Skip to main content
Glama

aziel-runtime

Aziel Runtime (aziel-runtime) is not merely an API orchestrator or software aggregator; it is a node-meshed orchestration suite of MCP-connected software designed to coordinate specialized tools through a shared, security-gated runtime while preserving provenance, chain-of-custody, temporal integrity, and auditable execution. It functions as a digital forensic, investigative, verification, research, intelligence-support, and systems-auditing environment in which individual engines can analyze evidence, validate records, inspect trajectories and patterns, track lineage, enforce capability boundaries, generate receipts, and exchange structured results without collapsing into one opaque model or unrestricted control plane. Its architecture emphasizes compartmentalization, deterministic routing, explicit refusal states, append-only evidence handling, and machine-readable metadata, making it suitable for distributed analysis workflows where trust, reproducibility, attribution, and post-hoc auditability matter as much as the result itself.

FragGate is THE single public executable door (fraggate_listfraggate_describefraggate_call). Softwares catalog is Plain → Gate → Lock; hubs refresh from GET /v1/software. Dual-surface: agents via OpenAPI/MCP; humans via Worker UI + counted /download. NodeMesh / QNM read-only suite-presence is ON by default; GET /v1/mesh never enables radios beyond that; not a login mesh / VPN / Node Gate.

Version 2.0.0-rc1 is the certification-point freeze (not a feature dump): public contract, clean-room reproducibility, and external adversarial pack under docs/2.0/. No intentional behavioral breaks from 1.9.3. Remain-OFF untouched. Crawler surfaces keep the abstract above; changelog stays below. 1.9.3 closed remaining AZRT-1.9-GAPS-CLOSE items (isolate AZ-OS ethics session VFS; isolate-safe Ask Jeeves; binding-gated media-run; published independent-validation attestation path — not a third-party lab). 1.9.2 bound Browser Rendering and live D1 MASTER. 1.9.1 closed AZRT-1.9-GAPS-CLOSE isolate-safe verify. 1.9.0 closed AZRT-1.9-CLOSE-1.0. 1.7.11 is the SEO-clarity heritage that locked that lead copy.

Kernel: AzielEliab/fraggate (FG-0.1)

Try on Glama is the primary Install Server / MCP distribution door. Worker origin stays the execution / OpenAPI surface.

Entity graph (locked): Person @id https://www.azieleliab.com/#aziel · Runtime SoftwareApplication @id https://www.azieleliab.com/runtime#runtime. Worker origin is the execution endpoint / relatedLink, not the identity hub. Identity Aziel Eliab only.

open → policy → exec(slug, op, payload) → receipt → close

Agents should not narrate that chain. Prefer fraggate_listfraggate_describefraggate_call { name, op, payload }. Hubs/clients: GET /v1/software.

1.3.0 vendored portable engines (ark, azai Lamb check, azclce, decisiongate, foldlock, zsolver) and ran them in this isolate.

1.2.0 was a session/receipt runtime: exec still upstreamFetched product Workers. Those receipts were not “this process ran FoldLock.”

1.1.0 was catalog + pull + proxy that started calling itself a runtime. Those front doors stay. They are not exec.

For every catalog slug session exec loads a vendored module, computes engine_digest = SHA-256 of that artifact’s bytes, runs the primary compute op inside this Worker isolate (the jail) or a local CLI jail, wipes scratch buffers, and the receipt includes engine_digest, engine_slug, engine_op, ran_in. GET /v1/health engine_slugs equals true_engine_slugs. Ops that literally cannot run without product-Worker bindings (KV / D1 / AI / live media) stay honest per-op proxy_fallback — the slug itself remains a true engine.

Cloudflare’s Worker / Durable Object isolate is the jail. No extra guest isolate is claimed. engine_digest is still required.

Hosted / in-process AZAI is still protocol mirror + Lamb check, not the local blend (azai serve).

Any OpenAPI-, MCP-, or HTTP-tool-capable assistant imports this OpenAPI file — then use fraggate_call. Session tools and runtime_run are advanced/internal. /p/{slug}/{op} is proxy only and is not the agent default path.

Author: Aziel Eliab
Identity: Aziel Eliab (primary). Also known as Aziel Elroi Eliab (alternateName / aka only).
License: Apache-2.0
Version: 2.0.0-rc1
2.0 pack: docs/2.0/ (contract freeze; self-test ≠ third-party lab)
Role: engine-runtime (layer: catalog+pull+proxy+session+in-process-engines+fraggate)
Door: fraggate
Worker: aziel-runtimehttps://aziel-runtime.vibelock.workers.dev/
Library front door: https://www.azielcorpuslibrary.net/runtime
Rose-star brand mark: https://aziel-runtime.vibelock.workers.dev/sigil.png
Packaging: Worker session + in-repo CLI (node cli/aziel-runtime.mjs) + stdio MCP (node cli/mcp-stdio.mjs / npm run mcp). No counted runtime tarball.

Forks are welcome and always allowed. Do not invent Zenodo DOIs.

Compatible AI clients

Assistants / clients that can call OpenAPI, MCP, or HTTP tools:

  • ChatGPT (GPT Actions / OpenAI)

  • Grok (xAI)

  • Venice

  • Claude (Anthropic Desktop / custom tools)

  • Cursor (MCP)

  • Glama (Install Server / MCP)

  • Perplexity

  • Microsoft Copilot / Bing

  • Google Gemini / Vertex AI

  • Mistral

  • Meta AI

  • Apple Intelligence / Applebot surfaces

  • Amazon Q / Amazonbot tooling

  • DuckAssist / DuckDuckGo AI

  • You.com

  • Cohere

  • plus other MCP/OpenAPI-capable assistants

Practical Add-to steps below cover ChatGPT, Grok, Venice, Claude Desktop, and Glama / Cursor MCP. Do not invent step-by-step for every crawler.

Crawl / SEO Allow set on robots.txt: GPTBot/ChatGPT, Venice, Grok, Google-Extended, GoogleOther, Google-CloudVertexBot, Claude(+Search/User), anthropic-ai, Perplexity(+User), bingbot, Meta-External*, Applebot(+Extended), Amazonbot, DuckDuck/DuckAssist, MistralAI-User, YouBot, CCBot, cohere-ai, cohere-training-data-crawler, Diffbot, AI2Bot(+Dolma), Timpibot, Petalbot, Bytespider, Omgili(+bot), FirecrawlAgent, ImagesiftBot, Cloudflare-AI-Search, FacebookBot, TikTokSpider, Baiduspider*, Yandex.

GitHub About (description / homepage / topics) is documented in docs/GITHUB.md so Google + AI indexes see MCP, OpenAPI, FragGate, and digital forensics. Coordinator applies gh repo edit from that lock.

Related MCP server: Relay

Websites / Live sites

This Worker homepage stays the API / MCP / OpenAPI execution surface. Human Softwares hubs are azieleliab.com, Aziel Corpus Library, and GodLock.uk. Sister archive: He Didn't Jump. Try on Glama is the primary MCP install door.

The Worker ships a FoldLock-packed library tip (index cite + sample MASTER + About Aziel) — not the entire live corpus. Verify via FragGate foldlock/pack-verify; open via aziel-corpus/tip-pack. Honesty: docs/corpus-fold-pack.md.

Every Worker launch (homepage, /about, every /p/{slug}, HTML Softwares/describe shells) includes product-specific #hashtag parts plus the same About Aziel block. Shared partial workerLaunchHtml. Product Workers inherit About Aziel + the fold tip by copy; hashtag parts stay local. Rule: docs/WORKER-LAUNCH.md.

Glama Install Server is stdio via glama.json + Dockerfile on main. See docs/GLAMA.md.

Public identity: Aziel Eliab only. Do not invent Zenodo DOIs.

Dual surface (product law)

  1. Agent / MCP — Software runs through the agent. Show display.title / display.summary / display.fields, then take the next input. Session, OpenAPI, and HTTP plumbing stay invisible unless asked for. One door — discover, route, refuse. Download via GET /v1/update/checkdownload_url or GET /v1/pull/{slug}. Mesh-resident azcorpus + azlibrary website designs download from GET /v1/software website_designs (open for all AI clients). Upload/ingest/receipt via fraggate_call (azbrowser airlock_ingest, peacelock upload_envelope, forgereceipts verify, miragegrid verify-receipt / bridge). azlibrary upload is API token only — never embed the secret. Same ops on /openapi.json.

  2. Human software — This Worker UI, local install, and counted /download remain complete developed software. Flutter mobile/ is not vendored in this repo.

Cold multi-shelf (COLD-MULTI-SHELF-1.0)

Runtime cites the same honesty as live corpus GET /shelves (corpus#96). GET /shelves · GET /v1/shelves · /cite.json shelves. Person @id https://www.azieleliab.com/#aziel.

Plane A LIVE: 5 published surfaces (4 CF hubs + GitHub) / 2 family radii. One independent live (cf-github). Plane B SLOT: Codeberg https://codeberg.org/AzielEliab/aziel-lockset-tip hash-verify PASS still SLOT; archive.org PASS https://archive.org/details/aziel-lockset-tip + https://archive.org/details/aziel-lockset-tip_202609 (same blast_radius archive-org; pack b549362c0736ddb54ddc488812327c464e0da1167281f92fd1a4263eedf5df37) still SLOT; Framagit URL null (third ALL-TARGETS); GitFlic refused (CNS-GITFLIC-EMAIL); GitLab refused (CNS-GITLAB-CF-LOOP); Zenodo refused (CNS-ZENODO-IP-BAN); doi null. Plane C USB SLOT until CNS-OPERATOR-ATTEST. This Worker is the same Plane A tunnel — not a sixth surface. No visible 15:20.

Cap-7 semantic bridge (not ICANN)

Cap-7 mesh names are MirageGrid-only. They inherit hub designs only (including mesh-resident azcorpus + azlibrary on the library hub). design_of: hub_designs. resolves_to_hub: false. name_may_change: true. Canonical hubs are immutable. They are not aliases of the four ICANN hostnames (azieleliab.com, azielcorpuslibrary.net, godlock.uk, hedidntjump.com). Not a fifth product. AI pulls metadata from MirageGrid Worker /bridge or GET /v1/mesh/az-generator. Update shuffle: fraggate_call { slug: "miragegrid", op: "shuffle" } pings until one distinct-name Cap-7 site lands (that-round update; hosted URL SLOT; public workers.dev shuffle SLOT). public_icann: false. No live AZ-GEN registrar. No fake ICANN .az. No visible 15:20. GET /v1/mesh never enables radios. Mesh browse: AZNet + AZBrowser via FragGate. Plane A hubs mirror tips.

FragGate door

Public MCP tools/list is a thin FragGate door: runtime_skill, fraggate_list, fraggate_describe, fraggate_verify, fraggate_call, decisiongate_check, library_lookup, suite mesh_*, plus catalog helpers. runtime_run is advanced/internal.

Every catalog product is a hashed registry entry (name, slug, digest, status, public ops). Status is live | stub | local_only.

stub_ops / stub_op_count are named refuse verbs (never hosted), not extra catalog Software engines. stub_count is registry entries whose status is stub (none after 1.9.0 — AZChat is LIVE+bound). EmbryoLock is a live catalog engine (live-with-local-destructive-boundary); wipe / scorch / unlock stay FG-STUB on the public mesh. FragGate live_count + local_only_count + stub_count === FragGate product_count.

Live on the public mesh (via fraggate_call): every catalog Software product that makes sense on a public agent door — advisory / score / classify / gate / search / preview / render / verify / hash / receipt / game / overlay / route / status, plus the original five (DecisionGATE, GodLock, FoldLock, AZ-CLCE, Aziel Digital Library). VeilLock stays local_only (device-local camera/screen). MCP tools/list stays the thin FragGate surface.

Stub ops (named refuse verbs, never execute): EmbryoLock wipe/scorch/unlock/encrypt/decrypt/initialize/login, ARK scorch/wipe/unlock/encrypt, WhistleLock send/mail/release, MirageGrid VPN-hop/hop/tunnel/mesh, AzielTether mesh-join/vpn/arm, VeilLock inject/intercept/facetime, AZ-OS exec/shell/lattice, AZAI blend/complete/chat, EmployeeLock court/judge, PeaceLock transcript/transcribe/motive/counterfactual/invent/waive-duty/bypass-duty, 4DMap truth_score/lumen_panel/invent_mark/backdate_class. Safe hosted ops on those products can still be live; the stub verbs refuse forever.

Unknown names refuse FG-HALLUC-TOOL and list the tools that do exist. DecisionGATE runs before any exec side effect; refuse is a typed ResultEnvelope + ledger tip (TemporalLock-shaped hash chain). Mesh is not claimed on this public surface.

curl -s -A 'Mozilla/5.0' https://aziel-runtime.vibelock.workers.dev/v1/fraggate
curl -s -A 'Mozilla/5.0' https://aziel-runtime.vibelock.workers.dev/v1/fraggate/list
curl -s -A 'Mozilla/5.0' -X POST https://aziel-runtime.vibelock.workers.dev/v1/fraggate/call \
  -H 'content-type: application/json' \
  -d '{"slug":"foldlock","op":"fold-preview","payload":{"text":"the cat and the dog"}}'

Session (the actual cut)

SID=$(curl -s -A 'Mozilla/5.0' -X POST https://aziel-runtime.vibelock.workers.dev/v1/session/open \
  -H 'content-type: application/json' -d '{}' | jq -r .session.id)

curl -s -A 'Mozilla/5.0' -X POST https://aziel-runtime.vibelock.workers.dev/v1/session/$SID/policy \
  -H 'content-type: application/json' \
  -d '{"allow_slugs":["azclce","foldlock"],"max_payload_bytes":8192}'

curl -s -A 'Mozilla/5.0' -X POST https://aziel-runtime.vibelock.workers.dev/v1/session/$SID/exec \
  -H 'content-type: application/json' \
  -d '{"slug":"azclce","op":"score","payload":{"r":"login button blue","d":"login form submits","p":"login button submits"}}'

curl -s -A 'Mozilla/5.0' https://aziel-runtime.vibelock.workers.dev/v1/session/$SID/receipt
curl -s -A 'Mozilla/5.0' https://aziel-runtime.vibelock.workers.dev/v1/session/$SID/receipts
curl -s -A 'Mozilla/5.0' -X POST https://aziel-runtime.vibelock.workers.dev/v1/session/$SID/close

A local exec receipt includes engine_digest, engine_slug, engine_op, ran_in: "aziel-runtime", result digests, and latency — not only an upstream HTTP status. close seals the chain; further exec is HTTP 409. Sessions expire after 6h (410/auto-close). Receipt cap is 64. Session mutate may require Authorization: Bearer … or X-Aziel-Runtime-Token when RUNTIME_TOKEN is set.

Local CLI (Worker client by default; --local writes a session file and prefers vendored engines; --jail runs the engine in a child Node process):

node cli/aziel-runtime.mjs session open --local
node cli/aziel-runtime.mjs session policy --allow-slugs azclce,foldlock
node cli/aziel-runtime.mjs session exec azclce score \
  '{"r":"login button blue","d":"login form submits","p":"login button submits"}'
node cli/aziel-runtime.mjs session exec foldlock fold-preview '{"text":"the cat and the dog"}'
node cli/aziel-runtime.mjs session receipt
node cli/aziel-runtime.mjs session close

Proof script (local session log): bash scripts/demo-session.sh

Front doors (still useful — not exec)

curl -s -A 'Mozilla/5.0' https://aziel-runtime.vibelock.workers.dev/v1/skill
curl -s -A 'Mozilla/5.0' https://aziel-runtime.vibelock.workers.dev/v1/runtime.json
curl -s -A 'Mozilla/5.0' https://aziel-runtime.vibelock.workers.dev/v1/bundle
curl -s -A 'Mozilla/5.0' https://aziel-runtime.vibelock.workers.dev/v1/pull/foldlock
curl -s -A 'Mozilla/5.0' https://aziel-runtime.vibelock.workers.dev/v1/pull/foldlock/skill

Proxy (no runtime-owned receipt — not exec):

curl -s -A 'Mozilla/5.0' -X POST https://aziel-runtime.vibelock.workers.dev/p/azclce/score \
  -H 'content-type: application/json' \
  -d '{"r":"login button blue","d":"login form submits","p":"login button submits"}'

Always send User-Agent: Mozilla/5.0.

Quick URLs

What

URL

Homepage (HTML)

https://aziel-runtime.vibelock.workers.dev/

Skill

https://aziel-runtime.vibelock.workers.dev/v1/skill

FragGate door

https://aziel-runtime.vibelock.workers.dev/v1/fraggate

FragGate Worker UI + counted download

https://fraggate-download-tracker.vibelock.workers.dev/

FragGate kernel

https://github.com/AzielEliab/fraggate

Machine manifest (role=engine-runtime)

https://aziel-runtime.vibelock.workers.dev/v1/runtime.json

Session open

POST https://aziel-runtime.vibelock.workers.dev/v1/session/open

Session exec

POST https://aziel-runtime.vibelock.workers.dev/v1/session/{id}/exec

Session receipt(s)

https://aziel-runtime.vibelock.workers.dev/v1/session/{id}/receipt

Bundle

https://aziel-runtime.vibelock.workers.dev/v1/bundle

Pull one product

https://aziel-runtime.vibelock.workers.dev/v1/pull/{slug}

Pull product skill

https://aziel-runtime.vibelock.workers.dev/v1/pull/{slug}/skill

Combined OpenAPI 3.1

https://aziel-runtime.vibelock.workers.dev/openapi.json

Authoritative software catalog (hubs)

https://aziel-runtime.vibelock.workers.dev/v1/software

FragGate software mirror

https://aziel-runtime.vibelock.workers.dev/v1/fraggate/software

Client update check

https://aziel-runtime.vibelock.workers.dev/v1/update/check?slug={slug}&version={installed}

Update manifest

https://aziel-runtime.vibelock.workers.dev/v1/update/manifest

Machine catalog

https://aziel-runtime.vibelock.workers.dev/v1/catalog.json

How to cite

https://aziel-runtime.vibelock.workers.dev/cite.json

Ban / blocked-endpoint failover

https://aziel-runtime.vibelock.workers.dev/survival (aliases /v1/survival, /doors, /failover)

LLM crawler

https://aziel-runtime.vibelock.workers.dev/llms.txt (also /ai.txt)

Person (machine)

https://aziel-runtime.vibelock.workers.dev/person.jsonld

Who-is (machine)

https://aziel-runtime.vibelock.workers.dev/who-is

robots.txt

https://aziel-runtime.vibelock.workers.dev/robots.txt

sitemap.xml

https://aziel-runtime.vibelock.workers.dev/sitemap.xml

sitemap-index.xml

https://aziel-runtime.vibelock.workers.dev/sitemap-index.xml

MCP (JSON-RPC over HTTP, public, no OAuth)

POST https://aziel-runtime.vibelock.workers.dev/mcp

MCP stdio (Glama / Claude Desktop)

node cli/mcp-stdio.mjsdocs/GLAMA.md

Glama listing

https://glama.ai/mcp/servers/AzielEliab/aziel-runtime

Health

https://aziel-runtime.vibelock.workers.dev/v1/health

API uses (no increment, no PII)

https://aziel-runtime.vibelock.workers.dev/v1/uses

Stats / awareness rollup (read-only)

https://aziel-runtime.vibelock.workers.dev/v1/stats-rollups

Ready

https://aziel-runtime.vibelock.workers.dev/v1/ready

Rose-star brand mark

https://aziel-runtime.vibelock.workers.dev/sigil.png

GET /v1/pull?all=1 is an alias of /v1/bundle.

POST /p/{product}/{op} proxies to the product Worker /v1/{op} with the JSON body. Service bindings are preferred; public *.vibelock.workers.dev is the fallback. That path is a proxy, not session exec. Download counters are not incremented.

This Worker is Worker-only (no counted runtime tarball). The local CLI lives in-repo and is not a GitBaby /download package. Each product still has its own counted /download.

