Skip to main content
Glama

FerryCat: Contract-Driven Cross-Host AI Agent Handoff Bus

npm version MCP Registry Node.js Version Native Addons Protocol Glama License

FerryCat (ferrycat) is a lightweight, deterministic cross-host AI agent handoff and code review bus built on the Model Context Protocol (MCP) and Node.js built-in node:sqlite (WAL mode).
Purpose-built to safely bridge isolated desktop IDE agent hosts (such as Google Antigravity, WorkBuddy, Claude Code, and Cursor) across separate OS processes without context drift or blind reviews on stale files.

๐Ÿ“– Deep Dive: Why I Started Building FerryCat: When Two AI Coding Hosts Live on the Same Desktop


Core Pain Points & Engineering Solutions

While the official MCP Tasks specification (2025-11 / 2026-07) addresses long-running operations within a single Client โ†” Server connection, it does not solve cross-host collaboration on a developer workstation:

  1. stdio Process Isolation: Desktop IDEs spawn local MCP servers as independent child processes with isolated memory spaces and distinct Node.js runtimes.

  2. Silent Blind Reviews on Stale Code (Stale Context): When handing off a task from Host A to Host B, unushed IDE buffers, branch switches, or mid-review edits cause the receiving agent to audit outdated code and produce plausible but invalid conclusions.

  3. Context Window Bloat: Pasting hundreds of lines of source code across chat windows duplicates token consumption on both ends.

  4. Unstructured Handoff Outputs: Free-form prose responses lack deterministic schema enforcement, making downstream consumption unreliable and prone to infinite retry loops.

FerryCat resolves these failure modes through a human-scheduled, contract-driven SQLite WAL bus:

[Developer]             [Host A: Antigravity]            [~/.ferrycat/mesh.db]            [Host B: WorkBuddy]
     |                            |                                |                               |
     |-- 1. "Dispatch review" --->|                                |                               |
     |                            |-- dispatch_contract() -------->| Write status = SUBMITTED      |
     |                            |   (Full SHA-256 + Line Bounds) | Store size / sha256 snapshot  |
     |                            |                                |                               |
     |-- 2. Switch IDE: "Poll" ---|--------------------------------|------------------------------>|
     |                            |                                |<-- poll_next_task() ----------|
     |                            |                                |    (Atomic claim changes===1  |
     |                            |                                |     + Verify disk SHA-256)    |
     |                            |                                |                               |-- Read local files
     |                            |                                |<-- fulfill_contract() --------|-- Re-verify SHA-256
     |                            |                                |    (Validate Ajv JSON Schema  |   & submit JSON
     |                            |                                |     -> status = COMPLETED)    |
     |                            |                                |                               |
     |-- 3. Switch IDE: "Inspect" |                                |                               |
     |                            |-- inspect_mesh_state() ------->| Read-only query of COMPLETED  |
     |<-- Present structured res -|                                |                               |

Related MCP server: AgentMesh MCP

Key Architectural Pillars

1. Deterministic 7-State Machine

Every state transition is bound to an explicit SQL transaction with optimistic concurrency control (changes === 1), eliminating phantom or dangling states:

                  dispatch_contract()
                          โ”‚
                          โ–ผ
                    โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”
                    โ”‚ SUBMITTED โ”‚ (Queue TTL: default 1800s)
                    โ””โ”€โ”€โ”€โ”€โ”€โ”ฌโ”€โ”€โ”€โ”€โ”€โ”˜
                          โ”‚
                 poll_next_task()
         โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”ผโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”
         โ”‚ (Queue TTL)    โ”‚ (Hash Match)   โ”‚ (Missing / Size Diff / SHA-256 Mismatch)
         โ–ผ                โ–ผ                โ–ผ
   โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”    โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”   โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”
   โ”‚ TIMED_OUT โ”‚    โ”‚  CLAIMED  โ”‚   โ”‚ POINTER_STALE โ”‚ (Terminal: Rejects blind review)
   โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜    โ””โ”€โ”€โ”€โ”€โ”€โ”ฌโ”€โ”€โ”€โ”€โ”€โ”˜   โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜
      โ–ฒ                   โ”‚ (Exec TTL: default 300s)
      โ”‚          fulfill_contract()
      โ”‚  โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”ผโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”ฌโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”
      โ””โ”€โ”€โ”ค (Exec TTL)     โ”‚ (Schema Valid) โ”‚ (Retries > 2)  โ”‚ (Mid-Review File Edit)
         โ”‚                โ–ผ                โ–ผ                โ–ผ
         โ”‚          โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”   โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ” โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”
         โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”‚ COMPLETED โ”‚   โ”‚ VALIDATION_FAILED โ”‚ โ”‚ POINTER_STALE โ”‚
                    โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜   โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜ โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜

Holder-side lifecycle controls on a CLAIMED contract (all require agent_id === target_agent):

Call

Transition

Guard rails

release_contract

CLAIMED โ†’ SUBMITTED (tail of queue, fresh queue window)

Resets extend_count (renewal budget is per holder) but preserves retry_count: the schema-failure circuit breaker is a contract-level quota, so releasing cannot launder retry budget. Refused past the absolute lifetime deadline. Max 3 releases per contract.

extend_ttl

CLAIMED โ†’ CLAIMED (claimed_at = now)

Must be called inside the active window; max 5 renewals per holder; refused once now โ‰ฅ created_at + 4 ร— queue_ttl_sec.

fail_contract

CLAIMED โ†’ FAILED (terminal)

Requires a reason, stored as WORKER_FAILED: <reason>. A report arriving after the window closed becomes TIMED_OUT with the reason attached.

2. Full-File SHA-256 Fingerprinting, Pre-Flight Verify & TOCTOU Soft-Failure Buffering (ADR-0004)

  • Dispatch Snapshot: dispatch_contract reads target files on disk, recording byte size, full-file sha256 (64 hex chars), first_line, and last_line. If a file was modified within the last 3 seconds, a warning is emitted to alert the requester of potential unsaved IDE buffers.

  • Claim Verification: poll_next_task verifies Existence -> Byte Size -> Full-File SHA-256 (never rejecting on mtime_ms alone to tolerate no-op IDE saves). On mismatch, it waits 150ms and retries once to rule out transient IDE flushes before marking the contract POINTER_STALE.

  • Pre-Flight Verify (verify_contract): A strictly read-only check allowing workers or scripts to audit pointer health (valid: true vs valid: false with dirty files list) before submitting.

  • TOCTOU Soft-Failure Buffering: fulfill_contract checks on-disk pointer fingerprints. If dirty pointers are detected:

    • Strike 1 returns RETRY_NEEDED, leaves the contract CLAIMED, renews the execution window, and lists dirty files with recovery instructions (git stash / git checkout -- <file>).

