option_strings: - --readback-rule @@ -1842,6 +1864,39 @@ tools: action: store type: null help: registered rule selected with --deliver-readback + - dest: piece + option_strings: + - --piece + required: false + default: null + default_type: NoneType + choices: null + nargs: null + action: store + type: null + help: frozen activation piece selected with --deliver-activation-piece or --ack-activation-piece + - dest: piece_nonce + option_strings: + - --piece-nonce + required: false + default: null + default_type: NoneType + choices: null + nargs: null + action: store + type: null + help: nonce returned from the delivered piece, supplied to --ack-activation-piece + - dest: piece_delivery_receipt + option_strings: + - --piece-delivery-receipt + required: false + default: null + default_type: NoneType + choices: null + nargs: null + action: store + type: null + help: delivery receipt the acknowledged nonce came from, supplied to --ack-activation-piece - dest: confirmation_receipt option_strings: - --confirmation-receipt @@ -1928,6 +1983,8 @@ tools: - require_maintenance_complete - resume_status - deliver_readback + - deliver_activation_piece + - ack_activation_piece receipt_extensions: - activation_context - active_card_context_deliveries @@ -1950,6 +2007,8 @@ tools: - pending_amendments - pending_delta_applies - pending_guidance + - piece_ack_context + - piece_context - progress_ledger_sha256 - queue_check_mode - queue_revision @@ -4216,7 +4275,7 @@ tools: receipt_extensions_extraction: complete - tool: update_queue module: Tools/update_queue.py - source_hash: sha256:3680ae8592ea307542de1b86bb808cc99e1153b1b244c8aeed8680bf0f7a77ae + source_hash: sha256:f691748b42ac0252cc7ecf948af01f593845242e2dc28f2ad462977f426a564f description: Apply one Required Queue transition arguments: - dest: root diff --git a/Tools/compiled/host-configs/claude-code.mcp.json b/Tools/compiled/host-configs/claude-code.mcp.json index 587cb69..40cb372 100644 --- a/Tools/compiled/host-configs/claude-code.mcp.json +++ b/Tools/compiled/host-configs/claude-code.mcp.json @@ -1 +1 @@ -{"mcpServers":{"cambium":{"args":["/Tools/mcp_server.py"],"command":"python3","cwd":"","env":{"CAMBIUM_INTERFACE_SOURCE_HASH":"sha256:4b49c621cfe358c02a341735bdfb2f2773d0803ebdb9a54ecf944066af696725","CAMBIUM_WORKSPACE_ROOT":""}}}} +{"mcpServers":{"cambium":{"args":["/Tools/mcp_server.py"],"command":"python3","cwd":"","env":{"CAMBIUM_INTERFACE_SOURCE_HASH":"sha256:2683bec5afe71533a7a8df5253ecd5e0fbc9160297e5ae2a88c717882191a82f","CAMBIUM_WORKSPACE_ROOT":""}}}} diff --git a/Tools/compiled/host-configs/codex.config.toml b/Tools/compiled/host-configs/codex.config.toml index 985d366..7715ed7 100644 --- a/Tools/compiled/host-configs/codex.config.toml +++ b/Tools/compiled/host-configs/codex.config.toml @@ -5,7 +5,7 @@ # server name: cambium # server entry point: Tools/mcp_server.py (under the distribution root) # source: Tools/compiled/mcp-tools.json -# source_hash: sha256:4b49c621cfe358c02a341735bdfb2f2773d0803ebdb9a54ecf944066af696725 +# source_hash: sha256:2683bec5afe71533a7a8df5253ecd5e0fbc9160297e5ae2a88c717882191a82f # regenerate: python3 Tools/render_host_configs.py . # verify: python3 Tools/render_host_configs.py . --check # @@ -35,5 +35,5 @@ command = "python3" cwd = "" [mcp_servers.cambium.env] -CAMBIUM_INTERFACE_SOURCE_HASH = "sha256:4b49c621cfe358c02a341735bdfb2f2773d0803ebdb9a54ecf944066af696725" +CAMBIUM_INTERFACE_SOURCE_HASH = "sha256:2683bec5afe71533a7a8df5253ecd5e0fbc9160297e5ae2a88c717882191a82f" CAMBIUM_WORKSPACE_ROOT = "" diff --git a/Tools/compiled/host-configs/dsh-profile-patch.yaml b/Tools/compiled/host-configs/dsh-profile-patch.yaml index 75fbe88..974d827 100644 --- a/Tools/compiled/host-configs/dsh-profile-patch.yaml +++ b/Tools/compiled/host-configs/dsh-profile-patch.yaml @@ -5,7 +5,7 @@ # server name: cambium # server entry point: Tools/mcp_server.py (under the distribution root) # source: Tools/compiled/mcp-tools.json -# source_hash: sha256:4b49c621cfe358c02a341735bdfb2f2773d0803ebdb9a54ecf944066af696725 +# source_hash: sha256:2683bec5afe71533a7a8df5253ecd5e0fbc9160297e5ae2a88c717882191a82f # regenerate: python3 Tools/render_host_configs.py . # verify: python3 Tools/render_host_configs.py . --check # diff --git a/Tools/compiled/host-configs/dsh.env b/Tools/compiled/host-configs/dsh.env index ab153b1..3cff541 100644 --- a/Tools/compiled/host-configs/dsh.env +++ b/Tools/compiled/host-configs/dsh.env @@ -4,7 +4,7 @@ # carries: binding # server name: cambium # source: Tools/compiled/mcp-tools.json -# source_hash: sha256:4b49c621cfe358c02a341735bdfb2f2773d0803ebdb9a54ecf944066af696725 +# source_hash: sha256:2683bec5afe71533a7a8df5253ecd5e0fbc9160297e5ae2a88c717882191a82f # regenerate: python3 Tools/render_host_configs.py . # verify: python3 Tools/render_host_configs.py . --check # @@ -21,5 +21,5 @@ # valid absolute path on any of these hosts, so an un-substituted copy # fails at launch instead of resolving to something. -CAMBIUM_INTERFACE_SOURCE_HASH="sha256:4b49c621cfe358c02a341735bdfb2f2773d0803ebdb9a54ecf944066af696725" +CAMBIUM_INTERFACE_SOURCE_HASH="sha256:2683bec5afe71533a7a8df5253ecd5e0fbc9160297e5ae2a88c717882191a82f" CAMBIUM_WORKSPACE_ROOT="" diff --git a/Tools/compiled/host-configs/kimi-code.mcp.json b/Tools/compiled/host-configs/kimi-code.mcp.json index 587cb69..40cb372 100644 --- a/Tools/compiled/host-configs/kimi-code.mcp.json +++ b/Tools/compiled/host-configs/kimi-code.mcp.json @@ -1 +1 @@ -{"mcpServers":{"cambium":{"args":["/Tools/mcp_server.py"],"command":"python3","cwd":"","env":{"CAMBIUM_INTERFACE_SOURCE_HASH":"sha256:4b49c621cfe358c02a341735bdfb2f2773d0803ebdb9a54ecf944066af696725","CAMBIUM_WORKSPACE_ROOT":""}}}} +{"mcpServers":{"cambium":{"args":["/Tools/mcp_server.py"],"command":"python3","cwd":"","env":{"CAMBIUM_INTERFACE_SOURCE_HASH":"sha256:2683bec5afe71533a7a8df5253ecd5e0fbc9160297e5ae2a88c717882191a82f","CAMBIUM_WORKSPACE_ROOT":""}}}} diff --git a/Tools/compiled/mcp-tools.json b/Tools/compiled/mcp-tools.json index fb898b4..081f26f 100644 --- a/Tools/compiled/mcp-tools.json +++ b/Tools/compiled/mcp-tools.json @@ -1 +1 @@ -{"artifact":"agent-interface-projection","form":"mcp","generated":{"not_a_revision_basis":"This file is downstream of each tool's own argparse declaration and is never the basis for revising one. To change what an agent may call, change the tool's argparse block, recompile Tools/compiled/cli-contract.yaml, then regenerate this file.","notice":"Generated artifact -- do not edit. Every value here is projected from Tools/compiled/cli-contract.yaml by Tools/render_interface_projection.py; a hand edit is reported by --check as a HOLD.","regenerate":"python3 Tools/render_interface_projection.py .","verify":"python3 Tools/render_interface_projection.py . --check"},"generator":"Tools/render_interface_projection.py","generator_version":"1.0.0","schema_version":1,"source":"Tools/compiled/cli-contract.yaml","source_artifact":"cli-invocation-contract","source_hash":"sha256:8508cfd49f529a59b9710ba3ed9f23eece3e336e68543931da9b6c8d138c7729","source_manifest_hash":"sha256:817a50981c3a7a36947af4811ab753c2791e691e5c3f474c9f62185fca5ba4de","source_schema_version":1,"tool_count":46,"tools":[{"description":"Adopt one approved Standards/Profile revision","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may apply a Standards adoption","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"write the transaction; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human-readable report to stderr; receipt writing, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"plan":{"description":".cambium/deltas/standards-adoptions/*.yaml","type":"string","x-cambium-cli":{"action":"store","option_strings":["--plan"]}},"receipts":{"default":".cambium/receipts/standards-adoptions.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","plan"],"type":"object"},"name":"adopt_standards"},{"description":"Apply one approved cross-Ledger Amendment transaction","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may apply an Amendment transaction","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"write the transaction; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"expected_coverage_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Coverage; planning is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-coverage-sha256"]}},"expected_progress_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Progress; planning is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-progress-sha256"]}},"expected_queue_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Queue; planning is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-queue-sha256"]}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human-readable report to stderr; receipt writing, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"plan":{"description":".cambium/deltas/amendments/*.yaml plan","type":"string","x-cambium-cli":{"action":"store","option_strings":["--plan"]}},"receipts":{"default":".cambium/receipts/amendments.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","plan","expected_coverage_sha256","expected_progress_sha256","expected_queue_sha256"],"type":"object"},"name":"apply_amendment"},{"description":"Amend the frozen Task Contract from one confirmed plan.","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may apply a contract amendment","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"write the transaction; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human-readable report to stderr; receipt writing, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"plan":{"description":"repository-relative path under .cambium/deltas/contract-amendments","type":"string","x-cambium-cli":{"action":"store","option_strings":["--plan"]}},"receipts":{"default":".cambium/receipts/contract-amendments.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","plan"],"type":"object"},"name":"apply_contract_amendment"},{"description":"Deterministic Coverage Delta application","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may apply canonical Coverage","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"write the merged Coverage; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"delta":{"description":"batch Coverage delta to apply; canonical mode requires exactly .cambium/deltas/.yaml","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"expected_coverage_sha256":{"description":"compare-and-swap guard for canonical --apply: sha256: the caller read from the current Coverage; the write is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-coverage-sha256"]}},"expected_queue_sha256":{"description":"compare-and-swap guard for canonical --apply: sha256: the caller read from the current Queue; the write is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-queue-sha256"]}},"force":{"default":false,"description":"legacy mode only: keep pages whose ledger batch/next_batch does not match the delta batch","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--force"]}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human-readable report to stderr; receipt writing, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"ledger":{"description":"Coverage ledger to merge into; canonical mode requires exactly .cambium/state/coverage_ledger.yaml","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"preflight":{"default":false,"description":"plan canonical Coverage and routed-gap settlement without writes; allows an open batch","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--preflight"]}},"receipts":{"description":"receipt JSONL destination; canonical mode defaults to a new .cambium/receipts/.jsonl and refuses an existing path","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root (canonical mode)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--root"]}}},"required":["ledger","delta"],"type":"object"},"name":"apply_delta","x-cambium-mutually-exclusive":[{"dests":["apply","preflight"],"required":false}]},{"description":"Apply one receipt-backed Profile metadata transition","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may write","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"commit owner state and page projection","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"expected_coverage_sha256":{"description":"Coverage fingerprint observed by the caller","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-coverage-sha256"]}},"expected_page_sha256":{"description":"target page fingerprint observed by the caller","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-page-sha256"]}},"gate_id":{"description":"exact typed Profile Extension Gate ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--gate-id"]}},"gate_receipt":{"description":"current producer receipt ID for this Gate","type":"string","x-cambium-cli":{"action":"store","option_strings":["--gate-receipt"]}},"json":{"default":false,"description":"write the applied receipt as one JSON array","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"page":{"description":"repository-relative Markdown target","type":"string","x-cambium-cli":{"action":"store","option_strings":["--page"]}},"receipts":{"description":"fresh JSONL path under .cambium/receipts; default is .jsonl","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"value":{"description":"requested registered completion value","type":"string","x-cambium-cli":{"action":"store","option_strings":["--value"]}}},"required":["root","gate_id","page","value","gate_receipt"],"type":"object"},"name":"apply_metadata_transition"},{"description":"Apply one no-runtime R09 Profile adoption (initial adoption or pre-runtime profile revision) from a restricted-YAML plan","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"perform the transaction; without it the complete planned change is reported and nothing is written","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"json":{"default":false,"description":"emit the plan/result as one JSON document","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"plan":{"description":"root-relative adoption plan (schemas/profile_adoption_plan.template.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--plan"]}},"receipts":{"description":"must be the canonical Standards history stream .cambium/receipts/standards-adoptions.jsonl","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"repository root (no task runtime may exist; governance state may exist)","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","plan"],"type":"object"},"name":"apply_profile_adoption"},{"description":"Materialize a task runtime from one confirmed plan.","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"write the transaction; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human-readable report to stderr; receipt writing, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"plan":{"description":"repository-relative path under .cambium/deltas/task-plans","type":"string","x-cambium-cli":{"action":"store","option_strings":["--plan"]}},"receipts":{"default":".cambium/receipts/task-plans.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","plan"],"type":"object"},"name":"apply_task_plan"},{"description":"Run and publish the K12/09 batch-close evidence bundle","inputSchema":{"additionalProperties":false,"properties":{"accept_candidate_id":{"default":[],"description":"accept this exact current candidate for this close only","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--accept-candidate-id"]}},"accept_candidate_type":{"default":[],"description":"accept every current candidate of this exact tool:check type for this close only","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--accept-candidate-type"]}},"accept_while_unchanged_id":{"default":[],"description":"accept this exact current candidate and permit reuse while its observation is unchanged","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--accept-while-unchanged-id"]}},"accept_while_unchanged_type":{"default":[],"description":"expand this current exact type set and permit those rows to be reused while unchanged","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--accept-while-unchanged-type"]}},"batch":{"description":"merge-ready batch ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--batch"]}},"integrator":{"description":"declared integrator label recorded in the evidence","type":"string","x-cambium-cli":{"action":"store","option_strings":["--integrator"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable summary to stderr; receipts written and the exit code are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"receipts":{"default":".cambium/receipts/batch-close.jsonl","description":"repository-relative close evidence JSONL","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"review_attestation":{"description":"reviewer's explicit global-review statement","type":"string","x-cambium-cli":{"action":"store","option_strings":["--review-attestation"]}},"reviewer":{"description":"declared reviewer label (must differ from integrator)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--reviewer"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","batch","integrator","reviewer","review_attestation"],"type":"object"},"name":"check_batch_close"},{"description":"Validate page boundary blocks against the K08/09 page boundary contract (gate: boundary-contract; advisory by default).","inputSchema":{"additionalProperties":false,"properties":{"contract":{"default":"Tools/page_contract.yaml","description":"compiled contract path (default Tools/page_contract.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--contract"]}},"exclude":{"default":[],"description":"subpath to exclude; repeatable","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable summary to stderr; receipts written and the exit code are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"profile":{"description":"profile directory override; default is the selected_profile_manifest of the active Standards state","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"scope":{"description":"only scan .md files under this subpath (directory or single page)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope"]}},"strict":{"default":false,"description":"treat violations as failures except the B4 migration-tolerated case; the mode a governance decision promotes to a gate","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--strict"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root"],"type":"object"},"name":"check_boundary_contract"},{"description":"Validate explicit Corpus Planning artifacts","inputSchema":{"additionalProperties":false,"properties":{"json":{"default":false,"description":"write only the deterministic normalized result JSON to stdout","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"profile":{"description":"repository-relative Profile manifest or Profile directory; default: selected Profile in Progress Ledger","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"receipts":{"description":"append JSONL receipts here","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"check_corpus_plan"},{"description":"Closed-world freshness / review_by candidate check","inputSchema":{"additionalProperties":false,"properties":{"as_of":{"description":"reference date YYYY-MM-DD for overdue computation (default: today)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--as-of"]}},"defaults":{"description":"optional domain -> volatility mapping file (restricted YAML subset); an active page with no explicit or defaulted volatility is a candidate","type":"string","x-cambium-cli":{"action":"store","option_strings":["--defaults"]}},"exclude":{"default":[],"description":"skip files whose path contains this component (repeatable; default: none)","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable report to stderr; receipts written, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"scope":{"description":"only scan .md files under this subpath","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root"],"type":"object"},"name":"check_freshness"},{"description":"Wiki link missing/ambiguous/heading check","inputSchema":{"additionalProperties":false,"properties":{"exclude":{"default":[],"description":"path component to exclude (repeatable); files whose path contains the component are neither scanned for outgoing links nor used in basename disambiguation, but exact full-path links into them still resolve (excluded means not audited, not nonexistent)","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable summary to stderr; receipts written and the exit code are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"scope":{"description":"only scan .md files under this subpath (the index still covers the whole vault)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root"],"type":"object"},"name":"check_links"},{"description":"MOC Module Index consistency candidate detection","inputSchema":{"additionalProperties":false,"properties":{"exclude":{"default":[],"description":"path component to exclude (repeatable); no semantic directory name is excluded by default","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable report to stderr; receipts written, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"receipts":{"description":"JSONL path to append a machine-readable receipt to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"scan root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"check_moc"},{"description":"Validate pages against the compiled frontmatter page contract (gate: page-contract; advisory by default).","inputSchema":{"additionalProperties":false,"properties":{"contract":{"default":"Tools/page_contract.yaml","description":"compiled contract path (default Tools/page_contract.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--contract"]}},"exclude":{"default":[],"description":"subpath to exclude; repeatable","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable summary to stderr; receipts written and the exit code are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"profile":{"description":"profile directory override; default is the selected_profile_manifest of the active Standards state","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"scope":{"description":"only scan .md files under this subpath (directory or single page)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope"]}},"strict":{"default":false,"description":"treat violations as failures; the mode a governance decision promotes to a gate","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--strict"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root"],"type":"object"},"name":"check_page_contract"},{"description":"Profile manifest completeness and unfilled-template check","inputSchema":{"additionalProperties":false,"properties":{"defaults":{"description":"machine-readable profile-form placeholder registry (default: Tools/schemas/execution_defaults.template.yaml under --root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--defaults"]}},"execution_defaults":{"description":"kernel execution-default override registry (default: kernel/K00 Standards Control/execution-defaults-base.yaml under --root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--execution-defaults"]}},"interface":{"description":"normative slot interface file (default: profiles/README.md under --root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--interface"]}},"json":{"default":false,"description":"write one deterministic JSON object (tool, root, result, findings each carrying a closed mechanical/semantic-unresolved category) to stdout instead of the human summary; receipts and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"profile_dir":{"description":"the profile directory to check (e.g. profiles/)","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"default":".","description":"vault root that vault-relative bindings resolve against (default: this script's repository root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--root"]}}},"required":["profile_dir"],"type":"object"},"name":"check_profile"},{"description":"Terminal Proof completeness and zero-condition check","inputSchema":{"additionalProperties":false,"properties":{"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable summary to stderr; receipts written and the exit code are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"ledger":{"description":"Coverage Ledger YAML; with --root this must be exactly .cambium/state/coverage_ledger.yaml","type":"string","x-cambium-cli":{"action":"store","option_strings":["--ledger"]}},"progress_ledger":{"description":"Progress Ledger YAML; required with --root and must be exactly .cambium/state/progress_ledger.yaml","type":"string","x-cambium-cli":{"action":"store","option_strings":["--progress-ledger"]}},"proof":{"description":"path to the terminal proof YAML file","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"vault root; when given, path-valued proof fields must exist and selected routes, Cards, and kernel Read Sets must agree with the canonical route indexes","type":"string","x-cambium-cli":{"action":"store","option_strings":["--root"]}},"template":{"default":"Tools/schemas/terminal_proof.template.yaml","description":"field-list template (default Tools/schemas/terminal_proof.template.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--template"]}}},"required":["proof"],"type":"object"},"name":"check_proof"},{"description":"Validate canonical Required Queue state","inputSchema":{"additionalProperties":false,"properties":{"boundary_gate_receipt":{"default":[],"description":"current gate evidence supplied to --require-revalidation","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--boundary-gate-receipt"]}},"budget_manifest_receipt":{"description":"closed budget-manifest receipt ID supplied to --require-maintenance-complete","type":"string","x-cambium-cli":{"action":"store","option_strings":["--budget-manifest-receipt"]}},"confirmation_receipt":{"description":"confirmation evidence supplied to --require-ready","type":"string","x-cambium-cli":{"action":"store","option_strings":["--confirmation-receipt"]}},"deliver_readback":{"description":"deliver one registered conditional Card read-back source for an already-open batch","type":"string","x-cambium-cli":{"action":"store","option_strings":["--deliver-readback"]}},"json":{"default":false,"description":"write this run's receipt object to stdout as one canonical JSON array and move the human report to stderr; receipt writing and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"ledger_advance_receipt":{"description":"Coverage Ledger advance receipt ID supplied to --require-maintenance-complete","type":"string","x-cambium-cli":{"action":"store","option_strings":["--ledger-advance-receipt"]}},"readback_rule":{"description":"registered rule selected with --deliver-readback","type":"string","x-cambium-cli":{"action":"store","option_strings":["--readback-rule"]}},"receipts":{"description":"repository-relative JSONL receipt path","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"require_complete":{"default":false,"description":"build completion gate: prove no Required work remains","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--require-complete"]}},"require_maintenance_complete":{"default":false,"description":"maintenance completion gate: prove one bounded maintenance run is complete","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--require-maintenance-complete"]}},"require_ready":{"description":"prove BATCH_ID is queued and ready to activate","type":"string","x-cambium-cli":{"action":"store","option_strings":["--require-ready"]}},"require_revalidation":{"description":"prove BATCH_ID may produce its Standards revalidation aggregate","type":"string","x-cambium-cli":{"action":"store","option_strings":["--require-revalidation"]}},"resume_status":{"default":false,"description":"show interruption-safe task and batch resume state","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--resume-status"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"watermark_advance_receipt":{"description":"watermark advance receipt ID supplied to --require-maintenance-complete","type":"string","x-cambium-cli":{"action":"store","option_strings":["--watermark-advance-receipt"]}}},"required":["root"],"type":"object"},"name":"check_queue","x-cambium-mutually-exclusive":[{"dests":["require_ready","require_revalidation","require_complete","require_maintenance_complete","resume_status","deliver_readback"],"required":false}]},{"description":"Find profile-configured residual content outside accepted roots.","inputSchema":{"additionalProperties":false,"properties":{"config":{"description":"profile-owned restricted YAML scan configuration","type":"string","x-cambium-cli":{"action":"store","option_strings":["--config"]}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human summary to stderr; receipt writing and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"positive_controls_only":{"default":false,"description":"execute the registered controls through the production classifier without scanning repository content","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--positive-controls-only"]}},"receipts":{"description":"optional JSONL receipt path","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"scan_id":{"description":"stable ID from the selected profile's scan registry","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scan-id"]}},"time_limit":{"default":55.0,"description":"hard evidence-production budget in seconds (greater than 0 and at most 55)","type":"number","x-cambium-cli":{"action":"store","option_strings":["--time-limit"],"type":"float"}},"vault_root":{"description":"knowledge-vault root to scan","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root","scan_id","config"],"type":"object"},"name":"check_residual_content"},{"description":"Validate the selected profile's Structure Registry against the vault (gate: structure-registry).","inputSchema":{"additionalProperties":false,"properties":{"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable summary to stderr; receipts written and the exit code are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"profile":{"description":"profile directory override; default is the selected_profile_manifest of the active Standards state","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root"],"type":"object"},"name":"check_structure"},{"description":"Frontmatter controlled-vocabulary check","inputSchema":{"additionalProperties":false,"properties":{"exclude":{"default":[],"description":"subpath to exclude (repeatable; e.g. the compiled kernel/Cards artifacts, whose frontmatter is not governed by the K08 module's knowledge-page schema)","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human summary to stderr; receipt writing and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"policy_fingerprint":{"description":"effective-policy fingerprint (kblib.effective_priority_policy) the quotas were resolved from; recorded on the priority-quota-compliance receipt so its consumers can bind the policy identity, never re-derive it","type":"string","x-cambium-cli":{"action":"store","option_strings":["--policy-fingerprint"]}},"quota_p0":{"default":15.0,"description":"P0 priority quota in percent (default 15; kernel default; the selected profile manifest or task contract may override)","type":"number","x-cambium-cli":{"action":"store","option_strings":["--quota-p0"],"type":"float"}},"quota_p1":{"default":35.0,"description":"P1 priority quota in percent (default 35; kernel default; the selected profile manifest or task contract may override)","type":"number","x-cambium-cli":{"action":"store","option_strings":["--quota-p1"],"type":"float"}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"scope":{"description":"only scan .md files under this subpath","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"vocab":{"description":"path to vocab.yaml (defaults to vocab.yaml next to this script)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--vocab"]}}},"required":["vault_root"],"type":"object"},"name":"check_vocab"},{"description":"Compile the machine-readable CLI invocation contract from every Tools/*.py argparse declaration.","inputSchema":{"additionalProperties":false,"properties":{"check":{"default":false,"description":"recompute and compare against the existing output; exit 0 when byte-identical, 2 when it is stale or hand-edited","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"output":{"description":"artifact path to write or verify (default: /Tools/compiled/cli-contract.