How to cite: Eliab, Aziel. (2026). Aziel Eliab Runtime [Software]. Apache-2.0. https://aziel-runtime.vibelock.workers.dev/

Digital Library: Eliab, Aziel. (2026). Aziel Digital Library [Software]. Apache-2.0. https://www.azielcorpuslibrary.net/

Product Worker crawl template: docs/PRODUCT_SEO.md. QNM suite rollup: docs/NODE_MESH.md. Cross-network survival umbrella: docs/designs/CROSS-NETWORK-SURVIVAL-1.0.md. Companion NO-LIE / NO-REWRITE: docs/designs/NO-LIE-NO-REWRITE-1.0.md. Donate plan (cite-only, not a Softwares product): docs/designs/AZL-DONATE-1.0.md.

Canonical rails live on hubs: https://www.azieleliab.com/donate. Hub Donate pages include five QRs that encode payment URIs (BTC / ETH / LTC / XRP / DOGE). This runtime only links. Do not invent wallet addresses or tokens. Do not duplicate those five QRs on runtime or download-trackers.

  • Runtime Worker UI footer — one line: Donatehttps://www.azieleliab.com/donate

  • Product download-tracker Workers — same footer pattern: Support the workhttps://www.azieleliab.com/donate

This repo does not own product Workers. Copy that one line into those repos. Addresses stay operator paste on the hub.

Designs

Current suite software designs (AZL / SEC-FEAT / QNM-WP / NODE-OPS / AZL-DONATE-1.0 / CROSS-NETWORK-SURVIVAL-1.0 / NO-LIE-NO-REWRITE-1.0) plus LIVE fabric papers (CL-WP-0.4, AP-WP-0.2, SG-WP-0.1, LS-WP-0.1, RL-WP-0.1-runtime, QNS-CD-1.0, ACT-RECEIPT-1.0 — not Softwares-tab products): docs/designs/. Author: Aziel Eliab only. MCP chainlock_*. GET /v1/mesh never enables. QNS-CD-1.0 is the Quantum Node Signal packet-transfer coding design (photon QNS1 1.3). Implementation is local qnsd in AzielEliab/qnm-node. GET /v1/qns cites only — the public Worker does not proxy local via emit. Every /v1/software card carries qns_cd. Do not add QNS as a Softwares-tab product. ACT-RECEIPT-1.0 is the public four-field action-receipt mesh copy. The chain lives on corpus /receipts. GET /v1/receipts cites; append runs after FragGate list/call and POST /mcp when RECEIPT_APPEND_TOKEN is set (fail-open). Do not add ACT-RECEIPT as a Softwares-tab product. CROSS-NETWORK-SURVIVAL-1.0 is the umbrella survival law. If network and data die tomorrow, the chain survives on cold shelves (hosts / DOI / git / vault). Machine tip: /cite.json survival.tip and /llms.txt. Do not add it as a Softwares-tab product. NO-LIE-NO-REWRITE-1.0 is companion law under that umbrella (does not replace the machine tip): receipts that still hash; copies not all on one tunnel; no rewrite key; the network is never allowed to lie even to self-preserve. Do not add it as a Softwares-tab product. GET /v1/azpipe/arch cites the locked MASTER-33 strip (same payload as GET /v1/fraggate pipeline). Not a Softwares-tab door.

Add to ChatGPT (GPT Actions)

  1. Create a GPT (or open GPT Actions).

  2. Import from URLhttps://aziel-runtime.vibelock.workers.dev/openapi.json

  3. No authentication. CORS *.

  4. Ask the GPT to call fraggate_list, then fraggate_call. Named live modules: decisiongate_check, library_lookup. Session tools and runtime_run are advanced/internal.

Add to Grok

  • Custom tool / OpenAPI: import https://aziel-runtime.vibelock.workers.dev/openapi.json

  • MCP remote: POST https://aziel-runtime.vibelock.workers.dev/mcp
    Methods: initialize, tools/list, tools/call.
    Default: thin FragGate door (fraggate_list, fraggate_describe, fraggate_verify, fraggate_call).
    Named live: decisiongate_check, library_lookup. Catalog/pull: runtime_skill, runtime_bundle, runtime_pull.
    Advanced/internal: runtime_run, runtime_manifest, runtime_session_*.
    Flat {product}_{op} names are not listed. HTTP /p/{product}/{op} is still a proxy (not exec). Public, no OAuth.
    Tool results are { display, result, ledger_tip? } — show display to the user.

Add to Claude Desktop

Claude Desktop claude_desktop_config.json (same shape as Cursor mcp.json):

{
  "mcpServers": {
    "aziel-runtime": {
      "command": "node",
      "args": ["cli/mcp-stdio.mjs"],
      "cwd": "/path/to/aziel-runtime",
      "env": {
        "AZIEL_RUNTIME_URL": "https://aziel-runtime.vibelock.workers.dev"
      }
    }
  }
}

Restart Claude Desktop after updating. Remote alternative: POST https://aziel-runtime.vibelock.workers.dev/mcp. Full stdio notes: docs/GLAMA.md.

Add to Glama / Cursor MCP (Install Server)

Glama hosts a stdio MCP process. HTTP POST /mcp on the Worker is not enough — without glama.json, cli/mcp-stdio.mjs, and a Dockerfile, the listing says This server cannot be installed.

node cli/mcp-stdio.mjs
npm run mcp

Default mode bridges to POST https://aziel-runtime.vibelock.workers.dev/mcp (User-Agent: Mozilla/5.0). Optional RUNTIME_TOKEN / AZIEL_RUNTIME_TOKEN. --local or AZIEL_RUNTIME_MCP=local runs the same /mcp handler in-process.

docker build -t aziel-runtime-mcp .
docker run --rm -i aziel-runtime-mcp

After merge: claim on the Glama Score tab (glama.json maintainers = AzielEliab), then admin Dockerfile → DeployMake Release so Install Server works. Build steps: npm install --omit=dev. CMD: ["node", "cli/mcp-stdio.mjs"]. Full steps: docs/GLAMA.md. Public identity: Aziel Eliab only.

Add to Venice

Custom HTTP tools / OpenAPI: import the same https://aziel-runtime.vibelock.workers.dev/openapi.json. Pull via GET /v1/bundle / GET /v1/pull/{slug}. Session exec is POST /v1/session/{id}/exec. Proxy remains POST /p/{slug}/{op}.

Honesty banners

  • Every catalog Software slug is in-process. engine_slugs equals true_engine_slugs on /v1/health and /v1/runtime.json. Binding-only ops stay per-op proxy_fallback.

  • GodLock and MirageGrid are not VPNs and not anonymity networks.

  • ForgeReceipts is not legal advice and does not contact courts.

  • ZionPattern Solver never claims more than 75% confidence. It does not solve cases.

  • VeilLock does not inject into FaceTime or any calling app. YOUR camera/screen only.

  • AZ-CLCE detects inconsistency, not intent. Type D is a label, not a finding of malice.

  • ChronoLock is advisory only — not a scheduler, not targeting, not virality. 08:30–10:30 local. Distinct from TemporalLock.

  • The ARK is not a kernel. Hosted API never unlocks or encrypts with a passphrase and never stores vaults. Sweep is Mode E heuristics only.

  • AZAI is a local OpenAI-compatible runtime, not a new foundation model. Hosted / in-process /v1 is a protocol mirror + Lamb check, not a provider proxy. Jeeves is not sovereign. Live blend is local azai serve.

  • SpectralLock hosted overlay is a 256px preview, not a spectrometer, not forensic. Inject ON is paint, not pigment recovery. UV is not a lamp. Balance/lemon/indent never invent marks. Full pipeline is the Python package.

  • EmployeeLock is not a court, not UL, not a truth score. Hosted never stores xlsx. Demo rows are format proof, not case facts.

  • FoldLock is not zip. Hosted / in-process preview is tether-suppression on small UTF-8 text. Ratios are receipts, not trophies. Short strings can grow.

  • WhistleLock is a local vault + dead-man copy. Not a mailer. Hosted never holds whistle files.

  • TrajectoryLock is a research prototype / auditable geometric test. Not a certified forensic instrument. Hosted never stores media. Match probability is P(match | declared model), not P(official account is true). Synthetic examples are not real-case findings.

  • M.I.A.Lock Doe hits are compatibility leads only — never an ID. Coverage heat is not presence. No live tracking.

  • Aziel Corpus Library is a public library index + counted PDF/package download. Not a private-file search engine, not Zenodo, not a new Lock engine.

  • AzielTether is not a VPN. Prefer-central mesh for downloaded Aziel Eliab software; public HTTPS stays mesh-free.

  • PeaceLock is chosen silence / chosen inaction as a first-class receipt (PL-WP-0.1). Not a transcript, not a counterfactual, not a motive score, not a HARD_DUTY waiver. Hosted never invents speech or stores files.

  • 4DMap is a four-axis inspection frame T/Δ/Γ/Π (4DM-WP-1.0). Not a sequential gate, not a truth score, not a Lumen panel, and not an extra door (domains_are_doors:false). Does not invent marks or backdate class. Inspection frame after AZPIPE. FragGate claims cite join types. ChainLock may stamp walks.

  • AZBrowser is the Lamb Lens ethical research browser (AZB-1.0). Not Chromium, not a Tor exit, not an unrestricted proxy. Lamb Lens cites; refuses harmful harvest; never invents visit results. FragGate only. AZNet is separate software (same FragGate door) — pairing is order/token only, not a shared Phase-1 UI.

  • AZNet is a silent verification side-net (AZN-WP-0.1). Separate product (own Worker aznet-download-tracker, own UI). Not a payload host. Garden / stamp / memorial ops require AZBrowser pair_token AND pair_flag (functional order only). Hosted never stores payloads.

Product slugs → Workers

slug

Worker hostname

example ops

session exec

vibelock

vibelock-download-tracker

analyze

in-process (features/PCM; no live mic)

veillock

veillock-download-tracker

apps

in-process (no camera inject)

codelock

codelock-download-tracker

render

in-process

godlock

godlock-download-tracker

score, submit

in-process (not a VPN)

shadowlock

shadowlock-download-tracker

observe

in-process (no OS hook)

temporallock

temporallock-download-tracker

genesis, append, verify

in-process

forgereceipts

forgereceipts-download-tracker

receipt

in-process (not legal advice)

decisiongate

decisiongate-download-tracker

check

in-process

zsolver

zsolver-download-tracker

patterns, score, session

in-process

azos

azos-download-tracker

status

in-process (session/exec/lattice per-op proxy)

glossafilter

glossafilter-download-tracker

render

in-process

miragegrid

miragegrid-download-tracker

assign

in-process (control-plane; not a hosted VPN hop)

staticclock

staticclock-download-tracker

advise

in-process

chronolock

chronolock-download-tracker

advisory, anchors

in-process

postking

postking-download-tracker

new, move, status

in-process

azclce

azclce-download-tracker

score, classify, gate

in-process

ark

ark-download-tracker

sweep, levels

in-process

azai

azai-download-tracker

health, lamb-check

in-process (Lamb only; not the blend)

spectrallock

spectrallock-download-tracker

health, modes, overlay

in-process (256px PNG preview; inject ON/OFF)

azbot

azbot-download-tracker

health, skill, route

in-process (skill router, not a model)

employeelock

employeelock-download-tracker

health, append-preview, verify-canonical, skill

in-process (no xlsx store)

foldlock

foldlock-download-tracker

health, fold-preview, unfold-preview, skill

in-process

whistlelock

whistlelock-download-tracker

health, hash-preview, canon-preview, skill

in-process (no file store)

trajectorylock

trajectorylock-download-tracker

health, example, analyze, skill

in-process (geometry; no media store)

mialock

mialock-download-tracker

map, search-options, queries, doe-match, coverage

in-process (leads ≠ ID)

azieltether

azieltether-download-tracker

health, skill, verify

in-process (not a VPN)

peacelock

peacelock-download-tracker

open, seal, break, show, verify, stamp

in-process (HARD_DUTY refuse; ABSENT invariants)

azmail

azmail-download-tracker

airlock_classify, scrub, trust_score, mesh_*, keyword_alert_*

in-process (FragGate only; mesh default off; not an MTA)

azbrowser

azbrowser-download-tracker

ethical_search, lamb_lens_search, navigate, airlock_ingest, tab_*, receipt_list, verify

in-process (FragGate only; Lamb Lens; not Chromium)

aznet

aznet-download-tracker

pair_status, garden_list, stamp, verify_hash, memorial_*, receipt_verify

in-process (FragGate only; never hosts payloads; AZBrowser pair required)

azhub

azhub-download-tracker

region_list, place_module, remove_module, tether_*, blank_key_status

in-process (FragGate only; Blank Key; not AZInterface; no auto-unlock)

azinterface

azinterface-download-tracker

genesis_status, site_state_*, integrity_check, witness_list, page_cycle_status

in-process (FragGate only; pre-locked page cycles; not AZHub)

aziel-corpus

aziel-corpus-download-tracker (www.azielcorpuslibrary.net)

health, search, example, skill

in-process (sample MASTER; live D1/Whisper/OCR per-op proxy)

4dmap

4dmap-download-tracker

health, skill, pin, span, stack, gap, fork, walk, lens, class, cohort, absence, cap, join, list, example, card_new, card_pin, card_span, card_join, card_walk, card_list, verify_hash, frame_status, axis_describe, walk_trace, card_export, card_import, verify_chain, neighbor_cite

in-process (4DM-WP-1.0 / 0.2.0; inspection frame after AZPIPE; not an extra door; not a sequential gate)

Catalog aliases (also accepted on /v1/pull/{slug}): az-clce → azclce, zion-pattern-solver → zsolver, postking-chess → postking, aziel-digital-library → aziel-corpus, mia-lock → mialock, peace-lock → peacelock, az-mail / app-1.0 → azmail, az-browser / lamb-lens → azbrowser, az-net / azn-wp-0.1 → aznet, az-hub / blank-key → azhub, az-interface / page-cycle → azinterface. aznet is not an AZBrowser alias — AZNet is separate software (same FragGate door). fourdmap / 4d-map / 4dm-wp-1.0 → 4dmap. AZHub and AZInterface are sibling softwares under the same FragGate door (never aliases of each other).

Software hubs (corpus / godlock.uk / azieleliab) list catalog products[] after merge: slug azhub / azinterface / aznet / azbrowser, workers azhub-download-tracker / azinterface-download-tracker / aznet-download-tracker / azbrowser-download-tracker, github https://github.com/AzielEliab/azhub · https://github.com/AzielEliab/azinterface · https://github.com/AzielEliab/aznet · https://github.com/AzielEliab/azbrowser. AZHub, AZInterface, AZNet, and AZBrowser are separate products (own Workers, own UIs; never nested). Pairing AZNet with AZBrowser is functional order only. FragGate itself is not a 34th true-engine product. Hubs already show its GitHub; this runtime also publishes a catalog-friendly kernel card at catalog.json extras[] / fraggate (slug: "fraggate", kind: "kernel", github: "https://github.com/AzielEliab/fraggate", worker: "fraggate-download-tracker", engine: false). FragGate is the kernel door; human UI + counted download is the separate FragGate Worker app (not nested in AZBrowser, AZHub, or AZInterface): https://fraggate-download-tracker.vibelock.workers.dev/

If a sibling /v1 API is not live yet, the proxy returns that Worker's response (often 404 JSON) and the combined OpenAPI still lists the expected path. GET /v1/pull/{slug}/skill falls back to a catalog-built skill so an AI can still invoke.

Vendored engine artifacts live under src/engines/. engine_digest is SHA-256 of those file bytes (sorted path order). Recompute with node scripts/hash-engines.mjs --write.

Deploy

npx wrangler deploy

Account ac575a9b822bea2bed97d0ab73aed238. workers.dev aziel-runtime.vibelock.workers.dev. Product download KV stays on each product Worker. This runtime's USES namespace is the API use counter and ring log (GET /v1/uses) — no Authorization, tokens, bodies, or PII. Production KV ids in wrangler.toml: USES c1f89ba6f1db47328d36379cdd69b7ab, AZMAIL_MESH ce81cecf8b75412fb7b56e1119e017da, AZBROWSER_TABS 7487aba1bbb5417fb668de86d8b48f37. Do not create replacement namespaces.

Same-origin doors (/runtime on azielcorpuslibrary.net, godlock.uk, www.azieleliab.com) should set X-Aziel-Runtime-Via or X-Aziel-Runtime-Host (origin, azieleliab.com, godlock.uk, azielcorpuslibrary.net) so host counters stay distinct.

1.2.0+ requires Durable Object migration tag v1 (RuntimeSession, SQLite). The first deploy after the session cut creates the SESSION binding. 1.4.0 does not need a new DO migration — engines run in the same isolate. 1.4.1 reuses that SESSION class. 1.5.0, 1.6.0, 1.6.1, 1.6.2, 1.6.3, 1.6.4, 1.6.5, 1.6.6, 1.6.7, 1.6.8, 1.6.9, 1.6.10, 1.6.11, 1.6.12, 1.6.13, 1.6.14, 1.6.15, and 1.7.0 do not need a new DO migration.

Optional production token (session mutate only — catalog / health / runtime / skill / pull stay public):

# wrangler.toml
# [vars]
# REQUIRE_TOKEN = "1"
npx wrangler secret put RUNTIME_TOKEN
npx wrangler deploy
node scripts/probe-live.mjs

If RUNTIME_TOKEN is unset and REQUIRE_TOKEN is not 1, sessions stay open (dev). If the secret is set, POST /v1/session/open|policy|exec|close requires Authorization: Bearer … or X-Aziel-Runtime-Token. GET /v1/ready is 200 only when the SESSION Durable Object binding is up, and 503 when REQUIRE_TOKEN=1 and the secret is missing. Authority JSON (/v1/health, /v1/ready, /v1/runtime.json, /v1/catalog.json) is Cache-Control: no-store. Receipts cap at 64. Sessions expire after 6h. Per-IP: 20 opens / minute, 60 execs / minute (HTTP 429 JSON).

Push to main runs .github/workflows/deploy.yml (npx wrangler deploy) only when repo secret CLOUDFLARE_API_TOKEN is set. Missing token skips the job (does not fail). Primary deploy is Cursor/wrangler OAuth (Aziel Eliab). Account ac575a9b822bea2bed97d0ab73aed238 is the non-secret default. Do not put tokens in the repo. workflow_dispatch is also enabled. The Action passes GIT_SHA so /v1/software can stamp git_sha.

If this checkout has no wrangler credentials, deploy from the author's machine:

npx wrangler secret put RUNTIME_TOKEN
npx wrangler deploy
node scripts/probe-live.mjs
# confirm GET /v1/health and /v1/ready and /v1/runtime.json version=1.7.0 role=engine-runtime door=fraggate
# confirm GET /v1/uses returns uses / by_host / by_path / by_day / recent (no increment)
# confirm engine_slugs == true_engine_slugs == all 36 catalog slugs
# confirm POST /v1/session/open → policy → exec each primary op → receipt has engine_digest + ran_in

Library /runtime

https://www.azielcorpuslibrary.net/runtime is the Aziel Digital Library front door that points here. After this runtime ships pull APIs, the corpus Worker should advertise and reverse-proxy:

  • GET https://www.azielcorpuslibrary.net/runtime — human front door

  • GET https://www.azielcorpuslibrary.net/runtime/v1/skill → this /v1/skill

  • GET https://www.azielcorpuslibrary.net/runtime/v1/runtime.json → this /v1/runtime.json

  • GET https://www.azielcorpuslibrary.net/runtime/v1/software → this /v1/software

  • GET https://www.azielcorpuslibrary.net/runtime/v1/update/check → this /v1/update/check

  • GET https://www.azielcorpuslibrary.net/runtime/v1/bundle → this /v1/bundle

  • GET https://www.azielcorpuslibrary.net/runtime/v1/pull/{slug} → this /v1/pull/{slug}

  • POST https://www.azielcorpuslibrary.net/runtime/v1/session/open → this session object

  • GET https://www.azielcorpuslibrary.net/runtime/v1/uses → this /v1/uses (set X-Aziel-Runtime-Via: azielcorpuslibrary.net)

  • POST https://www.azielcorpuslibrary.net/runtime/v1/fraggate/call → this FragGate door (AZMail and every live slug; no side door)

See the companion PR on AzielEliab/aziel-corpus.