    • Strike 2 transitions to terminal POINTER_STALE and saves the full submitted review payload into salvaged_result_json so review effort is never lost.

  • TOCTOU Race Narrowing: While no file-based system can eliminate the microsecond race between reading disk bytes and committing a database row, FerryCat's dual-verification (at poll and at fulfill) drastically narrows the TOCTOU window from minutes of blind review down to the sub-millisecond atomic SQL transition boundary.

3. Bounded Schema Validation (RETRY_NEEDED $\le 2$)

  • Outputs are validated against the contract's JSON Schema via cached Ajv validators, with errors flattened into concise single-line paths (e.g., ["/passed: must be boolean"]).

  • Up to 2 validation failures return RETRY_NEEDED while keeping the contract CLAIMED for immediate self-correction (each rejection also renews the execution window); a 3rd failure transitions the contract to terminal VALIDATION_FAILED.

4. Dual-Stage TTL & Read-Before-Write Sweeping

  • Separates queue_ttl_sec (default 1800s for SUBMITTED) from exec_ttl_sec (measured from claimed_at), preventing tasks claimed late in the queue window from timing out prematurely during execution.

  • exec_ttl_sec defaults are tiered by task_type: code_review / architecture_audit โ†’ 1800s (deep reasoning or human-in-the-loop), implementation / test_generation โ†’ 300s. An explicit exec_ttl_sec always wins.

  • poll_next_task executes a lock-free SELECT COUNT(*) probe before attempting any UPDATE on expired rows; inspect_mesh_state is strictly read-only.

5. Defense-in-Depth Path Security

  • Enforces path containment within workspace_root and blocks sensitive file patterns (.env*, *.pem, *.key, id_rsa*, *credentials*, *secret*, .npmrc, .git/config) on both dispatch and worker verification paths.

  • Path Resolution: workspace_root is strongly recommended to be passed as an absolute path. If a relative path is provided, it is deterministically resolved against process.cwd() via path.resolve.

6. Threat Model & Security Assumptions (Local Workstation IPC)

  • Assumed Trust Environment: FerryCat is intentionally designed as a Trusted Local Workstation Bus bridging isolated IDE hosts operating under the same OS user account. Callers and workers share the local file system (workspace_root) and SQLite database (~/.ferrycat/mesh.db).

  • Defense Scope: Path containment (assertSafePointerPath) and sensitive file pattern filters prevent unintentional workspace escapes, symlink traversals, or accidental leakage of credentials/secret files during handoffs.

  • Out of Scope (Non-Goals): FerryCat does not provide adversarial sandboxing, multi-tenant isolation, or network authorization against malicious local processes or adversarial agents spoofing AGENT_NAME.


Applicability Boundaries (When NOT to Use FerryCat)

  1. Disjoint File Systems: FerryCat offloads context by file reference; both hosts must share access to the same local workspace_root.

  2. Trivial Single-Turn Queries: Each cross-host handoff involves 3 explicit human window switches (~15โ€“25s overhead).

  3. Unattended Background Pipelines: Desktop IDE hosts follow a request-response model and cannot be woken up asynchronously by an idle MCP server. For unattended multi-step pipelines, use a standalone DAG workflow engine such as PatchCat.


Quickstart

No local clone or manual compilation required. Mount directly into your IDE's MCP configuration using npx -y ferrycat:

Antigravity Configuration

Edit %USERPROFILE%\.gemini\antigravity\mcp_config.json (or ~/.gemini/antigravity/mcp_config.json on macOS/Linux):

{
  "mcpServers": {
    "ferrycat": {
      "command": "npx",
      "args": ["-y", "ferrycat"],
      "env": {
        "AGENT_NAME": "antigravity"
      }
    }
  }
}

WorkBuddy / Claude Code / Cursor / Codex Configuration

Configure the target host's MCP settings with its respective AGENT_NAME:

{
  "mcpServers": {
    "ferrycat": {
      "command": "npx",
      "args": ["-y", "ferrycat"],
      "env": {
        "AGENT_NAME": "workbuddy"
      }
    }
  }
}

2. Global Installation & Source Build

  • Global CLI Installation:

    npm install -g ferrycat

    Then simply set "command": "ferrycat" in your MCP config.

  • Local Source Build (For Contributors):

    git clone https://github.com/GuoBug/FerryCat.git
    cd FerryCat
    npm install
    npm run build
    npm test

    Mount using your local path: "command": "node", "args": ["--experimental-sqlite", "/path/to/FerryCat/dist/index.js"].


First-Class CLI Experience (ferrycat-cli)

Beyond serving as an in-IDE MCP Server, FerryCat provides a first-class CLI utility (ferrycat-cli or npx ferrycat-cli). Sharing the same ~/.ferrycat/mesh.db SQLite WAL database and Zod validation contracts, the CLI allows developers to inspect mesh health, verify working tree safety, and hook into automated CI/Git scripts without leaving their terminal:

1. Terminal Visual Inspection (ASCII Status Table)

Inspect all cross-host handoffs and error reasons formatted as an ASCII table:

# View all contracts in an ASCII table
npx ferrycat-cli inspect

# Filter by target agent (e.g., only tasks for antigravity)
npx ferrycat-cli inspect --target antigravity

2. Pre-Flight Verification (Auditing Before Mutation)

Audit on-disk pointer file integrity against the contract's baseline SHA-256 before committing review work (ADR-0004), eliminating false-positive deliveries:

npx ferrycat-cli verify <CONTRACT_ID>

3. Local CI & Headless Worker Execution

Poll the queue, claim tasks, and execute local review/test scripts with automatic failure closure:

# Safely run a script upon task arrival (no shell quotation hazards)
npx ferrycat-cli worker --agent codex --mode=exec --exec-file ./scripts/review.sh

Exposed MCP Tools

Tool Name

Role

Transactional Behavior

dispatch_contract

Requester

Enforces path blacklist $\to$ computes full-file SHA-256 & line bounds $\to$ inserts SUBMITTED.

poll_next_task

Worker

Sweeps expired TTLs (read-before-write) $\to$ claims via changes === 1 (CLAIMED) $\to$ verifies disk SHA-256 (or marks POINTER_STALE).

fulfill_contract

Worker

Re-verifies SHA-256 (TOCTOU guard) $\to$ validates Ajv JSON Schema ($\le 2$ retries via RETRY_NEEDED, 3rd marks VALIDATION_FAILED) $\to$ marks COMPLETED.

release_contract

Worker (holder)

Hands a CLAIMED contract back to the queue tail as SUBMITTED. retry_count is preserved (contract-level circuit breaker); extend_count is reset. Max 3 releases; refused once past the absolute lifetime deadline.

extend_ttl

Worker (holder)

Heartbeat: restarts the execution window (claimed_at = now), max 5 renewals and bounded total lifetime.

fail_contract

Worker (holder)

Marks a CLAIMED contract terminal FAILED with a mandatory reason.

verify_contract

Worker / Any (Read-Only)

Pre-flight check: validates on-disk pointer files against the baseline SHA-256 without mutating contract state (ADR-0004).

inspect_mesh_state

Any (Read-Only)

Pure read-only query of contract states, outputs, and dynamic is_logically_expired flags.

