FerryCat
FerryCat is a local MCP server for contract-driven cross-host AI agent handoff and code review over a shared SQLite WAL bus.
Dispatch contracts to another local agent host with task type, context, workspace root, file pointers, optional JSON schema, and TTLs, while snapshotting full-file SHA-256 fingerprints and line bounds.
Poll and atomically claim pending contracts, sweep expired queue items, verify local file fingerprints, and mark contracts stale if files changed.
Fulfill claimed contracts with summaries, structured outputs, and artifact pointers, with TOCTOU file checks and Ajv JSON Schema validation plus bounded retries/salvage behavior.
Inspect mesh state read-only: contract statuses, outputs, counters, expiry flags, errors, and salvaged results.
Release claimed contracts back to the queue, extend execution TTL as a heartbeat, or fail contracts with a required reason.
Verify on-disk pointer files against the dispatched baseline before submitting, without mutating contract state.
Support human-scheduled handoffs between IDE agents that share the same local filesystem and database; it is not an adversarial sandbox or unattended workflow engine.
Supports Google Antigravity as a target desktop AI agent host, enabling cross-host handoff and code-review contracts to be dispatched to and fulfilled by Antigravity agents.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@FerryCatdispatch a review of src/api.ts to WorkBuddy"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
FerryCat: Contract-Driven Cross-Host AI Agent Handoff Bus
FerryCat (
ferrycat) is a lightweight, deterministic cross-host AI agent handoff and code review bus built on the Model Context Protocol (MCP) and Node.js built-innode:sqlite(WAL mode).
Purpose-built to safely bridge isolated desktop IDE agent hosts (such as Google Antigravity, WorkBuddy, Claude Code, and Cursor) across separate OS processes without context drift or blind reviews on stale files.
๐ Deep Dive: Why I Started Building FerryCat: When Two AI Coding Hosts Live on the Same Desktop
Core Pain Points & Engineering Solutions
While the official MCP Tasks specification (2025-11 / 2026-07) addresses long-running operations within a single Client โ Server connection, it does not solve cross-host collaboration on a developer workstation:
stdioProcess Isolation: Desktop IDEs spawn local MCP servers as independent child processes with isolated memory spaces and distinct Node.js runtimes.Silent Blind Reviews on Stale Code (
Stale Context): When handing off a task from Host A to Host B, unushed IDE buffers, branch switches, or mid-review edits cause the receiving agent to audit outdated code and produce plausible but invalid conclusions.Context Window Bloat: Pasting hundreds of lines of source code across chat windows duplicates token consumption on both ends.
Unstructured Handoff Outputs: Free-form prose responses lack deterministic schema enforcement, making downstream consumption unreliable and prone to infinite retry loops.
FerryCat resolves these failure modes through a human-scheduled, contract-driven SQLite WAL bus:
[Developer] [Host A: Antigravity] [~/.ferrycat/mesh.db] [Host B: WorkBuddy]
| | | |
|-- 1. "Dispatch review" --->| | |
| |-- dispatch_contract() -------->| Write status = SUBMITTED |
| | (Full SHA-256 + Line Bounds) | Store size / sha256 snapshot |
| | | |
|-- 2. Switch IDE: "Poll" ---|--------------------------------|------------------------------>|
| | |<-- poll_next_task() ----------|
| | | (Atomic claim changes===1 |
| | | + Verify disk SHA-256) |
| | | |-- Read local files
| | |<-- fulfill_contract() --------|-- Re-verify SHA-256
| | | (Validate Ajv JSON Schema | & submit JSON
| | | -> status = COMPLETED) |
| | | |
|-- 3. Switch IDE: "Inspect" | | |
| |-- inspect_mesh_state() ------->| Read-only query of COMPLETED |
|<-- Present structured res -| | |Related MCP server: AgentMesh MCP
Key Architectural Pillars
1. Deterministic 7-State Machine
Every state transition is bound to an explicit SQL transaction with optimistic concurrency control (changes === 1), eliminating phantom or dangling states:
dispatch_contract()
โ
โผ
โโโโโโโโโโโโโ
โ SUBMITTED โ (Queue TTL: default 1800s)
โโโโโโโฌโโโโโโ
โ
poll_next_task()
โโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโ
โ (Queue TTL) โ (Hash Match) โ (Missing / Size Diff / SHA-256 Mismatch)
โผ โผ โผ
โโโโโโโโโโโโโ โโโโโโโโโโโโโ โโโโโโโโโโโโโโโโโ
โ TIMED_OUT โ โ CLAIMED โ โ POINTER_STALE โ (Terminal: Rejects blind review)
โโโโโโโโโโโโโ โโโโโโโฌโโโโโโ โโโโโโโโโโโโโโโโโ
โฒ โ (Exec TTL: default 300s)
โ fulfill_contract()
โ โโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโฌโโโโโโโโโโโโโโโโโ
โโโโค (Exec TTL) โ (Schema Valid) โ (Retries > 2) โ (Mid-Review File Edit)
โ โผ โผ โผ
โ โโโโโโโโโโโโโ โโโโโโโโโโโโโโโโโโโโโ โโโโโโโโโโโโโโโโโ
โโโโโโโโโโโโ COMPLETED โ โ VALIDATION_FAILED โ โ POINTER_STALE โ
โโโโโโโโโโโโโ โโโโโโโโโโโโโโโโโโโโโ โโโโโโโโโโโโโโโโโHolder-side lifecycle controls on a CLAIMED contract (all require agent_id === target_agent):
Call | Transition | Guard rails |
|
| Resets |
|
| Must be called inside the active window; max 5 renewals per holder; refused once |
|
| Requires a |
2. Full-File SHA-256 Fingerprinting, Pre-Flight Verify & TOCTOU Soft-Failure Buffering (ADR-0004)
Dispatch Snapshot:
dispatch_contractreads target files on disk, recording bytesize, full-filesha256(64 hex chars),first_line, andlast_line. If a file was modified within the last 3 seconds, awarningis emitted to alert the requester of potential unsaved IDE buffers.Claim Verification:
poll_next_taskverifiesExistence -> Byte Size -> Full-File SHA-256(never rejecting onmtime_msalone to tolerate no-op IDE saves). On mismatch, it waits150msand retries once to rule out transient IDE flushes before marking the contractPOINTER_STALE.Pre-Flight Verify (
verify_contract): A strictly read-only check allowing workers or scripts to audit pointer health (valid: truevsvalid: falsewith dirty files list) before submitting.TOCTOU Soft-Failure Buffering:
fulfill_contractchecks on-disk pointer fingerprints. If dirty pointers are detected:Strike 1 returns
RETRY_NEEDED, leaves the contractCLAIMED, renews the execution window, and lists dirty files with recovery instructions (git stash/git checkout -- <file>).Strike 2 transitions to terminal
POINTER_STALEand saves the full submitted review payload intosalvaged_result_jsonso review effort is never lost.