License

Apache License 2.0. Copyright 2026 Aziel Eliab.

Available Tools

36 tools
chainlock_appendChainLock appendA

Append one fact-bearing stamp to a local ChainLock chain (CL-WP-0.4). Grounded write — not a tip read, not AKM observe, not a LOCKSET seal. Fabric, not Softwares-tab. No Node Gate. Use this when you have a concrete fact to stamp onto a named chain. Do not use it for reading the tip, adaptive memory observation, or sealing LOCKSET; use chainlock_tip, memory_observe, or chainlock_seal instead. Write: additive append (append-only vault; no chainlock_delete). Hash-only or empty fact refuses no-fact. Unknown roster name refuses unknown-chain. Oversized card refuses card-cap. Does not write godlock.uk. Omit c/chain to stamp the session chain. Door aliases: chain→c, s→subject, f→fact, kind→k. Omit k to store kind stamp. subject clips to 80; fact clips to 160 then refuses if still empty. Mutation requires confirm=true (runtime gate) or dry_run=true (preview only, no write). confirm and dry_run stay optional on inputSchema.required. Returns the new stamp (id, h, fh, chain, seq) plus display envelope.

ParametersJSON Schema
NameRequiredDescriptionDefault
cNoOptional chain name. One of genesis, identity, ssh, session, acts, evidence, recall, mesh, library, learn. Alias: chain. Omit both to stamp the session chain.
kNoOptional kind label. Omit to store kind stamp. Alias: kind.
factYesRequired fact text clipped to 160 characters. Empty or hash-only after clip refuses no-fact. Alias: f.
chainNoAlias of c. Omit both to stamp the session chain.
confirmNoDocumented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true (preview, no write).
dry_runNoOptional preview flag. When true, return a would-mutate preview and do not write. Alternative to confirm=true. Does not mutate.
subjectNoOptional subject clipped to 80 characters. Alias: s.

Output Schema

ParametersJSON Schema
NameRequiredDescription
codeNoFragGate or fabric code when present: FG-OK, FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-UNKNOWN-OP, FG-GATE-REFUSE, FG-LAMB-REFUSE, or a module refuse such as MESH-* / AKM-*.
doorNoDoor name. The public door is fraggate.
ran_inNoExecution locale (for example aziel-runtime) when present.
resultNoAppend body: ok, stamp (id, c, k, fact, fh, stamp_sha256, prev), card, seq, vault path. Refuses: no-fact, unknown-chain, card-cap.
statusNoHTTP-like status when present on wrappers (200 ok; 400+ error / refuse).
displayNoHuman-facing envelope. Show title and summary, then take the next input.
receiptNoOptional receipt, ledger tip, or TemporalLock/ForgeReceipts exit when the door stamped one.
refusalNoExplicit refuse object, code, or message when the door or engine refused.
engine_opNoResolved engine op when present (often inside result).
ledger_tipNoAsk/refuse ledger tip when the door stamped one.
provenanceNoProvenance / input packet when the pipeline attached one.
session_idNoRaw session id when session plumbing was used. Hidden unless the user asked for the chain.
engine_slugNoResolved engine slug when present (often inside result).
limitationsNoCapability limitations or Remain-OFF notes when present.
engine_digestNo64-hex engine_digest when a true in-process engine ran (often inside result).

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only state non-read-only, non-idempotent, non-destructive. The description adds far more: append-only behavior ('no chainlock_delete'), refusal cases ('Hash-only or empty fact refuses no-fact', 'Unknown roster name refuses unknown-chain', 'Oversized card refuses card-cap'), the 'Does not write godlock.uk' constraint, and the confirm/dry_run mutation gate. This is rich behavioral disclosure beyond structured data.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Dense but purposeful; each sentence carries a distinct behavior, refusal rule, or routing decision. The core operation is front-loaded in the first sentence. Minor redundancy with schema descriptions (e.g., 'Omit c/chain' appears in both) costs a small deduction, but the overall density is justified for a 7-param mutation tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers environment context ('local ChainLock chain', 'Fabric, not Softwares-tab. No Node Gate'), all validation outcomes, alias handling, the mutation gate, and the return envelope (id, h, fh, chain, seq). With an output schema present, nothing an agent needs to invoke correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds substantial meaning: alias mapping (chain→c, s→subject, f→fact, kind→k), clipping thresholds (subject to 80, fact to 160), the 'omit k to store kind stamp' convention, and the confirm/dry_run contract ('tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true'). These details are absent from the schema alone.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States the specific operation and resource: 'Append one fact-bearing stamp to a local ChainLock chain (CL-WP-0.4).' It explicitly excludes sibling operations: 'not a tip read, not AKM observe, not a LOCKSET seal.' The version spec and exclusions leave no ambiguity about what this tool does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives an explicit trigger: 'Use this when you have a concrete fact to stamp onto a named chain.' It then names the non-uses and alternatives directly: 'Do not use it for reading the tip, adaptive memory observation, or sealing LOCKSET; use chainlock_tip, memory_observe, or chainlock_seal instead.' No inference is required.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

chainlock_recallChainLock recallA
Read-onlyIdempotent

Grounded ChainLock recall at depth 0–5 (id+h+fh facts or refuse=no-stamp). Stamped vault facts — not Bayesian rank and not tip-only. Use this when you need stamped facts from the local vault, not a Bayesian ranking. Do not use it for adaptive memory ranking or reading only the live tip; use memory_recall or chainlock_tip instead. Depth above 5 is clipped to 5. refuse=no-stamp when empty — do not invent a fact. Append-only; there is no chainlock_delete. Omit depth to use 1 (not 0). 0 = tip only; 5 = full chain / genesis budget. Omit c/chain to scan session+acts+recall+learn (not the whole roster). q/query is a case-insensitive subject/fact substring; empty q does not invent cards. Returns grounded facts (id, h, fh) or refuse=no-stamp.

ParametersJSON Schema
NameRequiredDescriptionDefault
cNoOptional chain name. One of genesis, identity, ssh, session, acts, evidence, recall, mesh, library, learn. Alias: chain. Omit both to scan session, acts, recall, and learn — not the full roster.
qNoOptional case-insensitive substring over subject/fact. Alias: query. Empty does not invent matches.
chainNoAlias of c. Omit both to scan session, acts, recall, and learn — not the full roster.
depthNoOptional recall depth. Omit for 1. 0 = tip only; 5 = genesis/budget maximum. Values outside 0–5 are clipped. Alias: d.

Output Schema

ParametersJSON Schema
NameRequiredDescription
codeNoFragGate or fabric code when present: FG-OK, FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-UNKNOWN-OP, FG-GATE-REFUSE, FG-LAMB-REFUSE, or a module refuse such as MESH-* / AKM-*.
doorNoDoor name. The public door is fraggate.
ran_inNoExecution locale (for example aziel-runtime) when present.
resultNoFragGate body: ok, code, door, slug, op, engine_digest, ran_in, provenance, refusal, limitations, receipt, plus the engine result. Unknown names refuse FG-HALLUC-TOOL; stubs refuse FG-STUB.
statusNoHTTP-like status when present on wrappers (200 ok; 400+ error / refuse).
displayNoHuman-facing envelope. Show title and summary, then take the next input.
receiptNoOptional receipt, ledger tip, or TemporalLock/ForgeReceipts exit when the door stamped one.
refusalNoExplicit refuse object, code, or message when the door or engine refused.
engine_opNoResolved engine op when present (often inside result).
ledger_tipNoAsk/refuse ledger tip when the door stamped one.
provenanceNoProvenance / input packet when the pipeline attached one.
session_idNoRaw session id when session plumbing was used. Hidden unless the user asked for the chain.
engine_slugNoResolved engine slug when present (often inside result).
limitationsNoCapability limitations or Remain-OFF notes when present.
engine_digestNo64-hex engine_digest when a true in-process engine ran (often inside result).

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare readOnly/idempotent/non-destructive, and the description adds behavior beyond them: depth above 5 is clipped, empty results return refuse=no-stamp rather than fabricated facts, the store is append-only with no delete counterpart, and the default depth/chain-scan scope is spelled out. The empty-result and clipping semantics are exactly the kind of non-obvious behavior an agent needs.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with purpose then scope, alternatives, then parameter defaults. It is dense and slightly run-on with many dashes and clauses, but nearly every sentence carries a distinct constraint rather than filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return-shape explanation is not required; the description nonetheless covers defaults, clipping, empty-result behavior, and chain-scan scope. For a 4-param, fully-optional read tool, nothing needed to call it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the schema already documents defaults, aliases, clipping, and the 0/5 meaning of depth, so the description's restatement of these earns little. It does frame the depth range semantically (tip only vs full chain/genesis budget), but that is largely duplicative of the schema text; baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource with scope ('Grounded ChainLock recall at depth 0–5') and explicitly contrasts itself with the two nearest siblings: it is not 'Bayesian rank' and not 'tip-only'. An agent can distinguish it from memory_recall and chainlock_tip without opening either schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit when-to-use ('when you need stamped facts from the local vault') and when-not (adaptive memory ranking, reading only the live tip), naming the alternative tools to use instead. This is the full when/when-not/alternatives pattern.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

chainlock_sealLOCKSET sealA

Write a new local LOCKSET over live chain tips (members {c,id,h,fh} + TemporalLock + GodLock cite, LS-WP-0.1). Not a raw-session close and not verify-only. Use this when the operator wants a new local lockset over current tips. Do not use it for verify-only, appending one fact, writing godlock.uk, or sealing a raw runtime session; use chainlock_verify, chainlock_append, or runtime_session_close instead. Write: replaces receipts/LOCKSET.json. Empty vault (no live tip on any roster chain) refuses empty-vault. Empty chains are omitted from members, not invented. Runtime cites godlock.uk and does not write the public ledger — the operator posts lockset_sha256. A later seal overwrites the previous local lockset. Empty {} still attempts the seal. Omit ts so TemporalLock stamps now. Passing ts labels that receipt only and never backdates seal authority or prior stamps. Mutation requires confirm=true (runtime gate) or dry_run=true (preview only, no write). confirm and dry_run stay optional on inputSchema.required. Returns lockset document (members, temporal, godlock cite) and lockset_sha256.

ParametersJSON Schema
NameRequiredDescriptionDefault
tsNoOptional ISO-8601 timestamp copied onto the TemporalLock block. Omit to use now. Never backdates authority, prior stamps, or godlock.uk.
confirmNoDocumented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true (preview, no write).
dry_runNoOptional preview flag. When true, return a would-mutate preview and do not write. Alternative to confirm=true. Does not mutate.

Output Schema

ParametersJSON Schema
NameRequiredDescription
codeNoFragGate or fabric code when present: FG-OK, FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-UNKNOWN-OP, FG-GATE-REFUSE, FG-LAMB-REFUSE, or a module refuse such as MESH-* / AKM-*.
doorNoDoor name. The public door is fraggate.
ran_inNoExecution locale (for example aziel-runtime) when present.
resultNoSeal body: ok, lockset (members, temporal, godlock, lockset_sha256), or refuse empty-vault when no live tips exist. Does not write godlock.uk.
statusNoHTTP-like status when present on wrappers (200 ok; 400+ error / refuse).
displayNoHuman-facing envelope. Show title and summary, then take the next input.
receiptNoOptional receipt, ledger tip, or TemporalLock/ForgeReceipts exit when the door stamped one.
refusalNoExplicit refuse object, code, or message when the door or engine refused.
engine_opNoResolved engine op when present (often inside result).
ledger_tipNoAsk/refuse ledger tip when the door stamped one.
provenanceNoProvenance / input packet when the pipeline attached one.
session_idNoRaw session id when session plumbing was used. Hidden unless the user asked for the chain.
engine_slugNoResolved engine slug when present (often inside result).
limitationsNoCapability limitations or Remain-OFF notes when present.
engine_digestNo64-hex engine_digest when a true in-process engine ran (often inside result).

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description goes far beyond the annotations, disclosing that the tool overwrites the previous local lockset, refuses empty-vault, omits empty chains, does not write the public ledger, requires confirm=true or dry_run=true for mutation, and that ts never backdates authority. These are substantive behavioral details not implied by readOnlyHint=false or destructiveHint=false.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but every sentence carries distinct, necessary information. It is front-loaded with the core action, then alternatives, then behavioral edge cases and parameter semantics. No filler or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a mutating tool with three optional params, the description covers mutation gating, side effects, edge cases, alternatives, and timestamp semantics. With an output schema provided, no additional return-value detail is needed. The description is fully adequate for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Although input schema coverage is 100%, the description adds meaningful parameter semantics: ts is described as receipt-only metadata that does not backdate, confirm and dry_run are explained as alternative gates, and their optionality in inputSchema.required is explicitly addressed. This materially helps an agent choose correct parameter values.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Write a new local LOCKSET over live chain tips', and immediately distinguishes it from 'raw-session close' and 'verify-only'. It also names the artifact it writes (receipts/LOCKSET.json), making the tool's purpose unmistakable and distinct from sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives an explicit when-to-use condition ('when the operator wants a new local lockset over current tips') and a clear when-not-to-use list, naming exact alternatives: chainlock_verify, chainlock_append, and runtime_session_close. This is exemplary usage guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

chainlock_tipChainLock tipA
Read-onlyIdempotent

Read only the live tip card of one local ChainLock chain — not depth recall and not LOCKSET verify. Use this when you need the current tip of a named chain. Do not use it for depth-0–5 grounded recall, LOCKSET verify, or adaptive memory explain; use chainlock_recall, chainlock_verify, or memory_get instead. Does not invent a missing tip. An empty chain returns ok with tip=null and empty=true (not a refuse). Fabric module — not a Softwares-tab product. Omit c/chain to read the session chain tip (not the full vault). chain is an alias of c. This is one card, not depth recall. Returns the tip card (id, h, fh) or tip=null / empty=true when that chain has no stamp.

ParametersJSON Schema
NameRequiredDescriptionDefault
cNoOptional chain name. One of genesis, identity, ssh, session, acts, evidence, recall, mesh, library, learn. Alias: chain. Omit both to read the session chain tip.
chainNoAlias of c. Omit both to read the session chain tip.

Output Schema

ParametersJSON Schema
NameRequiredDescription
codeNoFragGate or fabric code when present: FG-OK, FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-UNKNOWN-OP, FG-GATE-REFUSE, FG-LAMB-REFUSE, or a module refuse such as MESH-* / AKM-*.
doorNoDoor name. The public door is fraggate.
ran_inNoExecution locale (for example aziel-runtime) when present.
resultNoTip body: ok, chain, tip card or null, empty flag, seq when a stamp exists. Empty chain is ok+empty, not an invented card.
statusNoHTTP-like status when present on wrappers (200 ok; 400+ error / refuse).
displayNoHuman-facing envelope. Show title and summary, then take the next input.
receiptNoOptional receipt, ledger tip, or TemporalLock/ForgeReceipts exit when the door stamped one.
refusalNoExplicit refuse object, code, or message when the door or engine refused.
engine_opNoResolved engine op when present (often inside result).
ledger_tipNoAsk/refuse ledger tip when the door stamped one.
provenanceNoProvenance / input packet when the pipeline attached one.
session_idNoRaw session id when session plumbing was used. Hidden unless the user asked for the chain.
engine_slugNoResolved engine slug when present (often inside result).
limitationsNoCapability limitations or Remain-OFF notes when present.
engine_digestNo64-hex engine_digest when a true in-process engine ran (often inside result).

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, non-destructive, non-openWorld. The description adds valuable behavior beyond that: empty chains return ok with tip=null and empty=true rather than a refusal, it does not invent a missing tip, and it discloses that it is a Fabric module and only reads a single card (not full depth recall). These are meaningful edge-case disclosures not available in annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The core routing information is front-loaded, but the description is repetitive: it states 'not depth recall' twice, and mentions 'tip card' / 'one card' multiple times. It is longer than necessary to convey the same content, hurting conciseness without losing correctness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only, zero-required-param tool with an output schema already present, the description covers the key edge cases (empty chain, no invention, Fabric module nature) and routing. Return values needn't be explained since an output schema exists, and safety is covered by annotations. Nearly complete, with minor redundancy.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with both params enumerated and described, including the alias relationship and the omit-both default. The description repeats the alias and omit-default facts but adds no new syntax or format details beyond the schema. Baseline 3 is appropriate when the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource: 'Read only the live tip card of one local ChainLock chain.' Explicitly distinguishes from siblings by naming chainlock_recall, chainlock_verify, and memory_get as the tools for other purposes. An agent can route correctly without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit when-to-use ('when you need the current tip of a named chain') and when-not ('Do not use it for depth-0–5 grounded recall, LOCKSET verify, or adaptive memory explain') with named alternatives for each excluded case. Also clarifies the omit-c/chain default behavior.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

chainlock_verifyChainLock / LOCKSET verifyA
Read-onlyIdempotent

Confirm fail-closed integrity of ChainLock chains and LOCKSET (LS-WP-0.1): broken prev, tip drift, missing GodLock cite. Integrity check — not a new seal. Use this when you must prove local chain integrity before trusting a recall. Do not use it for appending a stamp or sealing a new lockset; use chainlock_append or chainlock_seal instead. Cites godlock.uk; does not write the public ledger. Fail-closed — do not repair silently. Break reasons include broken-prev, stamp-hash-miss, body-hash-miss, tip-drift, missing-godlock-cite. Omit c/chain to verify every roster chain plus the stored LOCKSET. require_seal=true fails closed if no lockset is stored. Returns chain_ok, LOCKSET lattice, and per-chain verify notes.

ParametersJSON Schema
NameRequiredDescriptionDefault
cNoOptional chain name. One of genesis, identity, ssh, session, acts, evidence, recall, mesh, library, learn. Alias: chain. Omit both to verify every roster chain plus the stored LOCKSET.
chainNoAlias of c. Omit both to verify every roster chain plus the stored LOCKSET.
require_sealNoOptional. When true, fail-closed if receipts/LOCKSET.json is missing. When omitted, a stored lockset is still checked if present.

Output Schema

ParametersJSON Schema
NameRequiredDescription
codeNoFragGate or fabric code when present: FG-OK, FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-UNKNOWN-OP, FG-GATE-REFUSE, FG-LAMB-REFUSE, or a module refuse such as MESH-* / AKM-*.
doorNoDoor name. The public door is fraggate.
ran_inNoExecution locale (for example aziel-runtime) when present.
resultNoFragGate body: ok, code, door, slug, op, engine_digest, ran_in, provenance, refusal, limitations, receipt, plus the engine result. Unknown names refuse FG-HALLUC-TOOL; stubs refuse FG-STUB.
statusNoHTTP-like status when present on wrappers (200 ok; 400+ error / refuse).
displayNoHuman-facing envelope. Show title and summary, then take the next input.
receiptNoOptional receipt, ledger tip, or TemporalLock/ForgeReceipts exit when the door stamped one.
refusalNoExplicit refuse object, code, or message when the door or engine refused.
engine_opNoResolved engine op when present (often inside result).
ledger_tipNoAsk/refuse ledger tip when the door stamped one.
provenanceNoProvenance / input packet when the pipeline attached one.
session_idNoRaw session id when session plumbing was used. Hidden unless the user asked for the chain.
engine_slugNoResolved engine slug when present (often inside result).
limitationsNoCapability limitations or Remain-OFF notes when present.
engine_digestNo64-hex engine_digest when a true in-process engine ran (often inside result).