๐Ÿ’ก Architecture Decision Records & Engineering Verification:


About the Author
Guo Qiang (GuoBug), Product Engineer specializing in platform engineering and growth. Currently focused on AI workflow orchestration, DAG state machines, and deterministic system architectures.
Open Source & Homepage: https://github.com/GuoBug ยท https://guobug.github.io
Inquiries and discussions on workflow engine architecture, topological scheduling, and developer experience are warmly welcomed.

Available Tools

8 tools
dispatch_contractA

Dispatch a task or code review contract to another local AI agent host via the shared SQLite WAL mesh.

Purpose

Registers a new contract in SUBMITTED status with full-file SHA-256 fingerprint snapshots of all target files, establishing an immutable baseline for cross-host verification.

Usage Guidelines

  • When to use: Use when requesting code reviews, architecture audits, implementation, or test generation from a target agent (e.g., target_agent="workbuddy" or "antigravity").

  • When NOT to use:

    • Do NOT use to claim or execute tasks (use poll_next_task).

    • Do NOT use to check task status or inspect outputs (use inspect_mesh_state).

    • Do NOT use if the target host does not share the same local filesystem access to workspace_root.

  • Prerequisites: workspace_root must be a valid directory accessible by both hosts. Pointer files must exist on disk and be saved. Sensitive files (.env, keys, credentials, .git/config) and path escapes are strictly blocked.

Behavior & Side Effects

  • Mutates database: Synchronously inserts a single row into contracts with status='SUBMITTED' in SQLite WAL (~/.ferrycat/mesh.db).

  • SHA-256 Snapshot: Computes 64-char hex SHA-256, byte size, and first/last lines for each pointer. Emits a warning if any file was modified within the last 3 seconds (indicating unsaved IDE buffers).

  • Lifecycle & Expiry: Starts the queue_ttl_sec countdown (default: 1800s / 30m). If the target agent never claims it before queue_ttl_sec elapses, the contract lazily transitions to TIMED_OUT.

  • Once claimed, execution is governed by exec_ttl_sec (tiered default: 1800s for review/audit, 300s for implementation/test).

Return Value

Returns { contract_id: string, status: 'SUBMITTED', created_at: number, files: Array<{ path, size, mtime_ms, sha256, first_line, last_line, line_range? }>, warning?: string }. Note: requester_agent / target_agent / task_type / title / TTLs are NOT echoed back โ€” read them via inspect_mesh_state if needed.

NameRequiredDescriptionDefault
titleYesConcise contract title (1-120 chars) summarizing the goal of the request.
pointersYesArray of 1 to 50 target file pointers hashed with full-file SHA-256 and snapshot boundaries for tamper detection.
task_typeYesType of contract task. Tiered default execution TTL: 1800s for code_review/architecture_audit, 300s for implementation/test_generation.
exec_ttl_secNoExecution TTL in seconds once CLAIMED (default: 1800s for review/audit, 300s for implementation/test). Worker must fulfill, extend, release, or fail within this window.
target_agentYesTarget worker agent identifier expected to claim and execute this contract (e.g., "workbuddy", "antigravity").
queue_ttl_secNoQueue expiration TTL in seconds while status is SUBMITTED (default: 1800s / 30m). Transitions to TIMED_OUT if unclaimed before expiry.
workspace_rootYesAbsolute canonical path to the shared local workspace directory accessible by both hosts (e.g. "F:/git/FerryCat"). Path escapes and sensitive files are blocked.
context_summaryYesDetailed task instructions, audit focus areas, architectural constraints, and background context for the worker agent (1-20000 chars).
contract_schemaNoOptional Draft-07 JSON Schema that structured_output must validate against. Bounded to 1MB and max 32 depth (FC-302).
requester_agentNoRequester agent identifier. Defaults to AGENT_NAME env var (e.g., "antigravity", "workbuddy").

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does so thoroughly: it discloses the database mutation (a single row insert into contracts at ~/.ferrycat/mesh.db), the SHA-256 snapshot computation, a stale-buffer warning heuristic (files modified within 3 seconds), and the full lazy-expiry lifecycle with tiered TTLs. This is exactly the behavioral context an agent needs before a mutating call.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The markdown sectioning (Purpose / Usage Guidelines / Behavior & Side Effects / Return Value) makes the length appropriate for a 10-parameter mutating tool, and the purpose is front-loaded. There is some redundancy โ€” sensitive-file blocking is stated in both the description body and repeated again in the schema โ€” which keeps it from a 5.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Although there is no output schema, the description explicitly enumerates the return shape ({contract_id, status, created_at, files[...], warning?}) and even flags fields that are omitted from the response. Combined with the lifecycle and failure-mode detail, nothing an agent needs to invoke this correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema already documents all 10 parameters and the baseline would be 3. The description adds value beyond it by explaining the tiered TTL defaults tied to task_type, and by noting that requester_agent/target_agent/TTLs are NOT echoed in the return value. It does not add much per-parameter syntax detail, so a 4 rather than a 5.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb, resource, and mechanism ('Dispatch a task or code review contract to another local AI agent host via the shared SQLite WAL mesh') and immediately refines it ('Registers a new contract in SUBMITTED status with full-file SHA-256 fingerprint snapshots'). This is clearly distinct from siblings like poll_next_task and inspect_mesh_state, which are named as alternatives.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides explicit 'When to use', 'When NOT to use' with named sibling alternatives (poll_next_task for claiming/executing, inspect_mesh_state for status), and prerequisites (shared filesystem access, pointer files saved on disk, sensitive-file blocking). Nothing is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

extend_ttlA

Heartbeat renewal for long-running execution: restarts the active execution window of a CLAIMED contract.

Purpose

Prevents execution timeout during deep reasoning, extensive test execution, or complex multi-step refactoring by resetting the execution clock.

Usage Guidelines

  • When to use: Call periodically during long-running tasks before the active exec_ttl_sec countdown expires.

  • When NOT to use:

    • Do NOT use after the window has already expired (expired contracts transition to TIMED_OUT).

    • Do NOT use to deliver task completion (use fulfill_contract).

    • Do NOT use if abandoning the task (use release_contract or fail_contract).