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output"]}},"root":{"description":"repository root whose Tools/ directory is compiled","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"compile_cli_contract"},{"description":"Compile Required Queue from explicit Coverage assignments","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may apply a Queue write or replan","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"amendment_id":{"description":"registered Amendment id authorizing the replan; required with --apply-replan","type":"string","x-cambium-cli":{"action":"store","option_strings":["--amendment-id"]}},"apply":{"default":false,"description":"materialize an initially empty Queue","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"apply_replan":{"default":false,"description":"apply a controlled structural diff to a non-empty Queue","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply-replan"]}},"coverage_proposal":{"description":"repository-contained .cambium/deltas/replans/*.coverage.yaml input","type":"string","x-cambium-cli":{"action":"store","option_strings":["--coverage-proposal"]}},"expected_coverage_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Coverage; the replan is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-coverage-sha256"]}},"expected_progress_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Progress; the replan is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-progress-sha256"]}},"expected_queue_revision":{"description":"compare-and-swap guard: the queue_revision the caller read from the current Queue; the write is refused when the live value differs","type":"integer","x-cambium-cli":{"action":"store","option_strings":["--expected-queue-revision"],"type":"int"}},"expected_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Queue; the write is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-sha256"]}},"expected_state_revision":{"description":"compare-and-swap guard: the state_revision the caller read from the current Queue; the replan is refused when the live value differs","type":"integer","x-cambium-cli":{"action":"store","option_strings":["--expected-state-revision"],"type":"int"}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human-readable report to stderr; receipt writing, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"output":{"description":"repository-relative proposal path","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output"]}},"receipts":{"default":".cambium/receipts/queue-structure.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"replan_diff":{"description":"existing .cambium/tmp/*.yaml diff to consume","type":"string","x-cambium-cli":{"action":"store","option_strings":["--replan-diff"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"compile_queue","x-cambium-mutually-exclusive":[{"dests":["apply","apply_replan"],"required":false}]},{"description":"Compose the effective frontmatter page contract from the kernel bases and the selected profile's Metadata Contract.","inputSchema":{"additionalProperties":false,"properties":{"base":{"description":"applicability base to compile from (default: kernel/K08 Metadata and Status/applicability-base.yaml under --root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--base"]}},"check":{"default":false,"description":"recompute and compare against the existing output; exit 0 when byte-identical, 2 otherwise","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"output":{"description":"compiled page contract to write, or to compare against under --check (default: Tools/page_contract.yaml under --root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output"]}},"profile":{"description":"profile directory for a validation run; the vault selection stays with K00/03","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"relationships":{"description":"relationship base to compile from (default: kernel/K08 Metadata and Status/relationship-base.yaml under --root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--relationships"]}},"root":{"default":".","description":"vault root (default: this repository)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--root"]}},"sources_role":{"description":"sources-role base to compile from (default: kernel/K07 Sources and Accuracy/sources-role-base.yaml under --root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--sources-role"]}}},"type":"object"},"name":"compose_page_contract"},{"description":"Deterministically compose the vocabulary artifact from the kernel base and the selected profile's extensions.","inputSchema":{"additionalProperties":false,"properties":{"base":{"default":"kernel/K08 Metadata and Status/vocabulary-base.yaml","description":"the kernel vocabulary base the extensions are appended to (default: kernel/K08 Metadata and Status/vocabulary-base.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--base"]}},"check":{"default":false,"description":"recompute and compare against the existing output; exit 0 when values and provenance are identical, 2 otherwise","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"extensions":{"description":"the active profile's vocabulary-extensions.yaml. Canonical adopter Standards state selects the path; when this flag is present it must name that same path","type":"string","x-cambium-cli":{"action":"store","option_strings":["--extensions"]}},"output":{"default":"Tools/vocab.yaml","description":"composed vocabulary artifact to write, or to compare against under --check (default: Tools/vocab.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output"]}}},"type":"object"},"name":"compose_vocab"},{"description":"Cross-file duplicate paragraph candidate detection (for maintenance runs and governance tasks)","inputSchema":{"additionalProperties":false,"properties":{"exclude":{"description":"skip files whose path contains this component (repeatable; default: legacy)","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable report to stderr; receipts written, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"receipts":{"description":"JSONL path to append machine-readable receipts to (shared convention, Tools/schemas/receipt.template.jsonl)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"scope":{"description":"subpath (relative to vault, or absolute): only report similar pairs with at least one side under it","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope"]}},"vault":{"default":".","description":"vault root directory (default: current directory)","type":"string","x-cambium-cli":{"action":"store","nargs":"?","option_strings":[]}}},"type":"object"},"name":"duplicate_check"},{"description":"Initialize empty Cambium runtime state","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"materialize .cambium/; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"at":{"description":"initial Coverage timestamp (default: current UTC)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--at"]}},"completion_semantics":{"description":"build requires completion-candidate plus Terminal Proof; maintenance closes directly through the bounded maintenance completion gate","enum":["build","maintenance"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--completion-semantics"]}},"concurrency_cap":{"description":"explicit task-contract override of K13/10's concurrency cap; omit it to take the selected profile manifest's registered override, or the kernel default 3 when the manifest registers none","type":"integer","x-cambium-cli":{"action":"store","option_strings":["--concurrency-cap"],"type":"int"}},"contract_version":{"default":"c1","description":"non-empty task-contract version recorded on the Progress Ledger contract","type":"string","x-cambium-cli":{"action":"store","option_strings":["--contract-version"]}},"exclusions":{"default":[],"description":"explicit out-of-scope item; repeatable","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"objective":{"description":"non-empty statement of the task outcome","type":"string","x-cambium-cli":{"action":"store","option_strings":["--objective"]}},"profile_manifest":{"description":"repository-relative selected profile manifest; must equal the selected_profile_manifest of the canonical adopter Standards state","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile-manifest"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"scope_version":{"description":"non-empty scope identity stamped on the Queue, Coverage Ledger and task contract","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope-version"]}},"standards_version":{"description":"Standards version this runtime adopts; must equal the approved standards_version of the canonical adopter Standards state","type":"string","x-cambium-cli":{"action":"store","option_strings":["--standards-version"]}},"task_id":{"description":"non-empty task identity stamped on the Queue, Coverage Ledger and Progress Ledger","type":"string","x-cambium-cli":{"action":"store","option_strings":["--task-id"]}}},"required":["root","task_id","objective","scope_version","standards_version","profile_manifest","completion_semantics"],"type":"object"},"name":"init_state"},{"description":"Compile and load Cambium's closed metadata-execution authority contract. This module is deliberately the single authority boundary between metadata declarations and executable writers. A field rule is executable only when an installed writer capability declares the same ``(field, transition, adapter)`` operation, and every installed writer operation must be authorized by exactly one rule. Unknown keys, unknown adapters, orphan implementations, and partial evidence bindings fail closed.","inputSchema":{"additionalProperties":false,"properties":{"authority":{"default":"kernel/K08 Metadata and Status/metadata-authority-base.yaml","type":"string","x-cambium-cli":{"action":"store","option_strings":["--authority"]}},"capabilities":{"default":"Tools/operation-capabilities.yaml","type":"string","x-cambium-cli":{"action":"store","option_strings":["--capabilities"]}},"check":{"default":false,"type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"output":{"default":"Tools/compiled/metadata-execution-contract.json","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output"]}},"root":{"default":".","type":"string","x-cambium-cli":{"action":"store","option_strings":["--root"]}}},"type":"object"},"name":"metadata_execution_contract"},{"description":"Migrate existing runtime identity to Standards state","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"write state; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"migrate_standards_state"},{"description":"Read-only onboarding status projector: derives the adoption/onboarding state of one root and exactly one next_action token; writes nothing and owns no ledger","inputSchema":{"additionalProperties":false,"properties":{"json":{"default":false,"description":"emit the status view as one deterministic JSON object instead of the human summary","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"profile_id":{"description":"target one candidate profile directory name under profiles/ for the full profile-load evaluation (defaults to the single candidate when exactly one exists)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile-id"]}},"root":{"description":"the adopting repository root to project","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"profile_onboarding_status"},{"description":"Project metadata-contract owner state onto page frontmatter","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"take the runtime writer lock and publish the projection; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"page":{"description":"limit to these repository-relative pages (repeatable); default is every Ledger page","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--page"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"project_page_state"},{"description":"Record one snapshot-bound Batch Review judgment","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"append the evidence; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"batch":{"description":"exact open Queue batch ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--batch"]}},"json":{"default":false,"description":"write the applied receipt as one JSON array","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"judgment_item":{"description":"registered Batch Review Requirement Judgment Item ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--judgment-item"]}},"receipts":{"default":".cambium/receipts/batch-judgments.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"reviewer_role":{"description":"declared pass-authority Profile role ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--reviewer-role"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"statement":{"description":"bounded judgment statement (the concrete verdict, not \"reviewed\")","type":"string","x-cambium-cli":{"action":"store","option_strings":["--statement"]}},"target":{"description":"manifest page path, or the batch ID for a batch-selector requirement","type":"string","x-cambium-cli":{"action":"store","option_strings":["--target"]}}},"required":["root","batch","judgment_item","target","reviewer_role","statement"],"type":"object"},"name":"record_batch_judgment"},{"description":"Record a Profile-authorized Corpus Planning semantic decision as machine-readable JSONL","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"description":"declared authority Role ID; required with --apply and must equal the Profile/plan binding","type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"append the structural and semantic receipts; default is dry-run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"plan":{"description":"closed restricted-YAML acceptance decision plan; one .yaml file directly under .cambium/deltas/corpus-plan-acceptances/","type":"string","x-cambium-cli":{"action":"store","option_strings":["--plan"]}},"receipts":{"default":".cambium/receipts/corpus-plan-acceptance.jsonl","description":"repository-relative JSONL path the receipts are appended to (default: .cambium/receipts/corpus-plan-acceptance.jsonl)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","plan"],"type":"object"},"name":"record_corpus_acceptance"},{"description":"Record snapshot-bound manual Extension Gate evidence","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"description":"declared pass-authority Profile role ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"append the evidence; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"gate_id":{"description":"exact typed Profile Extension Gate ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--gate-id"]}},"json":{"default":false,"description":"write the applied receipt as one JSON array","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"page":{"description":"repository-relative Markdown target","type":"string","x-cambium-cli":{"action":"store","option_strings":["--page"]}},"receipts":{"default":".cambium/receipts/gate-attestations.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"statement":{"description":"bounded manual attestation statement","type":"string","x-cambium-cli":{"action":"store","option_strings":["--statement"]}},"value":{"description":"requested registered completion value","type":"string","x-cambium-cli":{"action":"store","option_strings":["--value"]}}},"required":["root","gate_id","page","value","actor_role","statement"],"type":"object"},"name":"record_gate_attestation"},{"description":"Run a registered scan and record a deterministic Extension Gate result","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"run and append the bound Gate result","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"gate_id":{"description":"exact deterministic typed Profile Gate ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--gate-id"]}},"json":{"default":false,"description":"write the applied receipt as one JSON array","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"page":{"description":"repository-relative Markdown target","type":"string","x-cambium-cli":{"action":"store","option_strings":["--page"]}},"receipts":{"default":".cambium/receipts/gate-results.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","gate_id","page"],"type":"object"},"name":"record_gate_result"},{"description":"Register one approved current-protocol Amendment","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may register or withdraw an Amendment","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"amendment_id":{"description":"id for a queue-replan registration; cross-Ledger operations derive it from --plan instead","type":"string","x-cambium-cli":{"action":"store","option_strings":["--amendment-id"]}},"apply":{"default":false,"description":"write the registration; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"approval_reference":{"description":"explicit-user approval reference; required when --decision-mode is explicit-user","type":"string","x-cambium-cli":{"action":"store","option_strings":["--approval-reference"]}},"coverage_proposal":{"description":".cambium/deltas/replans/*.coverage.yaml proposal","type":"string","x-cambium-cli":{"action":"store","option_strings":["--coverage-proposal"]}},"date":{"description":"YYYY-MM-DD; must equal the UTC registration date","type":"string","x-cambium-cli":{"action":"store","option_strings":["--date"]}},"decision_mode":{"default":"auto","description":"derive delegated authority by default; explicit-user requires --approval-reference","enum":["auto","contract-delegated","explicit-user"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--decision-mode"]}},"expected_coverage_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Coverage; registration is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-coverage-sha256"]}},"expected_progress_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Progress; registration is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-progress-sha256"]}},"expected_queue_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Queue; registration is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-queue-sha256"]}},"json":{"default":false,"description":"write the published receipt to stdout as one canonical JSON array and move the human report to stderr; a dry run publishes no receipt and so writes nothing there; receipt writing and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"operation":{"description":"Amendment operation being registered","enum":["cancel-batch","gap-routing-reconciliation","property-state-migration","queue-replan","scope-replan"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--operation"]}},"plan":{"description":".cambium/deltas/amendments/*.yaml plan","type":"string","x-cambium-cli":{"action":"store","option_strings":["--plan"]}},"reason":{"description":"nonempty withdrawal reason recorded on the row and its receipt","type":"string","x-cambium-cli":{"action":"store","option_strings":["--reason"]}},"receipts":{"default":".cambium/receipts/amendments.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"summary":{"description":"non-empty one-line rationale recorded on the row","type":"string","x-cambium-cli":{"action":"store","option_strings":["--summary"]}},"withdraw":{"description":"retire the named pending registration instead of registering one (K13/06 withdrawal); requires --reason","type":"string","x-cambium-cli":{"action":"store","option_strings":["--withdraw"]}}},"required":["root","expected_coverage_sha256","expected_progress_sha256","expected_queue_sha256"],"type":"object"},"name":"register_amendment"},{"description":"Render the K08/09 boundary projection blocks from page `boundary` frontmatter.","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"rewrite the stale owned blocks atomically; omit to only report what would render","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"check":{"default":false,"description":"exit 2 when any owned block is stale; the default report never fails on staleness","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"contract":{"default":"Tools/page_contract.yaml","description":"compiled contract path (default Tools/page_contract.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--contract"]}},"profile":{"description":"profile directory override; default is the selected_profile_manifest of the active Standards state","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"scope":{"description":"only scan .md files under this subpath","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root"],"type":"object"},"name":"render_boundary_projection"},{"description":"Render the Cambium MCP server's registration and corpus binding into the configuration file each supported host reads.","inputSchema":{"additionalProperties":false,"properties":{"check":{"default":false,"description":"re-render and compare against the existing products; exit 0 when byte-identical, 2 when one is stale or hand-edited","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"distribution_root":{"description":"absolute path of the Cambium checkout the server is launched from; substituted for (default: leave the placeholder)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--distribution-root"]}},"host":{"description":"render only this host's product (default: every host)","enum":["claude-code","codex","dsh-env","dsh-profile-patch","kimi-code"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--host"]}},"output_dir":{"description":"directory to write or verify the products in (default: /Tools/compiled/host-configs)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output-dir"]}},"projection":{"description":"compiled interface projection to bind to (default: /Tools/compiled/mcp-tools.json)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--projection"]}},"root":{"description":"repository root holding the compiled interface projection","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"sources":{"default":false,"description":"print the declaration source of every rendered field and exit without reading or writing any product","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--sources"]}},"workspace_root":{"description":"absolute path of the corpus repository this registration is bound to; substituted for (default: leave the placeholder)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--workspace-root"]}}},"required":["root"],"type":"object"},"name":"render_host_configs","x-cambium-mutually-exclusive":[{"dests":["check","sources"],"required":false}]},{"description":"Project the compiled CLI invocation contract into the agent-facing interface forms registered in this tool.","inputSchema":{"additionalProperties":false,"properties":{"check":{"default":false,"description":"recompute and compare against the existing artifacts; exit 0 when byte-identical, 2 when one is stale or hand-edited","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"contract":{"description":"compiled CLI contract to project (default: /Tools/compiled/cli-contract.