TOCTOU Race Narrowing: While no file-based system can eliminate the microsecond race between reading disk bytes and committing a database row, FerryCat's dual-verification (at
polland atfulfill) drastically narrows the TOCTOU window from minutes of blind review down to the sub-millisecond atomic SQL transition boundary.
3. Bounded Schema Validation (RETRY_NEEDED $\le 2$)
Outputs are validated against the contract's JSON Schema via cached Ajv validators, with errors flattened into concise single-line paths (e.g.,
["/passed: must be boolean"]).Up to 2 validation failures return
RETRY_NEEDEDwhile keeping the contractCLAIMEDfor immediate self-correction (each rejection also renews the execution window); a 3rd failure transitions the contract to terminalVALIDATION_FAILED.
4. Dual-Stage TTL & Read-Before-Write Sweeping
Separates
queue_ttl_sec(default 1800s forSUBMITTED) fromexec_ttl_sec(measured fromclaimed_at), preventing tasks claimed late in the queue window from timing out prematurely during execution.exec_ttl_secdefaults are tiered bytask_type:code_review/architecture_auditโ 1800s (deep reasoning or human-in-the-loop),implementation/test_generationโ 300s. An explicitexec_ttl_secalways wins.poll_next_taskexecutes a lock-freeSELECT COUNT(*)probe before attempting anyUPDATEon expired rows;inspect_mesh_stateis strictly read-only.
5. Defense-in-Depth Path Security
Enforces path containment within
workspace_rootand blocks sensitive file patterns (.env*,*.pem,*.key,id_rsa*,*credentials*,*secret*,.npmrc,.git/config) on bothdispatchandworkerverification paths.Path Resolution:
workspace_rootis strongly recommended to be passed as an absolute path. If a relative path is provided, it is deterministically resolved againstprocess.cwd()viapath.resolve.
6. Threat Model & Security Assumptions (Local Workstation IPC)
Assumed Trust Environment: FerryCat is intentionally designed as a Trusted Local Workstation Bus bridging isolated IDE hosts operating under the same OS user account. Callers and workers share the local file system (
workspace_root) and SQLite database (~/.ferrycat/mesh.db).Defense Scope: Path containment (
assertSafePointerPath) and sensitive file pattern filters prevent unintentional workspace escapes, symlink traversals, or accidental leakage of credentials/secret files during handoffs.Out of Scope (Non-Goals): FerryCat does not provide adversarial sandboxing, multi-tenant isolation, or network authorization against malicious local processes or adversarial agents spoofing
AGENT_NAME.
Applicability Boundaries (When NOT to Use FerryCat)
Disjoint File Systems: FerryCat offloads context by file reference; both hosts must share access to the same local
workspace_root.Trivial Single-Turn Queries: Each cross-host handoff involves 3 explicit human window switches (~15โ25s overhead).
Unattended Background Pipelines: Desktop IDE hosts follow a request-response model and cannot be woken up asynchronously by an idle MCP server. For unattended multi-step pipelines, use a standalone DAG workflow engine such as PatchCat.
Quickstart
1. Recommended: Zero-Install MCP Mounting (via npx)
No local clone or manual compilation required. Mount directly into your IDE's MCP configuration using npx -y ferrycat:
Antigravity Configuration
Edit %USERPROFILE%\.gemini\antigravity\mcp_config.json (or ~/.gemini/antigravity/mcp_config.json on macOS/Linux):
{
"mcpServers": {
"ferrycat": {
"command": "npx",
"args": ["-y", "ferrycat"],
"env": {
"AGENT_NAME": "antigravity"
}
}
}
}WorkBuddy / Claude Code / Cursor / Codex Configuration
Configure the target host's MCP settings with its respective AGENT_NAME:
{
"mcpServers": {
"ferrycat": {
"command": "npx",
"args": ["-y", "ferrycat"],
"env": {
"AGENT_NAME": "workbuddy"
}
}
}
}2. Global Installation & Source Build
Global CLI Installation:
npm install -g ferrycatThen simply set
"command": "ferrycat"in your MCP config.Local Source Build (For Contributors):
git clone https://github.com/GuoBug/FerryCat.git cd FerryCat npm install npm run build npm testMount using your local path:
"command": "node","args": ["--experimental-sqlite", "/path/to/FerryCat/dist/index.js"].
First-Class CLI Experience (ferrycat-cli)
Beyond serving as an in-IDE MCP Server, FerryCat provides a first-class CLI utility (ferrycat-cli or npx ferrycat-cli). Sharing the same ~/.ferrycat/mesh.db SQLite WAL database and Zod validation contracts, the CLI allows developers to inspect mesh health, verify working tree safety, and hook into automated CI/Git scripts without leaving their terminal:
1. Terminal Visual Inspection (ASCII Status Table)
Inspect all cross-host handoffs and error reasons formatted as an ASCII table:
# View all contracts in an ASCII table
npx ferrycat-cli inspect
# Filter by target agent (e.g., only tasks for antigravity)
npx ferrycat-cli inspect --target antigravity2. Pre-Flight Verification (Auditing Before Mutation)
Audit on-disk pointer file integrity against the contract's baseline SHA-256 before committing review work (ADR-0004), eliminating false-positive deliveries:
npx ferrycat-cli verify <CONTRACT_ID>3. Local CI & Headless Worker Execution
Poll the queue, claim tasks, and execute local review/test scripts with automatic failure closure:
# Safely run a script upon task arrival (no shell quotation hazards)
npx ferrycat-cli worker --agent codex --mode=exec --exec-file ./scripts/review.shExposed MCP Tools
Tool Name | Role | Transactional Behavior |
| Requester | Enforces path blacklist $\to$ computes full-file SHA-256 & line bounds $\to$ inserts |
| Worker | Sweeps expired TTLs (read-before-write) $\to$ claims via |
| Worker | Re-verifies SHA-256 (TOCTOU guard) $\to$ validates Ajv JSON Schema ($\le 2$ retries via |
| Worker (holder) | Hands a |
| Worker (holder) | Heartbeat: restarts the execution window ( |
| Worker (holder) | Marks a |
| Worker / Any (Read-Only) | Pre-flight check: validates on-disk pointer files against the baseline SHA-256 without mutating contract state (ADR-0004). |
| Any (Read-Only) | Pure read-only query of contract states, outputs, and dynamic |
๐ก Architecture Decision Records & Engineering Verification:
ADR-0001: Cross-Host SQLite WAL Bus & Human-Scheduled Poll Model (Why
node:sqliteWAL +poll_next_taskinstead of 60s Blocking Hold or single-connection MCP Tasks)ADR-0002: Full-File SHA-256 Fingerprinting, TOCTOU Guard & Cross-Model Audit (Stale-context prevention and real-world cross-host verification records)
ADR-0003: GUI Sandbox vs CLI Process Hybrid Layering Architecture & Wake-Up Boundaries (Desktop HITL approval vs in-house CLI dual-channel autonomy)
ADR-0004: Separation of Review and Mutation (SRM), TOCTOU Soft-Failure Buffering & Immutable Baseline Protocol (How to prevent review abortion from concurrent or well-intended reviewer edits)
About the Author
Guo Qiang (GuoBug), Product Engineer specializing in platform engineering and growth. Currently focused on AI workflow orchestration, DAG state machines, and deterministic system architectures.
