Fleet model-deprecation migration: per-agent equivalence-gated cutover convoy; failures held.
Scored across 7 tools
Each tool maps to a distinct stage: screen (ordering only), readiness (per-agent verdict), port (config migration), cutover (post-gate swap), disposition (for held agents), plus status and ledger as read surfaces. Mild overlap exists between convoy_readiness and convoy_screen since readiness internally runs a screen, and between convoy_port and convoy_cutover, but the descriptions explicitly delimit them (screen 'never an equivalence result'; cutover only for agents that passed the gate).
Every tool follows the same convoy_<noun> pattern with a shared prefix and single-word noun suffixes, so names are highly predictable and scannable as a group. The convention is noun-based rather than verb_noun, but it is applied uniformly with no mixing of styles.
Seven tools is well within the sweet spot and each one earns its place in a migration pipeline: two read surfaces (status, ledger), two evaluation steps (screen, readiness), and three actions (port, cutover, disposition). Nothing appears redundant or missing at this scope.
The surface covers the full migration lifecycle from screening through readiness, porting, cutover, and exception handling, with status and ledger for visibility. Minor gaps: no rollback/revert operation after cutover and no batch variant for multi-agent fleets despite the 'fleet' framing, so agents must loop tool calls per agent.
Cut over an agent that passed its equivalence gate. Held or ungated agents are refused.
Inputs: agent (required).
Disposition a held agent: pin-and-pay, retire, or accept-and-flag (ack bound to the exact failing set).
Inputs: kind (required), agent (required), ack.
Your append-only convoy ledger entries.
Inputs: no named parameters.
Port one agent's configuration to the successor model.
Inputs: agent (required).
Readiness verdict for one agent (inventory + screen). First verdict free once per proven-wallet operator; paid verdicts settle over x402 on POST /readiness.
Inputs: agent (required).
Run the metadata sensitivity screen; returns convoy order, most fragile first. Ordering only - never an equivalence result.
Inputs: no named parameters.
Your convoy status: per-agent states, sequence, at-risk list, meter.
Inputs: no named parameters.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Salvageability triage for agent fleets in a declared mass-failure mode.
Checkpoint-paired twin trials for agent fleet changes with blinded verdicts.
Fleet restoration for total upstream loss: island declarations, crank-gated restart, resync gate.
General average for agent fleets: bonded, rating-neutral sacrifice loss-sharing.
Add one secure layer between your agents and this server.