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--contract"]}},"form":{"description":"project only this form (default: every registered form)","enum":["mcp"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--form"]}},"output":{"description":"artifact path to write or verify; requires --form, because one path cannot hold two forms","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output"]}},"root":{"description":"repository root holding the compiled CLI contract","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"sources":{"default":false,"description":"print the declaration source of every projected field and exit without reading or writing any artifact","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--sources"]}}},"required":["root"],"type":"object"},"name":"render_interface_projection","x-cambium-mutually-exclusive":[{"dests":["check","sources"],"required":false}]},{"description":"Render Required Queue human report","inputSchema":{"additionalProperties":false,"properties":{"check":{"default":false,"description":"compare existing report instead of writing","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"output":{"default":".cambium/reports/required_queue.md","description":"repository-relative report path","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"stdout":{"default":false,"description":"print the report to stdout and write nothing","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--stdout"]}}},"required":["root"],"type":"object"},"name":"render_queue"},{"description":"Render derived Structure Registry coverage projections (K01/05 derived roles).","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"rewrite the stale owned blocks atomically; omit to only report what would render","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"check":{"default":false,"description":"exit 2 when any owned block is stale or missing; the default report never fails on staleness","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"profile":{"description":"profile directory override; default is the selected_profile_manifest of the active Standards state","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root"],"type":"object"},"name":"render_structure_projection"},{"description":"Run the adopter verification set derived from the K00/12 Stable Gate ID Registry (deterministic, not-batch-scoped producers).","inputSchema":{"additionalProperties":false,"properties":{"exclude":{"default":[],"description":"path prefix passed through to scanners that accept it (repeatable)","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"list":{"default":false,"description":"print the derived set and each command without running anything","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--list"]}},"profile":{"description":"profile directory override; default is the live runtime's selected_profile_manifest","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"root":{"description":"repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"run_gates"},{"description":"Scaffold a candidate profile from profiles/_template using the exact-copy whitelist in profiles/template-files.yaml","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"create the candidate; without it the plan is reported and nothing is written","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"json":{"default":false,"description":"emit the plan/result as one JSON document","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"profile_id":{"description":"candidate profile slug matching [a-z0-9][a-z0-9_-]* (equals the directory name)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile-id"]}},"root":{"description":"repository root containing profiles/","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","profile_id"],"type":"object"},"name":"scaffold_profile"},{"description":"Seal verified frozen receipt history (K12/07). --apply is a maintenance-window operation: run it only with no other Cambium or adopter writer, checker or receipt appender active against this repository.","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"write the seal, or with --reconcile finish the interrupted one; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable report to stderr; receipts written, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"receipts":{"default":".cambium/receipts/seal-receipts.jsonl","description":"repository-relative JSONL path for this tool's own seal receipts, which never seal (default: .cambium/receipts/seal-receipts.jsonl)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"reconcile":{"default":false,"description":"finish an interrupted seal over the publication paths this tool implements; other interruptions fail closed and are resolved by the runbook in Tools/README.md","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--reconcile"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"verify":{"default":false,"description":"re-prove every sealed segment, projection and seal-receipt binding, then exit","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--verify"]}}},"required":["root"],"type":"object"},"name":"seal_receipts"},{"description":"Stamp kernel Runtime Cards","inputSchema":{"additionalProperties":false,"properties":{"acknowledge_compiled":{"default":false,"description":"after semantic regeneration/review, advance compiled_source_hash to the exact current source digest","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--acknowledge-compiled"]}},"cards_dir":{"default":"kernel/Cards","description":"Card directory relative to (default: kernel/Cards)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--cards-dir"]}},"check":{"default":false,"description":"verify only; never write","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"root":{"description":"repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"set_version":{"description":"also set every card's compiled_from value","type":"string","x-cambium-cli":{"action":"store","option_strings":["--set-version"]}}},"required":["root"],"type":"object"},"name":"stamp_cards"},{"description":"Apply one Required Queue transition","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; Queue transition planning and apply both require integrator","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"write the transition; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"at":{"description":"transition timestamp; defaults to now in UTC","type":"string","x-cambium-cli":{"action":"store","option_strings":["--at"]}},"batch_receipt":{"default":[],"description":"batch-review gate receipt id for open -> merge-ready; exactly one is accepted","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--batch-receipt"]}},"close_gate_receipt":{"description":"check_batch_close receipt id required by the closed transition","type":"string","x-cambium-cli":{"action":"store","option_strings":["--close-gate-receipt"]}},"confirmation_receipt":{"description":"confirmation receipt id required by queued -> open when the batch is confirmation_required","type":"string","x-cambium-cli":{"action":"store","option_strings":["--confirmation-receipt"]}},"delta_apply_receipt":{"description":"apply_delta receipt id required by the closed transition and by merge-ready -> open reopen","type":"string","x-cambium-cli":{"action":"store","option_strings":["--delta-apply-receipt"]}},"delta_path":{"description":"repository-relative .cambium/deltas/.yaml batch delta required by open -> merge-ready","type":"string","x-cambium-cli":{"action":"store","option_strings":["--delta-path"]}},"expected_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Queue; the write is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-sha256"]}},"expected_state_revision":{"description":"compare-and-swap guard: the state_revision the caller read from the current Queue; the write is refused when the live value differs","type":"integer","x-cambium-cli":{"action":"store","option_strings":["--expected-state-revision"],"type":"int"}},"gate_receipt":{"description":"gate receipt id: activation gate for queued -> open, Queue consistency gate for closed and for clearing revalidation-required","type":"string","x-cambium-cli":{"action":"store","option_strings":["--gate-receipt"]}},"hold_state":{"description":"target hold state; exclusive with --transition","enum":["blocked","confirmation-required","none","paused","revalidation-required"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--hold-state"]}},"id":{"description":"Required Queue batch id to transition","type":"string","x-cambium-cli":{"action":"store","option_strings":["--id"]}},"json":{"default":false,"description":"write the applied transition receipt(s) to stdout as one canonical JSON array and move the human report to stderr; a dry run publishes no receipt and so writes nothing there; receipt writing and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"reason":{"description":"non-empty rationale required by merge-ready -> open and by any non-none hold","type":"string","x-cambium-cli":{"action":"store","option_strings":["--reason"]}},"receipts":{"default":".cambium/receipts/queue-transitions.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"standards_revalidation_receipt":{"description":"check_queue --require-revalidation receipt discharging an outstanding Standards revalidation; queued -> open or revalidation-required -> none only","type":"string","x-cambium-cli":{"action":"store","option_strings":["--standards-revalidation-receipt"]}},"transition":{"description":"target lifecycle state; exclusive with --hold-state","enum":["closed","merge-ready","open"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--transition"]}}},"required":["root","id"],"type":"object"},"name":"update_queue","x-cambium-mutually-exclusive":[{"dests":["transition","hold_state"],"required":true}]},{"description":"Apply one canonical task-state transition","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may apply a task-state write","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"write the transition; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"at":{"description":"transition timestamp; defaults to now in UTC","type":"string","x-cambium-cli":{"action":"store","option_strings":["--at"]}},"checkpoint_summary":{"description":"non-empty reason required by paused, blocked and cancelled, and when leaving completion-candidate for anything but complete","type":"string","x-cambium-cli":{"action":"store","option_strings":["--checkpoint-summary"]}},"expected_progress_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Progress; --apply is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-progress-sha256"]}},"expected_queue_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Queue; --apply is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-queue-sha256"]}},"json":{"default":false,"description":"write the applied transition receipt to stdout as one canonical JSON array and move the human report to stderr; a dry run publishes no receipt and so writes nothing there; receipt writing and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"maintenance_completion_receipt":{"description":"maintenance completion gate receipt id required by complete under maintenance completion_semantics","type":"string","x-cambium-cli":{"action":"store","option_strings":["--maintenance-completion-receipt"]}},"queue_check_receipt":{"description":"Queue completion gate receipt id required by the completion-candidate transition","type":"string","x-cambium-cli":{"action":"store","option_strings":["--queue-check-receipt"]}},"receipts":{"default":".cambium/receipts/task-transitions.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"terminal_proof_receipt":{"description":"Terminal Proof receipt id required by complete under build completion_semantics","type":"string","x-cambium-cli":{"action":"store","option_strings":["--terminal-proof-receipt"]}},"transition":{"description":"target task state in the Progress Ledger","enum":["active","blocked","cancelled","complete","completion-candidate","paused"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--transition"]}}},"required":["root","transition"],"type":"object"},"name":"update_task"}],"transports":["stdio","streamable-http"]} +{"artifact":"agent-interface-projection","form":"mcp","generated":{"not_a_revision_basis":"This file is downstream of each tool's own argparse declaration and is never the basis for revising one. To change what an agent may call, change the tool's argparse block, recompile Tools/compiled/cli-contract.yaml, then regenerate this file.","notice":"Generated artifact -- do not edit. Every value here is projected from Tools/compiled/cli-contract.yaml by Tools/render_interface_projection.py; a hand edit is reported by --check as a HOLD.","regenerate":"python3 Tools/render_interface_projection.py .","verify":"python3 Tools/render_interface_projection.py . --check"},"generator":"Tools/render_interface_projection.py","generator_version":"1.0.0","schema_version":1,"source":"Tools/compiled/cli-contract.yaml","source_artifact":"cli-invocation-contract","source_hash":"sha256:0aaadf4b4e1b0fa897f376aef84cdfe6e0fb0f35a9d5081ac6230aea34ecbb3c","source_manifest_hash":"sha256:4f4385918e933e211b3676c0f85df847388ee7318fb76f208eae061ec40a476f","source_schema_version":1,"tool_count":46,"tools":[{"description":"Adopt one approved Standards/Profile revision","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may apply a Standards adoption","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"write the transaction; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human-readable report to stderr; receipt writing, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"plan":{"description":".cambium/deltas/standards-adoptions/*.yaml","type":"string","x-cambium-cli":{"action":"store","option_strings":["--plan"]}},"receipts":{"default":".cambium/receipts/standards-adoptions.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","plan"],"type":"object"},"name":"adopt_standards"},{"description":"Apply one approved cross-Ledger Amendment transaction","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may apply an Amendment transaction","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"write the transaction; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"expected_coverage_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Coverage; planning is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-coverage-sha256"]}},"expected_progress_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Progress; planning is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-progress-sha256"]}},"expected_queue_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Queue; planning is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-queue-sha256"]}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human-readable report to stderr; receipt writing, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"plan":{"description":".cambium/deltas/amendments/*.yaml plan","type":"string","x-cambium-cli":{"action":"store","option_strings":["--plan"]}},"receipts":{"default":".cambium/receipts/amendments.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","plan","expected_coverage_sha256","expected_progress_sha256","expected_queue_sha256"],"type":"object"},"name":"apply_amendment"},{"description":"Amend the frozen Task Contract from one confirmed plan.","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may apply a contract amendment","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"write the transaction; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human-readable report to stderr; receipt writing, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"plan":{"description":"repository-relative path under .cambium/deltas/contract-amendments","type":"string","x-cambium-cli":{"action":"store","option_strings":["--plan"]}},"receipts":{"default":".cambium/receipts/contract-amendments.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","plan"],"type":"object"},"name":"apply_contract_amendment"},{"description":"Deterministic Coverage Delta application","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may apply canonical Coverage","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"write the merged Coverage; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"delta":{"description":"batch Coverage delta to apply; canonical mode requires exactly .cambium/deltas/.yaml","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"expected_coverage_sha256":{"description":"compare-and-swap guard for canonical --apply: sha256: the caller read from the current Coverage; the write is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-coverage-sha256"]}},"expected_queue_sha256":{"description":"compare-and-swap guard for canonical --apply: sha256: the caller read from the current Queue; the write is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-queue-sha256"]}},"force":{"default":false,"description":"legacy mode only: keep pages whose ledger batch/next_batch does not match the delta batch","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--force"]}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human-readable report to stderr; receipt writing, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"ledger":{"description":"Coverage ledger to merge into; canonical mode requires exactly .cambium/state/coverage_ledger.yaml","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"preflight":{"default":false,"description":"plan canonical Coverage and routed-gap settlement without writes; allows an open batch","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--preflight"]}},"receipts":{"description":"receipt JSONL destination; canonical mode defaults to a new .cambium/receipts/.jsonl and refuses an existing path","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root (canonical mode)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--root"]}}},"required":["ledger","delta"],"type":"object"},"name":"apply_delta","x-cambium-mutually-exclusive":[{"dests":["apply","preflight"],"required":false}]},{"description":"Apply one receipt-backed Profile metadata transition","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may write","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"commit owner state and page projection","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"expected_coverage_sha256":{"description":"Coverage fingerprint observed by the caller","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-coverage-sha256"]}},"expected_page_sha256":{"description":"target page fingerprint observed by the caller","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-page-sha256"]}},"gate_id":{"description":"exact typed Profile Extension Gate ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--gate-id"]}},"gate_receipt":{"description":"current producer receipt ID for this Gate","type":"string","x-cambium-cli":{"action":"store","option_strings":["--gate-receipt"]}},"json":{"default":false,"description":"write the applied receipt as one JSON array","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"page":{"description":"repository-relative Markdown target","type":"string","x-cambium-cli":{"action":"store","option_strings":["--page"]}},"receipts":{"description":"fresh JSONL path under .cambium/receipts; default is .jsonl","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"value":{"description":"requested registered completion value","type":"string","x-cambium-cli":{"action":"store","option_strings":["--value"]}}},"required":["root","gate_id","page","value","gate_receipt"],"type":"object"},"name":"apply_metadata_transition"},{"description":"Apply one no-runtime R09 Profile adoption (initial adoption or pre-runtime profile revision) from a restricted-YAML plan","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"perform the transaction; without it the complete planned change is reported and nothing is written","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"json":{"default":false,"description":"emit the plan/result as one JSON document","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"plan":{"description":"root-relative adoption plan (schemas/profile_adoption_plan.template.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--plan"]}},"receipts":{"description":"must be the canonical Standards history stream .cambium/receipts/standards-adoptions.jsonl","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"repository root (no task runtime may exist; governance state may exist)","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","plan"],"type":"object"},"name":"apply_profile_adoption"},{"description":"Materialize a task runtime from one confirmed plan.","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"write the transaction; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human-readable report to stderr; receipt writing, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"plan":{"description":"repository-relative path under .cambium/deltas/task-plans","type":"string","x-cambium-cli":{"action":"store","option_strings":["--plan"]}},"receipts":{"default":".cambium/receipts/task-plans.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","plan"],"type":"object"},"name":"apply_task_plan"},{"description":"Run and publish the K12/09 batch-close evidence bundle","inputSchema":{"additionalProperties":false,"properties":{"accept_candidate_id":{"default":[],"description":"accept this exact current candidate for this close only","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--accept-candidate-id"]}},"accept_candidate_type":{"default":[],"description":"accept every current candidate of this exact tool:check type for this close only","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--accept-candidate-type"]}},"accept_while_unchanged_id":{"default":[],"description":"accept this exact current candidate and permit reuse while its observation is unchanged","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--accept-while-unchanged-id"]}},"accept_while_unchanged_type":{"default":[],"description":"expand this current exact type set and permit those rows to be reused while unchanged","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--accept-while-unchanged-type"]}},"batch":{"description":"merge-ready batch ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--batch"]}},"integrator":{"description":"declared integrator label recorded in the evidence","type":"string","x-cambium-cli":{"action":"store","option_strings":["--integrator"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable summary to stderr; receipts written and the exit code are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"receipts":{"default":".cambium/receipts/batch-close.jsonl","description":"repository-relative close evidence JSONL","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"review_attestation":{"description":"reviewer's explicit global-review statement","type":"string","x-cambium-cli":{"action":"store","option_strings":["--review-attestation"]}},"reviewer":{"description":"declared reviewer label (must differ from integrator)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--reviewer"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","batch","integrator","reviewer","review_attestation"],"type":"object"},"name":"check_batch_close"},{"description":"Validate page boundary blocks against the K08/09 page boundary contract (gate: boundary-contract; advisory by default).","inputSchema":{"additionalProperties":false,"properties":{"contract":{"default":"Tools/page_contract.yaml","description":"compiled contract path (default Tools/page_contract.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--contract"]}},"exclude":{"default":[],"description":"subpath to exclude; repeatable","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable summary to stderr; receipts written and the exit code are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"profile":{"description":"profile directory override; default is the selected_profile_manifest of the active Standards state","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"scope":{"description":"only scan .md files under this subpath (directory or single page)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope"]}},"strict":{"default":false,"description":"treat violations as failures except the B4 migration-tolerated case; the mode a governance decision promotes to a gate","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--strict"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root"],"type":"object"},"name":"check_boundary_contract"},{"description":"Validate explicit Corpus Planning artifacts","inputSchema":{"additionalProperties":false,"properties":{"json":{"default":false,"description":"write only the deterministic normalized result JSON to stdout","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"profile":{"description":"repository-relative Profile manifest or Profile directory; default: selected Profile in Progress Ledger","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"receipts":{"description":"append JSONL receipts here","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"check_corpus_plan"},{"description":"Closed-world freshness / review_by candidate check","inputSchema":{"additionalProperties":false,"properties":{"as_of":{"description":"reference date YYYY-MM-DD for overdue computation (default: today)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--as-of"]}},"defaults":{"description":"optional domain -> volatility mapping file (restricted YAML subset); an active page with no explicit or defaulted volatility is a candidate","type":"string","x-cambium-cli":{"action":"store","option_strings":["--defaults"]}},"exclude":{"default":[],"description":"skip files whose path contains this component (repeatable; default: none)","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable report to stderr; receipts written, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"scope":{"description":"only scan .md files under this subpath","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root"],"type":"object"},"name":"check_freshness"},{"description":"Wiki link missing/ambiguous/heading check","inputSchema":{"additionalProperties":false,"properties":{"exclude":{"default":[],"description":"path component to exclude (repeatable); files whose path contains the component are neither scanned for outgoing links nor used in basename disambiguation, but exact full-path links into them still resolve (excluded means not audited, not nonexistent)","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable summary to stderr; receipts written and the exit code are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"scope":{"description":"only scan .md files under this subpath (the index still covers the whole vault)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root"],"type":"object"},"name":"check_links"},{"description":"MOC Module Index consistency candidate detection","inputSchema":{"additionalProperties":false,"properties":{"exclude":{"default":[],"description":"path component to exclude (repeatable); no semantic directory name is excluded by default","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable report to stderr; receipts written, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"receipts":{"description":"JSONL path to append a machine-readable receipt to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"scan root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"check_moc"},{"description":"Validate pages against the compiled frontmatter page contract (gate: page-contract; advisory by default).","inputSchema":{"additionalProperties":false,"properties":{"contract":{"default":"Tools/page_contract.yaml","description":"compiled contract path (default Tools/page_contract.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--contract"]}},"exclude":{"default":[],"description":"subpath to exclude; repeatable","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable summary to stderr; receipts written and the exit code are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"profile":{"description":"profile directory override; default is the selected_profile_manifest of the active Standards state","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"scope":{"description":"only scan .md files under this subpath (directory or single page)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope"]}},"strict":{"default":false,"description":"treat violations as failures; the mode a governance decision promotes to a gate","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--strict"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root"],"type":"object"},"name":"check_page_contract"},{"description":"Profile manifest completeness and unfilled-template check","inputSchema":{"additionalProperties":false,"properties":{"defaults":{"description":"machine-readable profile-form placeholder registry (default: Tools/schemas/execution_defaults.template.yaml under --root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--defaults"]}},"execution_defaults":{"description":"kernel execution-default override registry (default: kernel/K00 Standards Control/execution-defaults-base.yaml under --root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--execution-defaults"]}},"interface":{"description":"normative slot interface file (default: profiles/README.md under --root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--interface"]}},"json":{"default":false,"description":"write one deterministic JSON object (tool, root, result, findings each carrying a closed mechanical/semantic-unresolved category) to stdout instead of the human summary; receipts and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"profile_dir":{"description":"the profile directory to check (e.g. profiles/)","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"default":".","description":"vault root that vault-relative bindings resolve against (default: this script's repository root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--root"]}}},"required":["profile_dir"],"type":"object"},"name":"check_profile"},{"description":"Terminal Proof completeness and zero-condition check","inputSchema":{"additionalProperties":false,"properties":{"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable summary to stderr; receipts written and the exit code are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"ledger":{"description":"Coverage Ledger YAML; with --root this must be exactly .cambium/state/coverage_ledger.yaml","type":"string","x-cambium-cli":{"action":"store","option_strings":["--ledger"]}},"progress_ledger":{"description":"Progress Ledger YAML; required with --root and must be exactly .cambium/state/progress_ledger.yaml","type":"string","x-cambium-cli":{"action":"store","option_strings":["--progress-ledger"]}},"proof":{"description":"path to the terminal proof YAML file","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"vault root; when given, path-valued proof fields must exist and selected routes, Cards, and kernel Read Sets must agree with the canonical route indexes","type":"string","x-cambium-cli":{"action":"store","option_strings":["--root"]}},"template":{"default":"Tools/schemas/terminal_proof.template.yaml","description":"field-list template (default Tools/schemas/terminal_proof.template.