Open Source & Homepage: https://github.com/GuoBug ยท https://guobug.github.io
Inquiries and discussions on workflow engine architecture, topological scheduling, and developer experience are warmly welcomed.
Available Tools
8 toolsdispatch_contractA
Dispatch a task or code review contract to another local AI agent host via the shared SQLite WAL mesh.
Purpose
Registers a new contract in SUBMITTED status with full-file SHA-256 fingerprint snapshots of all target files, establishing an immutable baseline for cross-host verification.
Usage Guidelines
When to use: Use when requesting code reviews, architecture audits, implementation, or test generation from a target agent (e.g., target_agent="workbuddy" or "antigravity").
When NOT to use:
Do NOT use to claim or execute tasks (use poll_next_task).
Do NOT use to check task status or inspect outputs (use inspect_mesh_state).
Do NOT use if the target host does not share the same local filesystem access to workspace_root.
Prerequisites: workspace_root must be a valid directory accessible by both hosts. Pointer files must exist on disk and be saved. Sensitive files (.env, keys, credentials, .git/config) and path escapes are strictly blocked.
Behavior & Side Effects
Mutates database: Synchronously inserts a single row into contracts with status='SUBMITTED' in SQLite WAL (~/.ferrycat/mesh.db).
SHA-256 Snapshot: Computes 64-char hex SHA-256, byte size, and first/last lines for each pointer. Emits a warning if any file was modified within the last 3 seconds (indicating unsaved IDE buffers).
Lifecycle & Expiry: Starts the queue_ttl_sec countdown (default: 1800s / 30m). If the target agent never claims it before queue_ttl_sec elapses, the contract lazily transitions to TIMED_OUT.
Once claimed, execution is governed by exec_ttl_sec (tiered default: 1800s for review/audit, 300s for implementation/test).
Return Value
Returns { contract_id: string, status: 'SUBMITTED', created_at: number, files: Array<{ path, size, mtime_ms, sha256, first_line, last_line, line_range? }>, warning?: string }. Note: requester_agent / target_agent / task_type / title / TTLs are NOT echoed back โ read them via inspect_mesh_state if needed.
| Name | Required | Description | Default |
|---|---|---|---|
| title | Yes | Concise contract title (1-120 chars) summarizing the goal of the request. | |
| pointers | Yes | Array of 1 to 50 target file pointers hashed with full-file SHA-256 and snapshot boundaries for tamper detection. | |
| task_type | Yes | Type of contract task. Tiered default execution TTL: 1800s for code_review/architecture_audit, 300s for implementation/test_generation. | |
| exec_ttl_sec | No | Execution TTL in seconds once CLAIMED (default: 1800s for review/audit, 300s for implementation/test). Worker must fulfill, extend, release, or fail within this window. | |
| target_agent | Yes | Target worker agent identifier expected to claim and execute this contract (e.g., "workbuddy", "antigravity"). | |
| queue_ttl_sec | No | Queue expiration TTL in seconds while status is SUBMITTED (default: 1800s / 30m). Transitions to TIMED_OUT if unclaimed before expiry. | |
| workspace_root | Yes | Absolute canonical path to the shared local workspace directory accessible by both hosts (e.g. "F:/git/FerryCat"). Path escapes and sensitive files are blocked. | |
| context_summary | Yes | Detailed task instructions, audit focus areas, architectural constraints, and background context for the worker agent (1-20000 chars). | |
| contract_schema | No | Optional Draft-07 JSON Schema that structured_output must validate against. Bounded to 1MB and max 32 depth (FC-302). | |
| requester_agent | No | Requester agent identifier. Defaults to AGENT_NAME env var (e.g., "antigravity", "workbuddy"). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does so thoroughly: it discloses the database mutation (a single row insert into contracts at ~/.ferrycat/mesh.db), the SHA-256 snapshot computation, a stale-buffer warning heuristic (files modified within 3 seconds), and the full lazy-expiry lifecycle with tiered TTLs. This is exactly the behavioral context an agent needs before a mutating call.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The markdown sectioning (Purpose / Usage Guidelines / Behavior & Side Effects / Return Value) makes the length appropriate for a 10-parameter mutating tool, and the purpose is front-loaded. There is some redundancy โ sensitive-file blocking is stated in both the description body and repeated again in the schema โ which keeps it from a 5.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Although there is no output schema, the description explicitly enumerates the return shape ({contract_id, status, created_at, files[...], warning?}) and even flags fields that are omitted from the response. Combined with the lifecycle and failure-mode detail, nothing an agent needs to invoke this correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema already documents all 10 parameters and the baseline would be 3. The description adds value beyond it by explaining the tiered TTL defaults tied to task_type, and by noting that requester_agent/target_agent/TTLs are NOT echoed in the return value. It does not add much per-parameter syntax detail, so a 4 rather than a 5.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb, resource, and mechanism ('Dispatch a task or code review contract to another local AI agent host via the shared SQLite WAL mesh') and immediately refines it ('Registers a new contract in SUBMITTED status with full-file SHA-256 fingerprint snapshots'). This is clearly distinct from siblings like poll_next_task and inspect_mesh_state, which are named as alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It provides explicit 'When to use', 'When NOT to use' with named sibling alternatives (poll_next_task for claiming/executing, inspect_mesh_state for status), and prerequisites (shared filesystem access, pointer files saved on disk, sensitive-file blocking). Nothing is left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
extend_ttlA
Heartbeat renewal for long-running execution: restarts the active execution window of a CLAIMED contract.
Purpose
Prevents execution timeout during deep reasoning, extensive test execution, or complex multi-step refactoring by resetting the execution clock.
Usage Guidelines
When to use: Call periodically during long-running tasks before the active exec_ttl_sec countdown expires.
When NOT to use:
Do NOT use after the window has already expired (expired contracts transition to TIMED_OUT).
Do NOT use to deliver task completion (use fulfill_contract).
Do NOT use if abandoning the task (use release_contract or fail_contract).
Prerequisites: Caller must be the current holder and contract must be currently CLAIMED.