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover read-only/idempotent safety, but the description adds rich traits beyond them: fail-closed semantics, 'do not repair silently', the enumerated break reasons (broken-prev, stamp-hash-miss, tip-drift, missing-godlock-cite), non-writing of the public ledger, and the require_seal failure behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Dense but front-loaded, with the integrity-check purpose stated first and routing guidance next. Minor redundancy ('Fail-closed' is stated twice and return values are listed despite an output schema) keeps it short of a 5.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given a mutation-adjacent integrity tool with full schema coverage, annotations, and an output schema, the description covers purpose, routing, failure modes, and scope (local only, no ledger writes) completely. Nothing needed to invoke it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%; the enum chain names and the require_seal semantics are already documented in the schema. The description restates the omit-to-verify-all behavior and require_seal fail-closed rule but adds no syntax or format detail beyond what the schema provides, so the baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Specific verb (confirm/verify) plus resource (ChainLock chains and LOCKSET), and it explicitly states what it is not: 'Integrity check — not a new seal.' It names its siblings chainlock_append and chainlock_seal, so an agent can distinguish it without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit when-to-use ('when you must prove local chain integrity before trusting a recall'), explicit when-not ('Do not use it for appending a stamp or sealing a new lockset'), and named alternatives (chainlock_append, chainlock_seal). Nothing is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

decisiongate_checkRun DecisionGATE on a proposalA

Run the named DecisionGATE five sequential gates on a proposal (Freedom without clarity is chaos) without executing a catalog product. Also runs automatically inside fraggate_call before exec. Use this when you want a gate check without executing a catalog product verb. Do not use it for executing a product op or searching the library; use fraggate_call or library_lookup instead. Write: appends an ask/refuse ledger tip (not idempotent). Empty {} still runs the five gates and stamps the ledger. Does not execute domain software. Named wrapper — same DecisionGATE kernel; not the full MASTER-33 hop list; Softwares exec stays fraggate_call. All proposal fields are optional. Missing evidence can fail a gate. accountable identity on this runtime is Aziel Eliab only. Mutation requires confirm=true (runtime gate) or dry_run=true (preview only, no write). confirm and dry_run stay optional on inputSchema.required. Returns gate view, final_state, ledger_tip, and result (code FG-OK on the named module wrapper).

ParametersJSON Schema
NameRequiredDescriptionDefault
valuesNoOptional values list.
confirmNoDocumented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true (preview, no write).
dry_runNoOptional preview flag. When true, return a would-mutate preview and do not write. Alternative to confirm=true. Does not mutate.
evidenceNoOptional evidence strings. Missing evidence can fail a gate.
statementNoOptional proposal statement to evaluate.
impact_negNoOptional negative-impact list.
impact_posNoOptional positive-impact list.
accountableNoOptional accountable party string.

Output Schema

ParametersJSON Schema
NameRequiredDescription
codeNoFragGate or fabric code when present: FG-OK, FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-UNKNOWN-OP, FG-GATE-REFUSE, FG-LAMB-REFUSE, or a module refuse such as MESH-* / AKM-*.
doorNoDoor name. The public door is fraggate.
ran_inNoExecution locale (for example aziel-runtime) when present.
resultNoFragGate body: ok, code, door, slug, op, engine_digest, ran_in, provenance, refusal, limitations, receipt, plus the engine result. Unknown names refuse FG-HALLUC-TOOL; stubs refuse FG-STUB.
statusNoHTTP-like status when present on wrappers (200 ok; 400+ error / refuse).
displayNoHuman-facing envelope. Show title and summary, then take the next input.
receiptNoOptional receipt, ledger tip, or TemporalLock/ForgeReceipts exit when the door stamped one.
refusalNoExplicit refuse object, code, or message when the door or engine refused.
engine_opNoResolved engine op when present (often inside result).
ledger_tipNoAsk/refuse ledger tip when the door stamped one.
provenanceNoProvenance / input packet when the pipeline attached one.
session_idNoRaw session id when session plumbing was used. Hidden unless the user asked for the chain.
engine_slugNoResolved engine slug when present (often inside result).
limitationsNoCapability limitations or Remain-OFF notes when present.
engine_digestNo64-hex engine_digest when a true in-process engine ran (often inside result).

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations are all false hints (readOnlyHint, openWorldHint, idempotentHint, destructiveHint), so the description carries the full burden. It clearly discloses that the tool writes a ledger tip ('appends an ask/refuse ledger tip (not idempotent)'), does not execute domain software, requires confirm=true or dry_run=true for mutation, and returns a specific result shape. This is rich behavioral context beyond what annotations provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense and front-loaded with the core purpose, but it is a long single paragraph that mixes gate semantics, runtime identity, ledger behavior, and module-wrapper internals. Phrases like 'Named wrapper — same DecisionGATE kernel; not the full MASTER-33 hop list; Softwares exec stays fraggate_call' add differentiating detail but are cryptic and could be trimmed or structured for better scannability.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (8 optional params, mutation guards, ledger writes, gate evaluation), the description covers all essential decision axes: when to use, when not to use, side effects, mutation requirements, and return values. An output schema exists, so the returns need not be fully spelled out, but the description still names key outputs (gate view, final_state, ledger_tip, result) and the caller identity constraint.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The schema already documents each parameter and even contains notes like 'Missing evidence can fail a gate' and the confirm/dry_run behavior. The description adds a few clarifications ('All proposal fields are optional', 'Empty {} still runs the five gates'), but these largely mirror the schema. No significant additional parameter meaning is provided.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Run the named DecisionGATE five sequential gates on a proposal' and immediately clarifies the scope ('without executing a catalog product'). It differentiates itself from siblings by explicitly naming fraggate_call and library_lookup as the alternatives for execution and search, so an agent can select this tool unambiguously.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit when-to-use and when-not-to-use guidance: 'Use this when you want a gate check without executing a catalog product verb. Do not use it for executing a product op or searching the library; use fraggate_call or library_lookup instead.' It also notes the automatic invocation inside fraggate_call, which is a valuable context signal for avoiding redundant calls.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fraggate_callStep 3 — Call through FragGateA

Execute a known catalog slug+op through the FragGate single door (CallEnvelope → FragGate → Lamb Lens → SweepGate → Sentinel → Provenance → ChainLock-IN → DecisionGATE → AZPIPE → Internal Domain Layer → optional ASE → RoseClock → TemporalLock → ChainLock-OUT → ForgeReceipts → Return). Default exec path — not discovery and not a raw session. Use this when fraggate_list and fraggate_describe already identified a live allowlisted op. Do not use it for discovering names, inspecting one capability without exec, or raw session plumbing; use fraggate_list, fraggate_describe, or (only if asked) runtime_run / runtime_session_exec instead. Side effects are operation-dependent (read, write, or refuse). May reach an open world when the target op does (for example AZBrowser ethical_search); many ops stay isolate-local. Unknown names refuse FG-HALLUC-TOOL. Stub, local-only, and Remain-OFF verbs refuse FG-STUB / FG-LOCAL-ONLY / FG-GATE-REFUSE / FG-LAMB-REFUSE. FragGate is THE single door. Required: op. Also pass slug or name. Extra top-level keys other than name/slug/product/tool/op/verb/claim/proposal/ground/payload/session_id/id become the op payload when payload is omitted. UI aliases (list_modules, place, genesis_boot, hold, airlock, home, classify, doctor, pair) forward to catalog ops. Mutation requires confirm=true (runtime gate) or dry_run=true (preview only, no write). confirm and dry_run stay optional on inputSchema.required. Returns status, result, receipt, engine_slug, engine_op, engine_digest, ran_in, provenance, refusal, and limitations. Not the full FragGate door. Empty fraggate_list is discovery (hashed LIVE_OPS). Catalog LIVE_OPS slugs (40): 4dmap, ark, azai, azbot, azbrowser, azchat, azclce, azcoherence, azhub, aziel-corpus, azieltether, azinterface, azmail, aznet, azos, azvpn, chronolock, codelock, decisiongate, embryolock, employeelock, foldlock, forgereceipts, glossafilter, godlock, mialock, miragegrid, mmconsensus, peacelock, postking, shadowlock, spectrallock, staticclock, temporallock, toolbench, trajectorylock, vibelock, whistlelock, zkattest, zsolver. Compact product-verify tokens (not a second allowlist): allowlist.azhub LIVE_OPS: health, skill, region_list, place_module, remove_module, tether_declare, tether_cut, tether_list, blank_key_status, list_modules, place. allowlist.azinterface LIVE_OPS: health, skill, genesis_status, site_state_get, site_state_set, integrity_check, witness_list, page_cycle_status, genesis_boot, hold. allowlist.azbrowser LIVE_OPS: ethical_search, lamb_lens_search, navigate, airlock_ingest, airlock, home, tab_open, tab_list, receipt_list, verify, receipt_verify, sandbox_status, sandbox_render, health, skill, vpn. allowlist.azvpn LIVE_OPS: health, skill, doctor, limitation, describe, open, status, list, close, send, recv, pull, peers, attach. allowlist.aznet LIVE_OPS: health, doctor, pair_status, pair, garden_list, stamp, verify_hash, memorial_list, memorial_append, receipt_verify, skill. UI aliases forward to catalog ops. EmbryoLock LIVE_OPS health/skill/doctor/verify-hash/policy/limitation; wipe/scorch/unlock stay FG-STUB on the public mesh.

ParametersJSON Schema
NameRequiredDescriptionDefault
opYesRequired public allowlisted op from fraggate_describe (for example fold-preview, ethical_search, blank_key_status). UI aliases (list_modules, place, genesis_boot, hold, airlock, home, classify, doctor, pair) forward to catalog ops. Unknown ops refuse FG-UNKNOWN-OP; stubs refuse FG-STUB.
nameNoOptional registry display name (for example FoldLock, EmbryoLock, AZHub). Use name or slug — one is enough. Combined name/op forms such as foldlock/fold-preview are accepted by the door parser. Unknown names refuse FG-HALLUC-TOOL.
slugNoOptional catalog slug (lowercase a-z0-9-, for example foldlock, embryolock, azhub). Alternative to name. Prefer the slug returned by fraggate_list or GET /v1/software.
claimNoOptional DecisionGATE proposal attached to this call. Also runs automatically inside the door even when omitted (defaults). Freedom without clarity is chaos.
confirmNoDocumented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true (preview, no write).
dry_runNoOptional preview flag. When true, return a would-mutate preview and do not write. Alternative to confirm=true. Does not mutate.
payloadNoOptional op payload object. Shape is engine-specific (see fraggate_describe). Malformed fields are refused by the engine, not by this door schema. If omitted, leftover top-level keys are used as the payload.

Output Schema

ParametersJSON Schema
NameRequiredDescription
codeNoFragGate or fabric code when present: FG-OK, FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-UNKNOWN-OP, FG-GATE-REFUSE, FG-LAMB-REFUSE, or a module refuse such as MESH-* / AKM-*.
doorNoDoor name. The public door is fraggate.
ran_inNoExecution locale (for example aziel-runtime) when present.
resultNoFragGate body: ok, code, door, slug, op, engine_digest, ran_in, provenance, refusal, limitations, receipt, plus the engine result. Unknown names refuse FG-HALLUC-TOOL; stubs refuse FG-STUB.
statusNoHTTP-like status when present on wrappers (200 ok; 400+ error / refuse).
displayNoHuman-facing envelope. Show title and summary, then take the next input.
receiptNoOptional receipt, ledger tip, or TemporalLock/ForgeReceipts exit when the door stamped one.
refusalNoExplicit refuse object, code, or message when the door or engine refused.
engine_opNoResolved engine op when present (often inside result).
ledger_tipNoAsk/refuse ledger tip when the door stamped one.
provenanceNoProvenance / input packet when the pipeline attached one.
session_idNoRaw session id when session plumbing was used. Hidden unless the user asked for the chain.
engine_slugNoResolved engine slug when present (often inside result).
limitationsNoCapability limitations or Remain-OFF notes when present.
engine_digestNo64-hex engine_digest when a true in-process engine ran (often inside result).

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With annotations already declaring readOnlyHint=false and openWorldHint=true, the description adds substantial context: operation-dependent side effects (read, write, or refuse), open-world reach conditional on the target op, specific refusal codes (FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-GATE-REFUSE, FG-LAMB-REFUSE), the confirm=true / dry_run=true mutation gate, and the return envelope fields. No contradiction with annotations; in fact it calibrates the openWorldHint by noting many ops stay isolate-local.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The core purpose is front-loaded, but the description is severely bloated. 'UI aliases forward to catalog ops' is stated three times in different forms, the full 40-slug catalog plus five per-product allowlists are dumped inline even though the description itself directs agents to fraggate_list for discovery, and sentences like 'Not the full FragGate door' and 'Empty fraggate_list is discovery (hashed LIVE_OPS)' are out-of-place. The 16-stage pipeline chain (CallEnvelope → FragGate → ... → Return) is opaque jargon that occupies space without actionable guidance.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex 7-parameter tool with nested objects and a mutation gate, the description is genuinely comprehensive: when to use, exclusions, side effects, refusal codes, mutation requirements, alias forwarding, and the return envelope are all covered. It falls short of 5 because the catalog dump is redundant with the tool's own discovery guidance, and the scattered asides ('Not the full FragGate door', 'Empty fraggate_list is discovery') muddy rather than clarify.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds non-obvious parameter behavior beyond the schema: the reserved top-level key list (name/slug/product/tool/op/verb/claim/proposal/ground/payload/session_id/id) with all leftover keys becoming the payload when payload is omitted, the UI-alias-to-catalog-op forwarding, and the confirm vs dry_run trade-off. The 40-slug catalog enumeration is more contextual than semantic, which keeps this from a 5.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb+resource statement: 'Execute a known catalog slug+op through the FragGate single door,' and frames it as 'Default exec path — not discovery and not a raw session.' It explicitly names the siblings it is not (fraggate_list, fraggate_describe, runtime_run, runtime_session_exec), so an agent can distinguish it without opening schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit when-to-use ('Use this when fraggate_list and fraggate_describe already identified a live allowlisted op'), when-not-to-use ('Do not use it for discovering names, inspecting one capability without exec, or raw session plumbing'), and names the exact alternatives for each excluded case. Nothing is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fraggate_describeStep 2 — Describe one registry nameA
Read-onlyIdempotent

Inspect one known FragGate card (live vs stub vs local_only, public ops, engine_digest). Not execute and not a digest-only proof. Use this when you already have a name or slug from fraggate_list or GET /v1/software. Do not use it for discovering the full registry, proving a digest, pulling a hub product card, or executing an op; use fraggate_list, fraggate_verify, runtime_pull, or fraggate_call instead. Missing both name and slug, or an unknown name, refuses FG-HALLUC-TOOL. Wipe/unlock on embryolock stay FG-STUB. AZChat is LIVE+bound (mesh default off; not AZMail). Pass name or slug — one is enough. Combined name/op forms such as foldlock/fold-preview are accepted. Returns one registry card (ops, stub_ops, digest, status, aliases).

ParametersJSON Schema
NameRequiredDescriptionDefault
nameNoOptional registry display name (for example FoldLock, EmbryoLock, AZHub). Use name or slug — one is enough. Combined name/op forms such as foldlock/fold-preview are accepted by the door parser. Unknown names refuse FG-HALLUC-TOOL.
slugNoOptional catalog slug (lowercase a-z0-9-, for example foldlock, embryolock, azhub). Alternative to name. Prefer the slug returned by fraggate_list or GET /v1/software.

Output Schema

ParametersJSON Schema
NameRequiredDescription
codeNoFragGate or fabric code when present: FG-OK, FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-UNKNOWN-OP, FG-GATE-REFUSE, FG-LAMB-REFUSE, or a module refuse such as MESH-* / AKM-*.
doorNoDoor name. The public door is fraggate.
ran_inNoExecution locale (for example aziel-runtime) when present.
resultNoFragGate body: ok, code, door, slug, op, engine_digest, ran_in, provenance, refusal, limitations, receipt, plus the engine result. Unknown names refuse FG-HALLUC-TOOL; stubs refuse FG-STUB.
statusNoHTTP-like status when present on wrappers (200 ok; 400+ error / refuse).
displayNoHuman-facing envelope. Show title and summary, then take the next input.
receiptNoOptional receipt, ledger tip, or TemporalLock/ForgeReceipts exit when the door stamped one.
refusalNoExplicit refuse object, code, or message when the door or engine refused.
engine_opNoResolved engine op when present (often inside result).
ledger_tipNoAsk/refuse ledger tip when the door stamped one.
provenanceNoProvenance / input packet when the pipeline attached one.
session_idNoRaw session id when session plumbing was used. Hidden unless the user asked for the chain.
engine_slugNoResolved engine slug when present (often inside result).
limitationsNoCapability limitations or Remain-OFF notes when present.
engine_digestNo64-hex engine_digest when a true in-process engine ran (often inside result).

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, destructiveHint=false, and openWorldHint=false, so the safety profile is covered. The description adds substantial value beyond that: the refusal code FG-HALLUC-TOOL on unknown/missing input, the FG-STUB classification for wipe/unlock on embryolock, and the LIVE+bound state of AZChat with mesh default off.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core purpose and the not-this routing, then constraints, then return shape. Dense but every sentence carries routing or behavioral information. Slightly overpacked with domain classification (embryolock, AZChat) that borders on noise for a generic agent, but none of it is filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Output schema exists so return values need not be re-explained, yet the description still names the card fields. Combined with the refusal semantics, the stub/live distinctions, and the name/slug equivalence, an agent has everything needed to invoke correctly or route elsewhere.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds a real semantic detail the schema does not carry as prominently: pass name OR slug, one is enough, and combined name/op forms like foldlock/fold-preview are parsed. It correctly avoids restating the enum-less parameter definitions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (Inspect) and resource (one known FragGate card) with explicit scope (live vs stub vs local_only, public ops, engine_digest). Immediately distinguishes itself from siblings by naming exactly what it is not (not execute, not digest-only proof) and listing the four alternative tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit when-to-use ('when you already have a name or slug from fraggate_list or GET /v1/software') and explicit when-not with a named alternative for each excluded case (fraggate_list, fraggate_verify, runtime_pull, fraggate_call). Prerequisites and refusal behavior (FG-HALLUC-TOOL) are also stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fraggate_listStep 1 — List the FragGate registryA
Read-onlyIdempotent

List the hashed FragGate registry (live / stub / local_only + digests) so you can discover names. Discovery first — not a hub Software tab and not exec. Use this when you do not yet know the catalog name or slug. Do not use it for hub Software-tab refresh, inspecting one known capability, or executing an op; use runtime_software (GET /v1/software), fraggate_describe, or fraggate_call instead. Empty {} only. Never enables mesh radios. Never invents tools or ops. Compact LIVE_OPS tokens below are discovery hints required by product verify scripts — they are not exec. Call fraggate_describe for the live card; later unknown names refuse FG-HALLUC-TOOL. Returns registry entries, allowlists, digests, and the MASTER-33 pipeline cite. Not the full FragGate door. Empty fraggate_list is discovery (hashed LIVE_OPS). Catalog LIVE_OPS slugs (40): 4dmap, ark, azai, azbot, azbrowser, azchat, azclce, azcoherence, azhub, aziel-corpus, azieltether, azinterface, azmail, aznet, azos, azvpn, chronolock, codelock, decisiongate, embryolock, employeelock, foldlock, forgereceipts, glossafilter, godlock, mialock, miragegrid, mmconsensus, peacelock, postking, shadowlock, spectrallock, staticclock, temporallock, toolbench, trajectorylock, vibelock, whistlelock, zkattest, zsolver. Compact product-verify tokens (not a second allowlist): allowlist.azhub LIVE_OPS: health, skill, region_list, place_module, remove_module, tether_declare, tether_cut, tether_list, blank_key_status, list_modules, place. allowlist.azinterface LIVE_OPS: health, skill, genesis_status, site_state_get, site_state_set, integrity_check, witness_list, page_cycle_status, genesis_boot, hold. allowlist.azbrowser LIVE_OPS: ethical_search, lamb_lens_search, navigate, airlock_ingest, airlock, home, tab_open, tab_list, receipt_list, verify, receipt_verify, sandbox_status, sandbox_render, health, skill, vpn. allowlist.azvpn LIVE_OPS: health, skill, doctor, limitation, describe, open, status, list, close, send, recv, pull, peers, attach. allowlist.aznet LIVE_OPS: health, doctor, pair_status, pair, garden_list, stamp, verify_hash, memorial_list, memorial_append, receipt_verify, skill. UI aliases forward to catalog ops. EmbryoLock LIVE_OPS health/skill/doctor/verify-hash/policy/limitation; wipe/scorch/unlock stay FG-STUB on the public mesh.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
codeNoFragGate or fabric code when present: FG-OK, FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-UNKNOWN-OP, FG-GATE-REFUSE, FG-LAMB-REFUSE, or a module refuse such as MESH-* / AKM-*.
doorNoDoor name. The public door is fraggate.
ran_inNoExecution locale (for example aziel-runtime) when present.
resultNoFragGate body: ok, code, door, slug, op, engine_digest, ran_in, provenance, refusal, limitations, receipt, plus the engine result. Unknown names refuse FG-HALLUC-TOOL; stubs refuse FG-STUB.
statusNoHTTP-like status when present on wrappers (200 ok; 400+ error / refuse).
displayNoHuman-facing envelope. Show title and summary, then take the next input.
receiptNoOptional receipt, ledger tip, or TemporalLock/ForgeReceipts exit when the door stamped one.
refusalNoExplicit refuse object, code, or message when the door or engine refused.
engine_opNoResolved engine op when present (often inside result).
ledger_tipNoAsk/refuse ledger tip when the door stamped one.
provenanceNoProvenance / input packet when the pipeline attached one.
session_idNoRaw session id when session plumbing was used. Hidden unless the user asked for the chain.
engine_slugNoResolved engine slug when present (often inside result).
limitationsNoCapability limitations or Remain-OFF notes when present.
engine_digestNo64-hex engine_digest when a true in-process engine ran (often inside result).