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--template"]}}},"required":["proof"],"type":"object"},"name":"check_proof"},{"description":"Validate canonical Required Queue state","inputSchema":{"additionalProperties":false,"properties":{"ack_activation_piece":{"description":"return one delivered piece nonce as same-context delivery evidence","type":"string","x-cambium-cli":{"action":"store","option_strings":["--ack-activation-piece"]}},"boundary_gate_receipt":{"default":[],"description":"current gate evidence supplied to --require-revalidation","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--boundary-gate-receipt"]}},"budget_manifest_receipt":{"description":"closed budget-manifest receipt ID supplied to --require-maintenance-complete","type":"string","x-cambium-cli":{"action":"store","option_strings":["--budget-manifest-receipt"]}},"confirmation_receipt":{"description":"confirmation evidence supplied to --require-ready","type":"string","x-cambium-cli":{"action":"store","option_strings":["--confirmation-receipt"]}},"deliver_activation_piece":{"description":"deliver one frozen activation piece of BATCH_ID inside the protocol delivery budget","type":"string","x-cambium-cli":{"action":"store","option_strings":["--deliver-activation-piece"]}},"deliver_readback":{"description":"deliver one registered conditional Card read-back source for an already-open batch","type":"string","x-cambium-cli":{"action":"store","option_strings":["--deliver-readback"]}},"json":{"default":false,"description":"write this run's receipt object to stdout as one canonical JSON array and move the human report to stderr; receipt writing and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"ledger_advance_receipt":{"description":"Coverage Ledger advance receipt ID supplied to --require-maintenance-complete","type":"string","x-cambium-cli":{"action":"store","option_strings":["--ledger-advance-receipt"]}},"piece":{"description":"frozen activation piece selected with --deliver-activation-piece or --ack-activation-piece","type":"string","x-cambium-cli":{"action":"store","option_strings":["--piece"]}},"piece_delivery_receipt":{"description":"delivery receipt the acknowledged nonce came from, supplied to --ack-activation-piece","type":"string","x-cambium-cli":{"action":"store","option_strings":["--piece-delivery-receipt"]}},"piece_nonce":{"description":"nonce returned from the delivered piece, supplied to --ack-activation-piece","type":"string","x-cambium-cli":{"action":"store","option_strings":["--piece-nonce"]}},"readback_rule":{"description":"registered rule selected with --deliver-readback","type":"string","x-cambium-cli":{"action":"store","option_strings":["--readback-rule"]}},"receipts":{"description":"repository-relative JSONL receipt path","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"require_complete":{"default":false,"description":"build completion gate: prove no Required work remains","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--require-complete"]}},"require_maintenance_complete":{"default":false,"description":"maintenance completion gate: prove one bounded maintenance run is complete","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--require-maintenance-complete"]}},"require_ready":{"description":"prove BATCH_ID is queued and ready to activate","type":"string","x-cambium-cli":{"action":"store","option_strings":["--require-ready"]}},"require_revalidation":{"description":"prove BATCH_ID may produce its Standards revalidation aggregate","type":"string","x-cambium-cli":{"action":"store","option_strings":["--require-revalidation"]}},"resume_status":{"default":false,"description":"show interruption-safe task and batch resume state","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--resume-status"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"watermark_advance_receipt":{"description":"watermark advance receipt ID supplied to --require-maintenance-complete","type":"string","x-cambium-cli":{"action":"store","option_strings":["--watermark-advance-receipt"]}}},"required":["root"],"type":"object"},"name":"check_queue","x-cambium-mutually-exclusive":[{"dests":["require_ready","require_revalidation","require_complete","require_maintenance_complete","resume_status","deliver_readback","deliver_activation_piece","ack_activation_piece"],"required":false}]},{"description":"Find profile-configured residual content outside accepted roots.","inputSchema":{"additionalProperties":false,"properties":{"config":{"description":"profile-owned restricted YAML scan configuration","type":"string","x-cambium-cli":{"action":"store","option_strings":["--config"]}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human summary to stderr; receipt writing and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"positive_controls_only":{"default":false,"description":"execute the registered controls through the production classifier without scanning repository content","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--positive-controls-only"]}},"receipts":{"description":"optional JSONL receipt path","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"scan_id":{"description":"stable ID from the selected profile's scan registry","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scan-id"]}},"time_limit":{"default":55.0,"description":"hard evidence-production budget in seconds (greater than 0 and at most 55)","type":"number","x-cambium-cli":{"action":"store","option_strings":["--time-limit"],"type":"float"}},"vault_root":{"description":"knowledge-vault root to scan","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root","scan_id","config"],"type":"object"},"name":"check_residual_content"},{"description":"Validate the selected profile's Structure Registry against the vault (gate: structure-registry).","inputSchema":{"additionalProperties":false,"properties":{"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable summary to stderr; receipts written and the exit code are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"profile":{"description":"profile directory override; default is the selected_profile_manifest of the active Standards state","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root"],"type":"object"},"name":"check_structure"},{"description":"Frontmatter controlled-vocabulary check","inputSchema":{"additionalProperties":false,"properties":{"exclude":{"default":[],"description":"subpath to exclude (repeatable; e.g. the compiled kernel/Cards artifacts, whose frontmatter is not governed by the K08 module's knowledge-page schema)","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human summary to stderr; receipt writing and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"policy_fingerprint":{"description":"effective-policy fingerprint (kblib.effective_priority_policy) the quotas were resolved from; recorded on the priority-quota-compliance receipt so its consumers can bind the policy identity, never re-derive it","type":"string","x-cambium-cli":{"action":"store","option_strings":["--policy-fingerprint"]}},"quota_p0":{"default":15.0,"description":"P0 priority quota in percent (default 15; kernel default; the selected profile manifest or task contract may override)","type":"number","x-cambium-cli":{"action":"store","option_strings":["--quota-p0"],"type":"float"}},"quota_p1":{"default":35.0,"description":"P1 priority quota in percent (default 35; kernel default; the selected profile manifest or task contract may override)","type":"number","x-cambium-cli":{"action":"store","option_strings":["--quota-p1"],"type":"float"}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"scope":{"description":"only scan .md files under this subpath","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"vocab":{"description":"path to vocab.yaml (defaults to vocab.yaml next to this script)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--vocab"]}}},"required":["vault_root"],"type":"object"},"name":"check_vocab"},{"description":"Compile the machine-readable CLI invocation contract from every Tools/*.py argparse declaration.","inputSchema":{"additionalProperties":false,"properties":{"check":{"default":false,"description":"recompute and compare against the existing output; exit 0 when byte-identical, 2 when it is stale or hand-edited","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"output":{"description":"artifact path to write or verify (default: /Tools/compiled/cli-contract.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output"]}},"root":{"description":"repository root whose Tools/ directory is compiled","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"compile_cli_contract"},{"description":"Compile Required Queue from explicit Coverage assignments","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may apply a Queue write or replan","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"amendment_id":{"description":"registered Amendment id authorizing the replan; required with --apply-replan","type":"string","x-cambium-cli":{"action":"store","option_strings":["--amendment-id"]}},"apply":{"default":false,"description":"materialize an initially empty Queue","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"apply_replan":{"default":false,"description":"apply a controlled structural diff to a non-empty Queue","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply-replan"]}},"coverage_proposal":{"description":"repository-contained .cambium/deltas/replans/*.coverage.yaml input","type":"string","x-cambium-cli":{"action":"store","option_strings":["--coverage-proposal"]}},"expected_coverage_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Coverage; the replan is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-coverage-sha256"]}},"expected_progress_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Progress; the replan is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-progress-sha256"]}},"expected_queue_revision":{"description":"compare-and-swap guard: the queue_revision the caller read from the current Queue; the write is refused when the live value differs","type":"integer","x-cambium-cli":{"action":"store","option_strings":["--expected-queue-revision"],"type":"int"}},"expected_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Queue; the write is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-sha256"]}},"expected_state_revision":{"description":"compare-and-swap guard: the state_revision the caller read from the current Queue; the replan is refused when the live value differs","type":"integer","x-cambium-cli":{"action":"store","option_strings":["--expected-state-revision"],"type":"int"}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human-readable report to stderr; receipt writing, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"output":{"description":"repository-relative proposal path","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output"]}},"receipts":{"default":".cambium/receipts/queue-structure.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"replan_diff":{"description":"existing .cambium/tmp/*.yaml diff to consume","type":"string","x-cambium-cli":{"action":"store","option_strings":["--replan-diff"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"compile_queue","x-cambium-mutually-exclusive":[{"dests":["apply","apply_replan"],"required":false}]},{"description":"Compose the effective frontmatter page contract from the kernel bases and the selected profile's Metadata Contract.","inputSchema":{"additionalProperties":false,"properties":{"base":{"description":"applicability base to compile from (default: kernel/K08 Metadata and Status/applicability-base.yaml under --root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--base"]}},"check":{"default":false,"description":"recompute and compare against the existing output; exit 0 when byte-identical, 2 otherwise","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"output":{"description":"compiled page contract to write, or to compare against under --check (default: Tools/page_contract.yaml under --root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output"]}},"profile":{"description":"profile directory for a validation run; the vault selection stays with K00/03","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"relationships":{"description":"relationship base to compile from (default: kernel/K08 Metadata and Status/relationship-base.yaml under --root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--relationships"]}},"root":{"default":".","description":"vault root (default: this repository)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--root"]}},"sources_role":{"description":"sources-role base to compile from (default: kernel/K07 Sources and Accuracy/sources-role-base.yaml under --root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--sources-role"]}}},"type":"object"},"name":"compose_page_contract"},{"description":"Deterministically compose the vocabulary artifact from the kernel base and the selected profile's extensions.","inputSchema":{"additionalProperties":false,"properties":{"base":{"default":"kernel/K08 Metadata and Status/vocabulary-base.yaml","description":"the kernel vocabulary base the extensions are appended to (default: kernel/K08 Metadata and Status/vocabulary-base.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--base"]}},"check":{"default":false,"description":"recompute and compare against the existing output; exit 0 when values and provenance are identical, 2 otherwise","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"extensions":{"description":"the active profile's vocabulary-extensions.yaml. Canonical adopter Standards state selects the path; when this flag is present it must name that same path","type":"string","x-cambium-cli":{"action":"store","option_strings":["--extensions"]}},"output":{"default":"Tools/vocab.yaml","description":"composed vocabulary artifact to write, or to compare against under --check (default: Tools/vocab.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output"]}}},"type":"object"},"name":"compose_vocab"},{"description":"Cross-file duplicate paragraph candidate detection (for maintenance runs and governance tasks)","inputSchema":{"additionalProperties":false,"properties":{"exclude":{"description":"skip files whose path contains this component (repeatable; default: legacy)","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable report to stderr; receipts written, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"receipts":{"description":"JSONL path to append machine-readable receipts to (shared convention, Tools/schemas/receipt.template.jsonl)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"scope":{"description":"subpath (relative to vault, or absolute): only report similar pairs with at least one side under it","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope"]}},"vault":{"default":".","description":"vault root directory (default: current directory)","type":"string","x-cambium-cli":{"action":"store","nargs":"?","option_strings":[]}}},"type":"object"},"name":"duplicate_check"},{"description":"Initialize empty Cambium runtime state","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"materialize .cambium/; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"at":{"description":"initial Coverage timestamp (default: current UTC)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--at"]}},"completion_semantics":{"description":"build requires completion-candidate plus Terminal Proof; maintenance closes directly through the bounded maintenance completion gate","enum":["build","maintenance"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--completion-semantics"]}},"concurrency_cap":{"description":"explicit task-contract override of K13/10's concurrency cap; omit it to take the selected profile manifest's registered override, or the kernel default 3 when the manifest registers none","type":"integer","x-cambium-cli":{"action":"store","option_strings":["--concurrency-cap"],"type":"int"}},"contract_version":{"default":"c1","description":"non-empty task-contract version recorded on the Progress Ledger contract","type":"string","x-cambium-cli":{"action":"store","option_strings":["--contract-version"]}},"exclusions":{"default":[],"description":"explicit out-of-scope item; repeatable","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"objective":{"description":"non-empty statement of the task outcome","type":"string","x-cambium-cli":{"action":"store","option_strings":["--objective"]}},"profile_manifest":{"description":"repository-relative selected profile manifest; must equal the selected_profile_manifest of the canonical adopter Standards state","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile-manifest"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"scope_version":{"description":"non-empty scope identity stamped on the Queue, Coverage Ledger and task contract","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope-version"]}},"standards_version":{"description":"Standards version this runtime adopts; must equal the approved standards_version of the canonical adopter Standards state","type":"string","x-cambium-cli":{"action":"store","option_strings":["--standards-version"]}},"task_id":{"description":"non-empty task identity stamped on the Queue, Coverage Ledger and Progress Ledger","type":"string","x-cambium-cli":{"action":"store","option_strings":["--task-id"]}}},"required":["root","task_id","objective","scope_version","standards_version","profile_manifest","completion_semantics"],"type":"object"},"name":"init_state"},{"description":"Compile and load Cambium's closed metadata-execution authority contract. This module is deliberately the single authority boundary between metadata declarations and executable writers. A field rule is executable only when an installed writer capability declares the same ``(field, transition, adapter)`` operation, and every installed writer operation must be authorized by exactly one rule. Unknown keys, unknown adapters, orphan implementations, and partial evidence bindings fail closed.","inputSchema":{"additionalProperties":false,"properties":{"authority":{"default":"kernel/K08 Metadata and Status/metadata-authority-base.yaml","type":"string","x-cambium-cli":{"action":"store","option_strings":["--authority"]}},"capabilities":{"default":"Tools/operation-capabilities.yaml","type":"string","x-cambium-cli":{"action":"store","option_strings":["--capabilities"]}},"check":{"default":false,"type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"output":{"default":"Tools/compiled/metadata-execution-contract.json","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output"]}},"root":{"default":".","type":"string","x-cambium-cli":{"action":"store","option_strings":["--root"]}}},"type":"object"},"name":"metadata_execution_contract"},{"description":"Migrate existing runtime identity to Standards state","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"write state; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"migrate_standards_state"},{"description":"Read-only onboarding status projector: derives the adoption/onboarding state of one root and exactly one next_action token; writes nothing and owns no ledger","inputSchema":{"additionalProperties":false,"properties":{"json":{"default":false,"description":"emit the status view as one deterministic JSON object instead of the human summary","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"profile_id":{"description":"target one candidate profile directory name under profiles/ for the full profile-load evaluation (defaults to the single candidate when exactly one exists)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile-id"]}},"root":{"description":"the adopting repository root to project","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"profile_onboarding_status"},{"description":"Project metadata-contract owner state onto page frontmatter","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"take the runtime writer lock and publish the projection; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"page":{"description":"limit to these repository-relative pages (repeatable); default is every Ledger page","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--page"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"project_page_state"},{"description":"Record one snapshot-bound Batch Review judgment","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"append the evidence; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"batch":{"description":"exact open Queue batch ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--batch"]}},"json":{"default":false,"description":"write the applied receipt as one JSON array","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"judgment_item":{"description":"registered Batch Review Requirement Judgment Item ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--judgment-item"]}},"receipts":{"default":".cambium/receipts/batch-judgments.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"reviewer_role":{"description":"declared pass-authority Profile role ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--reviewer-role"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"statement":{"description":"bounded judgment statement (the concrete verdict, not \"reviewed\")","type":"string","x-cambium-cli":{"action":"store","option_strings":["--statement"]}},"target":{"description":"manifest page path, or the batch ID for a batch-selector requirement","type":"string","x-cambium-cli":{"action":"store","option_strings":["--target"]}}},"required":["root","batch","judgment_item","target","reviewer_role","statement"],"type":"object"},"name":"record_batch_judgment"},{"description":"Record a Profile-authorized Corpus Planning semantic decision as machine-readable JSONL","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"description":"declared authority Role ID; required with --apply and must equal the Profile/plan binding","type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"append the structural and semantic receipts; default is dry-run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"plan":{"description":"closed restricted-YAML acceptance decision plan; one .yaml file directly under .cambium/deltas/corpus-plan-acceptances/","type":"string","x-cambium-cli":{"action":"store","option_strings":["--plan"]}},"receipts":{"default":".cambium/receipts/corpus-plan-acceptance.jsonl","description":"repository-relative JSONL path the receipts are appended to (default: .cambium/receipts/corpus-plan-acceptance.jsonl)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","plan"],"type":"object"},"name":"record_corpus_acceptance"},{"description":"Record snapshot-bound manual Extension Gate evidence","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"description":"declared pass-authority Profile role ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"append the evidence; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"gate_id":{"description":"exact typed Profile Extension Gate ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--gate-id"]}},"json":{"default":false,"description":"write the applied receipt as one JSON array","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"page":{"description":"repository-relative Markdown target","type":"string","x-cambium-cli":{"action":"store","option_strings":["--page"]}},"receipts":{"default":".cambium/receipts/gate-attestations.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"statement":{"description":"bounded manual attestation statement","type":"string","x-cambium-cli":{"action":"store","option_strings":["--statement"]}},"value":{"description":"requested registered completion value","type":"string","x-cambium-cli":{"action":"store","option_strings":["--value"]}}},"required":["root","gate_id","page","value","actor_role","statement"],"type":"object"},"name":"record_gate_attestation"},{"description":"Run a registered scan and record a deterministic Extension Gate result","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"run and append the bound Gate result","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"gate_id":{"description":"exact deterministic typed Profile Gate ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--gate-id"]}},"json":{"default":false,"description":"write the applied receipt as one JSON array","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"page":{"description":"repository-relative Markdown target","type":"string","x-cambium-cli":{"action":"store","option_strings":["--page"]}},"receipts":{"default":".cambium/receipts/gate-results.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","gate_id","page"],"type":"object"},"name":"record_gate_result"},{"description":"Register one approved current-protocol Amendment","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may register or withdraw an Amendment","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"amendment_id":{"description":"id for a queue-replan registration; cross-Ledger operations derive it from --plan instead","type":"string","x-cambium-cli":{"action":"store","option_strings":["--amendment-id"]}},"apply":{"default":false,"description":"write the registration; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"approval_reference":{"description":"explicit-user approval reference; required when --decision-mode is explicit-user","type":"string","x-cambium-cli":{"action":"store","option_strings":["--approval-reference"]}},"coverage_proposal":{"description":".cambium/deltas/replans/*.coverage.yaml proposal","type":"string","x-cambium-cli":{"action":"store","option_strings":["--coverage-proposal"]}},"date":{"description":"YYYY-MM-DD; must equal the UTC registration date","type":"string","x-cambium-cli":{"action":"store","option_strings":["--date"]}},"decision_mode":{"default":"auto","description":"derive delegated authority by default; explicit-user requires --approval-reference","enum":["auto","contract-delegated","explicit-user"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--decision-mode"]}},"expected_coverage_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Coverage; registration is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-coverage-sha256"]}},"expected_progress_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Progress; registration is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-progress-sha256"]}},"expected_queue_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Queue; registration is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-queue-sha256"]}},"json":{"default":false,"description":"write the published receipt to stdout as one canonical JSON array and move the human report to stderr; a dry run publishes no receipt and so writes nothing there; receipt writing and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"operation":{"description":"Amendment operation being registered","enum":["cancel-batch","gap-routing-reconciliation","property-state-migration","queue-replan","scope-replan"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--operation"]}},"plan":{"description":".cambium/deltas/amendments/*.yaml plan","type":"string","x-cambium-cli":{"action":"store","option_strings":["--plan"]}},"reason":{"description":"nonempty withdrawal reason recorded on the row and its receipt","type":"string","x-cambium-cli":{"action":"store","option_strings":["--reason"]}},"receipts":{"default":".cambium/receipts/amendments.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"summary":{"description":"non-empty one-line rationale recorded on the row","type":"string","x-cambium-cli":{"action":"store","option_strings":["--summary"]}},"withdraw":{"description":"retire the named pending registration instead of registering one (K13/06 withdrawal); requires --reason","type":"string","x-cambium-cli":{"action":"store","option_strings":["--withdraw"]}}},"required":["root","expected_coverage_sha256","expected_progress_sha256","expected_queue_sha256"],"type":"object"},"name":"register_amendment"},{"description":"Render the K08/09 boundary projection blocks from page `boundary` frontmatter.","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"rewrite the stale owned blocks atomically; omit to only report what would render","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"check":{"default":false,"description":"exit 2 when any owned block is stale; the default report never fails on staleness","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"contract":{"default":"Tools/page_contract.yaml","description":"compiled contract path (default Tools/page_contract.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--contract"]}},"profile":{"description":"profile directory override; default is the selected_profile_manifest of the active Standards state","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"scope":{"description":"only scan .md files under this subpath","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root"],"type":"object"},"name":"render_boundary_projection"},{"description":"Render the Cambium MCP server's registration and corpus binding into the configuration file each supported host reads.","inputSchema":{"additionalProperties":false,"properties":{"check":{"default":false,"description":"re-render and compare against the existing products; exit 0 when byte-identical, 2 when one is stale or hand-edited","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"distribution_root":{"description":"absolute path of the Cambium checkout the server is launched from; substituted for (default: leave the placeholder)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--distribution-root"]}},"host":{"description":"render only this host's product (default: every host)","enum":["claude-code","codex","dsh-env","dsh-profile-patch","kimi-code"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--host"]}},"output_dir":{"description":"directory to write or verify the products in (default: /Tools/compiled/host-configs)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output-dir"]}},"projection":{"description":"compiled interface projection to bind to (default: /Tools/compiled/mcp-tools.json)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--projection"]}},"root":{"description":"repository root holding the compiled interface projection","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"sources":{"default":false,"description":"print the declaration source of every rendered field and exit without reading or writing any product","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--sources"]}},"workspace_root":{"description":"absolute path of the corpus repository this registration is bound to; substituted for (default: leave the placeholder)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--workspace-root"]}}},"required":["root"],"type":"object"},"name":"render_host_configs","x-cambium-mutually-exclusive":[{"dests":["check","sources"],"required":false}]},{"description":"Project the compiled CLI invocation contract into the agent-facing interface forms registered in this tool.","inputSchema":{"additionalProperties":false,"properties":{"check":{"default":false,"description":"recompute and compare against the existing artifacts; exit 0 when byte-identical, 2 when one is stale or hand-edited","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"contract":{"description":"compiled CLI contract to project (default: /Tools/compiled/cli-contract.