  • Prerequisites: Caller must be the current holder and contract must be currently CLAIMED.

Behavior & Side Effects

  • Mutates database: Resets claimed_at=nowMs (restarting the full exec_ttl_sec window from the current moment) and increments extend_count.

  • Quotas & Boundaries: Maximum 5 renewals per holder. Bounded by the contract's absolute lifetime ceiling (created_at + 4 * queue_ttl_sec); rejected if proposedExpiresAt > lifetimeDeadline.

Return Value

Returns { ok: boolean, contract_id: string, status: 'CLAIMED' | 'TIMED_OUT', claimed_at?: number, expires_at?: number, extend_count: number, max_extends: number, message: string }.

NameRequiredDescriptionDefault
agent_idNoCurrent holder agent identifier. Must match target_agent of the claimed contract (defaults to AGENT_NAME env var).
claim_tokenNoExclusive lease token returned in contract.claim_token by poll_next_task (FC-301).
contract_idYesThe CLAIMED contract ID whose active execution window should be renewed.

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and delivers: it discloses the database mutation (claimed_at=nowMs reset, extend_count increment), hard quotas (max 5 renewals per holder), an absolute lifetime ceiling (created_at + 4 * queue_ttl_sec), and the rejection condition. It also warns that expiry transitions the contract to TIMED_OUT.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Content is front-loaded with the core action and organized under clear headings, and virtually every line carries operational information. The markdown-section framing is heavier than necessary for a tool description and the return-value block is dense, but nothing is truly redundant.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a mutation tool with no annotations and no output schema, the description supplies the missing pieces: side effects, quota limits, failure conditions, prerequisites, and an explicit return shape. An agent has everything needed to call it correctly and to anticipate rejections.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents contract_id, agent_id, and claim_token in detail; baseline is 3. The description adds the holder-must-match precondition but never explains claim_token's lease role, and it references 'proposedExpiresAt' which is not an input in the schema, a minor source of confusion.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Heartbeat renewal ... restarts the active execution window of a CLAIMED contract') and immediately frames it as timeout prevention. It is clearly distinguishable from siblings that deliver, release, or fail a contract, which are named later.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit when-to-use ('periodically during long-running tasks before the active exec_ttl_sec countdown expires') and three when-NOT-to-use cases, each routing to a concrete sibling (fulfill_contract, release_contract, fail_contract). Prerequisites are stated: caller must be current holder and contract must be CLAIMED.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fail_contractA

Explicitly mark a CLAIMED contract as terminal FAILED with a mandatory failure reason.

Purpose

Immediately terminates a claimed task that cannot be completed, recording actionable diagnostic reasons and freeing the requester from waiting for the execution TTL to expire.

Usage Guidelines

  • When to use: Use when a task encounters an unrecoverable failure (e.g. fatal syntax error, broken test suite, missing required environment).

  • When NOT to use:

    • Do NOT use if the task succeeded (use fulfill_contract).

    • Do NOT use if the task is recoverable by another agent or retryable (use release_contract).

  • Prerequisites: Caller must be the current holder and reason must be non-empty.

Behavior & Side Effects

  • Mutates database: Sets status='FAILED', error_reason='WORKER_FAILED: ', and completed_at=nowMs.

  • Late report handling: If the execution window already expired before fail_contract was called, the status becomes TIMED_OUT while faithfully preserving the worker's reason for the requester.

Return Value

Returns { ok: boolean, contract_id: string, status: 'FAILED' | 'TIMED_OUT', message: string }.

NameRequiredDescriptionDefault
reasonYesMandatory explanation of why the task cannot be completed. Stored in error_reason for the requester.
agent_idNoCurrent holder agent identifier. Must match target_agent of the claimed contract (defaults to AGENT_NAME env var).
claim_tokenNoExclusive lease token returned in contract.claim_token by poll_next_task (FC-301).
contract_idYesThe CLAIMED contract ID to mark as terminal FAILED.

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does so: it discloses the exact mutation (status='FAILED', error_reason prefixed 'WORKER_FAILED:', completed_at=nowMs) and an edge case that would otherwise surprise an agent โ€” a late call after TTL expiry yields TIMED_OUT while preserving the reason. Return shape is also spelled out despite no output schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded single-sentence summary, then short labeled sections โ€” well structured and scannable. It is slightly longer than strictly necessary (Return Value repeats the shape the agent could otherwise infer, and the side-effect detail is dense), but no section is filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a terminal-mutation tool with no annotations and no output schema, the description covers authorization prerequisites, exact side effects, the expired-window edge case, and the return value. Nothing an agent needs to invoke it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3; the description adds real meaning by tying the caller-identity requirement ('caller must be the current holder') to agent_id/claim_token and stressing the reason is mandatory and surfaced to the requester. It does not add format or length guidance beyond the schema's min/max constraints.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (mark terminal FAILED) and resource (a CLAIMED contract), plus the distinguishing constraint 'claimed'. The usage guidelines explicitly name fulfill_contract and release_contract as the alternatives for success and recoverable cases, so an agent can route without opening other schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit when-to-use (unrecoverable failure such as fatal syntax error, broken test suite, missing environment) and two explicit when-NOT-to-use cases with the sibling to use instead. Prerequisites (current holder, non-empty reason) are also stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fulfill_contractA

Submit execution or review deliverables for a CLAIMED contract, with TOCTOU soft-failure buffering and Ajv JSON Schema validation.

Purpose

Delivers the final output of a task, verifies that the code baseline was not mutated during execution, validates structured payloads, and transitions the contract to terminal COMPLETED.

Usage Guidelines

  • When to use: Use after completing task work to deliver result_summary, optional structured_output, and optional artifacts_pointers.

  • When NOT to use:

    • Do NOT use if you cannot complete the task (use release_contract to re-queue, or fail_contract to record failure).

    • Do NOT use if you modified pointer files directly on disk. If modified accidentally, run "git stash" or restore the files, run verify_contract, and pass proposed fixes inside structured_output.fixes.

Behavior & Side Effects

  • Authorization: Caller agent_id must match target_agent of the claimed contract.

  • TOCTOU Guard & Soft-Failure Buffer (ADR-0004) โ€” exactly ONE recoverable rejection:

    • 1st blocked fulfill: returns status='RETRY_NEEDED', keeps the contract CLAIMED, renews the execution window (claimed_at=now), and lists dirty_files with restore instructions.

    • 2nd blocked fulfill: transitions to terminal status='POINTER_STALE', preserving your summary and payload in salvaged_result_json so the work is not lost.

    • Only ONE rejection is recoverable: restore/stash the files BEFORE retrying, and call verify_contract first so a stray second attempt cannot burn the buffer.