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, and the description adds vital behavioral context: it never enables mesh radios, never invents tools/ops, returns registry entries/digests/allowlists, and calls out that unknown names will refuse with FG-HALLUC-TOOL. It also clarifies that compact LIVE_OPS tokens are discovery hints, not execution.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is very long and includes large embedded allowlist catalog listings that could arguably live in an output schema or reference doc. However, those listings serve the tool's discovery mission and the front-loading is good ('List the hashed FragGate registry... Discovery first'). It earns its length functionally, though it is not tightly concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's discovery purpose and the presence of an output schema plus thorough annotations, the description covers usage boundaries, return contents, and key safety traits. It could be considered slightly over-complete for a simple 0-param tool, but it leaves no operational hole for an agent deciding how to invoke it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already covers the only parameter (none, empty object) with a description, so the baseline is high. The description further reinforces that 'Empty {} only' and explains what the caller should expect, adding a small but meaningful behavioral constraint beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('List') and resource ('the hashed FragGate registry') and distinguishes itself from siblings like fraggate_describe and fraggate_call. It explicitly frames itself as 'Discovery first' and gives the scope (live / stub / local_only + digests), which clearly differentiates it from other tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit when-to-use and when-not-to-use guidance, naming alternatives (runtime_software, fraggate_describe, fraggate_call) and specific exclusions ('Not a hub Software tab and not exec'). It also explains the discovery-first role, which leaves no ambiguity about selecting this tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fraggate_verifyVerify a registry name or digestA
Read-onlyIdempotent

Confirm a name, slug, or 64-hex engine_digest against the hashed FragGate registry — a proof, not a card listing. Use this when you must prove a listed name or digest exists after fraggate_describe. Do not use it for listing the registry, describing ops, or executing; use fraggate_list, fraggate_describe, or fraggate_call instead. Not an exec path and not a describe card. Empty {} (no name, slug, or digest) refuses FG-HALLUC-TOOL. Digest without name/slug compares the whole registry hash (kind=registry). Name or slug with an optional digest compares that entry (kind=entry); unknown names refuse FG-HALLUC-TOOL. Mismatch returns ok=false with matched=false — it does not invent a digest. Send digest alone to proof the live registry_digest. Send name or slug (one is enough) to proof one card. Combined name+digest must equal that card's engine_digest. Returns match or mismatch (kind registry|entry, matched, registry_digest).

ParametersJSON Schema
NameRequiredDescriptionDefault
nameNoOptional registry display name (for example FoldLock, EmbryoLock, AZHub). Use name or slug — one is enough. Combined name/op forms such as foldlock/fold-preview are accepted by the door parser. Unknown names refuse FG-HALLUC-TOOL.
slugNoOptional catalog slug (lowercase a-z0-9-, for example foldlock, embryolock, azhub). Alternative to name. Prefer the slug returned by fraggate_list or GET /v1/software.
digestNoOptional 64-char lowercase hex engine_digest or registry digest to verify. When digest is set without name/slug, the tool compares the live registry digest.

Output Schema

ParametersJSON Schema
NameRequiredDescription
codeNoFragGate or fabric code when present: FG-OK, FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-UNKNOWN-OP, FG-GATE-REFUSE, FG-LAMB-REFUSE, or a module refuse such as MESH-* / AKM-*.
doorNoDoor name. The public door is fraggate.
ran_inNoExecution locale (for example aziel-runtime) when present.
resultNoFragGate body: ok, code, door, slug, op, engine_digest, ran_in, provenance, refusal, limitations, receipt, plus the engine result. Unknown names refuse FG-HALLUC-TOOL; stubs refuse FG-STUB.
statusNoHTTP-like status when present on wrappers (200 ok; 400+ error / refuse).
displayNoHuman-facing envelope. Show title and summary, then take the next input.
receiptNoOptional receipt, ledger tip, or TemporalLock/ForgeReceipts exit when the door stamped one.
refusalNoExplicit refuse object, code, or message when the door or engine refused.
engine_opNoResolved engine op when present (often inside result).
ledger_tipNoAsk/refuse ledger tip when the door stamped one.
provenanceNoProvenance / input packet when the pipeline attached one.
session_idNoRaw session id when session plumbing was used. Hidden unless the user asked for the chain.
engine_slugNoResolved engine slug when present (often inside result).
limitationsNoCapability limitations or Remain-OFF notes when present.
engine_digestNo64-hex engine_digest when a true in-process engine ran (often inside result).

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover the safety profile (readOnly, idempotent, non-destructive), and the description adds real behavioral detail beyond them: empty {} refuses FG-HALLUC-TOOL, unknown names refuse, digest-only compares the whole registry hash (kind=registry), name/slug compares that entry (kind=entry), and mismatch returns ok=false with matched=false rather than inventing a digest.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with purpose, then usage, then behavior, and most sentences earn their place. Slightly repetitive: 'Not an exec path and not a describe card' restates the earlier exclusions, and the closing return-value sentence duplicates a present output schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Complete for a zero-required-param verification tool with an output schema: it covers refusal behavior, the two comparison modes, and match/mismatch outcomes. Nothing an agent needs to invoke it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3, but the description adds combination semantics the schema does not fully state: name or slug alone is enough, name+digest must equal that card's engine_digest, and the digest pattern is 64-hex. This is meaningful Fn semantics beyond the field docs.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (Confirm/verify) and resource (name, slug, or 64-hex engine_digest against the FragGate registry), and immediately frames it as 'a proof, not a card listing', which separates it from the sibling describe/list tools. An agent can distinguish it from fraggate_list, fraggate_describe, and fraggate_call without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says when to use it ('when you must prove a listed name or digest exists after fraggate_describe') and when not to ('Do not use it for listing the registry, describing ops, or executing'), naming the three alternatives. Routing conditions for digest-only vs name/slug are also spelled out.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

library_lookupSearch the Aziel Digital LibraryA
Read-onlyIdempotent

Search the public Aziel Digital Library (aziel-corpus search / example / skill) — cites, not beliefs and not vault stamps. Use this when you need a public corpus cite, example record, or library skill. Do not use it for adaptive memory belief, ChainLock facts, or private-file search; use memory_recall, chainlock_recall, or fraggate_call slug=aziel-corpus instead. Not a private-file search engine and not AKM/ChainLock. Empty q does not invent a cite. Unknown ops refuse FG-UNKNOWN-OP (allowed: search, example, skill, health). Named corpus wrapper — not MASTER-33; full aziel-corpus LIVE_OPS stay on fraggate_call. q is public corpus text — not memory_recall q and not ChainLock q. Omit op to search. Extra keys besides q/op/payload ride along as aziel-corpus payload (same as passing payload{}). Returns search, example, skill, or health payload inside the display envelope.

ParametersJSON Schema
NameRequiredDescriptionDefault
qNoOptional public-corpus query for op=search. Empty q returns an empty or default hit set, not an invented cite. Not a memory or ChainLock query.
opNoOptional library verb. search (default) looks up public corpus text; example returns a sample; skill returns the library skill; health is liveness. Other values refuse FG-UNKNOWN-OP.

Output Schema

ParametersJSON Schema
NameRequiredDescription
codeNoFragGate or fabric code when present: FG-OK, FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-UNKNOWN-OP, FG-GATE-REFUSE, FG-LAMB-REFUSE, or a module refuse such as MESH-* / AKM-*.
doorNoDoor name. The public door is fraggate.
ran_inNoExecution locale (for example aziel-runtime) when present.
resultNoFragGate body: ok, code, door, slug, op, engine_digest, ran_in, provenance, refusal, limitations, receipt, plus the engine result. Unknown names refuse FG-HALLUC-TOOL; stubs refuse FG-STUB.
statusNoHTTP-like status when present on wrappers (200 ok; 400+ error / refuse).
displayNoHuman-facing envelope. Show title and summary, then take the next input.
receiptNoOptional receipt, ledger tip, or TemporalLock/ForgeReceipts exit when the door stamped one.
refusalNoExplicit refuse object, code, or message when the door or engine refused.
engine_opNoResolved engine op when present (often inside result).
ledger_tipNoAsk/refuse ledger tip when the door stamped one.
provenanceNoProvenance / input packet when the pipeline attached one.
session_idNoRaw session id when session plumbing was used. Hidden unless the user asked for the chain.
engine_slugNoResolved engine slug when present (often inside result).
limitationsNoCapability limitations or Remain-OFF notes when present.
engine_digestNo64-hex engine_digest when a true in-process engine ran (often inside result).

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already provide readOnlyHint=true, idempotentHint=true, and destructiveHint=false, but the description adds substantial behavior beyond that: empty q does not fabricate a cite, unknown ops return FG-UNKNOWN-OP, this is a named-corpus wrapper rather than MASTER-33, extra keys are forwarded as payload, and the response is returned inside a display envelope. These are meaningful operational details not inferable from the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core purpose and uses a logical flow: what, when, not-for, error behavior, and payload behavior. It is dense but slightly redundant, e.g., 'Not a private-file search engine and not AKM/ChainLock' partially repeats earlier exclusions. Still, nearly every sentence adds needed differentiation.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 2 optional parameters, no required inputs, full schema coverage, a rich output schema, and a large sibling set, the description is exceptionally complete. It covers defaults, error responses, payload forwarding, return payload types, and limitations, making it fully usable by an agent without further investigation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with per-property descriptions, so the baseline is 3, but the description adds real semantic value: q is explicitly differentiated from memory_recall q and ChainLock q, op's default is clarified ('Omit op to search'), and extra keys beyond q/op are described as riding along as aziel-corpus payload. These are distinctions an agent needs to call the tool correctly.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Search the public Aziel Digital Library (aziel-corpus search / example / skill)'. It also immediately states what the tool does NOT return ('cites, not beliefs and not vault stamps'), which differentiates it from related memory and ChainLock tools without needing to open their schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly states when to use the tool: 'Use this when you need a public corpus cite, example record, or library skill.' It also gives a clear exclusion list and names the alternatives: memory_recall, chainlock_recall, and fraggate_call slug=aziel-corpus. This leaves no ambiguity about selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

memory_calibrateCalibrate a memoryA

Calibrate one memory with the deterministic 3-of-4 triad plus Bayesian posterior (AKM-TRIAD-1.0). Writes a LEARN stamp — not a ranked search and not an explain view. Use this when an observed memory should receive a posterior after evidence, not a ranked search. Do not use it for observing a new fact, resolving an outcome, or explaining a stored node; use memory_observe, memory_resolve, or memory_get instead. Write: forward-only RoseClock LEARN stamp. Posterior ≠ truth. authorizes_action=false. No automatic MODEL_UPDATE. subject or memory_id recommended. use_case labels calibration; it is not a permission. Mutation requires confirm=true (runtime gate) or dry_run=true (preview only, no write). confirm and dry_run stay optional on inputSchema.required. Returns triad_score, omitted leg, posterior, effective N, and Brier notes.

ParametersJSON Schema
NameRequiredDescriptionDefault
factNoFact text clipped to 160 characters. Required on observe. Hash-only cards refuse AKM-NO-FACT.
confirmNoDocumented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true (preview, no write).
dry_runNoOptional preview flag. When true, return a would-mutate preview and do not write. Alternative to confirm=true. Does not mutate.
subjectNoOptional subject key clipped to 80 characters. Used to find or create memory_id.
use_caseNoOptional use-case label for calibration / adaptive recall ranking. Not a truth claim.
memory_idNoOptional existing memory id. Alternative to subject for resolve/calibrate/get.

Output Schema

ParametersJSON Schema
NameRequiredDescription
codeNoFragGate or fabric code when present: FG-OK, FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-UNKNOWN-OP, FG-GATE-REFUSE, FG-LAMB-REFUSE, or a module refuse such as MESH-* / AKM-*.
doorNoDoor name. The public door is fraggate.
ran_inNoExecution locale (for example aziel-runtime) when present.
resultNoFragGate body: ok, code, door, slug, op, engine_digest, ran_in, provenance, refusal, limitations, receipt, plus the engine result. Unknown names refuse FG-HALLUC-TOOL; stubs refuse FG-STUB.
statusNoHTTP-like status when present on wrappers (200 ok; 400+ error / refuse).
displayNoHuman-facing envelope. Show title and summary, then take the next input.
receiptNoOptional receipt, ledger tip, or TemporalLock/ForgeReceipts exit when the door stamped one.
refusalNoExplicit refuse object, code, or message when the door or engine refused.
engine_opNoResolved engine op when present (often inside result).
ledger_tipNoAsk/refuse ledger tip when the door stamped one.
provenanceNoProvenance / input packet when the pipeline attached one.
session_idNoRaw session id when session plumbing was used. Hidden unless the user asked for the chain.
engine_slugNoResolved engine slug when present (often inside result).
limitationsNoCapability limitations or Remain-OFF notes when present.
engine_digestNo64-hex engine_digest when a true in-process engine ran (often inside result).

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only provide basic hints; the description adds substantial behavioral disclosure: it writes a forward-only RoseClock LEARN stamp, states 'Posterior ≠ truth', 'authorizes_action=false', 'No automatic MODEL_UPDATE', and clarifies the confirm/dry_run mutation gate. These are meaningful traits beyond the schema and annotations, with no contradictions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with purpose, and every sentence carries information. However, some redundancy exists: 'subject or memory_id recommended' and 'Mutation requires confirm=true or dry_run=true' appear in both the description and the input schema, which adds slight repetition in an otherwise dense definition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with six optional parameters, a mutation gate, exclusions, and an output schema, the description covers usage, alternatives, behavioral caveats, parameter interpretation, and return fields ('triad_score, omitted leg, posterior, effective N, and Brier notes'). An agent has everything needed to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3. The description adds valuable nuance: 'subject or memory_id recommended', 'use_case labels calibration; it is not a permission', and the subtle 'confirm and dry_run stay optional on inputSchema.required' runtime distinction. This is helpful above the schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Calibrate one memory'), names the exact algorithm (3-of-4 triad plus Bayesian posterior, AKM-TRIAD-1.0), and distinguishes itself from ranked search and explain view. It also names sibling tools it is not, so an agent can differentiate without opening schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says when to use it ('when an observed memory should receive a posterior after evidence') and when not to ('Do not use it for observing a new fact, resolving an outcome, or explaining a stored node'), with direct alternatives (memory_observe, memory_resolve, memory_get). Nothing is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

memory_getExplain a memoryA
Read-onlyIdempotent

Read one memory's stored explanation (node, history, or calibration: posterior, triad legs, effective N, Brier) — not a ranked list. Use this when you have a memory_id (or id) and need the stored explanation. Do not use it for ranked adaptive recall or appending an observation; use memory_recall or memory_observe instead. Missing both memory_id and id, or an unknown id, refuses AKM-NOT-FOUND — do not invent a node. authorizes_action stays false. There is no memory_delete; this is the read of the append-only node. Pass memory_id or id — one is enough; they are aliases, not two different records. Omit view for the default node slice. history returns events/resolutions; calibration returns posterior/triad/Brier. subject is not a lookup key here. Returns node, history, or calibration view (belief_is_not_truth).

ParametersJSON Schema
NameRequiredDescriptionDefault
idNoAlias of memory_id. Do not send two different values.
viewNoOptional slice. Omit or get = stored node; history = events/resolutions; calibration = posterior, triad legs, effective N, Brier.
memory_idNoMemory id to explain. Alternative to id. Missing both refuses AKM-NOT-FOUND.

Output Schema

ParametersJSON Schema
NameRequiredDescription
codeNoFragGate or fabric code when present: FG-OK, FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-UNKNOWN-OP, FG-GATE-REFUSE, FG-LAMB-REFUSE, or a module refuse such as MESH-* / AKM-*.
doorNoDoor name. The public door is fraggate.
ran_inNoExecution locale (for example aziel-runtime) when present.
resultNoExplain body: ok, memory_id, status, plus node or events or calibration fields. belief_is_not_truth. Refuses AKM-NOT-FOUND when the id is missing or unknown.
statusNoHTTP-like status when present on wrappers (200 ok; 400+ error / refuse).
displayNoHuman-facing envelope. Show title and summary, then take the next input.
receiptNoOptional receipt, ledger tip, or TemporalLock/ForgeReceipts exit when the door stamped one.
refusalNoExplicit refuse object, code, or message when the door or engine refused.
engine_opNoResolved engine op when present (often inside result).
ledger_tipNoAsk/refuse ledger tip when the door stamped one.
provenanceNoProvenance / input packet when the pipeline attached one.
session_idNoRaw session id when session plumbing was used. Hidden unless the user asked for the chain.
engine_slugNoResolved engine slug when present (often inside result).
limitationsNoCapability limitations or Remain-OFF notes when present.
engine_digestNo64-hex engine_digest when a true in-process engine ran (often inside result).

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover the read-only/idempotent/non-destructive profile, but the description adds substantial context beyond them: refusal code AKM-NOT-FOUND for missing/unknown ids, 'authorizes_action stays false', the append-only nature of the node, and the belief_is_not_truth return caveat. This is rich behavioral disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core action and scope, and sentences generally earn their place. However, the alias point ('Pass memory_id or id — one is enough; they are aliases') and the view semantics are each restated, adding some redundancy for a 3-parameter getter.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read tool with full schema coverage and an output schema, the description is more than complete: it explains error behavior, aliasing, view semantics, and safety flags. Nothing an agent needs to call it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3, but the description adds real meaning: memory_id and id are aliases for one record (not two), 'subject is not a lookup key here', and concrete view semantics (history = events/resolutions; calibration = posterior/triad/Brier). It goes beyond the schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (read/explain) and resource (one memory's stored explanation) with explicit scope qualifier '— not a ranked list.' It names the views it returns (node/history/calibration) and clearly differentiates from memory_recall and memory_observe.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit when-to-use ('when you have a memory_id and need the stored explanation') and when-not ('Do not use it for ranked adaptive recall or appending an observation'), naming the alternative tools. Also notes 'There is no memory_delete' to redirect any deletion intent.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

memory_observeObserve a memoryA

Append the first memory_observation to the ChainLock learn chain (AKM-TRIAD-1.0). New fact in — not an outcome resolve and not a grounded ChainLock append. Posterior ≠ truth. Use this when you have a new fact to observe before resolve/calibrate. Do not use it for grounded ChainLock append without AKM, resolving an outcome, or ranked recall; use chainlock_append, memory_resolve, or memory_recall instead. Write: additive learn-chain stamp. authorizes_action stays false. Hash-only cards refuse AKM-NO-FACT. Append-only; there is no memory_delete. fact is required (≤160). subject/memory_id/use_case optional. Mutation requires confirm=true (runtime gate) or dry_run=true (preview only, no write). confirm and dry_run stay optional on inputSchema.required. Returns memory_id, observation stamp, and display envelope (belief is not truth).