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--contract"]}},"form":{"description":"project only this form (default: every registered form)","enum":["mcp"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--form"]}},"output":{"description":"artifact path to write or verify; requires --form, because one path cannot hold two forms","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output"]}},"root":{"description":"repository root holding the compiled CLI contract","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"sources":{"default":false,"description":"print the declaration source of every projected field and exit without reading or writing any artifact","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--sources"]}}},"required":["root"],"type":"object"},"name":"render_interface_projection","x-cambium-mutually-exclusive":[{"dests":["check","sources"],"required":false}]},{"description":"Render Required Queue human report","inputSchema":{"additionalProperties":false,"properties":{"check":{"default":false,"description":"compare existing report instead of writing","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"output":{"default":".cambium/reports/required_queue.md","description":"repository-relative report path","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"stdout":{"default":false,"description":"print the report to stdout and write nothing","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--stdout"]}}},"required":["root"],"type":"object"},"name":"render_queue"},{"description":"Render derived Structure Registry coverage projections (K01/05 derived roles).","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"rewrite the stale owned blocks atomically; omit to only report what would render","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"check":{"default":false,"description":"exit 2 when any owned block is stale or missing; the default report never fails on staleness","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"profile":{"description":"profile directory override; default is the selected_profile_manifest of the active Standards state","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root"],"type":"object"},"name":"render_structure_projection"},{"description":"Run the adopter verification set derived from the K00/12 Stable Gate ID Registry (deterministic, not-batch-scoped producers).","inputSchema":{"additionalProperties":false,"properties":{"exclude":{"default":[],"description":"path prefix passed through to scanners that accept it (repeatable)","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"list":{"default":false,"description":"print the derived set and each command without running anything","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--list"]}},"profile":{"description":"profile directory override; default is the live runtime's selected_profile_manifest","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"root":{"description":"repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"run_gates"},{"description":"Scaffold a candidate profile from profiles/_template using the exact-copy whitelist in profiles/template-files.yaml","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"create the candidate; without it the plan is reported and nothing is written","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"json":{"default":false,"description":"emit the plan/result as one JSON document","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"profile_id":{"description":"candidate profile slug matching [a-z0-9][a-z0-9_-]* (equals the directory name)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile-id"]}},"root":{"description":"repository root containing profiles/","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","profile_id"],"type":"object"},"name":"scaffold_profile"},{"description":"Seal verified frozen receipt history (K12/07). --apply is a maintenance-window operation: run it only with no other Cambium or adopter writer, checker or receipt appender active against this repository.","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"write the seal, or with --reconcile finish the interrupted one; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable report to stderr; receipts written, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"receipts":{"default":".cambium/receipts/seal-receipts.jsonl","description":"repository-relative JSONL path for this tool's own seal receipts, which never seal (default: .cambium/receipts/seal-receipts.jsonl)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"reconcile":{"default":false,"description":"finish an interrupted seal over the publication paths this tool implements; other interruptions fail closed and are resolved by the runbook in Tools/README.md","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--reconcile"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"verify":{"default":false,"description":"re-prove every sealed segment, projection and seal-receipt binding, then exit","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--verify"]}}},"required":["root"],"type":"object"},"name":"seal_receipts"},{"description":"Stamp kernel Runtime Cards","inputSchema":{"additionalProperties":false,"properties":{"acknowledge_compiled":{"default":false,"description":"after semantic regeneration/review, advance compiled_source_hash to the exact current source digest","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--acknowledge-compiled"]}},"cards_dir":{"default":"kernel/Cards","description":"Card directory relative to (default: kernel/Cards)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--cards-dir"]}},"check":{"default":false,"description":"verify only; never write","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"root":{"description":"repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"set_version":{"description":"also set every card's compiled_from value","type":"string","x-cambium-cli":{"action":"store","option_strings":["--set-version"]}}},"required":["root"],"type":"object"},"name":"stamp_cards"},{"description":"Apply one Required Queue transition","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; Queue transition planning and apply both require integrator","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"write the transition; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"at":{"description":"transition timestamp; defaults to now in UTC","type":"string","x-cambium-cli":{"action":"store","option_strings":["--at"]}},"batch_receipt":{"default":[],"description":"batch-review gate receipt id for open -> merge-ready; exactly one is accepted","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--batch-receipt"]}},"close_gate_receipt":{"description":"check_batch_close receipt id required by the closed transition","type":"string","x-cambium-cli":{"action":"store","option_strings":["--close-gate-receipt"]}},"confirmation_receipt":{"description":"confirmation receipt id required by queued -> open when the batch is confirmation_required","type":"string","x-cambium-cli":{"action":"store","option_strings":["--confirmation-receipt"]}},"delta_apply_receipt":{"description":"apply_delta receipt id required by the closed transition and by merge-ready -> open reopen","type":"string","x-cambium-cli":{"action":"store","option_strings":["--delta-apply-receipt"]}},"delta_path":{"description":"repository-relative .cambium/deltas/.yaml batch delta required by open -> merge-ready","type":"string","x-cambium-cli":{"action":"store","option_strings":["--delta-path"]}},"expected_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Queue; the write is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-sha256"]}},"expected_state_revision":{"description":"compare-and-swap guard: the state_revision the caller read from the current Queue; the write is refused when the live value differs","type":"integer","x-cambium-cli":{"action":"store","option_strings":["--expected-state-revision"],"type":"int"}},"gate_receipt":{"description":"gate receipt id: activation gate for queued -> open, Queue consistency gate for closed and for clearing revalidation-required","type":"string","x-cambium-cli":{"action":"store","option_strings":["--gate-receipt"]}},"hold_state":{"description":"target hold state; exclusive with --transition","enum":["blocked","confirmation-required","none","paused","revalidation-required"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--hold-state"]}},"id":{"description":"Required Queue batch id to transition","type":"string","x-cambium-cli":{"action":"store","option_strings":["--id"]}},"json":{"default":false,"description":"write the applied transition receipt(s) to stdout as one canonical JSON array and move the human report to stderr; a dry run publishes no receipt and so writes nothing there; receipt writing and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"reason":{"description":"non-empty rationale required by merge-ready -> open and by any non-none hold","type":"string","x-cambium-cli":{"action":"store","option_strings":["--reason"]}},"receipts":{"default":".cambium/receipts/queue-transitions.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"standards_revalidation_receipt":{"description":"check_queue --require-revalidation receipt discharging an outstanding Standards revalidation; queued -> open or revalidation-required -> none only","type":"string","x-cambium-cli":{"action":"store","option_strings":["--standards-revalidation-receipt"]}},"transition":{"description":"target lifecycle state; exclusive with --hold-state","enum":["closed","merge-ready","open"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--transition"]}}},"required":["root","id"],"type":"object"},"name":"update_queue","x-cambium-mutually-exclusive":[{"dests":["transition","hold_state"],"required":true}]},{"description":"Apply one canonical task-state transition","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may apply a task-state write","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"write the transition; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"at":{"description":"transition timestamp; defaults to now in UTC","type":"string","x-cambium-cli":{"action":"store","option_strings":["--at"]}},"checkpoint_summary":{"description":"non-empty reason required by paused, blocked and cancelled, and when leaving completion-candidate for anything but complete","type":"string","x-cambium-cli":{"action":"store","option_strings":["--checkpoint-summary"]}},"expected_progress_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Progress; --apply is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-progress-sha256"]}},"expected_queue_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Queue; --apply is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-queue-sha256"]}},"json":{"default":false,"description":"write the applied transition receipt to stdout as one canonical JSON array and move the human report to stderr; a dry run publishes no receipt and so writes nothing there; receipt writing and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"maintenance_completion_receipt":{"description":"maintenance completion gate receipt id required by complete under maintenance completion_semantics","type":"string","x-cambium-cli":{"action":"store","option_strings":["--maintenance-completion-receipt"]}},"queue_check_receipt":{"description":"Queue completion gate receipt id required by the completion-candidate transition","type":"string","x-cambium-cli":{"action":"store","option_strings":["--queue-check-receipt"]}},"receipts":{"default":".cambium/receipts/task-transitions.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"terminal_proof_receipt":{"description":"Terminal Proof receipt id required by complete under build completion_semantics","type":"string","x-cambium-cli":{"action":"store","option_strings":["--terminal-proof-receipt"]}},"transition":{"description":"target task state in the Progress Ledger","enum":["active","blocked","cancelled","complete","completion-candidate","paused"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--transition"]}}},"required":["root","transition"],"type":"object"},"name":"update_task"}],"transports":["stdio","streamable-http"]} diff --git a/Tools/compiled/metadata-execution-contract.json b/Tools/compiled/metadata-execution-contract.json index b9d501c..c562ec5 100644 --- a/Tools/compiled/metadata-execution-contract.json +++ b/Tools/compiled/metadata-execution-contract.json @@ -1 +1 @@ -{"artifact":"metadata-execution-contract","capability_implementations":[{"path":"Tools/apply_amendment.py","sha256":"sha256:d541f4de5caa0b55c68817c406c820de856a675b030a716eaab10e47f3fad4d8"},{"path":"Tools/apply_delta.py","sha256":"sha256:3749db54ecc0d713c657eb32d1fe52011d65eb64e3a4c4938430344bcfe957d2"},{"path":"Tools/apply_metadata_transition.py","sha256":"sha256:71d687f1a2afb4006dc19b90bcb27e886ca46ce6e577d294802925523e7ae0cd"},{"path":"Tools/apply_task_plan.py","sha256":"sha256:99b47d8dfc2366098ebb3f7d285dec2bc84c0c834c39efea3b846a06b0a36f5d"},{"path":"Tools/card_activation.py","sha256":"sha256:a5106bf4db90eccfd078ffbd436846c753de5c1a01eb4fb3842ed934b5cecf97"},{"path":"Tools/check_batch_close.py","sha256":"sha256:bc2326400a6dde7863fd1384382475ea98fa78592cd0b67d84e3c817b5bf4d16"},{"path":"Tools/check_queue.py","sha256":"sha256:1ecaec9019b013358f2afda142585d3ca48360eebf90633da7b6d149ebc5c523"},{"path":"Tools/mcp_server.py","sha256":"sha256:9242ac64abe3baf24d8e6e9586c9bf8bd08ac708e802ee6bd12de00a267db270"},{"path":"Tools/metadata_gate_runtime.py","sha256":"sha256:da4aebb718dcbb37f31116c25e6cee3e374fa1e0a3edb87ab96eac6106ab22a3"},{"path":"Tools/metadata_property_state.py","sha256":"sha256:9fa07bf32b366a0bc1797006485b78f4d614b60c97f8b05c0e3dfa1c16ba2d43"},{"path":"Tools/project_page_state.py","sha256":"sha256:77c500cfbb0435f78908f8ab680f3fa4858c2c4d54cb90ce53e5870ddcfa3de4"},{"path":"Tools/record_gate_attestation.py","sha256":"sha256:73e8ad584a4c8e77f3510c09666496c2c7f2a2dd4b24b8394d6f41f9b9a81e3e"},{"path":"Tools/record_gate_result.py","sha256":"sha256:6111c6ff8bd5bf28fdb659cc891db318c314bd878cc9b75d86c6e2b9a97ed8d0"},{"path":"Tools/register_amendment.py","sha256":"sha256:917e0df2c028908b752e58894b61237807778e169e8e452d96d70458d0317fdc"},{"path":"Tools/update_queue.py","sha256":"sha256:3680ae8592ea307542de1b86bb808cc99e1153b1b244c8aeed8680bf0f7a77ae"}],"contract_fingerprint":"sha256:0be1a3e5168299090c72f25f39eb57bacf855a1fb3cd5491e2380aaadccedba4","contract_id":"kernel-metadata-execution","field_rules":[{"authority_class":"ledger-projection","canonical_owner":"coverage-ledger.pages[].authoring_status","evidence_requirement":null,"field":"authoring_status","invalidation_rule":"owner-value-change-v1","reconcile_policy":"existing-copy-exact-or-remove-v1","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection","value_shape":"scalar-string-or-null","write_timing":"batch-close-after-owner-update","writer_capability":"project-page-state-v2"},{"authority_class":"ledger-projection","canonical_owner":"coverage-ledger.pages[].coverage_disposition","evidence_requirement":null,"field":"coverage_disposition","invalidation_rule":"owner-value-change-v1","reconcile_policy":"existing-copy-exact-or-remove-v1","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection","value_shape":"scalar-string-or-null","write_timing":"batch-close-after-owner-update","writer_capability":"project-page-state-v2"},{"authority_class":"ledger-projection","canonical_owner":"coverage-ledger.pages[].property_state.last_content_modified","evidence_requirement":null,"field":"last_content_modified","invalidation_rule":"owner-property-state-change-v1","reconcile_policy":"upsert-exact-or-remove-v1","source_adapter":"coverage-property-state-v1","transition":"owner-to-page-projection","value_shape":"date","write_timing":"after-owner-state-transition","writer_capability":"project-page-state-v2"},{"authority_class":"evidence-projection","canonical_owner":"coverage-ledger.pages[].property_state.last_content_modified","evidence_requirement":{"change_scope":"semantic-content","content_binding":"after-page-content-sha256","excluded_change_classes":["projection-only","tool-controlled-metadata-only"],"invalidation":"current-content-fingerprint","protocol":"semantic-content-change-v1","result":"pass","target_binding":"exact-page-path","value_selector":"accepted-at-utc-date"},"field":"last_content_modified","invalidation_rule":"superseded-by-later-semantic-content-change-v1","reconcile_policy":"upsert-owner-property-state-v1","source_adapter":"content-change-event-v1","transition":"semantic-content-change","value_shape":"date","write_timing":"semantic-content-acceptance","writer_capability":"metadata-transition-integrator-v1"},{"authority_class":"ledger-projection","canonical_owner":"coverage-ledger.pages[].property_state.last_reviewed","evidence_requirement":null,"field":"last_reviewed","invalidation_rule":"semantic-content-change-tombstone-v1","reconcile_policy":"upsert-exact-or-remove-v1","source_adapter":"coverage-property-state-v1","transition":"owner-to-page-projection","value_shape":"date","write_timing":"after-owner-state-transition","writer_capability":"project-page-state-v2"},{"authority_class":"evidence-projection","canonical_owner":"coverage-ledger.pages[].property_state.last_reviewed","evidence_requirement":{"change_scope":"reviewed-content","content_binding":"exact-page-content-sha256","excluded_change_classes":[],"invalidation":"invalidated-by-null","protocol":"current-page-review-v1","result":"pass","target_binding":"exact-page-path","value_selector":"checked-at-utc-date"},"field":"last_reviewed","invalidation_rule":"superseded-by-review-or-semantic-content-change-v1","reconcile_policy":"upsert-owner-property-state-v1","source_adapter":"current-review-receipt-value-v1","transition":"review-completed","value_shape":"date","write_timing":"review-evidence-acceptance","writer_capability":"metadata-transition-integrator-v1"},{"authority_class":"evidence-projection","canonical_owner":"coverage-ledger.pages[].property_state.last_reviewed","evidence_requirement":{"change_scope":"semantic-content","content_binding":"after-page-content-sha256","excluded_change_classes":["projection-only","tool-controlled-metadata-only"],"invalidation":"current-content-fingerprint","protocol":"semantic-content-change-v1","result":"pass","target_binding":"exact-page-path","value_selector":"tombstone-null"},"field":"last_reviewed","invalidation_rule":"semantic-content-change-tombstone-v1","reconcile_policy":"tombstone-owner-property-state-v1","source_adapter":"content-change-event-v1","transition":"semantic-content-change","value_shape":"date","write_timing":"semantic-content-acceptance","writer_capability":"metadata-transition-integrator-v1"},{"authority_class":"ledger-projection","canonical_owner":"coverage-ledger.pages[].next_batch","evidence_requirement":null,"field":"next_batch","invalidation_rule":"owner-value-change-v1","reconcile_policy":"existing-copy-exact-or-remove-v1","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection","value_shape":"scalar-string-or-null","write_timing":"batch-close-after-owner-update","writer_capability":"project-page-state-v2"}],"operation_capabilities":[{"capability_id":"metadata-transition-integrator-v1","capability_version":"1.0.0","implementation_paths":["Tools/apply_metadata_transition.py","Tools/metadata_property_state.py"],"kind":"consumer","operations":[{"operation":"typed-field-metadata-transition"}]},{"capability_id":"card-context-delivery-v1","capability_version":"1.0.2","implementation_paths":["Tools/card_activation.py","Tools/check_queue.py","Tools/mcp_server.py","Tools/update_queue.py"],"kind":"producer","operations":[]},{"capability_id":"manual-attestation-v1","capability_version":"1.0.0","implementation_paths":["Tools/record_gate_attestation.py"],"kind":"producer","operations":[]},{"capability_id":"registered-scan-v1","capability_version":"1.0.0","implementation_paths":["Tools/record_gate_result.py"],"kind":"producer","operations":[]},{"capability_id":"deterministic-gate-result-v1","capability_version":"1.0.0","implementation_paths":["Tools/metadata_gate_runtime.py"],"kind":"receipt-schema","operations":[]},{"capability_id":"manual-gate-attestation-v1","capability_version":"1.0.0","implementation_paths":["Tools/metadata_gate_runtime.py"],"kind":"receipt-schema","operations":[]},{"capability_id":"legacy-property-adoption-v1","capability_version":"1.0.0","implementation_paths":["Tools/apply_amendment.py","Tools/apply_task_plan.py","Tools/metadata_property_state.py","Tools/project_page_state.py","Tools/register_amendment.py"],"kind":"writer","operations":[{"operation":"legacy-property-adoption-v1"}]},{"capability_id":"metadata-transition-integrator-v1","capability_version":"1.0.0","implementation_paths":["Tools/apply_delta.py","Tools/apply_metadata_transition.py","Tools/check_batch_close.py","Tools/metadata_property_state.py","Tools/update_queue.py"],"kind":"writer","operations":[{"field":"last_content_modified","source_adapter":"content-change-event-v1","transition":"semantic-content-change"},{"field":"last_reviewed","source_adapter":"content-change-event-v1","transition":"semantic-content-change"},{"field":"last_reviewed","source_adapter":"current-review-receipt-value-v1","transition":"review-completed"}]},{"capability_id":"project-page-state-v2","capability_version":"2.0.0","implementation_paths":["Tools/metadata_property_state.py","Tools/project_page_state.py"],"kind":"writer","operations":[{"field":"authoring_status","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection"},{"field":"coverage_disposition","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection"},{"field":"last_content_modified","source_adapter":"coverage-property-state-v1","transition":"owner-to-page-projection"},{"field":"last_reviewed","source_adapter":"coverage-property-state-v1","transition":"owner-to-page-projection"},{"field":"next_batch","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection"},{"operation":"profile-extension-enum-owner-projection-v1"}]}],"schema_version":1,"source_adapters":[{"adapter_id":"content-change-event-v1","authority_class":"evidence-projection","evidence_required":true,"owner_record_keys":[]},{"adapter_id":"coverage-property-state-v1","authority_class":"ledger-projection","evidence_required":false,"owner_record_keys":["content_fingerprint","evidence_receipt","value"]},{"adapter_id":"coverage-row-value-v1","authority_class":"ledger-projection","evidence_required":false,"owner_record_keys":[]},{"adapter_id":"current-review-receipt-value-v1","authority_class":"evidence-projection","evidence_required":true,"owner_record_keys":[]}],"temporal_order":["first_seen","last_content_modified","last_reviewed","last_verified"],"writer_capabilities":[{"capability_id":"legacy-property-adoption-v1","capability_version":"1.0.0","implementation_paths":["Tools/apply_amendment.py","Tools/apply_task_plan.py","Tools/metadata_property_state.py","Tools/project_page_state.py","Tools/register_amendment.py"],"kind":"writer","operations":[{"operation":"legacy-property-adoption-v1"}]},{"capability_id":"metadata-transition-integrator-v1","capability_version":"1.0.0","implementation_paths":["Tools/apply_delta.py","Tools/apply_metadata_transition.py","Tools/check_batch_close.py","Tools/metadata_property_state.py","Tools/update_queue.py"],"kind":"writer","operations":[{"field":"last_content_modified","source_adapter":"content-change-event-v1","transition":"semantic-content-change"},{"field":"last_reviewed","source_adapter":"content-change-event-v1","transition":"semantic-content-change"},{"field":"last_reviewed","source_adapter":"current-review-receipt-value-v1","transition":"review-completed"}]},{"capability_id":"project-page-state-v2","capability_version":"2.0.0","implementation_paths":["Tools/metadata_property_state.py","Tools/project_page_state.py"],"kind":"writer","operations":[{"field":"authoring_status","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection"},{"field":"coverage_disposition","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection"},{"field":"last_content_modified","source_adapter":"coverage-property-state-v1","transition":"owner-to-page-projection"},{"field":"last_reviewed","source_adapter":"coverage-property-state-v1","transition":"owner-to-page-projection"},{"field":"next_batch","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection"},{"operation":"profile-extension-enum-owner-projection-v1"}]}]} +{"artifact":"metadata-execution-contract","capability_implementations":[{"path":"Tools/apply_amendment.py","sha256":"sha256:d541f4de5caa0b55c68817c406c820de856a675b030a716eaab10e47f3fad4d8"},{"path":"Tools/apply_delta.py","sha256":"sha256:3749db54ecc0d713c657eb32d1fe52011d65eb64e3a4c4938430344bcfe957d2"},{"path":"Tools/apply_metadata_transition.py","sha256":"sha256:71d687f1a2afb4006dc19b90bcb27e886ca46ce6e577d294802925523e7ae0cd"},{"path":"Tools/apply_task_plan.py","sha256":"sha256:99b47d8dfc2366098ebb3f7d285dec2bc84c0c834c39efea3b846a06b0a36f5d"},{"path":"Tools/card_activation.py","sha256":"sha256:dde8c9a0a15620ade6935b249b6e1edce57e4331e65a8dd76d48b7fda7c9dfd7"},{"path":"Tools/check_batch_close.py","sha256":"sha256:bc2326400a6dde7863fd1384382475ea98fa78592cd0b67d84e3c817b5bf4d16"},{"path":"Tools/check_queue.py","sha256":"sha256:4ec7f2dc3727c35688ec89105a396d4421ae52568b14e8b7db7c373b870f7904"},{"path":"Tools/mcp_server.py","sha256":"sha256:667e6f983cdc702dce32a7ea1269d7f83de33cd253844221f5b045ebbc1c51fc"},{"path":"Tools/metadata_gate_runtime.py","sha256":"sha256:da4aebb718dcbb37f31116c25e6cee3e374fa1e0a3edb87ab96eac6106ab22a3"},{"path":"Tools/metadata_property_state.py","sha256":"sha256:9fa07bf32b366a0bc1797006485b78f4d614b60c97f8b05c0e3dfa1c16ba2d43"},{"path":"Tools/project_page_state.py","sha256":"sha256:77c500cfbb0435f78908f8ab680f3fa4858c2c4d54cb90ce53e5870ddcfa3de4"},{"path":"Tools/record_gate_attestation.py","sha256":"sha256:73e8ad584a4c8e77f3510c09666496c2c7f2a2dd4b24b8394d6f41f9b9a81e3e"},{"path":"Tools/record_gate_result.py","sha256":"sha256:6111c6ff8bd5bf28fdb659cc891db318c314bd878cc9b75d86c6e2b9a97ed8d0"},{"path":"Tools/register_amendment.py","sha256":"sha256:917e0df2c028908b752e58894b61237807778e169e8e452d96d70458d0317fdc"},{"path":"Tools/update_queue.py","sha256":"sha256:f691748b42ac0252cc7ecf948af01f593845242e2dc28f2ad462977f426a564f"}],"contract_fingerprint":"sha256:20146bb9451ce32a83b7d248544024f80ce66295c2c0c8755cef0a55956c9ef4","contract_id":"kernel-metadata-execution","field_rules":[{"authority_class":"ledger-projection","canonical_owner":"coverage-ledger.pages[].authoring_status","evidence_requirement":null,"field":"authoring_status","invalidation_rule":"owner-value-change-v1","reconcile_policy":"existing-copy-exact-or-remove-v1","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection","value_shape":"scalar-string-or-null","write_timing":"batch-close-after-owner-update","writer_capability":"project-page-state-v2"},{"authority_class":"ledger-projection","canonical_owner":"coverage-ledger.pages[].coverage_disposition","evidence_requirement":null,"field":"coverage_disposition","invalidation_rule":"owner-value-change-v1","reconcile_policy":"existing-copy-exact-or-remove-v1","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection","value_shape":"scalar-string-or-null","write_timing":"batch-close-after-owner-update","writer_capability":"project-page-state-v2"},{"authority_class":"ledger-projection","canonical_owner":"coverage-ledger.pages[].property_state.last_content_modified","evidence_requirement":null,"field":"last_content_modified","invalidation_rule":"owner-property-state-change-v1","reconcile_policy":"upsert-exact-or-remove-v1","source_adapter":"coverage-property-state-v1","transition":"owner-to-page-projection","value_shape":"date","write_timing":"after-owner-state-transition","writer_capability":"project-page-state-v2"},{"authority_class":"evidence-projection","canonical_owner":"coverage-ledger.pages[].property_state.last_content_modified","evidence_requirement":{"change_scope":"semantic-content","content_binding":"after-page-content-sha256","excluded_change_classes":["projection-only","tool-controlled-metadata-only"],"invalidation":"current-content-fingerprint","protocol":"semantic-content-change-v1","result":"pass","target_binding":"exact-page-path","value_selector":"accepted-at-utc-date"},"field":"last_content_modified","invalidation_rule":"superseded-by-later-semantic-content-change-v1","reconcile_policy":"upsert-owner-property-state-v1","source_adapter":"content-change-event-v1","transition":"semantic-content-change","value_shape":"date","write_timing":"semantic-content-acceptance","writer_capability":"metadata-transition-integrator-v1"},{"authority_class":"ledger-projection","canonical_owner":"coverage-ledger.pages[].property_state.last_reviewed","evidence_requirement":null,"field":"last_reviewed","invalidation_rule":"semantic-content-change-tombstone-v1","reconcile_policy":"upsert-exact-or-remove-v1","source_adapter":"coverage-property-state-v1","transition":"owner-to-page-projection","value_shape":"date","write_timing":"after-owner-state-transition","writer_capability":"project-page-state-v2"},{"authority_class":"evidence-projection","canonical_owner":"coverage-ledger.pages[].property_state.last_reviewed","evidence_requirement":{"change_scope":"reviewed-content","content_binding":"exact-page-content-sha256","excluded_change_classes":[],"invalidation":"invalidated-by-null","protocol":"current-page-review-v1","result":"pass","target_binding":"exact-page-path","value_selector":"checked-at-utc-date"},"field":"last_reviewed","invalidation_rule":"superseded-by-review-or-semantic-content-change-v1","reconcile_policy":"upsert-owner-property-state-v1","source_adapter":"current-review-receipt-value-v1","transition":"review-completed","value_shape":"date","write_timing":"review-evidence-acceptance","writer_capability":"metadata-transition-integrator-v1"},{"authority_class":"evidence-projection","canonical_owner":"coverage-ledger.pages[].property_state.last_reviewed","evidence_requirement":{"change_scope":"semantic-content","content_binding":"after-page-content-sha256","excluded_change_classes":["projection-only","tool-controlled-metadata-only"],"invalidation":"current-content-fingerprint","protocol":"semantic-content-change-v1","result":"pass","target_binding":"exact-page-path","value_selector":"tombstone-null"},"field":"last_reviewed","invalidation_rule":"semantic-content-change-tombstone-v1","reconcile_policy":"tombstone-owner-property-state-v1","source_adapter":"content-change-event-v1","transition":"semantic-content-change","value_shape":"date","write_timing":"semantic-content-acceptance","writer_capability":"metadata-transition-integrator-v1"},{"authority_class":"ledger-projection","canonical_owner":"coverage-ledger.pages[].next_batch","evidence_requirement":null,"field":"next_batch","invalidation_rule":"owner-value-change-v1","reconcile_policy":"existing-copy-exact-or-remove-v1","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection","value_shape":"scalar-string-or-null","write_timing":"batch-close-after-owner-update","writer_capability":"project-page-state-v2"}],"operation_capabilities":[{"capability_id":"metadata-transition-integrator-v1","capability_version":"1.0.0","implementation_paths":["Tools/apply_metadata_transition.py","Tools/metadata_property_state.py"],"kind":"consumer","operations":[{"operation":"typed-field-metadata-transition"}]},{"capability_id":"card-context-delivery-v1","capability_version":"1.0.2","implementation_paths":["Tools/card_activation.py","Tools/check_queue.py","Tools/mcp_server.py","Tools/update_queue.py"],"kind":"producer","operations":[]},{"capability_id":"manual-attestation-v1","capability_version":"1.0.0","implementation_paths":["Tools/record_gate_attestation.py"],"kind":"producer","operations":[]},{"capability_id":"registered-scan-v1","capability_version":"1.0.0","implementation_paths":["Tools/record_gate_result.py"],"kind":"producer","operations":[]},{"capability_id":"deterministic-gate-result-v1","capability_version":"1.0.0","implementation_paths":["Tools/metadata_gate_runtime.py"],"kind":"receipt-schema","operations":[]},{"capability_id":"manual-gate-attestation-v1","capability_version":"1.0.0","implementation_paths":["Tools/metadata_gate_runtime.py"],"kind":"receipt-schema","operations":[]},{"capability_id":"legacy-property-adoption-v1","capability_version":"1.0.0","implementation_paths":["Tools/apply_amendment.py","Tools/apply_task_plan.py","Tools/metadata_property_state.py","Tools/project_page_state.py","Tools/register_amendment.py"],"kind":"writer","operations":[{"operation":"legacy-property-adoption-v1"}]},{"capability_id":"metadata-transition-integrator-v1","capability_version":"1.0.0","implementation_paths":["Tools/apply_delta.py","Tools/apply_metadata_transition.py","Tools/check_batch_close.py","Tools/metadata_property_state.py","Tools/update_queue.py"],"kind":"writer","operations":[{"field":"last_content_modified","source_adapter":"content-change-event-v1","transition":"semantic-content-change"},{"field":"last_reviewed","source_adapter":"content-change-event-v1","transition":"semantic-content-change"},{"field":"last_reviewed","source_adapter":"current-review-receipt-value-v1","transition":"review-completed"}]},{"capability_id":"project-page-state-v2","capability_version":"2.0.0","implementation_paths":["Tools/metadata_property_state.py","Tools/project_page_state.py"],"kind":"writer","operations":[{"field":"authoring_status","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection"},{"field":"coverage_disposition","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection"},{"field":"last_content_modified","source_adapter":"coverage-property-state-v1","transition":"owner-to-page-projection"},{"field":"last_reviewed","source_adapter":"coverage-property-state-v1","transition":"owner-to-page-projection"},{"field":"next_batch","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection"},{"operation":"profile-extension-enum-owner-projection-v1"}]}],"schema_version":1,"source_adapters":[{"adapter_id":"content-change-event-v1","authority_class":"evidence-projection","evidence_required":true,"owner_record_keys":[]},{"adapter_id":"coverage-property-state-v1","authority_class":"ledger-projection","evidence_required":false,"owner_record_keys":["content_fingerprint","evidence_receipt","value"]},{"adapter_id":"coverage-row-value-v1","authority_class":"ledger-projection","evidence_required":false,"owner_record_keys":[]},{"adapter_id":"current-review-receipt-value-v1","authority_class":"evidence-projection","evidence_required":true,"owner_record_keys":[]}],"temporal_order":["first_seen","last_content_modified","last_reviewed","last_verified"],"writer_capabilities":[{"capability_id":"legacy-property-adoption-v1","capability_version":"1.0.0","implementation_paths":["Tools/apply_amendment.py","Tools/apply_task_plan.py","Tools/metadata_property_state.py","Tools/project_page_state.py","Tools/register_amendment.py"],"kind":"writer","operations":[{"operation":"legacy-property-adoption-v1"}]},{"capability_id":"metadata-transition-integrator-v1","capability_version":"1.0.0","implementation_paths":["Tools/apply_delta.py","Tools/apply_metadata_transition.py","Tools/check_batch_close.py","Tools/metadata_property_state.py","Tools/update_queue.py"],"kind":"writer","operations":[{"field":"last_content_modified","source_adapter":"content-change-event-v1","transition":"semantic-content-change"},{"field":"last_reviewed","source_adapter":"content-change-event-v1","transition":"semantic-content-change"},{"field":"last_reviewed","source_adapter":"current-review-receipt-value-v1","transition":"review-completed"}]},{"capability_id":"project-page-state-v2","capability_version":"2.0.0","implementation_paths":["Tools/metadata_property_state.py","Tools/project_page_state.py"],"kind":"writer","operations":[{"field":"authoring_status","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection"},{"field":"coverage_disposition","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection"},{"field":"last_content_modified","source_adapter":"coverage-property-state-v1","transition":"owner-to-page-projection"},{"field":"last_reviewed","source_adapter":"coverage-property-state-v1","transition":"owner-to-page-projection"},{"field":"next_batch","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection"},{"operation":"profile-extension-enum-owner-projection-v1"}]}]} diff --git a/Tools/mcp_server.py b/Tools/mcp_server.py index abc3350..49ea29c 100644 --- a/Tools/mcp_server.py +++ b/Tools/mcp_server.py @@ -200,6 +200,14 @@ WORKSPACE_ENV = "CAMBIUM_WORKSPACE_ROOT" EXECUTION_CONTEXT_ENV = "CAMBIUM_EXECUTION_CONTEXT_ID" +# The host's own identity, taken from `initialize`. Inline-delivery +# conformance is established by test against one adapter build, while a host +# updates itself underneath a passing registration. Exporting the declared +# name and version lets delivery evidence bind the adapter it actually ran +# against, so an unregistered build degrades instead of inheriting a stale +# pass. These are declared labels, not authentication. +HOST_CLIENT_NAME_ENV = "CAMBIUM_HOST_CLIENT_NAME" +HOST_CLIENT_VERSION_ENV = "CAMBIUM_HOST_CLIENT_VERSION" SOURCE_HASH_ENV = "CAMBIUM_INTERFACE_SOURCE_HASH" # What the projection must claim about itself before it is served. @@ -740,6 +748,8 @@ def __init__(self, distribution_root=None, environ=None): self.workspace_root = None self.projection = None self.execution_context_id = None + self.client_name = None + self.client_version = None # -- lifecycle -------------------------------------------------------- @@ -750,6 +760,13 @@ def handle_initialize(self, params): self.projection = load_projection(self.distribution_root, self.environ) self.execution_context_id = "mcp:%s" % uuid.uuid4().hex + client = params.get("clientInfo") + if isinstance(client, dict): + name = client.get("name") + version = client.get("version") + self.client_name = name if isinstance(name, str) and name else None + self.client_version = (version if isinstance(version, str) and + version else None) requested = params.get("protocolVersion") agreed = (requested if requested in SUPPORTED_PROTOCOL_VERSIONS else LATEST_PROTOCOL_VERSION) @@ -810,6 +827,14 @@ def handle_tools_call(self, params): workspace_root = resolve_workspace_root(self.environ) execution_env = dict(self.environ) execution_env[EXECUTION_CONTEXT_ENV] = self.execution_context_id + # Absent rather than empty: an unset variable claims nothing, while an + # empty one would satisfy a consumer that only tests presence. + for name, value in ((HOST_CLIENT_NAME_ENV, self.client_name), + (HOST_CLIENT_VERSION_ENV, self.client_version)): + if value: + execution_env[name] = value + else: + execution_env.pop(name, None) return run_tool(tool, arguments, workspace_root, execution_env) def handle_ping(self, params): diff --git a/Tools/schemas/receipt.template.jsonl b/Tools/schemas/receipt.template.jsonl index 99b2ba7..6206d2c 100644 --- a/Tools/schemas/receipt.template.jsonl +++ b/Tools/schemas/receipt.template.jsonl @@ -130,7 +130,7 @@ # check_links 1.6.0 / wiki-link-integrity; check_vocab 1.8.0 / # frontmatter-vocabulary and priority-quota-distribution; # check_residual_content 1.2.0 / -# registered-residual-content; check_queue 1.24.0 / its registered +# registered-residual-content; check_queue 1.25.0 / its registered # Required-Queue modes; check_batch_close 1.12.0 / batch-close; check_proof # 1.17.0 / terminal-proof; and adopt_standards 1.7.0 / # standards-adoption. Deterministic producers not shown above -- among them @@ -149,20 +149,44 @@ # after it. A run outside any Cambium runtime (no `.cambium/state/`) omits the # three fields rather than writing null: an omitted field claims nothing, while # an explicit null would satisfy consumers that only test field presence. -# Public R01 `check_queue.py` 1.24.0 admission reruns the complete +# Public R01 `check_queue.py` 1.25.0 admission reruns the complete # `profile-load` closure. The lower-level runtime view used to construct a # corrective Standards adoption retains only the selected Profile's # identity/sentinel guard, so an invalid current Profile does not prevent a # transaction whose candidate after-image passes full `profile-load`. # A passing `require-ready:*` receipt additionally carries -# `activation_protocol: card-first-readback-v1`, the Task Contract, reading -# plan, read-back plan and Card Bundle SHA-256 values, plus the closed -# `activation_bundle_manifest`. It stores paths and content hashes, never Card -# text. The tool result carries transient `activation_delivery_payload` bytes -# for Host injection. `delivery_assurance: machine-delivered` requires -# `delivery_mode: host-context-injection` and a nonempty -# `execution_context_id`; an unbound CLI result uses `degraded`, -# `cli-tool-result`, and null. `deliver-readback:*` carries a +# `activation_protocol`, the Task Contract, reading plan, read-back plan and +# Card Bundle SHA-256 values, plus the closed `activation_bundle_manifest`. It +# stores paths and content hashes, never Card text. +# card-first-readback-v3 (current): the manifest carries a `pieces` list -- +# one `{piece_id, kind, path, sha256, bytes}` record per deliverable file, +# plus `piece_count` and `max_piece_envelope_bytes` -- and NO `cards` or +# `startup_readbacks` arrays. No `activation_delivery_payload` accompanies +# it in the receipt or the tool result: admission delivers nothing. It +# records `delivery_assurance: host-bound` with +# `delivery_mode: host-context-injection` and a nonempty +# `execution_context_id`, or `prepared` with `cli-tool-result` and null. +# Neither value claims delivery; completion is `machine-delivery-complete` +# and is earned by the K13/20 Assignment delivery gate. +# card-first-readback-v1 / v2 (sealed history): the manifest carries `cards` +# and `startup_readbacks`, the tool result carries transient +# `activation_delivery_payload` bytes, and admission itself recorded +# `machine-delivered`/`degraded`. Those eras replay under their own shape +# and never acquire the v3 fields. +# `deliver-activation-piece::` carries an `activation-piece-v1` +# delivery: `piece_id`, `piece_sha256`, `piece_envelope_bytes`, +# `delivery_attempt_id` and a single-use `delivery_nonce`, with the exact file +# bytes only in the transient `activation_piece_payload`. The server re-reads +# current bytes and refuses a source that drifted since admission, and refuses +# any delivery serializing above the K13/19 budget. +# `ack-activation-piece::` carries an `activation-piece-ack-v1` +# record binding the delivery receipt, its nonce, `delivery_attempt_id` and the +# answering `execution_context_id`. An ack proves this context consumed that +# delivery; on its own it does not prove the body ahead of the nonce entered +# the model context. Only the server hash, a conformant Host Adapter (see +# `Tools/host-conformance.yaml`), and this ack together are piece delivery +# evidence. +# `deliver-readback:*` carries a # `card-readback-addendum-v1` manifest, parent Bundle hash, and registered rule; # its exact source bytes exist only in transient `readback_delivery_payload`. # `open -> merge-ready` additionally consumes one current in-batch wrapper: diff --git a/Tools/tests/test_card_activation.py b/Tools/tests/test_card_activation.py index 4437197..e61cc9b 100644 --- a/Tools/tests/test_card_activation.py +++ b/Tools/tests/test_card_activation.py @@ -59,17 +59,120 @@ def run_tool(self, name, *arguments, context_id=None): text=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, env=environ, check=False) - def test_bundle_carries_r01_and_every_selected_card(self): + def pieces(self, context): + return context["activation_bundle_manifest"]["pieces"] + + def test_admission_freezes_pieces_and_embeds_no_content(self): context = self.context() self.assertEqual([], card_activation.activation_context_errors(context)) - self.assertEqual("degraded", context["delivery_assurance"]) - bundle = context["activation_delivery_payload"] + self.assertEqual("prepared", context["delivery_assurance"]) + self.assertNotIn("activation_delivery_payload", context) + manifest = context["activation_bundle_manifest"] + self.assertNotIn("cards", manifest) + self.assertNotIn("startup_readbacks", manifest) self.assertEqual( ["R01", "R03", "R07"], - [card["route_id"] for card in bundle["cards"]]) - self.assertTrue(all(card["content"] for card in bundle["cards"])) - self.assertEqual(1, len(bundle["readback_plan"])) + [row["route_id"] for row in self.pieces(context) + if row["kind"] == "card"]) + self.assertNotIn("content", json.dumps(manifest, sort_keys=True)) + self.assertEqual(1, len(manifest["readback_plan"])) + + def test_admission_result_stays_far_inside_the_piece_budget(self): + context = self.context() + + envelope = len(kblib.canonical_json_bytes(context)) + + self.assertLess( + envelope, card_activation.MAX_ACTIVATION_PIECE_ENVELOPE_BYTES) + + def test_every_frozen_piece_delivers_within_the_budget(self): + context = self.context() + + for record in self.pieces(context): + delivery = card_activation.build_activation_piece( + self.root, context, record["piece_id"]) + payload = delivery["activation_piece_payload"] + self.assertEqual(record["sha256"], + kblib.sha256_bytes(payload["content"])) + self.assertEqual( + (self.root / record["path"]).read_text(encoding="utf-8"), + payload["content"]) + self.assertLessEqual( + delivery["piece_envelope_bytes"], + card_activation.MAX_ACTIVATION_PIECE_ENVELOPE_BYTES) + + def test_frozen_piece_ids_are_the_exact_delivery_obligation(self): + context = self.context() + + identifiers = card_activation.frozen_piece_ids(context) + + self.assertEqual(sorted(identifiers), identifiers) + self.assertEqual( + sorted(row["piece_id"] for row in self.pieces(context)), + identifiers) + # Every named piece must actually deliver, or the set the delivery + # gate compares against would be unsatisfiable by construction. + for piece_id in identifiers: + card_activation.build_activation_piece( + self.root, context, piece_id) + + def test_admission_budget_check_measures_the_real_envelope(self): + # A piece measured without its bundle hash, nonce and attempt id would + # be under-reported at admission and refused later at delivery. + context = self.context() + for record in self.pieces(context): + delivery = card_activation.build_activation_piece( + self.root, context, record["piece_id"]) + self.assertLessEqual( + delivery["piece_envelope_bytes"], + card_activation.MAX_ACTIVATION_PIECE_ENVELOPE_BYTES) + + def test_oversized_leaf_fails_closed_at_admission(self): + card = self.root / "kernel/Cards/R03 Module Build Card.md" + text = card.read_text(encoding="utf-8") + card.write_text( + text + ("\nfiller " * 12000), encoding="utf-8") + stamp = text.split("source_hash: ")[1].split("\n")[0] + rewritten = card.read_text(encoding="utf-8") + card.write_text(rewritten, encoding="utf-8") + self.assertTrue(stamp) + + with self.assertRaisesRegex(ValueError, "delivery budget"): + self.context() + + def test_piece_delivery_refuses_a_source_that_drifted(self): + context = self.context() + card = self.root / "kernel/Cards/R01 Core Bootstrap Card.md" + card.write_text(card.read_text(encoding="utf-8") + "\nDrift.\n", + encoding="utf-8") + + with self.assertRaisesRegex(ValueError, "drifted since admission"): + card_activation.build_activation_piece( + self.root, context, "card:R01") + + def test_piece_ack_binds_the_delivering_context_and_nonce(self): + context = self.context("mcp:ack") + delivery = card_activation.build_activation_piece( + self.root, context, "card:R01", execution_context_id="mcp:ack") + delivery["receipt_id"] = "audit-check_queue-fixture-0001" + + ack = card_activation.build_piece_ack( + delivery, delivery["delivery_nonce"], + execution_context_id="mcp:ack") + + self.assertEqual("card:R01", ack["piece_id"]) + self.assertEqual(delivery["delivery_attempt_id"], + ack["delivery_attempt_id"]) + self.assertEqual("audit-check_queue-fixture-0001", + ack["delivery_receipt_id"]) + with self.assertRaisesRegex(ValueError, "nonce does not match"): + card_activation.build_piece_ack( + delivery, "0" * 32, execution_context_id="mcp:ack") + with self.assertRaisesRegex(ValueError, "delivering execution context"): + card_activation.build_piece_ack( + delivery, delivery["delivery_nonce"], + execution_context_id="mcp:other") def test_frozen_card_index_is_delivered_as_startup_navigation(self): progress = self.progress() @@ -86,15 +189,17 @@ def test_frozen_card_index_is_delivered_as_startup_navigation(self): runtime_state=runtime) self.assertEqual([], card_activation.activation_context_errors(context)) - startup = context["activation_delivery_payload"]["startup_readbacks"] - index_rows = [row for row in startup + index_rows = [row for row in self.pieces(context) if row["path"] == card_activation.CARD_INDEX_PATH] self.assertEqual(1, len(index_rows)) self.assertEqual("kernel-card-index", index_rows[0]["route_id"]) + self.assertEqual("activation-readback", index_rows[0]["kind"]) + delivered = card_activation.build_activation_piece( + self.root, context, index_rows[0]["piece_id"]) self.assertEqual( (self.root / card_activation.CARD_INDEX_PATH).read_text( encoding="utf-8"), - index_rows[0]["content"]) + delivered["activation_piece_payload"]["content"]) def test_unregistered_extra_selected_card_path_is_rejected(self): progress = self.progress() @@ -144,13 +249,13 @@ def test_batch_provenance_does_not_select_runtime_cards(self): self.assertEqual([], card_activation.activation_context_errors(context)) self.assertEqual( ["R01", "R03", "R07"], - [card["route_id"] for card in - context["activation_delivery_payload"]["cards"]]) + [row["route_id"] for row in self.pieces(context) + if row["kind"] == "card"]) - def test_machine_delivery_is_bound_to_one_execution_context(self): + def test_admission_records_host_binding_not_delivery(self): context = self.context("mcp:fixture-context") - self.assertEqual("machine-delivered", context["delivery_assurance"]) + self.assertEqual("host-bound", context["delivery_assurance"]) self.assertEqual("host-context-injection", context["delivery_mode"]) self.assertEqual("mcp:fixture-context", context["execution_context_id"]) @@ -178,13 +283,14 @@ def test_r01_and_semantic_card_currency_fail_closed(self): with self.assertRaisesRegex(ValueError, "semantic source drift"): self.context() - def test_embedded_byte_tampering_is_detected(self): + def test_an_admission_that_embeds_a_payload_is_rejected(self): context = self.context() - context["activation_delivery_payload"]["cards"][0]["content"] += "x" + context["activation_delivery_payload"] = {"cards": []} errors = card_activation.activation_context_errors(context) - self.assertTrue(any("Card 0 bytes" in error for error in errors)) + self.assertTrue(any("embedded delivery payload" in error + for error in errors), errors) def test_declared_readback_is_one_parent_bound_addendum(self): context = self.context("mcp:readback") @@ -208,8 +314,10 @@ def _persist_machine_gate(self, context_id="mcp:activation-a"): "--receipts", relative, "--json", context_id=context_id) self.assertEqual(0, result.returncode, result.stderr) receipt = json.loads(result.stdout)[0] - self.assertEqual("machine-delivered", receipt["delivery_assurance"]) - self.assertTrue(receipt["activation_delivery_payload"]["cards"]) + self.assertEqual("host-bound", receipt["delivery_assurance"]) + self.assertNotIn("activation_delivery_payload", receipt) + self.assertTrue( + receipt["activation_bundle_manifest"]["pieces"]) persisted = json.loads( (self.root / relative).read_text(encoding="utf-8").splitlines()[0]) self.assertNotIn("activation_delivery_payload", persisted) @@ -228,14 +336,14 @@ def _open_command(self, receipt, context_id): "--actor-role", "integrator", "--at", "2026-08-21T00:00:00Z", "--apply", context_id=context_id) - def test_open_consumes_only_the_same_machine_delivery_context(self): + def test_open_binds_the_bundle_and_no_longer_binds_the_session(self): + # v1/v2 refused an admission consumed by a second host session. A v3 + # admission asserts no delivery, so `open` is admission only and the + # context binding moves to the Assignment delivery gate. _relative, receipt = self._persist_machine_gate() - wrong = self._open_command(receipt, "mcp:activation-b") - self.assertEqual(1, wrong.returncode, wrong.stdout + wrong.stderr) - self.assertIn("invalid Card activation delivery", wrong.stdout) + opened = self._open_command(receipt, "mcp:activation-b") - opened = self._open_command(receipt, "mcp:activation-a") self.assertEqual(0, opened.returncode, opened.stdout + opened.stderr) runtime = check_queue.validate_runtime(self.root) self.assertEqual([], runtime["errors"], runtime["errors"]) @@ -243,8 +351,63 @@ def test_open_consumes_only_the_same_machine_delivery_context(self): self.item()["transition_receipts"][0]][1] self.assertEqual(receipt["card_bundle_sha256"], transition["card_bundle_sha256"]) - self.assertEqual("mcp:activation-a", - transition["execution_context_id"]) + + def test_open_still_refuses_a_bundle_whose_bytes_drifted(self): + _relative, receipt = self._persist_machine_gate() + card = self.root / "kernel/Cards/R01 Core Bootstrap Card.md" + card.write_text(card.read_text(encoding="utf-8") + "\nDrift.\n", + encoding="utf-8") + + refused = self._open_command(receipt, "mcp:activation-a") + + self.assertEqual(1, refused.returncode) + self.assertIn("invalid Card activation delivery", refused.stdout) + + def test_piece_delivery_and_ack_round_trip_through_the_cli(self): + _relative, receipt = self._persist_machine_gate("mcp:pieces") + opened = self._open_command(receipt, "mcp:pieces") + self.assertEqual(0, opened.returncode, opened.stdout + opened.stderr) + + delivered = self.run_tool( + "check_queue.py", "--deliver-activation-piece", "B1", + "--piece", "card:R01", + "--receipts", ".cambium/receipts/piece.jsonl", "--json", + context_id="mcp:pieces") + self.assertEqual(0, delivered.returncode, delivered.stderr) + delivery = json.loads(delivered.stdout)[0] + payload = delivery["activation_piece_payload"] + self.assertEqual( + (self.root / "kernel/Cards/R01 Core Bootstrap Card.md").read_text( + encoding="utf-8"), + payload["content"]) + self.assertEqual(payload["delivery_nonce"], + delivery["delivery_nonce"]) + persisted = json.loads(( + self.root / ".cambium/receipts/piece.jsonl" + ).read_text(encoding="utf-8").splitlines()[0]) + self.assertNotIn("activation_piece_payload", persisted) + self.assertNotIn("content", json.dumps(persisted, sort_keys=True)) + + acked = self.run_tool( + "check_queue.py", "--ack-activation-piece", "B1", + "--piece", "card:R01", + "--piece-nonce", delivery["delivery_nonce"], + "--piece-delivery-receipt", delivery["receipt_id"], + "--receipts", ".cambium/receipts/ack.jsonl", "--json", + context_id="mcp:pieces") + self.assertEqual(0, acked.returncode, acked.stderr) + ack = json.loads(acked.stdout)[0] + self.assertEqual("card:R01", ack["piece_id"]) + self.assertEqual(delivery["receipt_id"], ack["delivery_receipt_id"]) + + wrong = self.run_tool( + "check_queue.py", "--ack-activation-piece", "B1", + "--piece", "card:R01", "--piece-nonce", "0" * 32, + "--piece-delivery-receipt", delivery["receipt_id"], + "--receipts", ".cambium/receipts/ack.jsonl", "--json", + context_id="mcp:pieces") + self.assertEqual(1, wrong.returncode) + self.assertIn("nonce does not match", wrong.stdout + wrong.stderr) def test_public_readback_mode_returns_exact_source_content(self): _relative, receipt = self._persist_machine_gate("mcp:readback") @@ -287,8 +450,10 @@ def test_resume_reinjects_the_bundle_into_the_new_context(self): delivery = status["active_card_context_deliveries"][0] self.assertEqual("B1", delivery["batch_id"]) self.assertEqual("mcp:replacement", delivery["execution_context_id"]) - self.assertEqual("machine-delivered", delivery["delivery_assurance"]) - self.assertTrue(delivery["activation_delivery_payload"]["cards"]) + self.assertEqual("host-bound", delivery["delivery_assurance"]) + self.assertNotIn("activation_delivery_payload", delivery) + self.assertTrue( + delivery["activation_bundle_manifest"]["pieces"]) def test_resume_refuses_card_bytes_that_drifted_after_open(self): _relative, receipt = self._persist_machine_gate("mcp:original") diff --git a/Tools/tests/test_update_queue.py b/Tools/tests/test_update_queue.py index 866de54..7afc2c2 100644 --- a/Tools/tests/test_update_queue.py +++ b/Tools/tests/test_update_queue.py @@ -3774,9 +3774,24 @@ def test_legacy_activation_era_carries_no_obligations(self): self.enable_requirement() self.open_b1() activation = self.activation_receipt() + # A v1 artifact is not today's manifest with an older label on it: the + # era embedded Card and read-back arrays and asserted delivery in the + # admission itself. Reconstruct that shape from the frozen pieces, or + # this test would only prove that a malformed record is rejected. legacy_manifest = dict(activation["activation_bundle_manifest"]) legacy_manifest["activation_protocol"] = "card-first-readback-v1" legacy_manifest.pop("batch_review_plan", None) + pieces = legacy_manifest.pop("pieces", []) + legacy_manifest.pop("piece_count", None) + legacy_manifest.pop("max_piece_envelope_bytes", None) + legacy_manifest["cards"] = [ + {key: value for key, value in piece.items() + if key not in ("piece_id", "kind", "bytes")} + for piece in pieces if piece.get("kind") == "card"] + legacy_manifest["startup_readbacks"] = [ + {key: value for key, value in piece.items() + if key not in ("piece_id", "kind", "bytes")} + for piece in pieces if piece.get("kind") == "activation-readback"] legacy_bundle_sha = kblib.sha256_bytes( kblib.canonical_json_bytes(legacy_manifest)) @@ -3786,6 +3801,10 @@ def downgrade(record): if "activation_bundle_manifest" in record: record["activation_bundle_manifest"] = legacy_manifest record["card_bundle_sha256"] = legacy_bundle_sha + if "delivery_assurance" in record: + record["delivery_assurance"] = "degraded" + record["delivery_mode"] = "cli-tool-result" + record["execution_context_id"] = None self.rewrite_receipt_for_negative_test( activation["receipt_id"], downgrade) diff --git a/Tools/update_queue.py b/Tools/update_queue.py index d959134..5e388b3 100644 --- a/Tools/update_queue.py +++ b/Tools/update_queue.py @@ -492,8 +492,21 @@ def require_standards_revalidation(): runtime_state=result) actual_activation_context = card_activation.context_from_receipt( activation_receipt) - activation_errors = card_activation.exact_context_errors( - expected_activation_context, actual_activation_context) + # v1/v2 additionally required the admission to be consumed by the same + # execution context that received it. That rule protected a claim v3 + # no longer makes here: a v3 admission freezes a manifest and asserts + # no delivery, so binding the Queue edge to one host session would + # re-couple the Queue lifecycle to the context lifecycle that K13/19 + # keeps separate. The protection moves to the