  • Schema Validation: If contract_schema was defined, validates structured_output via cached Ajv validator. Failures 1 & 2 return RETRY_NEEDED with flattened error paths and renew the execution window; 3rd failure transitions to terminal VALIDATION_FAILED.

  • On Success: Transitions to terminal status='COMPLETED', recording result_summary, structured_output, artifacts_pointers, and verified SHA-256 snapshot.

Return Value

Returns { ok: boolean, contract_id: string, status: 'COMPLETED' | 'RETRY_NEEDED' | 'POINTER_STALE' | 'VALIDATION_FAILED', retry_count: number, max_retries: number, toctou_strike?: number, max_toctou_strikes?: number, dirty_files?: Array<{ path, reason, detail }>, validation_errors?: string[], message: string }.

NameRequiredDescriptionDefault
agent_idNoWorker agent identifier. Must match the contract target_agent (defaults to AGENT_NAME env var).
claim_tokenNoExclusive lease token returned in contract.claim_token by poll_next_task (FC-301). Mutating operations must provide matching claim_token to prevent cross-worker interference.
contract_idYesThe contract ID returned by poll_next_task that is currently in CLAIMED status.
result_summaryYesDetailed markdown or plain text summary of review findings, implementation details, or test execution outcomes (1-20000 chars).
structured_outputNoStructured JSON payload matching contract_schema. Bounded to 1MB and max 32 depth (FC-302). For code reviews, pass proposed patches in fixes: [{ path, patch, description }] rather than editing pointer files directly (ADR-0004).
artifacts_pointersNoOptional pointers to new or modified artifact files created during task execution (max 50 files).

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, and the description carries the full burden well: it discloses the authorization requirement (agent_id must match target_agent), the exact TOCTOU soft-failure policy with strike counts and terminal outcomes, the Ajv validation retry ladder (2 recoverable, 3rd terminal VALIDATION_FAILED), and what data is preserved on failure. These are non-obvious side effects an agent could not infer from the schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Well front-loaded with a one-sentence summary, then headed sections that map to purpose, usage, behavior and returns. It is long but nearly all of it is load-bearing; the return-value enumeration and repeated strike-buffer detail are slightly redundant but justified given there is no output schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex 6-param mutating tool with no annotations and no output schema, the description covers prerequisites (claim_token, CLAIMED status), failure modes and terminal statuses, and spells out the return shape itself. Nothing an agent needs to call it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents every parameter, including claim_token and the fixes pattern. The description reinforces the roles of result_summary, structured_output and artifacts_pointers but adds little syntax or format detail beyond what the schema states; baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Names a specific verb and resource (submit deliverables for a CLAIMED contract) and explicitly describes the scope: delivery, baseline verification, schema validation, transition to COMPLETED. It distinguishes itself from release_contract and fail_contract by name, so an agent can route between them without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides an explicit 'When to use' and a 'When NOT to use' section that names the correct alternatives (release_contract to re-queue, fail_contract to record failure) along with a concrete accidental-modification recovery path (git stash, verify_contract, fixes in structured_output).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

inspect_mesh_stateA

Strictly read-only query of contracts, execution progress, outputs, diagnostic counters, and failure causes.

Purpose

Provides comprehensive observability into the multi-agent mesh state without acquiring database locks or mutating rows.

Usage Guidelines

  • When to use:

    • Check whether a contract you dispatched has been claimed or completed.

    • Inspect result summaries, structured outputs, or salvaged results of completed/stale contracts.

    • Monitor queue depth or pending contracts for a specific agent via target_agent filter.

  • When NOT to use:

    • Do NOT use to claim tasks (use poll_next_task).

    • Do NOT use to dispatch tasks (use dispatch_contract).

    • Do NOT use to verify on-disk file pointer hygiene (use verify_contract).

Behavior & Side Effects

  • Zero side effects: Pure read-only SELECT query against SQLite WAL. Never alters rows or triggers sweeps.

  • Dynamically calculates is_logically_expired: true when a contract has exceeded its queue or execution TTL based on the current timestamp, even before the next lazy sweep runs.

Return Value

Returns { total_returned: number, contracts: Array<{ contract_id, requester_agent, target_agent, task_type, title, status, is_logically_expired, created_at, claimed_at, completed_at, retry_count, extend_count, release_count, toctou_strike, result_summary, structured_output, artifacts_pointers, error_reason, salvaged_result, verified_sha256 }> }.

NameRequiredDescriptionDefault
limitNoMaximum number of records to return (default: 10)
statusNoFilter by status (default: ALL)
contract_idNoOptional specific contract_id to inspect single contract details, counters, errors, and output payloads.
target_agentNoOptional filter by target worker agent identifier (e.g., "workbuddy") to view pending or completed queue items.

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full behavioral burden and does so well: it states zero side effects, a pure read-only SELECT against SQLite WAL, no row mutation, no sweeps, and no database locks. It also explains the dynamic is_logically_expired calculation based on queue or execution TTL, which is non-obvious behavior an agent would otherwise miss.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core read-only purpose and then organized into clear sections for usage, behavior, and return value. The return-value structure is detailed but earns its place because there is no output schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the lack of annotations and output schema, the description is complete enough for correct invocation: it covers purpose, alternatives, side effects, lock behavior, expiration logic, and the returned object shape. No critical context for a 4-parameter optional-filter observability tool appears to be missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all four parameters are already documented in the schema; the baseline is therefore 3. The description adds some meaning by explaining the target_agent filter for monitoring a specific agentโ€™s queue, but it does not add much beyond the schema for limit, status, or contract_id.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: a strictly read-only query of contracts, execution progress, outputs, diagnostic counters, and failure causes in the multi-agent mesh state. It clearly distinguishes the tool from sibling operations by naming poll_next_task, dispatch_contract, and verify_contract as alternatives for other purposes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives explicit when-to-use cases such as checking whether a dispatched contract was claimed or completed, inspecting result summaries, and monitoring queue depth via target_agent. It also gives explicit when-not-to-use cases with named alternatives for claiming, dispatching, and verifying file pointer hygiene.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

poll_next_taskA

Atomically claim the oldest pending SUBMITTED contract assigned to this agent and verify local file fingerprints.

Purpose

Retrieves and claims next available contract work for the current agent, transitioning it from SUBMITTED to CLAIMED.

Usage Guidelines

  • When to use: Call periodically or when notified to discover and atomically take ownership of pending tasks assigned to your agent_id.

  • When NOT to use:

    • Do NOT use to non-destructively inspect queue depth or monitor status without claiming (use inspect_mesh_state).

    • Do NOT use to create contracts (use dispatch_contract).

  • IMPORTANT (ADR-0004): Pointers are an immutable baseline snapshot ("what I read"). Never edit pointer files directly on disk while holding a review contract; deliver any proposed code fixes via structured_output.fixes in fulfill_contract.