ParametersJSON Schema
NameRequiredDescriptionDefault
factYesFact text clipped to 160 characters. Required on observe. Hash-only cards refuse AKM-NO-FACT.
confirmNoDocumented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true (preview, no write).
dry_runNoOptional preview flag. When true, return a would-mutate preview and do not write. Alternative to confirm=true. Does not mutate.
subjectNoOptional subject key clipped to 80 characters. Used to find or create memory_id.
use_caseNoOptional use-case label for calibration / adaptive recall ranking. Not a truth claim.
memory_idNoOptional existing memory id. Alternative to subject for resolve/calibrate/get.

Output Schema

ParametersJSON Schema
NameRequiredDescription
codeNoFragGate or fabric code when present: FG-OK, FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-UNKNOWN-OP, FG-GATE-REFUSE, FG-LAMB-REFUSE, or a module refuse such as MESH-* / AKM-*.
doorNoDoor name. The public door is fraggate.
ran_inNoExecution locale (for example aziel-runtime) when present.
resultNoFragGate body: ok, code, door, slug, op, engine_digest, ran_in, provenance, refusal, limitations, receipt, plus the engine result. Unknown names refuse FG-HALLUC-TOOL; stubs refuse FG-STUB.
statusNoHTTP-like status when present on wrappers (200 ok; 400+ error / refuse).
displayNoHuman-facing envelope. Show title and summary, then take the next input.
receiptNoOptional receipt, ledger tip, or TemporalLock/ForgeReceipts exit when the door stamped one.
refusalNoExplicit refuse object, code, or message when the door or engine refused.
engine_opNoResolved engine op when present (often inside result).
ledger_tipNoAsk/refuse ledger tip when the door stamped one.
provenanceNoProvenance / input packet when the pipeline attached one.
session_idNoRaw session id when session plumbing was used. Hidden unless the user asked for the chain.
engine_slugNoResolved engine slug when present (often inside result).
limitationsNoCapability limitations or Remain-OFF notes when present.
engine_digestNo64-hex engine_digest when a true in-process engine ran (often inside result).

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only provide flags (readOnly=false, etc.), so the description carries the full burden. It discloses mutation requirements (confirm=true or dry_run=true), append-only nature (no memory_delete), the fact that authorizes_action stays false, and the epistemic caveat ('Posterior ≠ truth'). It also explains runtime gates. This goes well beyond the minimal flag information and sets accurate expectations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but every sentence adds value: action, usage, behavioral caveats, mutation gates, and returns. It is front-loaded with the primary action. While slightly long, it avoids redundancy and is well-structured for an agent to parse quickly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (mutation, confirmation, multiple siblings), the description covers the core operational aspects: when to use, how to mutate, what it returns, and the belief-vs-truth caveat. It does not detail error scenarios or rate limits, but these are not critical for correct invocation. The output schema likely covers return structure, so that gap is acceptable.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with each parameter described. The description adds clarity on the confirm/dry_run interaction (optional in schema but required for mutation) and explains the purpose of use_case ('Not a truth claim') and the behavior of hash-only cards with fact. It adds contextual meaning beyond the raw parameter names and types.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource ('Append the first memory_observation to the ChainLock learn chain') and immediately differentiates from siblings by naming chainlock_append, memory_resolve, and memory_recall. It clearly states this tool is for observing a new fact before resolve/calibrate, leaving no ambiguity about its role.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly states when to use ('Use this when you have a new fact to observe before resolve/calibrate') and when not to use, listing specific alternatives ('Do not use it for grounded ChainLock append without AKM, resolving an outcome, or ranked recall; use chainlock_append, memory_resolve, or memory_recall instead'). This is model guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

memory_recallAdaptive recallA
Read-onlyIdempotent

Ranked adaptive recall after ChainLock verify (AKM-TRIAD-1.0). Belief list — not raw grounded stamps, not a public corpus cite, not one-id explain. Use this when you want a ranked belief list after verify, not raw grounded stamps. Do not use it for grounded ChainLock recall, library search, or explaining one memory_id; use chainlock_recall, library_lookup, or memory_get instead. Does not authorize action (authorizes_action=false). Do not treat posterior rank as fact (belief_is_not_truth). Failed ChainLock verify refuses CHAIN_VERIFY_FAIL and does not invent cards. Empty grounded recall bubbles refuse=no-stamp. Ranking is capped at 16 cards. Omit depth to rank at 5 (full budget), unlike chainlock_recall which defaults to 1. q/query is lexical rank text, not a SQL filter. Empty q still verify-then-ranks stored cards. use_case weights triad_fit; it is not a permission. Optional limit clips the already-capped list. Returns ranked cards after verify (count, facts, belief_is_not_truth, authorizes_action=false).

ParametersJSON Schema
NameRequiredDescriptionDefault
qNoOptional lexical rank query (subject/fact). Alias: query. Empty still runs verify-then-rank; it does not invent facts.
depthNoOptional ChainLock recall depth after verify. Omit for 5 (full budget). 0 is tip-only ranking.
limitNoOptional result cap. Hard ceiling is 16 (MEMORY_CONTEXT_CAP) even if a larger number is sent.
use_caseNoOptional use-case label that weights triad_fit in ranking. Not a permission and not a truth claim.

Output Schema

ParametersJSON Schema
NameRequiredDescription
codeNoFragGate or fabric code when present: FG-OK, FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-UNKNOWN-OP, FG-GATE-REFUSE, FG-LAMB-REFUSE, or a module refuse such as MESH-* / AKM-*.
doorNoDoor name. The public door is fraggate.
ran_inNoExecution locale (for example aziel-runtime) when present.
resultNoAdaptive recall body: ok, adaptive=true, verified, count, facts (ranked cards with score/retrieval), belief_is_not_truth, authorizes_action=false. Refuses CHAIN_VERIFY_FAIL or no-stamp.
statusNoHTTP-like status when present on wrappers (200 ok; 400+ error / refuse).
displayNoHuman-facing envelope. Show title and summary, then take the next input.
receiptNoOptional receipt, ledger tip, or TemporalLock/ForgeReceipts exit when the door stamped one.
refusalNoExplicit refuse object, code, or message when the door or engine refused.
engine_opNoResolved engine op when present (often inside result).
ledger_tipNoAsk/refuse ledger tip when the door stamped one.
provenanceNoProvenance / input packet when the pipeline attached one.
session_idNoRaw session id when session plumbing was used. Hidden unless the user asked for the chain.
engine_slugNoResolved engine slug when present (often inside result).
limitationsNoCapability limitations or Remain-OFF notes when present.
engine_digestNo64-hex engine_digest when a true in-process engine ran (often inside result).

TDQS

A4.3/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare read-only/idempotent/non-destructive, but the description adds substantial non-obvious behavior: it does not authorize action, posterior rank is not truth, failed verify refuses CHAIN_VERIFY_FAIL without inventing cards, empty grounded recall returns no-stamp, and ranking is capped at 16 cards. These are exactly the failure-mode and safety traits an agent needs.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The routing and constraints are front-loaded, but the text is repetitive — "Belief list — not raw grounded stamps..." is restated almost verbatim in the next sentence. Several sentences could be merged without loss, and the jargon-dense framing slows scanning.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 4-param tool with full schema coverage and an output schema, the description covers behavior, routing, failure modes, and defaults thoroughly. It arguably over-explains the return shape (count, facts, belief_is_not_truth) that the output schema already provides, so nothing essential is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds real meaning: q is lexical rank text (not a SQL filter) and empty q still verify-then-ranks, depth omitted defaults to 5 unlike chainlock_recall's default of 1, use_case weights triad_fit and is not a permission, and limit clips the already-capped list. This goes beyond the schema text.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific operation (ranked adaptive recall of a belief list after ChainLock verify) and explicitly distinguishes itself from siblings chainlock_recall, library_lookup, and memory_get. The core purpose is identifiable, though heavy jargon ("AKM-TRIAD-1.0", "grounded stamps") adds noise without adding precision.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit when-to-use ("Use this when you want a ranked belief list after verify") and explicit when-not with named alternatives ("Do not use it for grounded ChainLock recall, library search, or explaining one memory_id; use chainlock_recall, library_lookup, or memory_get instead"). Routing is unambiguous.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

memory_resolveResolve a memory outcomeA

Append a memory_resolution outcome on an already-observed memory (AKM-TRIAD-1.0). UNKNOWN is distinct from MISS. Does not rewrite history. Use this when an observed memory_id or subject now has an outcome. Do not use it for first observation, calibration, or reading history; use memory_observe, memory_calibrate, or memory_get instead. Write: additive resolution stamp. Missing memory_id/subject refuses AKM-NO-MEMORY. Does not rewrite prior observations. No memory_update — this is the forward outcome path. Requires memory_id or a previously observed subject. outcome is optional [0,1]; omit for UNKNOWN. Mutation requires confirm=true (runtime gate) or dry_run=true (preview only, no write). confirm and dry_run stay optional on inputSchema.required. Returns resolution stamp with outcome or UNKNOWN.

ParametersJSON Schema
NameRequiredDescriptionDefault
factNoFact text clipped to 160 characters. Required on observe. Hash-only cards refuse AKM-NO-FACT.
confirmNoDocumented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true (preview, no write).
dry_runNoOptional preview flag. When true, return a would-mutate preview and do not write. Alternative to confirm=true. Does not mutate.
outcomeNoOptional graded outcome in [0, 1]. Omit (or pass UNKNOWN) for an UNKNOWN resolution — distinct from MISS.
subjectNoOptional subject key clipped to 80 characters. Used to find or create memory_id.
use_caseNoOptional use-case label for calibration / adaptive recall ranking. Not a truth claim.
memory_idNoOptional existing memory id. Alternative to subject for resolve/calibrate/get.
outcome_labelNoOptional label (for example HIT, MISS, GRADED, UNKNOWN). UNKNOWN is a first-class state, not a miss.

Output Schema

ParametersJSON Schema
NameRequiredDescription
codeNoFragGate or fabric code when present: FG-OK, FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-UNKNOWN-OP, FG-GATE-REFUSE, FG-LAMB-REFUSE, or a module refuse such as MESH-* / AKM-*.
doorNoDoor name. The public door is fraggate.
ran_inNoExecution locale (for example aziel-runtime) when present.
resultNoFragGate body: ok, code, door, slug, op, engine_digest, ran_in, provenance, refusal, limitations, receipt, plus the engine result. Unknown names refuse FG-HALLUC-TOOL; stubs refuse FG-STUB.
statusNoHTTP-like status when present on wrappers (200 ok; 400+ error / refuse).
displayNoHuman-facing envelope. Show title and summary, then take the next input.
receiptNoOptional receipt, ledger tip, or TemporalLock/ForgeReceipts exit when the door stamped one.
refusalNoExplicit refuse object, code, or message when the door or engine refused.
engine_opNoResolved engine op when present (often inside result).
ledger_tipNoAsk/refuse ledger tip when the door stamped one.
provenanceNoProvenance / input packet when the pipeline attached one.
session_idNoRaw session id when session plumbing was used. Hidden unless the user asked for the chain.
engine_slugNoResolved engine slug when present (often inside result).
limitationsNoCapability limitations or Remain-OFF notes when present.
engine_digestNo64-hex engine_digest when a true in-process engine ran (often inside result).

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description goes well beyond the annotations (readOnlyHint=false, idempotentHint=false) by disclosing that it appends an additive resolution stamp, does not rewrite history, refuses with AKM-NO-MEMORY when memory_id/subject is missing, and treats dry_run as a no-write preview. This adds meaningful behavioral context that annotations alone do not convey.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense and front-loaded with the core purpose, then usage, then constraints. It has minor redundancy ('Does not rewrite history' and 'Does not rewrite prior observations' appear twice), but every part still contributes needed guidance; the repetition is a small cost against the strong structure.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (8 parameters, mutation gate, error conditions, distinct UNKNOWN/MISS states), the description covers requirements, error responses, alternative tools, and preview behavior. An output schema exists, so return details are not necessary, and nothing essential is missing for an agent to invoke this correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds valuable semantics beyond the schema: it clarifies the outcome omission means UNKNOWN, the mutual exclusivity/requirement of memory_id or subject, and the interplay between confirm and dry_run. It does not restate each parameter but provides higher-order usage meaning, justifying a 4.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Append') and resource ('memory_resolution outcome on an already-observed memory'), and explicitly distinguishes this tool from siblings by naming 'No memory_update — this is the forward outcome path.' It clearly differentiates from memory_observe, memory_calibrate, and memory_get within the same description.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit when-to-use conditions ('Use this when an observed memory_id or subject now has an outcome') and when-not-to-use alternatives ('Do not use it for first observation, calibration, or reading history; use memory_observe, memory_calibrate, or memory_get instead'). It also explains the mutation gate with confirm=true or dry_run=true, leaving no ambiguity about prerequisites.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mesh_broadcastRegister a local hash receiptA

Register the SHA-256 of a local file as a hash receipt — never a publish or upload path. Use this when the operator already holds a local file and wants only its hash recorded. Do not use it for uploading bytes, publishing video, sending mail, or joining a mesh node; use local qnm-node/ anon-broadcast loopback, AZMail via fraggate_call, or mesh_join instead. Write: stores a hash receipt only. Does NOT accept video bytes. Operator keeps the file. Malformed sha256 refuses MESH-BAD-INPUT; publish-shaped keys refuse MESH-NO-PUBLISH. sha256 is required (64 hex). title and product are optional labels, not file contents. Mutation requires confirm=true (runtime gate) or dry_run=true (preview only, no write). confirm and dry_run stay optional on inputSchema.required. Returns hash receipt (sha256, optional title).

ParametersJSON Schema
NameRequiredDescriptionDefault
titleNoOptional short title for the receipt. Not the file contents.
sha256YesRequired 64-character hex SHA-256 of the local file. Hash receipt only — not a publish path.
confirmNoDocumented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true (preview, no write).
dry_runNoOptional preview flag. When true, return a would-mutate preview and do not write. Alternative to confirm=true. Does not mutate.
productNoOptional catalog product slug to attribute the receipt. Not required.

Output Schema

ParametersJSON Schema
NameRequiredDescription
codeNoFragGate or fabric code when present: FG-OK, FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-UNKNOWN-OP, FG-GATE-REFUSE, FG-LAMB-REFUSE, or a module refuse such as MESH-* / AKM-*.
doorNoDoor name. The public door is fraggate.
ran_inNoExecution locale (for example aziel-runtime) when present.
resultNoFragGate body: ok, code, door, slug, op, engine_digest, ran_in, provenance, refusal, limitations, receipt, plus the engine result. Unknown names refuse FG-HALLUC-TOOL; stubs refuse FG-STUB.
statusNoHTTP-like status when present on wrappers (200 ok; 400+ error / refuse).
displayNoHuman-facing envelope. Show title and summary, then take the next input.
receiptNoOptional receipt, ledger tip, or TemporalLock/ForgeReceipts exit when the door stamped one.
refusalNoExplicit refuse object, code, or message when the door or engine refused.
engine_opNoResolved engine op when present (often inside result).
ledger_tipNoAsk/refuse ledger tip when the door stamped one.
provenanceNoProvenance / input packet when the pipeline attached one.
session_idNoRaw session id when session plumbing was used. Hidden unless the user asked for the chain.
engine_slugNoResolved engine slug when present (often inside result).
limitationsNoCapability limitations or Remain-OFF notes when present.
engine_digestNo64-hex engine_digest when a true in-process engine ran (often inside result).

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only declare flags (readOnlyHint=false, etc.) without behavioral detail. The description supplies rich context: it stores a hash receipt only, does not accept video bytes, keeps the file with the operator, and has distinct refusal codes (MESH-BAD-INPUT, MESH-NO-PUBLISH). It also explains the mutation gate (confirm=true or dry_run=true) and that dry_run never writes, going well beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense and front-loaded with the core purpose, but it is long. Most sentences contribute unique information—exclusions, error behavior, and gating semantics—so the length is justified for a tool with nontrivial safety constraints. Slight redundancy with schema text (e.g., parameter labels) prevents a 5.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the 5-parameter schema, 100% schema coverage, output schema, and the complexity of mutation gating, the description covers every behavioral corner an agent needs: what happens on invalid input, publish-shaped keys, dry-run behavior, and explicit alternatives. Nothing required for correct invocation is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema already documents each parameter. The description adds meaningful meta-semantics beyond the schema: sha256 is required and 64 hex, title and product are 'labels, not file contents,' and confirm/dry_run are intentionally optional in inputSchema.required yet enforce a runtime mutation gate. This exceeds the baseline while not being strictly necessary.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Register the SHA-256 of a local file as a hash receipt' and immediately clarifies 'never a publish or upload path.' It clearly distinguishes this tool from publishing, uploading, mailing, and mesh joining, matching the title 'Register a local hash receipt.'

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives an explicit when-to-use condition: 'Use this when the operator already holds a local file and wants only its hash recorded.' It then lists what not to use it for and names concrete alternatives: 'use local qnm-node/ anon-broadcast loopback, AZMail via fraggate_call, or mesh_join instead.' This is complete routing guidance with no ambiguity.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mesh_disableSuite disable is refusedA
Read-onlyIdempotent

Confirm that read-only QNM suite-presence stays ON (POST /v1/mesh/disable refuses MESH-DISABLE-REFUSED) — not a kill switch. Use this when a client still posts the historical disable route and needs the honest refuse. Do not use it for dropping one node or declaring an extra bearer; use mesh_leave or mesh_enable instead. Read-only refuse: suite-presence stays ON. No tethers drop. No implicit heal, no account resurrection, no wipe internals. Repeating still refuses. AZMail mesh_disable is a separate product-local mail ring. Returns MESH-DISABLE-REFUSED with enabled=true and a stay-on note.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
codeNoFragGate or fabric code when present: FG-OK, FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-UNKNOWN-OP, FG-GATE-REFUSE, FG-LAMB-REFUSE, or a module refuse such as MESH-* / AKM-*.
doorNoDoor name. The public door is fraggate.
ran_inNoExecution locale (for example aziel-runtime) when present.
resultNoFragGate body: ok, code, door, slug, op, engine_digest, ran_in, provenance, refusal, limitations, receipt, plus the engine result. Unknown names refuse FG-HALLUC-TOOL; stubs refuse FG-STUB.
statusNoHTTP-like status when present on wrappers (200 ok; 400+ error / refuse).
displayNoHuman-facing envelope. Show title and summary, then take the next input.
receiptNoOptional receipt, ledger tip, or TemporalLock/ForgeReceipts exit when the door stamped one.
refusalNoExplicit refuse object, code, or message when the door or engine refused.
engine_opNoResolved engine op when present (often inside result).
ledger_tipNoAsk/refuse ledger tip when the door stamped one.
provenanceNoProvenance / input packet when the pipeline attached one.
session_idNoRaw session id when session plumbing was used. Hidden unless the user asked for the chain.
engine_slugNoResolved engine slug when present (often inside result).
limitationsNoCapability limitations or Remain-OFF notes when present.
engine_digestNo64-hex engine_digest when a true in-process engine ran (often inside result).

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnly/idempotent/non-destructive annotations, it discloses concrete behavioral guarantees: no tethers drop, no implicit heal, no account resurrection, no wipe internals, and that repeating the call still refuses. It also names the exact returned marker (MESH-DISABLE-REFUSED with enabled=true), which goes well past what the annotations carry.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The opening sentence is front-loaded and clear, but the text is dense and repetitive: suite-presence 'stays ON' is stated twice, refusal is restated three times, and the AZMail product-local note is a tangential aside. The content is useful but not tightly trimmed.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present and zero parameters, the description covers everything an agent needs: what it does, when to call it, what it does NOT do, and the identity of the refusal marker. No gap remains that would cause a misinvocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There are zero parameters, so the baseline is 4; the schema itself already states 'No arguments. Send {}.' The description adds no parameter detail, which is correct since none exist.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific resource and effect: it confirms read-only QNM suite-presence stays ON and returns MESH-DISABLE-REFUSED rather than disabling anything. The verb/resource pairing is slightly inverted from the tool name (mesh_disable actually refuses to disable), but the text explicitly corrects this with 'not a kill switch' and distinguishes it from mesh_leave and mesh_enable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives an explicit when ('when a client still posts the historical disable route and needs the honest refuse') and an explicit when-not with named alternatives ('Do not use it for dropping one node or declaring an extra bearer; use mesh_leave or mesh_enable instead'). Routing between siblings is unambiguous.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mesh_enableEnable QNM radios (declared bearer)A

Declare an extra QNM suite bearer (POST /v1/mesh/enable) — additive presence, not a first-time on-switch. Use this when an operator wants to declare an additional bearer (example: suite-presence) on top of the default-on rollup. Do not use it for reading status, joining one node, turning suite-presence off, or logging into an account; use mesh_status, mesh_join, or mesh_nodes instead. Write: stores the bearer. Rate-limited. Empty {} is refused (MESH-NEED-BEARER). Login/account/recover/gate names refuse. Does not arm, wipe, heal, or resurrect accounts. Not a login mesh. Read-only suite-presence is already ON by default. bearer is required. Example: suite-presence. Mutation requires confirm=true (runtime gate) or dry_run=true (preview only, no write). confirm and dry_run stay optional on inputSchema.required. Returns enabled state, bearers, and suite-presence note.