Behavior & Side Effects
Mutates database: Resets claimed_at=nowMs (restarting the full exec_ttl_sec window from the current moment) and increments extend_count.
Quotas & Boundaries: Maximum 5 renewals per holder. Bounded by the contract's absolute lifetime ceiling (created_at + 4 * queue_ttl_sec); rejected if proposedExpiresAt > lifetimeDeadline.
Return Value
Returns { ok: boolean, contract_id: string, status: 'CLAIMED' | 'TIMED_OUT', claimed_at?: number, expires_at?: number, extend_count: number, max_extends: number, message: string }.
| Name | Required | Description | Default |
|---|---|---|---|
| agent_id | No | Current holder agent identifier. Must match target_agent of the claimed contract (defaults to AGENT_NAME env var). | |
| claim_token | No | Exclusive lease token returned in contract.claim_token by poll_next_task (FC-301). | |
| contract_id | Yes | The CLAIMED contract ID whose active execution window should be renewed. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and delivers: it discloses the database mutation (claimed_at=nowMs reset, extend_count increment), hard quotas (max 5 renewals per holder), an absolute lifetime ceiling (created_at + 4 * queue_ttl_sec), and the rejection condition. It also warns that expiry transitions the contract to TIMED_OUT.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Content is front-loaded with the core action and organized under clear headings, and virtually every line carries operational information. The markdown-section framing is heavier than necessary for a tool description and the return-value block is dense, but nothing is truly redundant.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutation tool with no annotations and no output schema, the description supplies the missing pieces: side effects, quota limits, failure conditions, prerequisites, and an explicit return shape. An agent has everything needed to call it correctly and to anticipate rejections.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents contract_id, agent_id, and claim_token in detail; baseline is 3. The description adds the holder-must-match precondition but never explains claim_token's lease role, and it references 'proposedExpiresAt' which is not an input in the schema, a minor source of confusion.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Heartbeat renewal ... restarts the active execution window of a CLAIMED contract') and immediately frames it as timeout prevention. It is clearly distinguishable from siblings that deliver, release, or fail a contract, which are named later.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit when-to-use ('periodically during long-running tasks before the active exec_ttl_sec countdown expires') and three when-NOT-to-use cases, each routing to a concrete sibling (fulfill_contract, release_contract, fail_contract). Prerequisites are stated: caller must be current holder and contract must be CLAIMED.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fail_contractA
Explicitly mark a CLAIMED contract as terminal FAILED with a mandatory failure reason.
Purpose
Immediately terminates a claimed task that cannot be completed, recording actionable diagnostic reasons and freeing the requester from waiting for the execution TTL to expire.
Usage Guidelines
When to use: Use when a task encounters an unrecoverable failure (e.g. fatal syntax error, broken test suite, missing required environment).
When NOT to use:
Do NOT use if the task succeeded (use fulfill_contract).
Do NOT use if the task is recoverable by another agent or retryable (use release_contract).
Prerequisites: Caller must be the current holder and reason must be non-empty.
Behavior & Side Effects
Mutates database: Sets status='FAILED', error_reason='WORKER_FAILED: ', and completed_at=nowMs.
Late report handling: If the execution window already expired before fail_contract was called, the status becomes TIMED_OUT while faithfully preserving the worker's reason for the requester.
Return Value
Returns { ok: boolean, contract_id: string, status: 'FAILED' | 'TIMED_OUT', message: string }.
| Name | Required | Description | Default |
|---|---|---|---|
| reason | Yes | Mandatory explanation of why the task cannot be completed. Stored in error_reason for the requester. | |
| agent_id | No | Current holder agent identifier. Must match target_agent of the claimed contract (defaults to AGENT_NAME env var). | |
| claim_token | No | Exclusive lease token returned in contract.claim_token by poll_next_task (FC-301). | |
| contract_id | Yes | The CLAIMED contract ID to mark as terminal FAILED. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does so: it discloses the exact mutation (status='FAILED', error_reason prefixed 'WORKER_FAILED:', completed_at=nowMs) and an edge case that would otherwise surprise an agent โ a late call after TTL expiry yields TIMED_OUT while preserving the reason. Return shape is also spelled out despite no output schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded single-sentence summary, then short labeled sections โ well structured and scannable. It is slightly longer than strictly necessary (Return Value repeats the shape the agent could otherwise infer, and the side-effect detail is dense), but no section is filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a terminal-mutation tool with no annotations and no output schema, the description covers authorization prerequisites, exact side effects, the expired-window edge case, and the return value. Nothing an agent needs to invoke it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3; the description adds real meaning by tying the caller-identity requirement ('caller must be the current holder') to agent_id/claim_token and stressing the reason is mandatory and surfaced to the requester. It does not add format or length guidance beyond the schema's min/max constraints.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (mark terminal FAILED) and resource (a CLAIMED contract), plus the distinguishing constraint 'claimed'. The usage guidelines explicitly name fulfill_contract and release_contract as the alternatives for success and recoverable cases, so an agent can route without opening other schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit when-to-use (unrecoverable failure such as fatal syntax error, broken test suite, missing environment) and two explicit when-NOT-to-use cases with the sibling to use instead. Prerequisites (current holder, non-empty reason) are also stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fulfill_contractA
Submit execution or review deliverables for a CLAIMED contract, with TOCTOU soft-failure buffering and Ajv JSON Schema validation.
Purpose
Delivers the final output of a task, verifies that the code baseline was not mutated during execution, validates structured payloads, and transitions the contract to terminal COMPLETED.
Usage Guidelines
When to use: Use after completing task work to deliver result_summary, optional structured_output, and optional artifacts_pointers.
When NOT to use:
Do NOT use if you cannot complete the task (use release_contract to re-queue, or fail_contract to record failure).
Do NOT use if you modified pointer files directly on disk. If modified accidentally, run "git stash" or restore the files, run verify_contract, and pass proposed fixes inside structured_output.fixes.
Behavior & Side Effects
Authorization: Caller agent_id must match target_agent of the claimed contract.
TOCTOU Guard & Soft-Failure Buffer (ADR-0004) โ exactly ONE recoverable rejection:
1st blocked fulfill: returns status='RETRY_NEEDED', keeps the contract CLAIMED, renews the execution window (claimed_at=now), and lists dirty_files with restore instructions.
2nd blocked fulfill: transitions to terminal status='POINTER_STALE', preserving your summary and payload in salvaged_result_json so the work is not lost.
Only ONE rejection is recoverable: restore/stash the files BEFORE retrying, and call verify_contract first so a stray second attempt cannot burn the buffer.
Schema Validation: If contract_schema was defined, validates structured_output via cached Ajv validator. Failures 1 & 2 return RETRY_NEEDED with flattened error paths and renew the execution window; 3rd failure transitions to terminal VALIDATION_FAILED.