Assignment delivery + # gate, which consumes the piece ack set. What `open` still proves is + # that the frozen Bundle equals current Card/Read Set bytes. + if actual_activation_context.get("activation_protocol") == \ + card_activation.ACTIVATION_PROTOCOL: + activation_errors = card_activation.exact_bundle_errors( + expected_activation_context, actual_activation_context) + else: + activation_errors = card_activation.exact_context_errors( + expected_activation_context, actual_activation_context) if activation_errors: raise ValueError("invalid Card activation delivery: %s" % "; ".join(activation_errors)) diff --git a/kernel/K00 Standards Control/12 Control Registry.md b/kernel/K00 Standards Control/12 Control Registry.md index f376d46..99aeb6f 100644 --- a/kernel/K00 Standards Control/12 Control Registry.md +++ b/kernel/K00 Standards Control/12 Control Registry.md @@ -125,15 +125,15 @@ moves its own cell. |---|---|---|---|---|---|---| | `runtime-card-synchronization` | `manual-attestation` | `1.0.0` | `runtime-card-synchronization` | `*` | `guidance_and_contract` | `not-batch-scoped` | | `profile-load` | `check_profile` | `2.0.0` | `profile-check-summary` | `*` | `guidance_and_contract` | `not-batch-scoped` | -| `runtime-startup-recovery` | `check_queue` | `1.24.0` | `required_queue` | `resume-status` | `*` | `not-batch-scoped` | +| `runtime-startup-recovery` | `check_queue` | `1.25.0` | `required_queue` | `resume-status` | `*` | `not-batch-scoped` | | `large-scale-execution-admission` | `manual-attestation` | `1.0.0` | `large-scale-execution-admission` | `*` | `guidance_and_contract` | `not-batch-scoped` | | `wiki-link-integrity` | `check_links` | `1.6.0` | `link-check-summary` | `*` | `*` | `not-batch-scoped` | | `frontmatter-vocabulary` | `check_vocab` | `1.8.0` | `vocab-check-summary` | `*` | `*` | `not-batch-scoped` | | `priority-quota-distribution` | `check_vocab` | `1.8.0` | `priority-quota-distribution` | `*` | `*` | `not-batch-scoped` | -| `required-queue-consistency` | `check_queue` | `1.24.0` | `required_queue` | `consistency` | `*` | `not-batch-scoped` | -| `required-queue-admission` | `check_queue` | `1.24.0` | `required_queue` | `require-ready:*` | `*` | `queued` | -| `required-queue-completion` | `check_queue` | `1.24.0` | `required_queue` | `require-complete` | `*` | `queue-exhausted` | -| `maintenance-completion` | `check_queue` | `1.24.0` | `required_queue` | `require-maintenance-complete` | `*` | `queue-exhausted` | +| `required-queue-consistency` | `check_queue` | `1.25.0` | `required_queue` | `consistency` | `*` | `not-batch-scoped` | +| `required-queue-admission` | `check_queue` | `1.25.0` | `required_queue` | `require-ready:*` | `*` | `queued` | +| `required-queue-completion` | `check_queue` | `1.25.0` | `required_queue` | `require-complete` | `*` | `queue-exhausted` | +| `maintenance-completion` | `check_queue` | `1.25.0` | `required_queue` | `require-maintenance-complete` | `*` | `queue-exhausted` | | `batch-review` | `manual-attestation` | `1.0.0` | `batch_gate` | `*` | `none` | `open` | | `batch-close` | `check_batch_close` | `1.12.0` | `batch_close_gate` | `*` | `*` | `merge-ready` | | `structure-registry` | `check_structure` | `1.1.0` | `structure-registry-summary` | `*` | `*` | `not-batch-scoped` | @@ -146,7 +146,7 @@ moves its own cell. | `expression-layer-acceptance` | `manual-attestation` | `1.0.0` | `expression-layer-acceptance` | `*` | `content_and_depth`, `coverage_and_integration`, `guidance_and_contract`, `source_and_currentness`, `structure_and_links` | `not-batch-scoped` | | `coverage-reconciliation` | `manual-attestation` | `1.0.0` | `coverage-reconciliation` | `*` | `coverage_and_integration` | `not-batch-scoped` | | `standards-adoption` | `adopt_standards` | `1.7.0` | `standards_adoption` | `*` | `*` | `not-batch-scoped` | -| `standards-revalidation` | `check_queue` | `1.24.0` | `required_queue` | `require-revalidation:*` | `*` | `queued`, `open` | +| `standards-revalidation` | `check_queue` | `1.25.0` | `required_queue` | `require-revalidation:*` | `*` | `queued`, `open` | | `guidance-disposition` | `manual-attestation` | `1.0.0` | `guidance-disposition` | `*` | `guidance_and_contract` | `not-batch-scoped` | | `receipt-validity` | `manual-attestation` | `1.0.0` | `receipt-validity` | `*` | `guidance_and_contract` | `not-batch-scoped` | | `rendering` | `manual-attestation` | `1.0.0` | `rendering` | `*` | `rendering`, `structure_and_links` | `not-batch-scoped` | diff --git a/kernel/K13 Task Runtime and Execution Control/19 Card Context Activation and Read-back Delivery.md b/kernel/K13 Task Runtime and Execution Control/19 Card Context Activation and Read-back Delivery.md index bb7181f..18034fb 100644 --- a/kernel/K13 Task Runtime and Execution Control/19 Card Context Activation and Read-back Delivery.md +++ b/kernel/K13 Task Runtime and Execution Control/19 Card Context Activation and Read-back Delivery.md @@ -64,25 +64,77 @@ does not reinterpret an already-opened batch using new Card bytes. ## Execution-context Delivery The stdio MCP server assigns one non-reused ID to each initialized session and -passes it to every child tool as `CAMBIUM_EXECUTION_CONTEXT_ID`. A successful -admission result reached through that interface records: +passes it to every child tool as `CAMBIUM_EXECUTION_CONTEXT_ID`, together with +the host's declared `clientInfo` name and version as +`CAMBIUM_HOST_CLIENT_NAME` and `CAMBIUM_HOST_CLIENT_VERSION`. Those are +declared labels: they identify which adapter build ran, not who ran it. + +An admission records what it prepared, never what a later reader received: ```text delivery_mode: host-context-injection -delivery_assurance: machine-delivered +delivery_assurance: host-bound execution_context_id: mcp: ``` -The same MCP session must consume the admission at `queued -> open`; another -session receives a different ID and is refused. This proves that the exact -tool-result payload entered the named host session. It does not authenticate -the human/Agent identity or prove cognition. - -A direct CLI result still carries the complete Bundle, but records -`cli-tool-result`, `degraded`, and no execution-context ID. Queue `open` may -still be written by a human integrator because it is admission, not worker -execution. A runtime or adapter MUST NOT claim machine-enforced Card delivery -from that degraded record. +A direct CLI admission records `cli-tool-result`, `prepared`, and no +execution-context ID. Queue `open` consumes either, because `open` is +admission and not worker execution; what it still proves is that the frozen +Bundle equals current Card and Read Set bytes. + +Earlier eras claimed more here than the transport could support. A v1/v2 +admission that reached a bound session recorded `machine-delivered` and +required the same session to consume it at `queued -> open`. That claim was +minted before the result left the server, so a host that externalized an +oversized tool result left the payload outside the model context while the +receipt still asserted delivery, and no gate could observe the divergence. +Under v3 the session-identity rule is retired -- keeping it would re-couple +the Queue lifecycle to the context lifecycle this module separates -- and +delivery completion is earned per piece, by the Assignment delivery gate of +[[kernel/K13 Task Runtime and Execution Control/20 Assignment State and Delivery Gate|K13/20]]. + +## Budgeted Piece Delivery + +Protocol `card-first-readback-v3` stops embedding Card and read-back bytes in +the admission result. Admission freezes a piece manifest -- one record per +deliverable file, carrying `piece_id`, `kind`, `path`, `sha256`, and `bytes` +-- and the bytes travel afterwards, one file per tool result. + +A piece is always a whole file. Splitting one file across results is invalid: +the frozen hash binds the complete file, a receiving model cannot rehash +fragments, and no party could then prove a reassembly was faithful. + +`MAX_ACTIVATION_PIECE_ENVELOPE_BYTES` is 49152 and is owned here. The measured +object is the complete serialized delivery, not the source file: envelope, +JSON escaping, nonce, and transport wrapper all count. Admission fails closed +when any frozen piece would exceed the budget, so an oversized leaf is caught +as a governance problem at its own boundary rather than as a transport +accident mid-batch. [[kernel/K00 Standards Control/16 Leaf Module Size Register|K00/16]] +carries the derived check for `activation` leaves; it consumes this budget and +does not own it. + +`check_queue --deliver-activation-piece --piece ` returns one +piece for an already-open batch. The server re-reads the current bytes and +refuses when they differ from the frozen hash, so a source that drifts during +delivery is rejected rather than shipped. Each delivery carries a single-use +nonce placed after the content, and +`check_queue --ack-activation-piece --piece --piece-nonce + --piece-delivery-receipt ` returns it from the same execution +context. + +The nonce is one part of a three-part guarantee and never the whole of it: + +- the server hash proves the delivered object is the frozen file; +- a Host Adapter that has passed inline-delivery conformance proves a + within-budget result is inlined rather than truncated or externalized; +- the same-context ack proves this execution context consumed the delivery. + +Only all three together constitute piece delivery evidence. The ack alone +proves that a nonce was seen, not that the body ahead of it entered the model +context: a host may show a head-and-tail summary, keep structural fields while +externalizing content, surface the nonce separately, or leave an agent reading +only the tail of a spilled file. A host that cannot supply the middle part is +`degraded`, and no runtime may claim machine-enforced delivery from it. ## Frozen Review Plan @@ -123,10 +175,13 @@ whole-Kernel injection are both invalid fallbacks. ## Resume Reassignment And Failure -`check_queue --resume-status --json` includes a fresh Bundle delivery for -every active batch. A new MCP session therefore receives the current Cards -before it acts on `next_action`; future Assignment State records the delivery -chain before entering `running`. +`check_queue --resume-status --json` re-freezes a current Bundle manifest for +every active batch, so a new MCP session learns which pieces it must pull +before it acts on `next_action`; the bytes follow one budgeted piece at a +time. A new execution context invalidates every earlier ack: delivery evidence +never transfers between contexts, and +[[kernel/K13 Task Runtime and Execution Control/20 Assignment State and Delivery Gate|K13/20]] +requires the full set to be re-earned. Activation or read-back fails closed when R01 or a selected Card is absent, the Card Index disagrees with the contract, semantic hashes differ, a path is @@ -142,3 +197,4 @@ transition, never to restamp the receipt. - [[kernel/K00 Standards Control/15 Read Set Loading Boundaries|Read Set Loading Boundaries]] - [[kernel/K13 Task Runtime and Execution Control/10 Batch Admission Transitions and Serial Integration|Batch Admission Transitions and Serial Integration]] - [[kernel/K13 Task Runtime and Execution Control/14 Interruption Recovery and Rollover|Interruption Recovery and Rollover]] +- [[kernel/K13 Task Runtime and Execution Control/20 Assignment State and Delivery Gate|Assignment State and Delivery Gate]] From 273a3f9ec488809f67744c95f71483bd6eade543 Mon Sep 17 00:00:00 2001 From: KimGLee <05_bolster_inkling@icloud.com> Date: Sat, 22 Aug 2026 13:34:29 +0800 Subject: [PATCH 2/3] Add K13/20 Assignment State and Delivery Gate open means a batch is admitted and its partition reserved. It does not mean any worker holds the Cards. Before this leaf the distance between those two facts was unmeasured: a runtime could call a worker running on the strength of an admission receipt, and the 2026-08-22 host measurement showed that failure reaching production with nothing able to detect it. This module owns the mapping between one admitted batch and one temporary execution context, and the gate that decides when that context may be called running. K13/19 owns what is delivered and how one piece is proven; this owns whether enough of it arrived. It is not a second Queue -- no work list, no batch lifecycle, no completion semantics -- and it is discarded when its context ends while the batch survives. That separation is why the two lifecycles can fail independently: losing the context loses the delivery evidence and nothing else. delivering -> delivered requires the ack set to equal the frozen piece manifest exactly, every ack to bind the same assignment, context, bundle hash and attempt, and the host's declared adapter identity to resolve to a current inline-delivery conformance registration. Only delivered admits running. A runtime that cannot reach it records degraded and may not claim machine- enforced Card delivery; Queue open is unaffected, since a human integrator admits batches with no Assignment at all. Delivery evidence does not transfer. A new context, a reassignment, a reopened batch, a new bundle hash or a revised Profile contract each start a new attempt and void every earlier ack. Re-delivery is idempotent reading; a transferable ack would let a context claim delivery it never received. The gate proves the frozen bytes were delivered within budget to a conformant adapter and acknowledged from the same context. It does not prove the worker read, understood, or will obey them, and no field here asserts that. The admission criteria were answered before writing it: no existing module owns this (K13/19 explicitly creates no ledger, K13/10 is Queue-side, K13/01 has no per-context object); its rules change without touching Queue lifecycle or Bundle compilation; both one-sided loads are real (a resuming worker needs delivery rules without Queue-write rules, a CLI integrator needs the reverse); and the measurable change is that running moves from zero enforceable gates to a set-equality predicate. Connected closure: the leaf enters the R01 and R07 loading boundaries, both Cards give it an explicit source_files disposition and were regenerated and re-stamped, and K13/19's size cap rises from 7.5KB to 11KB in K00/16 with its reason recorded. That section was not split further on purpose -- a reader who had the byte budget without the conformance requirement would conclude a small result is a proven one, which is the error v3 exists to remove. Scope, stated plainly: this is normative text. The Assignment state machine has no executable implementation because no reference runtime exists to host it. The primitives it consumes -- piece delivery receipts, acks, and the frozen piece set -- are implemented and tested, so landing a runtime is wiring rather than design. Co-Authored-By: Claude Opus 5 --- kernel/Cards/R01 Core Bootstrap Card.md | 18 +++- .../Cards/R07 Long-running Execution Card.md | 7 +- kernel/Cards/R09 Standards Governance Card.md | 4 +- .../16 Leaf Module Size Register.md | 13 ++- ... Runtime and Execution Control Standard.md | 3 +- .../20 Assignment State and Delivery Gate.md | 95 +++++++++++++++++++ .../Read Sets/R01 Core Bootstrap Read Set.md | 1 + .../R07 Long-running Execution Read Set.md | 1 + 8 files changed, 130 insertions(+), 12 deletions(-) create mode 100644 kernel/K13 Task Runtime and Execution Control/20 Assignment State and Delivery Gate.md diff --git a/kernel/Cards/R01 Core Bootstrap Card.md b/kernel/Cards/R01 Core Bootstrap Card.md index 7b77f57..0c8b299 100644 --- a/kernel/Cards/R01 Core Bootstrap Card.md +++ b/kernel/Cards/R01 Core Bootstrap Card.md @@ -17,11 +17,12 @@ source_files: - kernel/K00 Standards Control/15 Read Set Loading Boundaries.md - kernel/K00 Standards Control/17 Profile Dependency Closure.md - kernel/K13 Task Runtime and Execution Control/19 Card Context Activation and Read-back Delivery.md + - kernel/K13 Task Runtime and Execution Control/20 Assignment State and Delivery Gate.md - kernel/K13 Task Runtime and Execution Control/11 Completion Policy.md readback_sources: [] readback_policy: none -source_hash: '72cd9219f1e8' -compiled_source_hash: '72cd9219f1e8' +source_hash: '2025ae92d192' +compiled_source_hash: '2025ae92d192' --- # R01 Core Bootstrap Card @@ -43,9 +44,16 @@ The selected profile's `Priority Rubric` grants P0/P1. Record the tier in the Co ## Before Start -- [ ] Enter through a `card-first-readback-v1` activation result that carries - R01 plus every selected task Card. Treat an unbound CLI delivery as - degraded; it does not prove injection into an Agent execution context. +- [ ] Enter through a `card-first-readback-v3` admission result. It freezes a + piece manifest naming R01 and every selected task Card; the bytes arrive + afterwards, one budgeted piece per tool result, each acknowledged from this + execution context. Admission records `host-bound` or `prepared` and claims + no delivery of its own. +- [ ] Treat delivery as incomplete until the ack set matches the frozen + manifest and the host adapter is a registered conformant build. Only then + may a runtime call this context `running`. An unbound CLI delivery, or any + unregistered adapter, is `degraded`: work may proceed, but no layer may + claim machine-enforced Card delivery. - [ ] State the objective, target scope, exclusions, and latest user instructions. - [ ] Inspect the repository root for `.cambium/state/` before any content or task-state write. If it exists, run `python3 Tools/check_queue.py . --resume-status`, diff --git a/kernel/Cards/R07 Long-running Execution Card.md b/kernel/Cards/R07 Long-running Execution Card.md index 9869528..4212769 100644 --- a/kernel/Cards/R07 Long-running Execution Card.md +++ b/kernel/Cards/R07 Long-running Execution Card.md @@ -22,6 +22,7 @@ source_files: - kernel/K13 Task Runtime and Execution Control/09 Queue Compilation Replanning and Views.md - kernel/K13 Task Runtime and Execution Control/10 Batch Admission Transitions and Serial Integration.md - kernel/K13 Task Runtime and Execution Control/19 Card Context Activation and Read-back Delivery.md + - kernel/K13 Task Runtime and Execution Control/20 Assignment State and Delivery Gate.md - kernel/K13 Task Runtime and Execution Control/11 Completion Policy.md - kernel/K13 Task Runtime and Execution Control/12 Completion Gate Bindings.md - kernel/K13 Task Runtime and Execution Control/13 Final Handoff.md @@ -46,8 +47,8 @@ readback_sources: - kernel/K12 Quality Assurance/17 Gate Receipt Payload Contract.md - kernel/K13 Task Runtime and Execution Control/16 Resume Next Action Vocabulary.md readback_policy: declared -source_hash: 'bd12dc944665' -compiled_source_hash: 'bd12dc944665' +source_hash: 'b66901b13a27' +compiled_source_hash: 'b66901b13a27' --- # R07 Long-running Execution Card @@ -71,7 +72,7 @@ Run a multi-batch task, sustain checkpoints, resume after interruption, maintain ## During -Each batch follows the fixed loop: version/Guidance self-check → `check_queue.py --require-ready` → integrator records `queued -> open` → execute the frozen manifest → build one AuditPlan, finish in-batch QA — including one `record_batch_judgment.py` receipt per record of the activation-delivered Batch Review plan — and write the delta → integrator records `open -> merge-ready` → serially applies the delta and global gates → reconciles Coverage/Queue/Progress → records `merge-ready -> closed`. +Each batch follows the fixed loop: version/Guidance self-check → `check_queue.py --require-ready` (freezes the piece manifest; delivers no bytes) → integrator records `queued -> open` → pull every frozen piece with `check_queue.py --deliver-activation-piece` and return each nonce with `--ack-activation-piece`, which is what lets a runtime call this context `running` → execute the frozen manifest → build one AuditPlan, finish in-batch QA — including one `record_batch_judgment.py` receipt per record of the activation-delivered Batch Review plan — and write the delta → integrator records `open -> merge-ready` → serially applies the delta and global gates → reconciles Coverage/Queue/Progress → records `merge-ready -> closed`. - Concurrent batches have disjoint manifests and merged prerequisites; only the integrator writes shared control state and hub pages. - In-batch QA is not satisfied by producing the close evidence set alone: each M-tier manifest page passes, page by page, the M-tier Gate Checklist surfaced by the kernel Single Note Authoring Card (K12/14 folds note-level acceptance into Batch Review), including the sources-role and page-contract items; the per-page conclusion is recorded in that page's attestation, not asserted once in the batch wrapper. diff --git a/kernel/Cards/R09 Standards Governance Card.md b/kernel/Cards/R09 Standards Governance Card.md index 593e806..3b474a1 100644 --- a/kernel/Cards/R09 Standards Governance Card.md +++ b/kernel/Cards/R09 Standards Governance Card.md @@ -38,8 +38,8 @@ readback_sources: - kernel/K12 Quality Assurance/02 Rendering Verification.md - kernel/K12 Quality Assurance/05 Automated and Manual Checks.md readback_policy: activation -source_hash: '547d2dc76216' -compiled_source_hash: '547d2dc76216' +source_hash: '5d3baf0de814' +compiled_source_hash: '5d3baf0de814' --- # R09 Standards Governance Card diff --git a/kernel/K00 Standards Control/16 Leaf Module Size Register.md b/kernel/K00 Standards Control/16 Leaf Module Size Register.md index cdd4bf5..9c3c663 100644 --- a/kernel/K00 Standards Control/16 Leaf Module Size Register.md +++ b/kernel/K00 Standards Control/16 Leaf Module Size Register.md @@ -8,6 +8,17 @@ This page carries the exception register that [[kernel/K00 Standards Control/03 Standards Governance#Leaf Module Size Budget|Leaf Module Size Budget]] requires each approved exception to be entered in. It owns no rule: the budget, the disposition classes, and the registration obligation are stated there, and every entry below points at the page it registers. `Tools/stamp_cards.py` measures each leaf module against the budget and the entries below. +## Activation Delivery Derived Check + +A leaf that some Runtime Card declares under `readback_policy: activation` +travels to an execution context as one delivery piece. Such a leaf MUST also +satisfy the delivery budget owned by +[[kernel/K13 Task Runtime and Execution Control/19 Card Context Activation and Read-back Delivery#Budgeted Piece Delivery|K13/19]] +once its piece envelope is added. This page consumes that budget and does not +own it: the measured object there is the serialized delivery, not the source +byte count registered below, and an exception entered here for prose size +never implies delivery-budget conformance. + ## Leaf Module Size Register | Exception register | Active entries | @@ -35,7 +46,7 @@ This page carries the exception register that [[kernel/K00 Standards Control/03 | [[kernel/K12 Quality Assurance/16 Terminal Proof Contract\|Terminal Proof Contract]] | 11042 bytes | The proof contract, the gate that consumes it, and the trust boundary that scopes it are one answer to whether a task may close. Its single routed consumer, the Audit and Completion Read Set, loads all three | 11KB | Re-measure whenever a proof field or a gate item is added. Raised from 10KB to 11KB when Terminal Proof was required to consume one shared Profile/runtime view and bind/recheck the root-owned profile-load inputs alongside the Profile snapshot, typed contract, and exact repository snapshot later consumed by the completion writer. This is a currentness condition of the same proof. The earlier 9.5KB-to-10KB raise applies when root validation was required to rerun `profile-load` and keep its closure outside the five loaded-set lists. That is a condition of the existing proof, not a new proof object. The earlier raise carries the exact five-list binding. The next split MUST be `Evidence Trust Boundary`, the only part carrying an anchor of its own, once a routed consumer reaches it without the contract | | [[kernel/K12 Quality Assurance/17 Gate Receipt Payload Contract\|Gate Receipt Payload Contract]] | 10482 bytes | Gate identity fields, producer-specific additions, recording authority, and rejection are one current-authorization payload contract. R07 loads the page when a receipt is offered and needs all four to decide whether it authorizes the boundary | 10.5KB | Raised from 8.5KB to 10.5KB when current Gate authorization separated raw semantic leaves from their registered owners and required native owner member chains while preserving producer-era replay. These are acceptance and rejection rules of the same receipt payload, not a second payload contract. Raised from 7KB to 8.5KB when profile-load and Profile-derived Gate receipts gained their root-input and compiled-artifact and terminal repository fingerprints; these are producer-specific fields under the same shared acceptance/rejection contract. Originally registered when `profile-load` added its pre-Queue manifest identity plus Profile snapshot and typed-contract fingerprints. Those fields specialize the one payload contract and splitting them would create a second owner of what a Gate receipt carries. Re-measured to 10482 bytes when the batch-review wrapper gained its frozen judgment-set binding — the same one-wrapper contract, extended, not a second payload owner. Re-measure whenever a producer adds required authorization fields; split only when a routed consumer can validate one receipt class without the shared payload and rejection rules | | [[kernel/K12 Quality Assurance/14 Batch Review\|Batch Review]] | 7328 bytes | The two checklist groups and the wrapper's binding contract are one merge-ready boundary: the in-batch items say what a batch owes, and the wrapper paragraph says how the one consuming receipt proves it, now including the frozen Batch Review judgment set. A reader given either half would rebuild the other from prose | 7.5KB | Registered when the wrapper gained the judgment-set binding (`review_requirement_set_sha256`, `judgment_receipt_ids`, `judgment_record_set_sha256`) and the in-batch items gained the per-record `record_batch_judgment` obligation — the binding belongs beside the wrapper it extends and nowhere else. Re-measure when a wrapper field or in-batch item is added; split only when a routed consumer can validate the wrapper without the in-batch items that produce its members | -| [[kernel/K13 Task Runtime and Execution Control/19 Card Context Activation and Read-back Delivery\|Card Context Activation and Read-back Delivery]] | 7226 bytes | The Bundle, the Frozen Review Plan, progressive read-back, and resume redelivery are one delivery boundary read at every activation; splitting the plan from the Bundle would let one recompile and not the other | 7.5KB | Registered when protocol v2 added the Frozen Review Plan section: the plan freezes at the same admission, recompiles at the same `queued -> open`, and is delivered in the same payload, so its contract belongs on the page that owns that boundary. Re-measure when the activation payload gains a commitment; split only when a consumer can validate one commitment without the shared delivery/era rules | +| [[kernel/K13 Task Runtime and Execution Control/19 Card Context Activation and Read-back Delivery\|Card Context Activation and Read-back Delivery]] | 10646 bytes | The Bundle, the transport budget, the Frozen Review Plan, progressive read-back, and resume redelivery are one delivery boundary read at every activation; splitting the plan or the budget from the Bundle would let one recompile and not the other | 11KB | Raised from 7.5KB when protocol v3 replaced embedded payload delivery with budgeted per-piece delivery. The `Budgeted Piece Delivery` section states the byte budget, the whole-file rule, and the three-part guarantee whose parts must be read together -- a reader who has the budget without the conformance requirement would conclude that a small result is a proven one, which is the exact error v3 exists to remove. The Assignment states that consume this evidence did split out, to [[kernel/K13 Task Runtime and Execution Control/20 Assignment State and Delivery Gate\|K13/20]]. Re-measure when the activation payload gains a commitment; split further only when a consumer can validate one commitment without the shared delivery/era rules | | [[kernel/K13 Task Runtime and Execution Control/06 Amendment Log and Controlled Replanning\|Amendment Log and Controlled Replanning]] | 9557 bytes | The Guidance record, the Amendment state machine, and the registration/withdrawal writer contract are one log discipline: both routed consumers load the page whole to decide what a Guidance or operational change may do next, and no page anchors a section of it. The withdrawal rule that took the page over the cap belongs beside the one-pending rule it protects — a pending registration whose execution can never validate would otherwise wedge every future operational Amendment — and nowhere else. The Contract Amendment section joined for the same reason: the guarded writer for the one amendable contract field is part of the same discipline that says what an approved decision may and may not execute, and a reader deciding whether a contract change is amendable or successor-bound needs the whole state machine in hand | 9.5KB | Re-measure whenever an Amendment state, registration rule, or versioning rule is added; raised from 8KB to 9.5KB when the Task Contract gained a closed delegated-authority record, operational registration began deriving and binding its exact impact under lock, and narrow