ParametersJSON Schema
NameRequiredDescriptionDefault
bearerYesRequired declared bearer name. Example: suite-presence. Login / account / recover / recovery / gate / IP / publish / phoenix / heal names refuse MESH-ENABLE. This is not a login mesh.
confirmNoDocumented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true (preview, no write).
dry_runNoOptional preview flag. When true, return a would-mutate preview and do not write. Alternative to confirm=true. Does not mutate.

Output Schema

ParametersJSON Schema
NameRequiredDescription
codeNoFragGate or fabric code when present: FG-OK, FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-UNKNOWN-OP, FG-GATE-REFUSE, FG-LAMB-REFUSE, or a module refuse such as MESH-* / AKM-*.
doorNoDoor name. The public door is fraggate.
ran_inNoExecution locale (for example aziel-runtime) when present.
resultNoFragGate body: ok, code, door, slug, op, engine_digest, ran_in, provenance, refusal, limitations, receipt, plus the engine result. Unknown names refuse FG-HALLUC-TOOL; stubs refuse FG-STUB.
statusNoHTTP-like status when present on wrappers (200 ok; 400+ error / refuse).
displayNoHuman-facing envelope. Show title and summary, then take the next input.
receiptNoOptional receipt, ledger tip, or TemporalLock/ForgeReceipts exit when the door stamped one.
refusalNoExplicit refuse object, code, or message when the door or engine refused.
engine_opNoResolved engine op when present (often inside result).
ledger_tipNoAsk/refuse ledger tip when the door stamped one.
provenanceNoProvenance / input packet when the pipeline attached one.
session_idNoRaw session id when session plumbing was used. Hidden unless the user asked for the chain.
engine_slugNoResolved engine slug when present (often inside result).
limitationsNoCapability limitations or Remain-OFF notes when present.
engine_digestNo64-hex engine_digest when a true in-process engine ran (often inside result).

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description goes well beyond the annotations by disclosing that the operation 'stores the bearer,' is rate-limited, refuses empty and reserved names, and does not arm, wipe, heal, or resurrect accounts. It also clarifies the mutation gate: 'Mutation requires confirm=true (runtime gate) or dry_run=true (preview only, no write).' No contradiction with annotations exists.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well organized and effectively front-loaded, but it is somewhat repetitive: 'bearer is required' appears in both the description and schema, and 'not a login mesh' plus the reserved-name refusal appear in both the description and the bearer parameter description. Tighter wording would be more efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the presence of an output schema, the description does not need to explain return values, yet it still mentions them briefly. It covers use cases, non-use cases, failure conditions, reserved names, mutation requirements, and side effects, making it complete for an agent to call correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds meaningful parameter semantics by explaining that bearer is required, that confirm and dry_run are optional in the schema yet required as a runtime mutation gate, and that login/account/gate names are refused. This adds value beyond the raw schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Declare an extra QNM suite bearer (POST /v1/mesh/enable)' and immediately clarifies it is 'additive presence, not a first-time on-switch.' This clearly differentiates mesh_enable from the sibling tools such as mesh_status, mesh_join, and mesh_nodes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly says when to use the tool: 'Use this when an operator wants to declare an additional bearer on top of the default-on rollup.' It also gives explicit exclusions and alternatives: 'Do not use it for reading status, joining one node, turning suite-presence off, or logging into an account; use mesh_status, mesh_join, or mesh_nodes instead.' This leaves little room for ambiguity.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mesh_heartbeatRefresh QNM rollup presenceA

Refresh one existing node's 5-minute QNM TTL (POST /v1/mesh/heartbeat) — not a first join. Use this when you already have a node_id from mesh_join and transmission radios are LIVE. Do not use it for first-time registration or dropping the node; use mesh_join or mesh_leave instead. Write: refreshes the strict 5-minute TTL (not idempotent). Miss the window and the node is dropped from the live roster. Radios off refuses MESH-OFF. Unknown or expired node_id refuses MESH-UNKNOWN-NODE — join again; no account resurrection. node_id is required. presence may replace the class (live|locked|isolated). Optional tip_hash and prev are 64 hex only (Split the wires + REHEAL: presence + tip hash; no body/diff/vote-to-fix). OPERATOR-OVERRIDE 2026-09-17 armed neighbor_heal. Mutation requires confirm=true (runtime gate) or dry_run=true (preview only, no write). confirm and dry_run stay optional on inputSchema.required. Returns updated presence and TTL. Body on this plane refuses MESH-NO-BYTES. Same prev + two tips refuses MESH-EQUIVOCATION. Vote-to-fix still refuses MESH-NO-NEIGHBOR-HEAL.

ParametersJSON Schema
NameRequiredDescriptionDefault
prevNoOptional 64-hex prev the receiver already holds. Same prev + a different tip_hash isolates this node (MESH-EQUIVOCATION).
confirmNoDocumented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true (preview, no write).
dry_runNoOptional preview flag. When true, return a would-mutate preview and do not write. Alternative to confirm=true. Does not mutate.
node_idYesRequired node id returned by mesh_join.
presenceNoOptional replacement presence class. Other values refuse MESH-BAD-INPUT.
tip_hashNoOptional 64-hex tip hash on the fast tick. Fixed-size. No body. Split the wires.

Output Schema

ParametersJSON Schema
NameRequiredDescription
codeNoFragGate or fabric code when present: FG-OK, FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-UNKNOWN-OP, FG-GATE-REFUSE, FG-LAMB-REFUSE, or a module refuse such as MESH-* / AKM-*.
doorNoDoor name. The public door is fraggate.
ran_inNoExecution locale (for example aziel-runtime) when present.
resultNoFragGate body: ok, code, door, slug, op, engine_digest, ran_in, provenance, refusal, limitations, receipt, plus the engine result. Unknown names refuse FG-HALLUC-TOOL; stubs refuse FG-STUB.
statusNoHTTP-like status when present on wrappers (200 ok; 400+ error / refuse).
displayNoHuman-facing envelope. Show title and summary, then take the next input.
receiptNoOptional receipt, ledger tip, or TemporalLock/ForgeReceipts exit when the door stamped one.
refusalNoExplicit refuse object, code, or message when the door or engine refused.
engine_opNoResolved engine op when present (often inside result).
ledger_tipNoAsk/refuse ledger tip when the door stamped one.
provenanceNoProvenance / input packet when the pipeline attached one.
session_idNoRaw session id when session plumbing was used. Hidden unless the user asked for the chain.
engine_slugNoResolved engine slug when present (often inside result).
limitationsNoCapability limitations or Remain-OFF notes when present.
engine_digestNo64-hex engine_digest when a true in-process engine ran (often inside result).

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations (readOnlyHint=false, idempotentHint=false, destructiveHint=false), the description discloses concrete behavioral traits: the refresh is not idempotent, a missed 5-minute window drops the node, radios-off refuses MESH-OFF, expired node_id refuses MESH-UNKNOWN-NODE with no account resurrection, mutation requires confirm=true or dry_run=true, and various body/equivocation/heal refusals. This is rich, specific behavioral context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but densely informative, with purpose and usage front-loaded in the first two sentences. The later sentences cover refusal conditions and mutation gates that are essential for correct invocation, so they earn their place. Some domain jargon ('Split the wires', 'REHEAL', 'armed neighbor_heal') is unexplained, which slightly reduces clarity, but the overall structure is logical and purposeful.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has 6 parameters, critical mutation semantics, and a complex refusal-code surface, the description covers everything an agent needs to invoke it correctly: prerequisites, alternatives, mutation gates, per-parameter constraints, and failure behavior. An output schema exists, so the absence of a return-format explanation is not a gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3, but the description adds meaning beyond the schema: node_id comes from mesh_join, presence replaces the live|locked|isolated class, tip_hash is on the fast tick with no body, and same prev plus two tips causes MESH-EQUIVOCATION. It also clarifies that confirm/dry_run remain optional in the schema but are runtime-required for mutation, which materially improves parameter understanding.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Refresh one existing node's 5-minute QNM TTL (POST /v1/mesh/heartbeat) — not a first join.' This clearly distinguishes it from the sibling tools mesh_join and mesh_leave by explicitly saying what it is not, so an agent can select it correctly without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit when-to-use guidance: 'Use this when you already have a node_id from mesh_join and transmission radios are LIVE.' It also names exclusions and alternatives: 'Do not use it for first-time registration or dropping the node; use mesh_join or mesh_leave instead.' This fully covers the selection decision.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mesh_joinRegister QNM rollup presenceA

Register one product node into the QNM rollup (POST /v1/mesh/join) — first presence, not a TTL refresh. Use this when transmission radios are LIVE and a catalog product should appear in live/locked/isolated counts. Do not use it for refreshing an existing node, reading the roster, enabling radios, or opening an account session; use mesh_heartbeat, mesh_nodes, mesh_enable, or runtime_session_open instead. Write: additive presence with a strict 5-minute TTL. Non-isolated nodes (active live or inactive locked) count toward public Live Nodes (mesh size). Isolated nodes do not. {slug}-worker is also labeled software_nodes and must not be used alone as Live Nodes. No heartbeat (or fan-out refresh) inside that window drops the node from the roster. Radios off refuses MESH-OFF. Missing product / bad node_id / bad presence refuse MESH-BAD-INPUT. Downloads are not live. Read-only suite-presence is ON by default. Not an account session. AnonBroadcast is not a product. Kernel-direct fabric wrapper — same mesh kernel as FragGate mesh/join; not MASTER-33; human Join uses fraggate_call. product is required (catalog slug). node_id optional 8–80 [a-z0-9._-]. presence is live|locked|isolated (default live). Mutation requires confirm=true (runtime gate) or dry_run=true (preview only, no write). confirm and dry_run stay optional on inputSchema.required. Returns node_id, presence, presence_ttl_ms (300000), and TTL note. MESH-OFF when radios are off.

ParametersJSON Schema
NameRequiredDescriptionDefault
labelNoOptional short label for the roster. Display only; not a score.
confirmNoDocumented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true (preview, no write).
dry_runNoOptional preview flag. When true, return a would-mutate preview and do not write. Alternative to confirm=true. Does not mutate.
node_idNoOptional stable node id. When set, must be 8–80 characters matching [a-z0-9._-]. Omit to receive a generated id.
productYesRequired catalog product slug (a-z0-9-, for example godlock, azmail). AnonBroadcast is refused. Unknown slugs refuse MESH-BAD-INPUT.
presenceNoOptional rollup class. live (default), locked, or isolated. No scores. Other values refuse MESH-BAD-INPUT.

Output Schema

ParametersJSON Schema
NameRequiredDescription
codeNoFragGate or fabric code when present: FG-OK, FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-UNKNOWN-OP, FG-GATE-REFUSE, FG-LAMB-REFUSE, or a module refuse such as MESH-* / AKM-*.
doorNoDoor name. The public door is fraggate.
ran_inNoExecution locale (for example aziel-runtime) when present.
resultNoFragGate body: ok, code, door, slug, op, engine_digest, ran_in, provenance, refusal, limitations, receipt, plus the engine result. Unknown names refuse FG-HALLUC-TOOL; stubs refuse FG-STUB.
statusNoHTTP-like status when present on wrappers (200 ok; 400+ error / refuse).
displayNoHuman-facing envelope. Show title and summary, then take the next input.
receiptNoOptional receipt, ledger tip, or TemporalLock/ForgeReceipts exit when the door stamped one.
refusalNoExplicit refuse object, code, or message when the door or engine refused.
engine_opNoResolved engine op when present (often inside result).
ledger_tipNoAsk/refuse ledger tip when the door stamped one.
provenanceNoProvenance / input packet when the pipeline attached one.
session_idNoRaw session id when session plumbing was used. Hidden unless the user asked for the chain.
engine_slugNoResolved engine slug when present (often inside result).
limitationsNoCapability limitations or Remain-OFF notes when present.
engine_digestNo64-hex engine_digest when a true in-process engine ran (often inside result).

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Description reveals mutation semantics ('Write: additive presence with a strict 5-minute TTL'), counting rules for live/locked/isolated nodes, the software_nodes caveat, error codes (MESH-OFF, MESH-BAD-INPUT), and the confirm/dry_run gate. Annotations only provide hint flags (readOnly=false, etc.), so this content adds substantial behavioral context beyond them.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long and information-dense, but front-loaded with purpose and usage before behavioral details. Every sentence contributes necessary context for a complex tool, though the density sacrifices some readability.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers purpose, usage, behavioral quirks, error modes, parameter semantics, mutation requirements, and return fields (node_id, presence, presence_ttl_ms). With an output schema and 100% parameter coverage, nothing essential is missing for an agent to invoke this correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema already documents all parameters (100% coverage), and the description adds the crucial confirm/dry_run mutation gate and the default for presence. However, it mostly restates schema constraints (node_id pattern, product required), so value added beyond schema is moderate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Register'), resource ('one product node into QNM rollup'), and explicitly distinguishes it from a TTL refresh ('first presence, not a TTL refresh'). It also names sibling tools for alternative operations, so an agent can tell it apart from mesh_heartbeat or mesh_enable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states the condition for use ('when transmission radios are LIVE and a catalog product should appear in live/locked/isolated counts') and lists exclusions ('Do not use it for refreshing an existing node...') with named alternatives (mesh_heartbeat, mesh_nodes, mesh_enable, runtime_session_open). This is textbook when/when-not guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mesh_leaveDrop QNM rollup presenceA
DestructiveIdempotent

Drop one node from the QNM rollup (POST /v1/mesh/leave) — not a suite-wide radio off. Use this when a previously joined node should leave the counts. Do not use it for turning suite-presence off or listing nodes; use mesh_nodes or mesh_status instead. Destructive to that node's presence only. Always allowed. No implicit heal. Repeating a missing node_id is a no-op/refuse, not resurrection. node_id is required. Mutation requires confirm=true (runtime gate) or dry_run=true (preview only, no write). confirm and dry_run stay optional on inputSchema.required. Returns leave receipt for the node_id.

ParametersJSON Schema
NameRequiredDescriptionDefault
confirmNoDocumented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true (preview, no write).
dry_runNoOptional preview flag. When true, return a would-mutate preview and do not write. Alternative to confirm=true. Does not mutate.
node_idYesRequired node id to drop from the rollup.

Output Schema

ParametersJSON Schema
NameRequiredDescription
codeNoFragGate or fabric code when present: FG-OK, FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-UNKNOWN-OP, FG-GATE-REFUSE, FG-LAMB-REFUSE, or a module refuse such as MESH-* / AKM-*.
doorNoDoor name. The public door is fraggate.
ran_inNoExecution locale (for example aziel-runtime) when present.
resultNoFragGate body: ok, code, door, slug, op, engine_digest, ran_in, provenance, refusal, limitations, receipt, plus the engine result. Unknown names refuse FG-HALLUC-TOOL; stubs refuse FG-STUB.
statusNoHTTP-like status when present on wrappers (200 ok; 400+ error / refuse).
displayNoHuman-facing envelope. Show title and summary, then take the next input.
receiptNoOptional receipt, ledger tip, or TemporalLock/ForgeReceipts exit when the door stamped one.
refusalNoExplicit refuse object, code, or message when the door or engine refused.
engine_opNoResolved engine op when present (often inside result).
ledger_tipNoAsk/refuse ledger tip when the door stamped one.
provenanceNoProvenance / input packet when the pipeline attached one.
session_idNoRaw session id when session plumbing was used. Hidden unless the user asked for the chain.
engine_slugNoResolved engine slug when present (often inside result).
limitationsNoCapability limitations or Remain-OFF notes when present.
engine_digestNo64-hex engine_digest when a true in-process engine ran (often inside result).

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses behaviors beyond annotations: 'Destructive to that node's presence only', 'No implicit heal', 'Repeating a missing node_id is a no-op/refuse', and the confirm/dry_run runtime gate. These add practical context that annotations (destructiveHint, idempotentHint) do not fully convey. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but well-structured, starting with purpose, then usage, then behavioral details, parameter gates, and return. Each sentence earns its place, though it is slightly long. It is appropriately sized for a mutating tool with gates.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

It covers purpose, usage exclusions, edge cases (missing node_id), confirmation requirements, dry_run preview, and return receipt. With an output schema present, it need not detail return structure. This is complete for safe and correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

While schema coverage is 100%, the description adds essential semantics: it clarifies that node_id is required, explains the runtime gate requiring confirm=true or dry_run=true, and notes that confirm and dry_run remain optional in the schema despite being required for mutation. This is critical for correct invocation and goes beyond schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Drop one node from the QNM rollup' with a specific verb and resource, and distinguishes it from 'a suite-wide radio off'. It also names alternatives (mesh_nodes, mesh_status) so the agent can differentiate it from sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit guidance: 'Use this when a previously joined node should leave the counts' and 'Do not use it for turning suite-presence off or listing nodes; use mesh_nodes or mesh_status instead.' This provides direct when-to-use and when-not-to-use conditions with named alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mesh_nodesList QNM rollup nodesA
Read-onlyIdempotent

List the QNM node roster (node_id + presence + 5-minute TTL) — not suite totals. Use this when you need the current node list after mesh_status. Do not use it for suite counts without the roster, or mutating presence; use mesh_status, mesh_join, or mesh_leave instead. No scores. No leaderboard. Views/MCP/downloads do not enter QNM-S. Returns node roster with presence classes.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
codeNoFragGate or fabric code when present: FG-OK, FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-UNKNOWN-OP, FG-GATE-REFUSE, FG-LAMB-REFUSE, or a module refuse such as MESH-* / AKM-*.
doorNoDoor name. The public door is fraggate.
ran_inNoExecution locale (for example aziel-runtime) when present.
resultNoFragGate body: ok, code, door, slug, op, engine_digest, ran_in, provenance, refusal, limitations, receipt, plus the engine result. Unknown names refuse FG-HALLUC-TOOL; stubs refuse FG-STUB.
statusNoHTTP-like status when present on wrappers (200 ok; 400+ error / refuse).
displayNoHuman-facing envelope. Show title and summary, then take the next input.
receiptNoOptional receipt, ledger tip, or TemporalLock/ForgeReceipts exit when the door stamped one.
refusalNoExplicit refuse object, code, or message when the door or engine refused.
engine_opNoResolved engine op when present (often inside result).
ledger_tipNoAsk/refuse ledger tip when the door stamped one.
provenanceNoProvenance / input packet when the pipeline attached one.
session_idNoRaw session id when session plumbing was used. Hidden unless the user asked for the chain.
engine_slugNoResolved engine slug when present (often inside result).
limitationsNoCapability limitations or Remain-OFF notes when present.
engine_digestNo64-hex engine_digest when a true in-process engine ran (often inside result).

