Advanced: attach session policy

Previous value: -"Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true (preview, no write)."New value: +"Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true. confirm is consent to run the call. It is not tenant auth and it does not upgrade shared public-demo isolation."

Previous value: -"Optional preview flag. When true, return a would-mutate preview and do not write. Alternative to confirm=true. Does not mutate."New value: +"Optional preview flag. When true, do not write and do not stamp a ledger tip. Allowlist, hallucination, stub, and local-only checks still run and return the same FragGate refuse code a confirm call would get. MCP-DRY-RUN is returned only when that call would have been allowed to proceed. confirm is consent, not tenant auth, and it does not upgrade shared public-demo isolation."

Previous value: -"session_id or id required. Other fields are optional policy overlays (also accepted nested under policy)."New value: +"session_id or id required. Other fields are optional policy overlays (also accepted nested under policy). Mutation requires confirm=true or dry_run=true."

Added value: +{
+  "description": "Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true (preview, no write).",
+  "type": "boolean"
+}

Added value: +{
+  "description": "Optional preview flag. When true, return a would-mutate preview and do not write. Alternative to confirm=true. Does not mutate.",
+  "type": "boolean"
+}

Previous value: -"session_id is required. Other fields are optional policy overlays."New value: +"session_id or id required. Other fields are optional policy overlays (also accepted nested under policy)."

Previous value: -"Optional allowlist of ops this session may exec."New value: +"Optional replacement allowlist of ops this session may exec. Omit to keep the current list."

Previous value: -"Optional allowlist of catalog slugs this session may exec."New value: +"Optional replacement allowlist of catalog slugs this session may exec. Omit to keep the current list."

Added value: +{
+  "description": "Alias of session_id. The door accepts either key; do not send two different values.",
+  "pattern": "^sess_[a-f0-9]{32}$",
+  "type": "string"
+}

Previous value: -"Optional. When true, allow KV increment side effects on this session."New value: +"Optional. When true, allow KV increment side effects on later exec. Not an increment itself."

Previous value: -"Optional max payload size in bytes for later exec."New value: +"Optional max payload size in bytes for later exec (integer 1..1048576). Overlay only; not the exec body. Out of range refuses bad_policy."

Added value: +1048576

Added value: +1

Previous value: -"Required raw session id from runtime_session_open. Alias: id."New value: +"Required. Raw session id from runtime_session_open (sess_ + 32 lowercase hex). Alias: id. Missing both fails with session_id required; unknown id returns session_not_found."

Added value: +"^sess_[a-f0-9]{32}$"

Previous value: -"Machine payload. FragGate-style results commonly include ok, code, slug, op, status, engine_slug, engine_op, engine_digest, ran_in, provenance, refusal, limitations, and ledger_tip."New value: +"Policy body: updated session allow lists and a policy receipt. Refuses session_id required, session_not_found, session_closed, session_expired."

Added value: +"session_id is required. Other fields are optional policy overlays."

Added value: +"Optional allowlist of ops this session may exec."

Added value: +"Optional allowlist of catalog slugs this session may exec."

Added value: +"Optional. When true, allow KV increment side effects on this session."

Added value: +"Optional max payload size in bytes for later exec."

Added value: +"Required raw session id from runtime_session_open. Alias: id."

Previous value: -nullNew value: +{
+  "additionalProperties": true,
+  "description": "Display envelope shown to the user (display.title / display.summary) plus the machine result. Extra engine fields may appear.",
+  "properties": {
+    "code": {
+      "description": "FragGate or fabric code when present: FG-OK, FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-UNKNOWN-OP, FG-GATE-REFUSE, FG-LAMB-REFUSE, or a module refuse such as MESH-* / AKM-*.",
+      "type": "string"
+    },
+    "display": {
+      "additionalProperties": true,
+      "description": "Human-facing envelope. Show title and summary, then take the next input.",
+      "properties": {
+        "fields": {
+          "description": "Optional labeled scalars copied from the result for display.",
+          "items": {
+            "additionalProperties": true,
+            "properties": {
+              "label": {
+                "description": "Field label.",
+                "type": "string"
+              },
+              "value": {
+                "description": "Field value as text.",
+                "type": "string"
+              }
+            },
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "next": {
+          "description": "What the agent should do after showing this output.",
+          "type": "string"
+        },
+        "summary": {
+          "description": "One-line outcome or refuse reason.",
+          "type": "string"
+        },
+        "title": {
+          "description": "Short result title for the AI client.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "door": {
+      "description": "Door name. The public door is fraggate.",
+      "type": "string"
+    },
+    "engine_digest": {
+      "description": "64-hex engine_digest when a true in-process engine ran (often inside result).",
+      "type": "string"
+    },
+    "engine_op": {
+      "description": "Resolved engine op when present (often inside result).",
+      "type": "string"
+    },
+    "engine_slug": {
+      "description": "Resolved engine slug when present (often inside result).",
+      "type": "string"
+    },
+    "ledger_tip": {
+      "description": "Ask/refuse ledger tip when the door stamped one."
+    },
+    "limitations": {
+      "description": "Capability limitations or Remain-OFF notes when present."
+    },
+    "provenance": {
+      "description": "Provenance / input packet when the pipeline attached one."
+    },
+    "ran_in": {
+      "description": "Execution locale (for example aziel-runtime) when present.",
+      "type": "string"
+    },
+    "receipt": {
+      "description": "Optional receipt, ledger tip, or TemporalLock/ForgeReceipts exit when the door stamped one."
+    },
+    "refusal": {
+      "description": "Explicit refuse object, code, or message when the door or engine refused."
+    },
+    "result": {
+      "description": "Machine payload. FragGate-style results commonly include ok, code, slug, op, status, engine_slug, engine_op, engine_digest, ran_in, provenance, refusal, limitations, and ledger_tip."
+    },
+    "session_id": {
+      "description": "Raw session id when session plumbing was used. Hidden unless the user asked for the chain.",
+      "type": "string"
+    },
+    "status": {
+      "description": "HTTP-like status when present on wrappers (200 ok; 400+ error / refuse).",
+      "type": "integer"
+    }
+  },
+  "type": "object"
+}