On Success: Transitions to terminal status='COMPLETED', recording result_summary, structured_output, artifacts_pointers, and verified SHA-256 snapshot.
Return Value
Returns { ok: boolean, contract_id: string, status: 'COMPLETED' | 'RETRY_NEEDED' | 'POINTER_STALE' | 'VALIDATION_FAILED', retry_count: number, max_retries: number, toctou_strike?: number, max_toctou_strikes?: number, dirty_files?: Array<{ path, reason, detail }>, validation_errors?: string[], message: string }.
| Name | Required | Description | Default |
|---|---|---|---|
| agent_id | No | Worker agent identifier. Must match the contract target_agent (defaults to AGENT_NAME env var). | |
| claim_token | No | Exclusive lease token returned in contract.claim_token by poll_next_task (FC-301). Mutating operations must provide matching claim_token to prevent cross-worker interference. | |
| contract_id | Yes | The contract ID returned by poll_next_task that is currently in CLAIMED status. | |
| result_summary | Yes | Detailed markdown or plain text summary of review findings, implementation details, or test execution outcomes (1-20000 chars). | |
| structured_output | No | Structured JSON payload matching contract_schema. Bounded to 1MB and max 32 depth (FC-302). For code reviews, pass proposed patches in fixes: [{ path, patch, description }] rather than editing pointer files directly (ADR-0004). | |
| artifacts_pointers | No | Optional pointers to new or modified artifact files created during task execution (max 50 files). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, and the description carries the full burden well: it discloses the authorization requirement (agent_id must match target_agent), the exact TOCTOU soft-failure policy with strike counts and terminal outcomes, the Ajv validation retry ladder (2 recoverable, 3rd terminal VALIDATION_FAILED), and what data is preserved on failure. These are non-obvious side effects an agent could not infer from the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well front-loaded with a one-sentence summary, then headed sections that map to purpose, usage, behavior and returns. It is long but nearly all of it is load-bearing; the return-value enumeration and repeated strike-buffer detail are slightly redundant but justified given there is no output schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a complex 6-param mutating tool with no annotations and no output schema, the description covers prerequisites (claim_token, CLAIMED status), failure modes and terminal statuses, and spells out the return shape itself. Nothing an agent needs to call it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents every parameter, including claim_token and the fixes pattern. The description reinforces the roles of result_summary, structured_output and artifacts_pointers but adds little syntax or format detail beyond what the schema states; baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Names a specific verb and resource (submit deliverables for a CLAIMED contract) and explicitly describes the scope: delivery, baseline verification, schema validation, transition to COMPLETED. It distinguishes itself from release_contract and fail_contract by name, so an agent can route between them without opening a schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides an explicit 'When to use' and a 'When NOT to use' section that names the correct alternatives (release_contract to re-queue, fail_contract to record failure) along with a concrete accidental-modification recovery path (git stash, verify_contract, fixes in structured_output).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
inspect_mesh_stateA
Strictly read-only query of contracts, execution progress, outputs, diagnostic counters, and failure causes.
Purpose
Provides comprehensive observability into the multi-agent mesh state without acquiring database locks or mutating rows.
Usage Guidelines
When to use:
Check whether a contract you dispatched has been claimed or completed.
Inspect result summaries, structured outputs, or salvaged results of completed/stale contracts.
Monitor queue depth or pending contracts for a specific agent via target_agent filter.
When NOT to use:
Do NOT use to claim tasks (use poll_next_task).
Do NOT use to dispatch tasks (use dispatch_contract).
Do NOT use to verify on-disk file pointer hygiene (use verify_contract).
Behavior & Side Effects
Zero side effects: Pure read-only SELECT query against SQLite WAL. Never alters rows or triggers sweeps.
Dynamically calculates is_logically_expired: true when a contract has exceeded its queue or execution TTL based on the current timestamp, even before the next lazy sweep runs.
Return Value
Returns { total_returned: number, contracts: Array<{ contract_id, requester_agent, target_agent, task_type, title, status, is_logically_expired, created_at, claimed_at, completed_at, retry_count, extend_count, release_count, toctou_strike, result_summary, structured_output, artifacts_pointers, error_reason, salvaged_result, verified_sha256 }> }.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of records to return (default: 10) | |
| status | No | Filter by status (default: ALL) | |
| contract_id | No | Optional specific contract_id to inspect single contract details, counters, errors, and output payloads. | |
| target_agent | No | Optional filter by target worker agent identifier (e.g., "workbuddy") to view pending or completed queue items. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full behavioral burden and does so well: it states zero side effects, a pure read-only SELECT against SQLite WAL, no row mutation, no sweeps, and no database locks. It also explains the dynamic is_logically_expired calculation based on queue or execution TTL, which is non-obvious behavior an agent would otherwise miss.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the core read-only purpose and then organized into clear sections for usage, behavior, and return value. The return-value structure is detailed but earns its place because there is no output schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the lack of annotations and output schema, the description is complete enough for correct invocation: it covers purpose, alternatives, side effects, lock behavior, expiration logic, and the returned object shape. No critical context for a 4-parameter optional-filter observability tool appears to be missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all four parameters are already documented in the schema; the baseline is therefore 3. The description adds some meaning by explaining the target_agent filter for monitoring a specific agentโs queue, but it does not add much beyond the schema for limit, status, or contract_id.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: a strictly read-only query of contracts, execution progress, outputs, diagnostic counters, and failure causes in the multi-agent mesh state. It clearly distinguishes the tool from sibling operations by naming poll_next_task, dispatch_contract, and verify_contract as alternatives for other purposes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives explicit when-to-use cases such as checking whether a dispatched contract was claimed or completed, inspecting result summaries, and monitoring queue depth via target_agent. It also gives explicit when-not-to-use cases with named alternatives for claiming, dispatching, and verifying file pointer hygiene.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
poll_next_taskA
Atomically claim the oldest pending SUBMITTED contract assigned to this agent and verify local file fingerprints.
Purpose
Retrieves and claims next available contract work for the current agent, transitioning it from SUBMITTED to CLAIMED.
Usage Guidelines
When to use: Call periodically or when notified to discover and atomically take ownership of pending tasks assigned to your agent_id.
When NOT to use:
Do NOT use to non-destructively inspect queue depth or monitor status without claiming (use inspect_mesh_state).
Do NOT use to create contracts (use dispatch_contract).
IMPORTANT (ADR-0004): Pointers are an immutable baseline snapshot ("what I read"). Never edit pointer files directly on disk while holding a review contract; deliver any proposed code fixes via structured_output.fixes in fulfill_contract.
Behavior & Side Effects
Mutates database: Atomically claims the oldest SUBMITTED contract for agent_id using optimistic concurrency (UPDATE ... WHERE status='SUBMITTED', checked by changes===1). Starts the exec_ttl_sec window.