Behavior & Side Effects

  • Mutates database: Atomically claims the oldest SUBMITTED contract for agent_id using optimistic concurrency (UPDATE ... WHERE status='SUBMITTED', checked by changes===1). Starts the exec_ttl_sec window.

  • Lazy TTL sweep: Automatically sweeps and marks expired contracts as TIMED_OUT using lock-free read-before-write probing.

  • Fingerprint verification: Verifies Existence -> Byte Size -> SHA-256 for all pointers. If on-disk files were altered or missing, marks the contract POINTER_STALE and transparently advances to claim the next valid candidate in the queue.

Return Value

  • When work is claimed: { ok: true, has_task: true, status: 'CLAIMED', contract: { contract_id, requester_agent, target_agent, task_type, title, context_summary, workspace_root, pointers, contract_schema, claimed_at, exec_ttl_sec } }.

  • When queue is empty: { ok: true, has_task: false, message: 'No pending contracts for agent "<agent_id>"' }.

NameRequiredDescriptionDefault
agent_idNoWorker agent identifier claiming tasks (defaults to AGENT_NAME env var, e.g., "workbuddy").

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full behavioral burden and does so thoroughly: it discloses the atomic DB mutation, optimistic concurrency check, TTL window start, lazy TTL sweep, fingerprint verification order, POINTER_STALE handling, and queue advancement. It also describes both success and empty-queue return shapes.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded and sectioned into purpose, usage, behavior, and return value, making it scannable despite its length. It is appropriately detailed for a stateful claiming operation, though some repetition of the atomic-claim concept across sections keeps it short of perfect conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex mutation with no annotations and no output schema, the description is complete enough to call correctly: it explains side effects, concurrency behavior, TTL behavior, stale-pointer handling, and return values. An agent has the operational context needed without opening additional documentation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, and the schema already documents agent_id including its default from the AGENT_NAME environment variable. The description reinforces that the task is assigned to this agent, but adds little parameter-level meaning beyond the schema, so the baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: atomically claim the oldest pending SUBMITTED contract assigned to this agent, including fingerprint verification. It clearly distinguishes the tool from siblings by naming inspect_mesh_state for non-claiming inspection and dispatch_contract for creating contracts.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives explicit when-to-use guidance (periodically or when notified to discover and claim pending tasks) and explicit when-not-to-use guidance with named alternatives for inspection and contract creation. It also adds a relevant ADR constraint about pointer immutability.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

release_contractA

Hand a CLAIMED contract back to the queue tail as SUBMITTED with a fresh queue window.

Purpose

Allows an agent holding a claimed task to safely release ownership back to the queue without failing or aborting the task.

Usage Guidelines

  • When to use: Use when your agent claimed a task by mistake, encounters missing local dependencies/tools, or needs to switch git branches before processing.

  • When NOT to use:

    • Do NOT use if the task permanently failed or cannot ever be completed (use fail_contract).

    • Do NOT use if you simply need more time to finish active execution (use extend_ttl).

  • Prerequisites: Caller must be the current holder (agent_id matches target_agent) and contract status must be CLAIMED.

Behavior & Side Effects

  • Mutates database: Resets claimed_at=NULL, updates queued_at=nowMs, resets extend_count=0 (renewal quota is per holder), and increments release_count.

  • Preserves retry_count: The schema validation circuit-breaker quota is contract-level; releasing a contract cannot launder previously consumed retry attempts.

  • Audit history: Appends reason to error_reason history ("RELEASED_BY_HOLDER: | prev: ...").

  • Limits: Maximum 3 releases per contract. Refused once the contract reaches its absolute lifetime ceiling (nowMs >= created_at + 4 * queue_ttl_sec).

Return Value

Returns { ok: boolean, contract_id: string, status: 'SUBMITTED' | 'CLAIMED' | 'TIMED_OUT', release_count: number, max_releases: number, message: string }.

NameRequiredDescriptionDefault
reasonNoOptional reason for releasing (e.g., "wrong context", "missing tool", "switching git branch"). Appended to error_reason history.
agent_idNoCurrent holder agent identifier. Must match target_agent of the claimed contract (defaults to AGENT_NAME env var).
claim_tokenNoExclusive lease token returned in contract.claim_token by poll_next_task (FC-301).
contract_idYesThe CLAIMED contract ID to release back to the queue tail as SUBMITTED.

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so the description carries the full burden and it does: it discloses exact DB mutations (claimed_at=NULL, queued_at=nowMs, extend_count=0, release_count incremented), what is deliberately preserved (retry_count circuit-breaker quota, with the anti-laundering rationale), the audit-trail format appended to error_reason, and hard limits (max 3 releases, absolute lifetime ceiling of 4 * queue_ttl_sec). This is exactly the side-effect detail a mutation tool needs.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the verb/effect in the first sentence, then cleanly partitioned into Purpose, Usage, Behavior, and Return Value. Slightly longer than necessary โ€” the one-line Purpose section largely repeats the headline โ€” but every other sentence carries distinct operational information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Although there is no output schema, the description spells out the full return shape ({ ok, contract_id, status, release_count, max_releases, message }). Combined with the side-effect and limit disclosures, an agent has everything needed to invoke this safely and interpret the result.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so each of the four parameters, including claim_token's provenance from poll_next_task, is already documented in the schema. The description restates the agent_id/target_agent match and CLAIMED-status prerequisite but adds no new syntax or format detail beyond that. Baseline 3 is appropriate when the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (release), resource (contract), and target state (back to queue tail as SUBMITTED with a fresh queue window). The usage-guidelines section explicitly contrasts it with fail_contract and extend_ttl, so an agent can distinguish it from every sibling without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit 'when to use' (claimed by mistake, missing local deps, need to switch branches) and an explicit 'when NOT to use' pair that names the correct alternative for each case (fail_contract for permanent failure, extend_ttl for needing more time). Prerequisites are stated outright (caller must be the current holder, status must be CLAIMED).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

verify_contractA

Read-only pre-flight consistency check (ADR-0004): audits on-disk pointer files against the baseline SHA-256 snapshot.

Purpose

Enables agents or automated scripts to verify that on-disk files match the contract's dispatched baseline before calling fulfill_contract, preventing accidental TOCTOU strikes.

Usage Guidelines

  • When to use: Call before fulfill_contract while holding a CLAIMED contract to confirm file cleanliness, or when investigating why a fulfill call was blocked.

  • When NOT to use:

    • Do NOT use to deliver results (use fulfill_contract).

    • Do NOT use to renew time (use extend_ttl).

  • ADR-0004 Rule: Pointers are an immutable review baseline. If verify_contract reports dirty files, restore or stash them (e.g., git stash or git checkout -- ) and deliver proposed changes inside structured_output.fixes.