gap-route reconciliation received an explicit-user writer. These are authorization rules of the existing Amendment state machine. Earlier: re-measured at 8185 bytes when the Contract Amendment section gained the writer's own authorization conditions (effective-policy fingerprint, joint ceiling, merge-ready refusal) -- invocation rules of the same writer, not a new discipline. The cap moved from 7KB to 8KB when the Contract Amendment writer landed, under the same standing necessity. The split condition is a routed consumer that resolves a registration or withdrawal without holding the Guidance state machine it serves | | [[kernel/K13 Task Runtime and Execution Control/08 Required Queue Contract and Lifecycle\|Required Queue Contract and Lifecycle]] | 9198 bytes | The Queue document contract, the Work Spec binding, and the batch lifecycle are one object read from three angles, and the routed consumers load the page whole. The Batch Reference Settlement table cannot be split from the lifecycle it settles: it states what each reference to a batch ID must become when that batch reaches a terminal state, so a reader holding the lifecycle without the table would have exactly the gap the table was written to close | 9KB | Raised from 8.5KB to 9KB when routed-gap settlement moved before Delta freeze, bound the prospective after-image, and retained landed/close rechecks so the terminal gate is defense in depth rather than first discovery. Registered here as a governance change under [[kernel/K00 Standards Control/03 Standards Governance#Leaf Module Size Budget\|Leaf Module Size Budget]]. The page passed the 6KB soft cap when it gained the settlement table; the table is a closed list of the four places a batch ID is referenced, added because three of the four had each been discovered as a separate production incident, and it belongs beside the terminal transition that consumes it. Re-measure whenever a reference kind or a lifecycle edge is added — adding a reference kind means amending the table and the close settlement in the same revision; the split condition is a routed consumer that resolves a batch transition without needing the reference contract it settles | | [[kernel/K13 Task Runtime and Execution Control/10 Batch Admission Transitions and Serial Integration\|Batch Admission Transitions and Serial Integration]] | 9200 bytes | Concurrent-batch admission and the transition gates that admit them are one state machine. Three routed consumers load it whole, and no page links a section of it | 9KB | Re-measured at 9200 bytes when Card delivery was delegated to K13/19 while Queue `open` remained the admission boundary; the state-machine split test still fails. Re-measure whenever a transition or a concurrency rule is added; the split condition is a routed consumer that evaluates a transition gate without holding the concurrency rules it guards. Raised from 7.5KB to 9KB when condition 2 gained its reporting-channel rule: the paragraph explains why one admission condition is time-invariant and therefore reported over the whole Queue while the others stay readiness-only, which belongs beside the conditions it distinguishes and nowhere else, and the split test above still fails — the consumers that evaluate a transition gate need those concurrency rules in hand | diff --git a/kernel/K13 Task Runtime and Execution Control Standard.md b/kernel/K13 Task Runtime and Execution Control Standard.md index db483e5..371e6ef 100644 --- a/kernel/K13 Task Runtime and Execution Control Standard.md +++ b/kernel/K13 Task Runtime and Execution Control Standard.md @@ -30,7 +30,8 @@ This page is the stable entry point of the Task Runtime and Execution Control st | [[kernel/K13 Task Runtime and Execution Control/16 Resume Next Action Vocabulary\|Resume Next Action Vocabulary]] | `Purpose And Boundary`, `Token Table`, `Tokens Without An Automated Path`, `Related` | | [[kernel/K13 Task Runtime and Execution Control/17 Escalation Policy\|Escalation Policy]] | `Purpose And Boundary`, `The Kernel Trigger`, `Profile-declared Triggers`, `Firing And Resuming`, `A Trigger Is Not A Gate`, `Control Accretion Decision`, `Related` | | [[kernel/K13 Task Runtime and Execution Control/18 Initial Task Planning Transaction\|Initial Task Planning Transaction]] | `Purpose And Boundary`, `What The Plan Supplies And What It May Never Infer`, `Where The Transaction Stops`, `Guarded Write Protocol`, `Applying It Twice`, `Control Accretion Decision`, `Related` | -| [[kernel/K13 Task Runtime and Execution Control/19 Card Context Activation and Read-back Delivery\|Card Context Activation and Read-back Delivery]] | `Purpose And Boundary`, `Frozen Reading Plan`, `Card Activation Bundle`, `Execution-context Delivery`, `Frozen Review Plan`, `Progressive Read-back`, `Resume Reassignment And Failure`, `Related` | +| [[kernel/K13 Task Runtime and Execution Control/19 Card Context Activation and Read-back Delivery\|Card Context Activation and Read-back Delivery]] | `Purpose And Boundary`, `Frozen Reading Plan`, `Card Activation Bundle`, `Execution-context Delivery`, `Budgeted Piece Delivery`, `Frozen Review Plan`, `Progressive Read-back`, `Resume Reassignment And Failure`, `Related` | +| [[kernel/K13 Task Runtime and Execution Control/20 Assignment State and Delivery Gate\|Assignment State and Delivery Gate]] | `Purpose And Boundary`, `Why This Is A Separate Gate`, `Assignment Record`, `Delivery States`, `Attempt Invalidation`, `What This Gate Does Not Prove`, `Related` | ## Applicable Read Sets diff --git a/kernel/K13 Task Runtime and Execution Control/20 Assignment State and Delivery Gate.md b/kernel/K13 Task Runtime and Execution Control/20 Assignment State and Delivery Gate.md new file mode 100644 index 0000000..98037f9 --- /dev/null +++ b/kernel/K13 Task Runtime and Execution Control/20 Assignment State and Delivery Gate.md @@ -0,0 +1,95 @@ +## Navigation + +- Parent: [[kernel/K13 Task Runtime and Execution Control Standard|K13 Task Runtime and Execution Control Standard]]. +- Previous: [[kernel/K13 Task Runtime and Execution Control/19 Card Context Activation and Read-back Delivery|Card Context Activation and Read-back Delivery]]. + +## Purpose And Boundary + +This module owns the mapping between one admitted batch and one temporary +execution context, and the gate that decides when that context may be called +`running`. [[kernel/K13 Task Runtime and Execution Control/19 Card Context Activation and Read-back Delivery|K13/19]] +owns what is delivered and how one piece is proven; this module owns whether +enough of it arrived. Nothing here is a second Queue: the Assignment record +carries no work list, no batch lifecycle, and no completion semantics, and it +is discarded when its context ends while the batch survives. + +The separation matters because the two lifecycles fail differently. A batch is +durable work that outlives any agent; an Assignment is one attempt by one +context to carry it. Losing the context loses the delivery evidence and +nothing else. + +## Why This Is A Separate Gate + +`open` means a batch is admitted and its partition reserved. It does not mean +any worker holds the Cards. Before this module existed the distance between +those two facts was unmeasured: a runtime could call a worker `running` on the +strength of an admission receipt, and the 2026-08-22 host measurement showed +exactly that failure reaching production -- a conformant server delivery, a +receipt claiming machine delivery, and a model context that never received the +bytes. The claim was unfalsifiable because no gate consumed delivery evidence. + +## Assignment Record + +An Assignment binds, for one execution context: + +- `assignment_id`, and the `batch_id` it carries; +- `execution_context_id`, and the optional parent context it was spawned from; +- the role (`integrator`, `writer`, `reviewer`, or `researcher`) and that + role's permitted write scope; +- the frozen `card_bundle_sha256` taken from Queue admission; +- the current `delivery_attempt_id`; +- the delivery state below, and the handoff checkpoint if one exists. + +Role topology is runtime metadata. It is never Profile configuration, and an +Assignment never widens a scope the Queue and Profile did not already grant. + +## Delivery States + +```text +pending Assignment created against an admitted batch +delivering at least one piece delivered, ack set incomplete +delivered ack set complete and Adapter conformance current +running worker may execute +``` + +`pending -> delivering` requires one delivered piece. `delivering -> delivered` +requires all of: + +- the ack set equals the frozen piece manifest exactly -- no missing, extra, + duplicated, or foreign record; +- every ack binds the same `assignment_id`, `execution_context_id`, + `card_bundle_sha256`, and `delivery_attempt_id`; +- the host's declared adapter identity resolves to a current + inline-delivery conformance registration. + +Only `delivered` admits `running`. A runtime that cannot reach `delivered` +may still work, but records `degraded` and MUST NOT claim machine-enforced +Card delivery. Queue `open` is unaffected either way: a human integrator +admits batches without any Assignment at all. + +## Attempt Invalidation + +Delivery evidence is bound to one attempt in one context, and does not +transfer. A new execution context, a reassignment, a reopened batch, a new +`card_bundle_sha256`, or a revised Profile contract each start a new +`delivery_attempt_id` and void every earlier ack. Recovery is to deliver the +current pieces again, never to carry evidence across the boundary that +invalidated it. + +This is deliberately expensive to fake and cheap to redo: re-delivery is +idempotent reading, while a transferable ack would let a context claim +delivery it never received. + +## What This Gate Does Not Prove + +`delivered` means the frozen bytes were delivered within budget to a +conformant adapter and acknowledged from the same context. It does not prove +the worker read them, understood them, or will obey them. Cognition is not +observable here and no field in this module asserts it. + +## Related + +- [[kernel/K13 Task Runtime and Execution Control/19 Card Context Activation and Read-back Delivery|Card Context Activation and Read-back Delivery]] +- [[kernel/K13 Task Runtime and Execution Control/10 Batch Admission Transitions and Serial Integration|Batch Admission Transitions and Serial Integration]] +- [[kernel/K13 Task Runtime and Execution Control/14 Interruption Recovery and Rollover|Interruption Recovery and Rollover]] +- [[kernel/K00 Standards Control/12 Control Registry|Control Registry]] diff --git a/kernel/Read Sets/R01 Core Bootstrap Read Set.md b/kernel/Read Sets/R01 Core Bootstrap Read Set.md index 74a8cf0..2f879cd 100644 --- a/kernel/Read Sets/R01 Core Bootstrap Read Set.md +++ b/kernel/Read Sets/R01 Core Bootstrap Read Set.md @@ -21,6 +21,7 @@ Read in order: 8. [[kernel/K00 Standards Control/15 Read Set Loading Boundaries|Read Set Loading Boundaries]] 9. [[kernel/K00 Standards Control/17 Profile Dependency Closure|Profile Dependency Closure]] 10. [[kernel/K13 Task Runtime and Execution Control/19 Card Context Activation and Read-back Delivery|Card Context Activation and Read-back Delivery]] +11. [[kernel/K13 Task Runtime and Execution Control/20 Assignment State and Delivery Gate|Assignment State and Delivery Gate]] Then select the task-specific Read Set from the [[kernel/Read Sets/Read Sets Index|Read Sets Index]]. diff --git a/kernel/Read Sets/R07 Long-running Execution Read Set.md b/kernel/Read Sets/R07 Long-running Execution Read Set.md index 9183f72..d4853c3 100644 --- a/kernel/Read Sets/R07 Long-running Execution Read Set.md +++ b/kernel/Read Sets/R07 Long-running Execution Read Set.md @@ -25,6 +25,7 @@ First read [[kernel/Read Sets/R01 Core Bootstrap Read Set|Core Bootstrap]], then - [[kernel/K13 Task Runtime and Execution Control/09 Queue Compilation Replanning and Views|Queue Compilation Replanning and Views]] - [[kernel/K13 Task Runtime and Execution Control/10 Batch Admission Transitions and Serial Integration|Batch Admission Transitions and Serial Integration]] - [[kernel/K13 Task Runtime and Execution Control/19 Card Context Activation and Read-back Delivery|Card Context Activation and Read-back Delivery]] +- [[kernel/K13 Task Runtime and Execution Control/20 Assignment State and Delivery Gate|Assignment State and Delivery Gate]] - [[kernel/K13 Task Runtime and Execution Control/14 Interruption Recovery and Rollover|Interruption Recovery and Rollover]] - [[kernel/K12 Quality Assurance/03 Module and Coverage Review|Module and Coverage Review]] - [[kernel/K12 Quality Assurance/14 Batch Review|Batch Review]] From bb142bc2846565c5239f01a5e484d39213310bef Mon Sep 17 00:00:00 2001 From: KimGLee <05_bolster_inkling@icloud.com> Date: Sat, 22 Aug 2026 13:34:49 +0800 Subject: [PATCH 3/3] Measure Host Adapter inline delivery instead of assuming it A server can prove what it sent and an ack can prove which context answered. Neither can see what the host did in between, and that gap is the failure card-first-readback-v3 exists to catch. It is now measured against a live adapter rather than assumed. inline_probe_server returns a payload of an exactly requested size with a nonce at its very end. It touches no corpus: the subject under test is the adapter, not Cambium state. host_conformance_probe emits the exact two-control procedure and judges the observations. Both controls are mandatory. The positive one requires a payload of exactly minimum_bytes to arrive whole, proven by the model reporting the trailing nonce. The negative one requires a larger payload to be OBSERVED as externalized. A positive result alone certifies nothing -- a probe that cannot fail cannot certify -- and the probe reports that case as its own failure. Measured against Claude Code 2.1.223 on 2026-08-22: 49152 bytes arrived inline with the tail nonce intact, while 57344 and 65536 bytes were both spilled to a persisted-output file with the nonce absent. So the adapter meets the budget, and the probe demonstrably detects the failure it rules out. That result carries a warning, recorded in the registry: the inline ceiling sits between 49152 and 57344 bytes, so the budget has no headroom above it. MAX_ACTIVATION_PIECE_ENVELOPE_BYTES must not be raised without re-measuring -- this adapter would not refuse a larger piece, it would silently externalize it, restoring the exact failure mode v3 removes. Registration binds the declared clientInfo name and a version range because hosts update themselves underneath a passing test; an unlisted build degrades rather than inheriting a stale pass. Absence from the registry is a statement about measurement, not about quality. Co-Authored-By: Claude Opus 5 --- Tools/host-conformance.yaml | 47 +++++++++ Tools/tests/host_conformance_probe.py | 135 ++++++++++++++++++++++++++ Tools/tests/inline_probe_server.py | 83 ++++++++++++++++ Tools/tests/test_host_conformance.py | 103 ++++++++++++++++++++ 4 files changed, 368 insertions(+) create mode 100644 Tools/host-conformance.yaml create mode 100644 Tools/tests/host_conformance_probe.py create mode 100644 Tools/tests/inline_probe_server.py create mode 100644 Tools/tests/test_host_conformance.py diff --git a/Tools/host-conformance.yaml b/Tools/host-conformance.yaml new file mode 100644 index 0000000..5e9768d --- /dev/null +++ b/Tools/host-conformance.yaml @@ -0,0 +1,47 @@ +# ============================================================================= +# Host Adapter conformance registry +# Owner standard: "kernel/K13 Task Runtime and Execution Control/19 Card +# Context Activation and Read-back Delivery.md" (Budgeted Piece Delivery) +# +# A server can prove what it sent. It cannot prove what the host put in the +# model context. This file records which adapter builds have demonstrated, +# by test, that a within-budget tool result is delivered inline rather than +# truncated or externalized -- the middle part of the three-part guarantee +# K13/19 defines. An adapter absent from this registry is `degraded`; that +# is a statement about measurement, not about quality. +# +# Registration is earned by the probe in +# `Tools/tests/host_conformance_probe.py`, which requires BOTH controls: +# positive -- a payload of exactly `minimum_bytes` arrives whole, proven by +# the model reporting a nonce placed at its very end; +# negative -- a larger payload is OBSERVED to be externalized, proving the +# probe can detect the failure it claims to rule out. +# A positive result alone is not a pass: a probe that cannot fail cannot +# certify. +# +# `version_range` is inclusive-exclusive over the host's declared +# `clientInfo` name/version, exported to tools as CAMBIUM_HOST_CLIENT_NAME +# and CAMBIUM_HOST_CLIENT_VERSION. Hosts update themselves underneath a +# passing registration, so evidence binds the build it ran against and an +# unlisted build degrades instead of inheriting a stale pass. These are +# declared labels, not authentication. +# +# Only the restricted YAML subset (Tools/kblib.py parse_yaml_subset). +# ============================================================================= + +schema_version: 1 +conformance_version: activation-inline-v1 +minimum_bytes: 49152 + +adapters: + - client_name: claude-code + version_range_from: 2.1.223 + version_range_before: 2.2.0 + inline_tool_result_supported: true + measured_inline_bytes: 49152 + measured_externalized_bytes: 57344 + externalization_below_limit: forbidden + conformance_version: activation-inline-v1 + measured_on: 2026-08-22 + evidence: "Tools/tests/host_conformance_probe.py; positive control 49152 B delivered inline with the trailing nonce reported by the model; negative control 57344 B and 65536 B both observed externalized to a persisted-output file with the nonce absent" + note: "The measured inline ceiling sits between 49152 and 57344 bytes, so the registered minimum has no headroom above it. Re-measure before raising MAX_ACTIVATION_PIECE_ENVELOPE_BYTES; this adapter would externalize a larger budget rather than refuse it." diff --git a/Tools/tests/host_conformance_probe.py b/Tools/tests/host_conformance_probe.py new file mode 100644 index 0000000..3df2a10 --- /dev/null +++ b/Tools/tests/host_conformance_probe.py @@ -0,0 +1,135 @@ +"""Inline-delivery conformance probe for one Host Adapter build. + +K13/19's delivery guarantee has three parts, and this probe supplies exactly +one of them: whether a within-budget tool result reaches the model context +whole. A server can prove what it sent and an ack can prove which context +answered, but neither can see what the host did in between. That gap is the +failure this protocol exists to catch, so it is measured against a live host +rather than asserted. + +The probe is not a unit test. It needs a real adapter, so it prints an exact +procedure, then validates the observations that procedure returns. What is +machine-checkable offline -- the payload shape and the registry schema -- +lives in `test_host_conformance.py`. + +Both controls are mandatory: + + positive a payload of exactly `minimum_bytes` must arrive whole, proven by + the model reporting the nonce placed at its very end; + negative a larger payload must be OBSERVED to be externalized or truncated. + +A positive result alone is not a pass. A probe that cannot fail cannot +certify, and the negative control is what proves this one can. +""" + +import argparse +import json +import os +import sys + +sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__)))) +sys.path.insert(0, os.path.dirname(os.path.abspath(__file__))) + +import kblib +import inline_probe_server + +REGISTRY_PATH = "Tools/host-conformance.yaml" +CONFORMANCE_VERSION = "activation-inline-v1" +PROBE_PROMPT = ( + "Call the probe tool with {\"size_bytes\": %d}. Then answer exactly two " + "lines. First line TAIL=> marker as it " + "appears in the tool result; write TAIL=ABSENT if it is not there, and do " + "not open any file to find it>. Second line PERSISTED=. Use no tool other than the probe tool." +) + + +def load_registry(root): + with open(os.path.join(root, REGISTRY_PATH), encoding="utf-8") as handle: + return kblib.parse_yaml_subset(handle.read()) + + +def procedure(root): + """Return the exact, reproducible steps for one adapter measurement.""" + registry = load_registry(root) + minimum = registry["minimum_bytes"] + return { + "conformance_version": registry["conformance_version"], + "minimum_bytes": minimum, + "server": "Tools/tests/inline_probe_server.py", + "expected_tail_nonce": inline_probe_server.NONCE, + "controls": [ + { + "control": "positive", + "size_bytes": minimum, + "prompt": PROBE_PROMPT % minimum, + "required": "TAIL equals the nonce and PERSISTED is NO", + }, + { + "control": "negative", + "size_bytes": minimum * 2, + "prompt": PROBE_PROMPT % (minimum * 2), + "required": "TAIL is ABSENT or PERSISTED is YES", + }, + ], + } + + +def evaluate(root, positive_tail, positive_persisted, negative_tail, + negative_persisted): + """Judge one observed pair; both controls must hold.""" + nonce = inline_probe_server.NONCE + findings = [] + if positive_tail != nonce: + findings.append( + "positive control did not deliver the trailing nonce inline; the " + "adapter truncated or externalized a within-budget result") + if positive_persisted: + findings.append( + "positive control was externalized; a within-budget result must " + "be inlined") + if negative_tail == nonce and not negative_persisted: + findings.append( + "negative control was also delivered whole, so this run cannot " + "detect externalization and certifies nothing") + return findings + + +def main(argv=None): + parser = argparse.ArgumentParser( + description="Measure one Host Adapter's inline tool-result delivery") + parser.add_argument("root", help="Cambium repository root") + parser.add_argument("--emit-plan", action="store_true", + help="print the exact measurement procedure as JSON") + parser.add_argument("--positive-tail", help="TAIL reported at the budget") + parser.add_argument("--positive-persisted", action="store_true", + help="the budget-sized result was externalized") + parser.add_argument("--negative-tail", help="TAIL reported above budget") + parser.add_argument("--negative-persisted", action="store_true", + help="the oversized result was externalized") + args = parser.parse_args(argv) + + if args.emit_plan: + print(json.dumps(procedure(args.root), indent=2, sort_keys=True)) + return 0 + if args.positive_tail is None or args.negative_tail is None: + print("[FAIL] both --positive-tail and --negative-tail are required; " + "a positive result alone cannot certify") + return 1 + findings = evaluate(args.root, args.positive_tail, + args.positive_persisted, args.negative_tail, + args.negative_persisted) + for finding in findings: + print("[FAIL] %s" % finding) + if findings: + return 1 + print("[PASS] adapter meets %s at %d bytes; register it in %s with the " + "declared clientInfo name and version range it was measured against" + % (CONFORMANCE_VERSION, load_registry(args.root)["minimum_bytes"], + REGISTRY_PATH)) + return 0 + + +if __name__ == "__main__": + sys.exit(main()) diff --git a/Tools/tests/inline_probe_server.py b/Tools/tests/inline_probe_server.py new file mode 100644 index 0000000..3a49e26 --- /dev/null +++ b/Tools/tests/inline_probe_server.py @@ -0,0 +1,83 @@ +"""Minimal stdio MCP server that measures one host's inline-result limit. + +It exposes a single tool that returns a result of an exactly requested byte +size with a nonce at the very end. A host that inlines the whole result puts +the trailing nonce in the model context; a host that truncates or externalizes +does not. Nothing here touches a corpus: the subject under test is the host +adapter, not Cambium state. +""" + +import json +import sys + +PROTOCOL = "2025-11-25" +NONCE = "TAILNONCE-9f2c41d7b6e84a03" + +TOOL = { + "name": "emit_sized_payload", + "description": ( + "Return a payload of exactly `size_bytes` UTF-8 bytes whose final " + "field is a fixed tail nonce."), + "inputSchema": { + "type": "object", + "additionalProperties": False, + "properties": { + "size_bytes": {"type": "integer", + "description": "target payload size in bytes"}, + }, + "required": ["size_bytes"], + }, +} + + +def build_payload(size_bytes): + """Return text of close to size_bytes whose last token is the nonce.""" + tail = "\n<>" % NONCE + head = "<>\n" + filler_len = max(0, size_bytes - len(head) - len(tail)) + # Line-broken filler so a host that shows a head-and-tail summary still + # produces readable evidence of what it dropped. + line = "0123456789abcdef" * 4 + "\n" + filler = (line * (filler_len // len(line) + 1))[:filler_len] + return head + filler + tail + + +def respond(message_id, result): + sys.stdout.write(json.dumps( + {"jsonrpc": "2.0", "id": message_id, "result": result}) + "\n") + sys.stdout.flush() + + +def main(): + for raw in sys.stdin: + raw = raw.strip() + if not raw: + continue + try: + message = json.loads(raw) + except ValueError: + continue + method = message.get("method") + message_id = message.get("id") + if method == "initialize": + respond(message_id, { + "protocolVersion": PROTOCOL, + "capabilities": {"tools": {}}, + "serverInfo": {"name": "inline-probe", "version": "1.0.0"}, + }) + elif method == "tools/list": + respond(message_id, {"tools": [TOOL]}) + elif method == "tools/call": + arguments = message.get("params", {}).get("arguments") or {} + size = int(arguments.get("size_bytes") or 0) + text = build_payload(size) + respond(message_id, { + "content": [{"type": "text", "text": text}], + "isError": False, + }) + elif message_id is not None: + respond(message_id, {}) + + +if __name__ == "__main__": + main() diff --git a/Tools/tests/test_host_conformance.py b/Tools/tests/test_host_conformance.py new file mode 100644 index 0000000..0a2bbac --- /dev/null +++ b/Tools/tests/test_host_conformance.py @@ -0,0 +1,103 @@ +import os +from pathlib import Path +import sys +import unittest + +TOOLS = Path(__file__).resolve().parents[1] +ROOT = TOOLS.parent +sys.path.insert(0, str(TOOLS / "tests")) +sys.path.insert(0, str(TOOLS)) + +import card_activation +import host_conformance_probe +import inline_probe_server +import kblib + + +class InlineProbePayloadTests(unittest.TestCase): + def test_payload_is_exactly_the_requested_size(self): + for size in (512, 4096, 49152, 65536): + self.assertEqual( + size, len(inline_probe_server.build_payload(size).encode( + "utf-8"))) + + def test_the_nonce_sits_at_the_very_end(self): + # A leading preview is the failure mode this probe exists to catch, so + # the evidence token must be the last thing a truncating host drops. + payload = inline_probe_server.build_payload(49152) + self.assertIn(inline_probe_server.NONCE, payload[-64:]) + self.assertNotIn(inline_probe_server.NONCE, payload[:-64]) + + +class ConformanceRegistryTests(unittest.TestCase): + def setUp(self): + self.registry = host_conformance_probe.load_registry(ROOT) + + def test_registry_minimum_equals_the_protocol_budget(self): + # A registry that certified a smaller result than the protocol + # delivers would pass adapters that cannot carry a real piece. + self.assertEqual(card_activation.MAX_ACTIVATION_PIECE_ENVELOPE_BYTES, + self.registry["minimum_bytes"]) + + def test_every_adapter_row_is_closed_and_measured(self): + self.assertTrue(self.registry["adapters"]) + for adapter in self.registry["adapters"]: + for field in ("client_name", "version_range_from", + "version_range_before", "measured_inline_bytes", + "measured_externalized_bytes", "conformance_version", + "measured_on", "evidence"): + self.assertIn(field, adapter) + self.assertEqual(host_conformance_probe.CONFORMANCE_VERSION, + adapter["conformance_version"]) + self.assertEqual("forbidden", + adapter["externalization_below_limit"]) + self.assertGreaterEqual(adapter["measured_inline_bytes"], + self.registry["minimum_bytes"]) + # The negative control has to sit above the positive one, or the + # row records no discrimination at all. + self.assertGreater(adapter["measured_externalized_bytes"], + adapter["measured_inline_bytes"]) + + +class ProbeJudgementTests(unittest.TestCase): + def evaluate(self, **overrides): + arguments = { + "positive_tail": inline_probe_server.NONCE, + "positive_persisted": False, + "negative_tail": "ABSENT", + "negative_persisted": True, + } + arguments.update(overrides) + return host_conformance_probe.evaluate(ROOT, **arguments) + + def test_both_controls_holding_is_a_pass(self): + self.assertEqual([], self.evaluate()) + + def test_a_truncated_positive_control_fails(self): + findings = self.evaluate(positive_tail="ABSENT") + self.assertTrue(any("within-budget" in finding + for finding in findings), findings) + + def test_an_externalized_positive_control_fails(self): + findings = self.evaluate(positive_persisted=True) + self.assertTrue(findings) + + def test_a_probe_that_cannot_detect_externalization_certifies_nothing(self): + findings = self.evaluate(negative_tail=inline_probe_server.NONCE, + negative_persisted=False) + self.assertTrue(any("certifies nothing" in finding + for finding in findings), findings) + + def test_plan_names_both_controls_and_the_budget(self): + plan = host_conformance_probe.procedure(ROOT) + self.assertEqual( + ["positive", "negative"], + [control["control"] for control in plan["controls"]]) + self.assertEqual(card_activation.MAX_ACTIVATION_PIECE_ENVELOPE_BYTES, + plan["controls"][0]["size_bytes"]) + self.assertGreater(plan["controls"][1]["size_bytes"], + plan["controls"][0]["size_bytes"]) + + +if __name__ == "__main__": + unittest.main()