Lazy TTL sweep: Automatically sweeps and marks expired contracts as TIMED_OUT using lock-free read-before-write probing.
Fingerprint verification: Verifies Existence -> Byte Size -> SHA-256 for all pointers. If on-disk files were altered or missing, marks the contract POINTER_STALE and transparently advances to claim the next valid candidate in the queue.
Return Value
When work is claimed: { ok: true, has_task: true, status: 'CLAIMED', contract: { contract_id, requester_agent, target_agent, task_type, title, context_summary, workspace_root, pointers, contract_schema, claimed_at, exec_ttl_sec } }.
When queue is empty: { ok: true, has_task: false, message: 'No pending contracts for agent "<agent_id>"' }.
| Name | Required | Description | Default |
|---|---|---|---|
| agent_id | No | Worker agent identifier claiming tasks (defaults to AGENT_NAME env var, e.g., "workbuddy"). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full behavioral burden and does so thoroughly: it discloses the atomic DB mutation, optimistic concurrency check, TTL window start, lazy TTL sweep, fingerprint verification order, POINTER_STALE handling, and queue advancement. It also describes both success and empty-queue return shapes.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded and sectioned into purpose, usage, behavior, and return value, making it scannable despite its length. It is appropriately detailed for a stateful claiming operation, though some repetition of the atomic-claim concept across sections keeps it short of perfect conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a complex mutation with no annotations and no output schema, the description is complete enough to call correctly: it explains side effects, concurrency behavior, TTL behavior, stale-pointer handling, and return values. An agent has the operational context needed without opening additional documentation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and the schema already documents agent_id including its default from the AGENT_NAME environment variable. The description reinforces that the task is assigned to this agent, but adds little parameter-level meaning beyond the schema, so the baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: atomically claim the oldest pending SUBMITTED contract assigned to this agent, including fingerprint verification. It clearly distinguishes the tool from siblings by naming inspect_mesh_state for non-claiming inspection and dispatch_contract for creating contracts.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives explicit when-to-use guidance (periodically or when notified to discover and claim pending tasks) and explicit when-not-to-use guidance with named alternatives for inspection and contract creation. It also adds a relevant ADR constraint about pointer immutability.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
release_contractA
Hand a CLAIMED contract back to the queue tail as SUBMITTED with a fresh queue window.
Purpose
Allows an agent holding a claimed task to safely release ownership back to the queue without failing or aborting the task.
Usage Guidelines
When to use: Use when your agent claimed a task by mistake, encounters missing local dependencies/tools, or needs to switch git branches before processing.
When NOT to use:
Do NOT use if the task permanently failed or cannot ever be completed (use fail_contract).
Do NOT use if you simply need more time to finish active execution (use extend_ttl).
Prerequisites: Caller must be the current holder (agent_id matches target_agent) and contract status must be CLAIMED.
Behavior & Side Effects
Mutates database: Resets claimed_at=NULL, updates queued_at=nowMs, resets extend_count=0 (renewal quota is per holder), and increments release_count.
Preserves retry_count: The schema validation circuit-breaker quota is contract-level; releasing a contract cannot launder previously consumed retry attempts.
Audit history: Appends reason to error_reason history ("RELEASED_BY_HOLDER: | prev: ...").
Limits: Maximum 3 releases per contract. Refused once the contract reaches its absolute lifetime ceiling (nowMs >= created_at + 4 * queue_ttl_sec).
Return Value
Returns { ok: boolean, contract_id: string, status: 'SUBMITTED' | 'CLAIMED' | 'TIMED_OUT', release_count: number, max_releases: number, message: string }.
| Name | Required | Description | Default |
|---|---|---|---|
| reason | No | Optional reason for releasing (e.g., "wrong context", "missing tool", "switching git branch"). Appended to error_reason history. | |
| agent_id | No | Current holder agent identifier. Must match target_agent of the claimed contract (defaults to AGENT_NAME env var). | |
| claim_token | No | Exclusive lease token returned in contract.claim_token by poll_next_task (FC-301). | |
| contract_id | Yes | The CLAIMED contract ID to release back to the queue tail as SUBMITTED. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description carries the full burden and it does: it discloses exact DB mutations (claimed_at=NULL, queued_at=nowMs, extend_count=0, release_count incremented), what is deliberately preserved (retry_count circuit-breaker quota, with the anti-laundering rationale), the audit-trail format appended to error_reason, and hard limits (max 3 releases, absolute lifetime ceiling of 4 * queue_ttl_sec). This is exactly the side-effect detail a mutation tool needs.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the verb/effect in the first sentence, then cleanly partitioned into Purpose, Usage, Behavior, and Return Value. Slightly longer than necessary โ the one-line Purpose section largely repeats the headline โ but every other sentence carries distinct operational information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Although there is no output schema, the description spells out the full return shape ({ ok, contract_id, status, release_count, max_releases, message }). Combined with the side-effect and limit disclosures, an agent has everything needed to invoke this safely and interpret the result.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so each of the four parameters, including claim_token's provenance from poll_next_task, is already documented in the schema. The description restates the agent_id/target_agent match and CLAIMED-status prerequisite but adds no new syntax or format detail beyond that. Baseline 3 is appropriate when the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (release), resource (contract), and target state (back to queue tail as SUBMITTED with a fresh queue window). The usage-guidelines section explicitly contrasts it with fail_contract and extend_ttl, so an agent can distinguish it from every sibling without opening a schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit 'when to use' (claimed by mistake, missing local deps, need to switch branches) and an explicit 'when NOT to use' pair that names the correct alternative for each case (fail_contract for permanent failure, extend_ttl for needing more time). Prerequisites are stated outright (caller must be the current holder, status must be CLAIMED).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
verify_contractA
Read-only pre-flight consistency check (ADR-0004): audits on-disk pointer files against the baseline SHA-256 snapshot.
Purpose
Enables agents or automated scripts to verify that on-disk files match the contract's dispatched baseline before calling fulfill_contract, preventing accidental TOCTOU strikes.
Usage Guidelines
When to use: Call before fulfill_contract while holding a CLAIMED contract to confirm file cleanliness, or when investigating why a fulfill call was blocked.
When NOT to use:
Do NOT use to deliver results (use fulfill_contract).
Do NOT use to renew time (use extend_ttl).
ADR-0004 Rule: Pointers are an immutable review baseline. If verify_contract reports dirty files, restore or stash them (e.g., git stash or git checkout -- ) and deliver proposed changes inside structured_output.fixes.
Behavior & Side Effects
Zero side effects: Pure read-only operation. Never updates the database, never alters contract status, and never consumes a TOCTOU strike.