Behavior & Side Effects

  • Zero side effects: Pure read-only operation. Never updates the database, never alters contract status, and never consumes a TOCTOU strike.

  • Complete pointer check: Verifies all pointer files on disk and returns every drifted file (reason: SIZE_MISMATCH, CONTENT_CHANGED, or FILE_MISSING).

Return Value

Returns { ok: true, valid: boolean, fulfillable: boolean, contract_id: string, status: ContractStatus, target_agent: string, toctou_strike: number, max_toctou_strikes: number, dirty_files: Array<{ path, reason, detail }>, message: string }. NOTE: valid only means every pointer still matches its dispatched baseline. fulfillable additionally requires the contract to be CLAIMED. A contract that already went terminal (FAILED / POINTER_STALE / COMPLETED) can report valid=true while fulfillable=false, so branch on fulfillable rather than valid before calling fulfill_contract.

NameRequiredDescriptionDefault
agent_idNoOptional caller agent identifier for audit logging. Does not restrict read-only verification.
claim_tokenNoOptional lease token for caller verification (FC-301).
contract_idYesThe contract ID whose on-disk pointer files should be verified against the baseline SHA-256 snapshot without mutating contract state.

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations at all, the description carries the full burden and does so: zero side effects, never mutates DB, never alters contract status, never consumes a TOCTOU strike. It also discloses that all pointer files are checked and enumerates the drift reasons (SIZE_MISMATCH, CONTENT_CHANGED, FILE_MISSING).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the one-line summary and well-structured under headers, with the critical branch-on-fulfillable warning placed last for emphasis. It is somewhat long, and the Behavior section partly re-states the read-only claim made in the opening line, but nearly every sentence carries actionable information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, and the description fully documents the return shape and the crucial valid vs. fulfillable distinction, including the terminal-state edge case. Combined with side-effect disclosure and the ADR-0004 rule, nothing an agent needs to call this correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so contract_id, agent_id, and claim_token are already documented in the schema; the description adds no syntax or format detail for them. Baseline 3 applies since the schema does the heavy lifting on parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('pre-flight consistency check ... audits on-disk pointer files against the baseline SHA-256 snapshot') and immediately scopes it as read-only. The Usage Guidelines name the exact siblings it is not (fulfill_contract, extend_ttl), so an agent can route without opening either schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit 'When to use' (before fulfill_contract while holding a CLAIMED contract; when debugging a blocked fulfill) and 'When NOT to use' with named alternatives. It even supplies the remediation path (restore/stash, put changes in structured_output.fixes) when verification reports dirty files.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 6 tool updatesv0.3.2
    • Changeddispatch_contract1 field changed
      • changedInput schema / properties / contract_schema / description
        Previous value: -"Optional Draft-07 JSON Schema that structured_output must validate against. Enforces bounded retry (max 2 RETRY_NEEDED attempts before terminal VALIDATION_FAILED)."New value: +"Optional Draft-07 JSON Schema that structured_output must validate against. Bounded to 1MB and max 32 depth (FC-302)."
    • Changedextend_ttl1 field changed
      • addedInput schema / properties / claim_token
        Added value: +{
        +  "description": "Exclusive lease token returned in contract.claim_token by poll_next_task (FC-301).",
        +  "maxLength": 128,
        +  "minLength": 1,
        +  "type": "string"
        +}
    • Changedfail_contract1 field changed
      • addedInput schema / properties / claim_token
        Added value: +{
        +  "description": "Exclusive lease token returned in contract.claim_token by poll_next_task (FC-301).",
        +  "maxLength": 128,
        +  "minLength": 1,
        +  "type": "string"
        +}
    • Changedfulfill_contract2 fields changed
      • addedInput schema / properties / claim_token
        Added value: +{
        +  "description": "Exclusive lease token returned in contract.claim_token by poll_next_task (FC-301). Mutating operations must provide matching claim_token to prevent cross-worker interference.",
        +  "maxLength": 128,
        +  "minLength": 1,
        +  "type": "string"
        +}
      • changedInput schema / properties / structured_output / description
        Previous value: -"Structured JSON payload matching contract_schema. For code reviews, pass proposed patches in fixes: [{ path, patch, description }] rather than editing pointer files directly (ADR-0004)."New value: +"Structured JSON payload matching contract_schema. Bounded to 1MB and max 32 depth (FC-302). For code reviews, pass proposed patches in fixes: [{ path, patch, description }] rather than editing pointer files directly (ADR-0004)."
    • Changedrelease_contract1 field changed
      • addedInput schema / properties / claim_token
        Added value: +{
        +  "description": "Exclusive lease token returned in contract.claim_token by poll_next_task (FC-301).",
        +  "maxLength": 128,
        +  "minLength": 1,
        +  "type": "string"
        +}
    • Changedverify_contract1 field changed
      • addedInput schema / properties / claim_token
        Added value: +{
        +  "description": "Optional lease token for caller verification (FC-301).",
        +  "maxLength": 128,
        +  "minLength": 1,
        +  "type": "string"
        +}
  2. 8 tool updatesv0.3.0
    • Changeddispatch_contract12 fields changed
      • changedInput schema / properties / context_summary / description
        Previous value: -"Task instructions, audit focus, and background context"New value: +"Detailed task instructions, audit focus areas, architectural constraints, and background context for the worker agent (1-20000 chars)."
      • changedInput schema / properties / contract_schema / description
        Previous value: -"Optional JSON Schema that the worker structured_output must satisfy"New value: +"Optional Draft-07 JSON Schema that structured_output must validate against. Enforces bounded retry (max 2 RETRY_NEEDED attempts before terminal VALIDATION_FAILED)."
      • changedInput schema / properties / exec_ttl_sec / description
        Previous value: -"Execution expiration TTL in seconds for CLAIMED state (default: 300)"New value: +"Execution TTL in seconds once CLAIMED (default: 1800s for review/audit, 300s for implementation/test). Worker must fulfill, extend, release, or fail within this window."
      • changedInput schema / properties / pointers / description
        Previous value: -"File pointers to be hashed and verified on the worker side (max 50 files)"New value: +"Array of 1 to 50 target file pointers hashed with full-file SHA-256 and snapshot boundaries for tamper detection."
      • changedInput schema / properties / pointers / items / properties / line_range / description
        Previous value: -"Optional [startLine, endLine] 1-based inclusive range"New value: +"Optional [startLine, endLine] 1-based inclusive line range focus for the task."
      • changedInput schema / properties / pointers / items / properties / path / description
        Previous value: -"File path relative to workspace_root"New value: +"File path relative to workspace_root. Must exist on disk. Sensitive files (.env*, *.pem, *.key, id_rsa*, *credentials*, *secret*, .npmrc, .git/config) and path escapes are strictly rejected."
      • changedInput schema / properties / queue_ttl_sec / description
        Previous value: -"Queue expiration TTL in seconds for SUBMITTED state (default: 1800)"New value: +"Queue expiration TTL in seconds while status is SUBMITTED (default: 1800s / 30m). Transitions to TIMED_OUT if unclaimed before expiry."
      • changedInput schema / properties / requester_agent / description
        Previous value: -"Requester agent identifier (defaults to AGENT_NAME env var, e.g., \"antigravity\")"New value: +"Requester agent identifier. Defaults to AGENT_NAME env var (e.g., \"antigravity\", \"workbuddy\")."
      • changedInput schema / properties / target_agent / description
        Previous value: -"Target worker agent identifier (e.g., \"workbuddy\", \"antigravity\")"New value: +"Target worker agent identifier expected to claim and execute this contract (e.g., \"workbuddy\", \"antigravity\")."
      • changedInput schema / properties / task_type / description
        Previous value: -"Type of contract task"New value: +"Type of contract task. Tiered default execution TTL: 1800s for code_review/architecture_audit, 300s for implementation/test_generation."
      • changedInput schema / properties / title / description
        Previous value: -"Concise contract title"New value: +"Concise contract title (1-120 chars) summarizing the goal of the request."
      • changedInput schema / properties / workspace_root / description
        Previous value: -"Absolute path to the shared local workspace root directory"New value: +"Absolute canonical path to the shared local workspace directory accessible by both hosts (e.g. \"F:/git/FerryCat\"). Path escapes and sensitive files are blocked."
    • Addedextend_ttl
    • Addedfail_contract
    • Changedfulfill_contract7 fields changed
      • changedInput schema / properties / agent_id / description
        Previous value: -"Worker agent identifier (defaults to AGENT_NAME env var)"New value: +"Worker agent identifier. Must match the contract target_agent (defaults to AGENT_NAME env var)."
      • changedInput schema / properties / artifacts_pointers / description
        Previous value: -"Optional pointers to files created or modified during task execution"New value: +"Optional pointers to new or modified artifact files created during task execution (max 50 files)."
      • addedInput schema / properties / artifacts_pointers / items / properties / description / description
        Added value: +"Description of the artifact and its role"
      • addedInput schema / properties / artifacts_pointers / items / properties / path / description
        Added value: +"File path of created or modified artifact relative to workspace_root"
      • changedInput schema / properties / contract_id / description
        Previous value: -"The contract ID returned by poll_next_task"New value: +"The contract ID returned by poll_next_task that is currently in CLAIMED status."
      • changedInput schema / properties / result_summary / description
        Previous value: -"Human-readable summary of findings or implementation"New value: +"Detailed markdown or plain text summary of review findings, implementation details, or test execution outcomes (1-20000 chars)."
      • changedInput schema / properties / structured_output / description
        Previous value: -"Structured JSON payload matching the contract_schema"New value: +"Structured JSON payload matching contract_schema. For code reviews, pass proposed patches in fixes: [{ path, patch, description }] rather than editing pointer files directly (ADR-0004)."
    • Changedinspect_mesh_state3 fields changed
      • changedInput schema / properties / contract_id / description
        Previous value: -"Optional specific contract_id to inspect"New value: +"Optional specific contract_id to inspect single contract details, counters, errors, and output payloads."
      • changedInput schema / properties / status / enum
        Previous value: -[
        -  "SUBMITTED",
        -  "CLAIMED",
        -  "COMPLETED",
        -  "POINTER_STALE",
        -  "VALIDATION_FAILED",
        -  "TIMED_OUT",
        -  "ACTIVE",
        -  "ALL"
        -]New value: +[
        +  "SUBMITTED",
        +  "CLAIMED",
        +  "COMPLETED",
        +  "POINTER_STALE",
        +  "VALIDATION_FAILED",
        +  "TIMED_OUT",
        +  "FAILED",
        +  "ACTIVE",
        +  "ALL"
        +]
      • addedInput schema / properties / target_agent
        Added value: +{
        +  "description": "Optional filter by target worker agent identifier (e.g., \"workbuddy\") to view pending or completed queue items.",
        +  "maxLength": 64,
        +  "minLength": 1,
        +  "type": "string"
        +}
    • Changedpoll_next_task1 field changed
      • changedInput schema / properties / agent_id / description
        Previous value: -"Current worker agent identifier (defaults to AGENT_NAME env var, e.g., \"workbuddy\")"New value: +"Worker agent identifier claiming tasks (defaults to AGENT_NAME env var, e.g., \"workbuddy\")."
    • Addedrelease_contract
    • Addedverify_contract
  3. 4 tool updatesv0.1.0
    • First observeddispatch_contract
    • First observedfulfill_contract
    • First observedinspect_mesh_state
    • First observedpoll_next_task