Complete pointer check: Verifies all pointer files on disk and returns every drifted file (reason: SIZE_MISMATCH, CONTENT_CHANGED, or FILE_MISSING).
Return Value
Returns { ok: true, valid: boolean, fulfillable: boolean, contract_id: string, status: ContractStatus, target_agent: string, toctou_strike: number, max_toctou_strikes: number, dirty_files: Array<{ path, reason, detail }>, message: string }. NOTE: valid only means every pointer still matches its dispatched baseline. fulfillable additionally requires the contract to be CLAIMED. A contract that already went terminal (FAILED / POINTER_STALE / COMPLETED) can report valid=true while fulfillable=false, so branch on fulfillable rather than valid before calling fulfill_contract.
| Name | Required | Description | Default |
|---|---|---|---|
| agent_id | No | Optional caller agent identifier for audit logging. Does not restrict read-only verification. | |
| claim_token | No | Optional lease token for caller verification (FC-301). | |
| contract_id | Yes | The contract ID whose on-disk pointer files should be verified against the baseline SHA-256 snapshot without mutating contract state. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations at all, the description carries the full burden and does so: zero side effects, never mutates DB, never alters contract status, never consumes a TOCTOU strike. It also discloses that all pointer files are checked and enumerates the drift reasons (SIZE_MISMATCH, CONTENT_CHANGED, FILE_MISSING).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the one-line summary and well-structured under headers, with the critical branch-on-fulfillable warning placed last for emphasis. It is somewhat long, and the Behavior section partly re-states the read-only claim made in the opening line, but nearly every sentence carries actionable information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, and the description fully documents the return shape and the crucial valid vs. fulfillable distinction, including the terminal-state edge case. Combined with side-effect disclosure and the ADR-0004 rule, nothing an agent needs to call this correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so contract_id, agent_id, and claim_token are already documented in the schema; the description adds no syntax or format detail for them. Baseline 3 applies since the schema does the heavy lifting on parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('pre-flight consistency check ... audits on-disk pointer files against the baseline SHA-256 snapshot') and immediately scopes it as read-only. The Usage Guidelines name the exact siblings it is not (fulfill_contract, extend_ttl), so an agent can route without opening either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit 'When to use' (before fulfill_contract while holding a CLAIMED contract; when debugging a blocked fulfill) and 'When NOT to use' with named alternatives. It even supplies the remediation path (restore/stash, put changes in structured_output.fixes) when verification reports dirty files.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
6 tool updates
v0.3.2- Changed
dispatch_contract1 field changed- changed
Input schema / properties / contract_schema / descriptionPrevious value: -"Optional Draft-07 JSON Schema that structured_output must validate against. Enforces bounded retry (max 2 RETRY_NEEDED attempts before terminal VALIDATION_FAILED)."New value: +"Optional Draft-07 JSON Schema that structured_output must validate against. Bounded to 1MB and max 32 depth (FC-302)."
- Changed
extend_ttl1 field changed- added
Input schema / properties / claim_tokenAdded value: +{ + "description": "Exclusive lease token returned in contract.claim_token by poll_next_task (FC-301).", + "maxLength": 128, + "minLength": 1, + "type": "string" +}
- Changed
fail_contract1 field changed- added
Input schema / properties / claim_tokenAdded value: +{ + "description": "Exclusive lease token returned in contract.claim_token by poll_next_task (FC-301).", + "maxLength": 128, + "minLength": 1, + "type": "string" +}
- Changed
fulfill_contract2 fields changed- added
Input schema / properties / claim_tokenAdded value: +{ + "description": "Exclusive lease token returned in contract.claim_token by poll_next_task (FC-301). Mutating operations must provide matching claim_token to prevent cross-worker interference.", + "maxLength": 128, + "minLength": 1, + "type": "string" +} - changed
Input schema / properties / structured_output / descriptionPrevious value: -"Structured JSON payload matching contract_schema. For code reviews, pass proposed patches in fixes: [{ path, patch, description }] rather than editing pointer files directly (ADR-0004)."New value: +"Structured JSON payload matching contract_schema. Bounded to 1MB and max 32 depth (FC-302). For code reviews, pass proposed patches in fixes: [{ path, patch, description }] rather than editing pointer files directly (ADR-0004)."
- Changed
release_contract1 field changed- added
Input schema / properties / claim_tokenAdded value: +{ + "description": "Exclusive lease token returned in contract.claim_token by poll_next_task (FC-301).", + "maxLength": 128, + "minLength": 1, + "type": "string" +}
- Changed
verify_contract1 field changed- added
Input schema / properties / claim_tokenAdded value: +{ + "description": "Optional lease token for caller verification (FC-301).", + "maxLength": 128, + "minLength": 1, + "type": "string" +}
8 tool updates
v0.3.0- Changed
dispatch_contract12 fields changed- changed
Input schema / properties / context_summary / descriptionPrevious value: -"Task instructions, audit focus, and background context"New value: +"Detailed task instructions, audit focus areas, architectural constraints, and background context for the worker agent (1-20000 chars)." - changed
Input schema / properties / contract_schema / descriptionPrevious value: -"Optional JSON Schema that the worker structured_output must satisfy"New value: +"Optional Draft-07 JSON Schema that structured_output must validate against. Enforces bounded retry (max 2 RETRY_NEEDED attempts before terminal VALIDATION_FAILED)." - changed
Input schema / properties / exec_ttl_sec / descriptionPrevious value: -"Execution expiration TTL in seconds for CLAIMED state (default: 300)"New value: +"Execution TTL in seconds once CLAIMED (default: 1800s for review/audit, 300s for implementation/test). Worker must fulfill, extend, release, or fail within this window." - changed
Input schema / properties / pointers / descriptionPrevious value: -"File pointers to be hashed and verified on the worker side (max 50 files)"New value: +"Array of 1 to 50 target file pointers hashed with full-file SHA-256 and snapshot boundaries for tamper detection." - changed
Input schema / properties / pointers / items / properties / line_range / descriptionPrevious value: -"Optional [startLine, endLine] 1-based inclusive range"New value: +"Optional [startLine, endLine] 1-based inclusive line range focus for the task." - changed
Input schema / properties / pointers / items / properties / path / descriptionPrevious value: -"File path relative to workspace_root"New value: +"File path relative to workspace_root. Must exist on disk. Sensitive files (.env*, *.pem, *.key, id_rsa*, *credentials*, *secret*, .npmrc, .git/config) and path escapes are strictly rejected." - changed
Input schema / properties / queue_ttl_sec / descriptionPrevious value: -"Queue expiration TTL in seconds for SUBMITTED state (default: 1800)"New value: +"Queue expiration TTL in seconds while status is SUBMITTED (default: 1800s / 30m). Transitions to TIMED_OUT if unclaimed before expiry." - changed
Input schema / properties / requester_agent / descriptionPrevious value: -"Requester agent identifier (defaults to AGENT_NAME env var, e.g., \"antigravity\")"New value: +"Requester agent identifier. Defaults to AGENT_NAME env var (e.g., \"antigravity\", \"workbuddy\")." - changed
Input schema / properties / target_agent / descriptionPrevious value: -"Target worker agent identifier (e.g., \"workbuddy\", \"antigravity\")"New value: +"Target worker agent identifier expected to claim and execute this contract (e.g., \"workbuddy\", \"antigravity\")." - changed
Input schema / properties / task_type / descriptionPrevious value: -"Type of contract task"New value: +"Type of contract task. Tiered default execution TTL: 1800s for code_review/architecture_audit, 300s for implementation/test_generation." - changed
Input schema / properties / title / descriptionPrevious value: -"Concise contract title"New value: +"Concise contract title (1-120 chars) summarizing the goal of the request." - changed
Input schema / properties / workspace_root / descriptionPrevious value: -"Absolute path to the shared local workspace root directory"New value: +"Absolute canonical path to the shared local workspace directory accessible by both hosts (e.g. \"F:/git/FerryCat\"). Path escapes and sensitive files are blocked."