TDQS

A4.7/5.0

Scored across 8 tools

Disambiguation5/5

Each tool has a clearly distinct role in the contract lifecycle: dispatch, poll/claim, extend, release, fulfill, fail, inspect, and verify. The descriptions explicitly state when NOT to use a tool and point to the correct alternative, eliminating overlap. The only close pair, inspect_mesh_state and verify_contract, is cleanly separated by scope: mesh-wide read-only status vs. on-disk pointer baseline audit.

Naming Consistency5/5

All tool names follow a predictable snake_case verb_noun pattern: inspect_mesh_state, poll_next_task, release_contract, extend_ttl, verify_contract, dispatch_contract, fulfill_contract, fail_contract. The few multi-word names remain readable and consistent with the convention.

Tool Count5/5

Eight tools is well-scoped for a multi-agent contract queue. Every tool maps to a necessary lifecycle action or diagnostic check, with no redundant or filler operations. The surface is neither too thin nor bloated.

Completeness4/5

The lifecycle is nearly complete: create, claim, renew, release, verify, complete, fail, and inspect all exist with terminal state handling. Minor gaps remain, such as a requester-side cancel/revoke for a SUBMITTED contract before it is claimed, and cleanup/maintenance operations. These can be worked around via TTL expiry but are noticeable omissions.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    C
    quality
    C
    maintenance
    Enables coding agents to coordinate around shared project context, durable tasks, messages, artifacts, multimodal analysis requests, design-system checks, change proposals, and review requests through a compact MCP interface. It persists state locally in JSON and exposes tools, resources, and prompts for agent-to-agent workflows.
    9
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    Enables Claude and Codex agents to delegate implementation, testing, research, or review tasks to each other through local MCP tools, while supporting persistent sessions, isolated editing workspaces, and reviewed integration. It also allows progress tracking, cancellation, model selection, and management handoff between providers.
    2
    MIT