- Added
extend_ttl - Added
fail_contract - Changed
fulfill_contract7 fields changed- changed
Input schema / properties / agent_id / descriptionPrevious value: -"Worker agent identifier (defaults to AGENT_NAME env var)"New value: +"Worker agent identifier. Must match the contract target_agent (defaults to AGENT_NAME env var)." - changed
Input schema / properties / artifacts_pointers / descriptionPrevious value: -"Optional pointers to files created or modified during task execution"New value: +"Optional pointers to new or modified artifact files created during task execution (max 50 files)." - added
Input schema / properties / artifacts_pointers / items / properties / description / descriptionAdded value: +"Description of the artifact and its role" - added
Input schema / properties / artifacts_pointers / items / properties / path / descriptionAdded value: +"File path of created or modified artifact relative to workspace_root" - changed
Input schema / properties / contract_id / descriptionPrevious value: -"The contract ID returned by poll_next_task"New value: +"The contract ID returned by poll_next_task that is currently in CLAIMED status." - changed
Input schema / properties / result_summary / descriptionPrevious value: -"Human-readable summary of findings or implementation"New value: +"Detailed markdown or plain text summary of review findings, implementation details, or test execution outcomes (1-20000 chars)." - changed
Input schema / properties / structured_output / descriptionPrevious value: -"Structured JSON payload matching the contract_schema"New value: +"Structured JSON payload matching contract_schema. For code reviews, pass proposed patches in fixes: [{ path, patch, description }] rather than editing pointer files directly (ADR-0004)."
- Changed
inspect_mesh_state3 fields changed- changed
Input schema / properties / contract_id / descriptionPrevious value: -"Optional specific contract_id to inspect"New value: +"Optional specific contract_id to inspect single contract details, counters, errors, and output payloads." - changed
Input schema / properties / status / enumPrevious value: -[ - "SUBMITTED", - "CLAIMED", - "COMPLETED", - "POINTER_STALE", - "VALIDATION_FAILED", - "TIMED_OUT", - "ACTIVE", - "ALL" -]New value: +[ + "SUBMITTED", + "CLAIMED", + "COMPLETED", + "POINTER_STALE", + "VALIDATION_FAILED", + "TIMED_OUT", + "FAILED", + "ACTIVE", + "ALL" +] - added
Input schema / properties / target_agentAdded value: +{ + "description": "Optional filter by target worker agent identifier (e.g., \"workbuddy\") to view pending or completed queue items.", + "maxLength": 64, + "minLength": 1, + "type": "string" +}
- Changed
poll_next_task1 field changed- changed
Input schema / properties / agent_id / descriptionPrevious value: -"Current worker agent identifier (defaults to AGENT_NAME env var, e.g., \"workbuddy\")"New value: +"Worker agent identifier claiming tasks (defaults to AGENT_NAME env var, e.g., \"workbuddy\")."
- Added
release_contract - Added
verify_contract
4 tool updates
v0.1.0- First observed
dispatch_contract - First observed
fulfill_contract - First observed
inspect_mesh_state - First observed
poll_next_task
TDQS
Scored across 8 tools
Each tool has a clearly distinct role in the contract lifecycle: dispatch, poll/claim, extend, release, fulfill, fail, inspect, and verify. The descriptions explicitly state when NOT to use a tool and point to the correct alternative, eliminating overlap. The only close pair, inspect_mesh_state and verify_contract, is cleanly separated by scope: mesh-wide read-only status vs. on-disk pointer baseline audit.
All tool names follow a predictable snake_case verb_noun pattern: inspect_mesh_state, poll_next_task, release_contract, extend_ttl, verify_contract, dispatch_contract, fulfill_contract, fail_contract. The few multi-word names remain readable and consistent with the convention.
Eight tools is well-scoped for a multi-agent contract queue. Every tool maps to a necessary lifecycle action or diagnostic check, with no redundant or filler operations. The surface is neither too thin nor bloated.
The lifecycle is nearly complete: create, claim, renew, release, verify, complete, fail, and inspect all exist with terminal state handling. Minor gaps remain, such as a requester-side cancel/revoke for a SUBMITTED contract before it is claimed, and cleanup/maintenance operations. These can be worked around via TTL expiry but are noticeable omissions.
Maintenance
Related MCP Connectors
Control plane for autonomous software labor. Agents claim objectives over MCP with audit trail.
Public MCP for agent verification, work discovery and governed interoperability.
Project management shared by people and AI agents, with persistent project state through MCP.
Agent-native notes, tasks, dev-docs, vaults, sync & handoffs. MCP + OpenAPI dual surface.
Related MCP Servers
- FlicenseNot gradedqualityCmaintenanceEnables MCP-capable coding agents to coordinate via authenticated task creation, claiming, messaging, and review approval over a secure local event log.-
- AlicenseCqualityCmaintenanceEnables coding agents to coordinate around shared project context, durable tasks, messages, artifacts, multimodal analysis requests, design-system checks, change proposals, and review requests through a compact MCP interface. It persists state locally in JSON and exposes tools, resources, and prompts for agent-to-agent workflows.9MIT
- AlicenseNot gradedqualityCmaintenanceEnables AI coding agents to plan, split, and build one project together through shared tasks, file leases, a versioned contract, and urgent interrupts over MCP.MIT
- AlicenseNot gradedqualityCmaintenanceEnables Claude and Codex agents to delegate implementation, testing, research, or review tasks to each other through local MCP tools, while supporting persistent sessions, isolated editing workspaces, and reviewed integration. It also allows progress tracking, cancellation, model selection, and management handoff between providers.2MIT