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare the safe read-only, idempotent profile, so the bar is lower. The description still adds real behavioral context: a 5-minute TTL and presence classes on nodes, plus scope exclusions. Minor deduction because some clauses ("Views/MCP/downloads do not enter QNM-S") are cryptic rather than clarifying.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the core purpose and the "not suite totals" qualifier before usage and exclusions. Mostly second sentence earns its place, but the terse fragments "No scores. No leaderboard." are slightly redundant noise that dilute the signal.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, return values need no explanation, and annotations carry the safety profile. The description supplies the purpose, usage routing, and scope constraints an agent needs to invoke this zero-argument tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Zero parameters, which is the baseline-4 case. The schema itself explains "No arguments. Send {}." and the description correctly adds nothing about parameters, so there is no gap to compensate for.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ("List the QNM node roster") and enumerates the returned fields (node_id + presence + TTL) while explicitly excluding suite totals. It names the siblings it is not (mesh_status, mesh_join, mesh_leave), so an agent can distinguish it without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit when-to-use ("after mesh_status", when you need the current node list) and when-not-to-use with named alternatives ("use mesh_status, mesh_join, or mesh_leave instead"). This is the full when/when-not/alternatives pattern.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mesh_statusQNM suite rollupA
Read-onlyIdempotent

Read QNM suite rollup totals (enabled?, bearers, live_nodes = mesh size active+inactive excluding isolated, software_nodes = {slug}-worker roster) — not the node roster. Packet-transfer cite is QNS-CD-1.0 (photon QNS1 1.3 on local qnsd; GET /v1/qns cites only; Worker does not proxy via emit). Use this when you need public Live Nodes (mesh size) or software_nodes (product Worker roster). Do not use it for listing individual nodes, enabling extra radios, or executing a catalog engine; use mesh_nodes, mesh_enable, or fraggate_call instead. Read-only. Never enables radios beyond default suite-presence. Read-only suite-presence is ON by default. Not a login mesh. Views/MCP/downloads do not enter QNM-S. Full node process is local qnm-node/. Kernel-direct fabric wrapper — not MASTER-33; not a second Softwares door. Softwares exec stays fraggate_call. Returns enabled flag, bearers, live_nodes (mesh size), active_nodes, inactive_nodes, isolated_nodes, software_nodes (product Workers), and QNS-CD-1.0 cite.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
codeNoFragGate or fabric code when present: FG-OK, FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-UNKNOWN-OP, FG-GATE-REFUSE, FG-LAMB-REFUSE, or a module refuse such as MESH-* / AKM-*.
doorNoDoor name. The public door is fraggate.
ran_inNoExecution locale (for example aziel-runtime) when present.
resultNoFragGate body: ok, code, door, slug, op, engine_digest, ran_in, provenance, refusal, limitations, receipt, plus the engine result. Unknown names refuse FG-HALLUC-TOOL; stubs refuse FG-STUB.
statusNoHTTP-like status when present on wrappers (200 ok; 400+ error / refuse).
displayNoHuman-facing envelope. Show title and summary, then take the next input.
receiptNoOptional receipt, ledger tip, or TemporalLock/ForgeReceipts exit when the door stamped one.
refusalNoExplicit refuse object, code, or message when the door or engine refused.
engine_opNoResolved engine op when present (often inside result).
ledger_tipNoAsk/refuse ledger tip when the door stamped one.
provenanceNoProvenance / input packet when the pipeline attached one.
session_idNoRaw session id when session plumbing was used. Hidden unless the user asked for the chain.
engine_slugNoResolved engine slug when present (often inside result).
limitationsNoCapability limitations or Remain-OFF notes when present.
engine_digestNo64-hex engine_digest when a true in-process engine ran (often inside result).

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, and destructiveHint=false, and the description reinforces them with 'Read-only' and 'Never enables radios beyond default suite-presence.' It adds important non-obvious context: this is not a login mesh, Views/MCP/downloads do not enter QNM-S, the node process is local qnm-node/, and it is not a second Softwares door. This goes well beyond the structured annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The core purpose and usage guidance are front-loadedheavily, but the description becomes a dense run-on of system-specific caveats such as 'Kernel-direct fabric wrapper — not MASTER-33; not a second Softwares door' and 'Views/MCP/downloads do not enter QNM-S.' It repeats read-only and radio-enabling statements and mixes return-value enumeration with architectural disambiguation, so it is more verbose than necessary.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite its verbosity, the description is complete for selection and invocation: it explains what fields are returned, gives the live_nodes formula, names the QNS-CD-1.0 citation, states the no-argument contract, and covers exclusions. An output schema also exists, so the agent is not missing any needed context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters rentals and the schema already states 'No arguments. Send {}.', so there is no parameter-level detail for the description to add. The baseline of 4 for a no-parameter tool is appropriate, and the description does not need to compensate for any schema gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource ('Read QNM suite rollup totals') and immediately defines the key fields (live_nodes, software_nodes, bearers, etc.). It explicitly says this is 'not the node roster' and names mesh_nodes as the sibling to use for listing individual nodes, making its scope unmistakable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives explicit positive guidance: 'Use this when you need public Live Nodes (mesh size) or software_nodes (product Worker roster).' It also provides clear negative guidance with named alternatives: 'Do not use it for listing individual nodes, enabling extra radios, or executing a catalog engine; use mesh_nodes, mesh_enable, or fraggate_call instead.'

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

runtime_bundleList every product (bundle helper)A
Read-onlyIdempotent

Read a compact bootstrap of every product skill URL and invoke prefix — not Software-tab cards and not the hashed registry. Use this when a client needs skill URLs in one shot. Do not use it for Software-tab refresh, hashed registry discovery, or exec; use runtime_software, fraggate_list, or fraggate_call instead. Prefer GET /v1/software for hub Software tabs. This helper is URL bootstrap only. Returns compact product list with skill URLs.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
codeNoFragGate or fabric code when present: FG-OK, FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-UNKNOWN-OP, FG-GATE-REFUSE, FG-LAMB-REFUSE, or a module refuse such as MESH-* / AKM-*.
doorNoDoor name. The public door is fraggate.
ran_inNoExecution locale (for example aziel-runtime) when present.
resultNoMachine payload. FragGate-style results commonly include ok, code, slug, op, status, engine_slug, engine_op, engine_digest, ran_in, provenance, refusal, limitations, and ledger_tip.
statusNoHTTP-like status when present on wrappers (200 ok; 400+ error / refuse).
displayNoHuman-facing envelope. Show title and summary, then take the next input.
receiptNoOptional receipt, ledger tip, or TemporalLock/ForgeReceipts exit when the door stamped one.
refusalNoExplicit refuse object, code, or message when the door or engine refused.
engine_opNoResolved engine op when present (often inside result).
ledger_tipNoAsk/refuse ledger tip when the door stamped one.
provenanceNoProvenance / input packet when the pipeline attached one.
session_idNoRaw session id when session plumbing was used. Hidden unless the user asked for the chain.
engine_slugNoResolved engine slug when present (often inside result).
limitationsNoCapability limitations or Remain-OFF notes when present.
engine_digestNo64-hex engine_digest when a true in-process engine ran (often inside result).

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, destructiveHint=false and openWorldHint=false, so the safety profile is covered. The description adds scope boundaries the annotations do not carry — that this is a URL-bootstrap-only helper that does not touch Software-tab cards or the hashed registry — though it says nothing about auth or rate limits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core purpose and well ordered (what, when, when-not, alternatives). However, 'compact bootstrap', 'This helper is URL bootstrap only', and 'Returns compact product list with skill URLs' restate the same point three times, so it is slightly redundant.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return-value explanation is optional (though the description supplies it redundantly). Routing to alternatives is complete; the only gap is the absence of any note about response compactness limits or invocation constraints, which is minor for a no-arg read.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Zero-parameter tool, so the baseline is 4; there is nothing for the description to disambiguate. The schema's own 'No arguments. Send {}.' note already covers invocation, and the description adds no param detail beyond restating the bootstrap nature.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('Read a compact bootstrap of every product skill URL and invoke prefix') and explicitly negates two sibling scopes (Software-tab cards, hashed registry). An agent can identify what it returns and what it does not without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly names when to use it ('when a client needs skill URLs in one shot'), when not to use it (Software-tab refresh, hashed registry discovery, exec), and routes to the correct alternatives (runtime_software, fraggate_list, fraggate_call). This is a complete routing statement.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

runtime_manifestAdvanced: runtime manifestA
Read-onlyIdempotent

[advanced/internal] Read the machine runtime manifest JSON (version, role, door=fraggate, engine slugs, registry_digest) — not the human how-to. Use this when a client needs the machine manifest rather than the human skill. Do not use it for the default agent how-to or hashed registry discovery; use runtime_skill or fraggate_list instead. Not the default agent path. Does not list hub cards or execute. Returns manifest including door=fraggate and registry_digest.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
codeNoFragGate or fabric code when present: FG-OK, FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-UNKNOWN-OP, FG-GATE-REFUSE, FG-LAMB-REFUSE, or a module refuse such as MESH-* / AKM-*.
doorNoDoor name. The public door is fraggate.
ran_inNoExecution locale (for example aziel-runtime) when present.
resultNoMachine payload. FragGate-style results commonly include ok, code, slug, op, status, engine_slug, engine_op, engine_digest, ran_in, provenance, refusal, limitations, and ledger_tip.
statusNoHTTP-like status when present on wrappers (200 ok; 400+ error / refuse).
displayNoHuman-facing envelope. Show title and summary, then take the next input.
receiptNoOptional receipt, ledger tip, or TemporalLock/ForgeReceipts exit when the door stamped one.
refusalNoExplicit refuse object, code, or message when the door or engine refused.
engine_opNoResolved engine op when present (often inside result).
ledger_tipNoAsk/refuse ledger tip when the door stamped one.
provenanceNoProvenance / input packet when the pipeline attached one.
session_idNoRaw session id when session plumbing was used. Hidden unless the user asked for the chain.
engine_slugNoResolved engine slug when present (often inside result).
limitationsNoCapability limitations or Remain-OFF notes when present.
engine_digestNo64-hex engine_digest when a true in-process engine ran (often inside result).

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly/idempotent/non-destructive/closed-world, lowering the bar, and the description usefully adds scope limits (“Does not list hub cards or execute”) plus the [advanced/internal] positioning. It does not add much beyond that, but the extra scope disclosure is genuine value over the structured fields.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The [advanced/internal] tag is well front-loaded, but the text is repetitive: door=fraggate and registry_digest appear twice, and the human-how-to exclusion is restated as both “not the human how-to” and “not the default agent path.” Several sentences could be merged without losing meaning.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, return values need not be explained, and the annotations carry the safety profile. The description covers purpose, alternatives, and scope limits well; only the redundancy keeps it from being fully tight.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes 0 parameters, so the baseline is 4; schema coverage is 100% and the description correctly signals no arguments are needed. There is no parameter semantics to add.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource (“Read the machine runtime manifest JSON”) and enumerates the returned contents (version, role, door=fraggate, engine slugs, registry_digest). It explicitly distinguishes itself from the human how-to skill and names related siblings, so an agent can separate it from peers without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit when-to-use (“when a client needs the machine manifest rather than the human skill”) and when-not (“Do not use it for the default agent how-to or hashed registry discovery”), naming the alternatives runtime_skill and fraggate_list. Routing is unambiguous.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

runtime_pullOpen one productA
Read-onlyIdempotent

Open one hub product card by slug (name, version, skill, download, ops) — not FragGate live/stub status. Use this when you already have a slug from GET /v1/software or fraggate_list and need the card, not exec. Do not use it for inspecting FragGate live/stub status or executing an op; use fraggate_describe or fraggate_call instead. Not exec — then use fraggate_call. Unknown slug throws unknown product (it does not invent a card and does not refuse FG-HALLUC-TOOL; that code is FragGate-only). Missing skill falls back to in-repo markdown. slug is required. product is an accepted alias of slug. Extra keys besides those two are ignored and are not an op payload. Returns one product card (name, version, skill, download, ops, skill_source).

ParametersJSON Schema
NameRequiredDescriptionDefault
slugYesRequired catalog slug from GET /v1/software or fraggate_list (for example foldlock). Alias: product. Not an exec path.
productNoAlias of slug. Do not send two different values.

Output Schema

ParametersJSON Schema
NameRequiredDescription
codeNoFragGate or fabric code when present: FG-OK, FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-UNKNOWN-OP, FG-GATE-REFUSE, FG-LAMB-REFUSE, or a module refuse such as MESH-* / AKM-*.
doorNoDoor name. The public door is fraggate.
ran_inNoExecution locale (for example aziel-runtime) when present.
resultNoOne hub product card: name, version, skill markdown, download, ops, skill_source. Unknown slug is unknown product — not a FragGate FG-HALLUC-TOOL envelope.
statusNoHTTP-like status when present on wrappers (200 ok; 400+ error / refuse).
displayNoHuman-facing envelope. Show title and summary, then take the next input.
receiptNoOptional receipt, ledger tip, or TemporalLock/ForgeReceipts exit when the door stamped one.
refusalNoExplicit refuse object, code, or message when the door or engine refused.
engine_opNoResolved engine op when present (often inside result).
ledger_tipNoAsk/refuse ledger tip when the door stamped one.
provenanceNoProvenance / input packet when the pipeline attached one.
session_idNoRaw session id when session plumbing was used. Hidden unless the user asked for the chain.
engine_slugNoResolved engine slug when present (often inside result).
limitationsNoCapability limitations or Remain-OFF notes when present.
engine_digestNo64-hex engine_digest when a true in-process engine ran (often inside result).

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly/idempotent/non-destructive, and the description adds substantial behavior beyond that: unknown slug throws 'unknown product' rather than inventing a card or emitting FG-HALLUC-TOOL, and a missing skill falls back to in-repo markdown. It also clarifies extra keys are ignored and are not an op payload.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The routing constraint is front-loaded, but the text is redundant: 'not FragGate live/stub status' and 'not exec' are each stated twice, and the return-field list duplicates the output schema. It earns its size only partially.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present and full annotation coverage, the description need not explain return values, yet it still covers the routing decision, error behavior, and fallback semantics. Nothing an agent needs to call it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the schema already documents slug, the product alias, and that extra keys are ignored, so the baseline is 3. The description largely restates the alias/required semantics rather than adding new meaning, though the 'not an exec path' note is mildly useful.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Open one hub product card by slug') and enumerates the card fields (name, version, skill, download, ops). It explicitly contrasts itself with the FragGate status siblings and with exec, so an agent can distinguish it without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives an explicit trigger ('when you already have a slug from GET /v1/software or fraggate_list'), explicit exclusions (do not use for FragGate live/stub status or executing an op), and names the alternatives fraggate_describe and fraggate_call for those cases.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

runtime_runAdvanced: raw runtime_runA

[advanced/internal] Advanced exec façade: admit a slug+op (still DecisionGATE-admitted) and run it through a raw session. Not the default door. Use this when you were explicitly asked for the raw runtime_run path. Do not use it for the default agent exec path or an already-open session you were asked to exec on; use fraggate_call (default) or runtime_session_exec (existing session_id) instead. Side effects are operation-dependent. Not a backdoor past FragGate. Opens a session when session_id is omitted. slug and op are required. session_id optional; omit to auto-open. Extra keys other than payload/session_id may be treated as payload. Mutation requires confirm=true (runtime gate) or dry_run=true (preview only, no write). confirm and dry_run stay optional on inputSchema.required. Returns exec display envelope with session_id, result, engine_digest, ran_in, and refusal when gated.

ParametersJSON Schema
NameRequiredDescriptionDefault
opYesRequired allowlisted op. Stubs refuse FG-STUB.
slugYesRequired catalog slug (or name alias). Unknown slugs refuse FG-HALLUC-TOOL.
confirmNoDocumented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true (preview, no write).
dry_runNoOptional preview flag. When true, return a would-mutate preview and do not write. Alternative to confirm=true. Does not mutate.
payloadNoOptional op payload object. Engine-specific.
session_idNoOptional existing raw session id. If omitted, a session is opened automatically. Prefer leaving session plumbing invisible unless asked.

Output Schema

ParametersJSON Schema
NameRequiredDescription
codeNoFragGate or fabric code when present: FG-OK, FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-UNKNOWN-OP, FG-GATE-REFUSE, FG-LAMB-REFUSE, or a module refuse such as MESH-* / AKM-*.
doorNoDoor name. The public door is fraggate.
ran_inNoExecution locale (for example aziel-runtime) when present.
resultNoMachine payload. FragGate-style results commonly include ok, code, slug, op, status, engine_slug, engine_op, engine_digest, ran_in, provenance, refusal, limitations, and ledger_tip.
statusNoHTTP-like status when present on wrappers (200 ok; 400+ error / refuse).
displayNoHuman-facing envelope. Show title and summary, then take the next input.
receiptNoOptional receipt, ledger tip, or TemporalLock/ForgeReceipts exit when the door stamped one.
refusalNoExplicit refuse object, code, or message when the door or engine refused.
engine_opNoResolved engine op when present (often inside result).
ledger_tipNoAsk/refuse ledger tip when the door stamped one.
provenanceNoProvenance / input packet when the pipeline attached one.
session_idNoRaw session id when session plumbing was used. Hidden unless the user asked for the chain.
engine_slugNoResolved engine slug when present (often inside result).
limitationsNoCapability limitations or Remain-OFF notes when present.
engine_digestNo64-hex engine_digest when a true in-process engine ran (often inside result).

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses side-effect dependency, that this is not a backdoor past FragGate, that a session auto-opens when session_id is omitted, and that mutation requires confirm=true or dry_run=true. These details meaningfully extend the annotations, which only say readOnly=false and openWorld=true.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but every sentence earns its place: identity, conditions of use, exclusions, side-effect warning, session semantics, payload rule, mutation gate, and return envelope. The most important routing information is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a high-complexity internal exec tool, the description covers the non-obvious semantics: DecisionGATE admission, open-session behavior, confirm/dry_run gating, extra-key payload handling, and the output envelope including refusal. With a rich schema and output schema present, nothing essential is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema already documents all parameters. The description adds useful emphasis on extra keys being treated as payload and confirm/dry_run enforcement, but it largely restates what the input-schema descriptions already provide.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a concrete verb and resource: 'admit a slug+op ... and run it through a raw session.' It immediately labels the tool as an advanced/internal façade, distinguishing it from the default exec path, and explicitly names fraggate_call and runtime_session_exec as alternatives.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is fully specified: use only when explicitly asked for the raw runtime_run path; do not use for the default agent exec path or an already-open session. It names the correct alternative tools for those cases and adds rules about session_id, confirm, and dry_run.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

runtime_session_closeAdvanced: seal a sessionA
DestructiveIdempotent

[advanced/internal] Seal a raw session so further exec or policy on that session_id is rejected. End of the raw lifecycle — not a LOCKSET seal and not a FragGate call. Use this when the user asked to close the session. Do not use it for ordinary completion, writing a ChainLock LOCKSET, or default product work; use leaving the session to TTL expire (6h), chainlock_seal for a lockset, or fraggate_call for new work instead. Destructive to further exec/policy on that session_id only (session_closed 409). Does not delete receipts. A second close does not reopen — it returns session_closed (409) while the session stays sealed. Missing session returns session_not_found. Prefer leaving sessions to expire unless asked. session_id or id (aliases) required. No force flag on the public tool — TTL expiry is the automatic close path. Mutation requires confirm=true (runtime gate) or dry_run=true (preview only, no write). confirm and dry_run stay optional on inputSchema.required. Returns sealed session status, close receipt, and verified.

ParametersJSON Schema
NameRequiredDescriptionDefault
idNoAlias of session_id. The door accepts either key; do not send two different values.
confirmNoDocumented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true (preview, no write).
dry_runNoOptional preview flag. When true, return a would-mutate preview and do not write. Alternative to confirm=true. Does not mutate.
session_idYesRequired. Raw session id from runtime_session_open (sess_ + 32 lowercase hex). Alias: id. Missing both fails with session_id required; unknown id returns session_not_found.

Output Schema

ParametersJSON Schema
NameRequiredDescription
codeNoFragGate or fabric code when present: FG-OK, FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-UNKNOWN-OP, FG-GATE-REFUSE, FG-LAMB-REFUSE, or a module refuse such as MESH-* / AKM-*.
doorNoDoor name. The public door is fraggate.
ran_inNoExecution locale (for example aziel-runtime) when present.
resultNoClose body: sealed session, close receipt, verified. Errors: session_id required, session_not_found, session_closed (already sealed; does not reopen).
statusNoHTTP-like status when present on wrappers (200 ok; 400+ error / refuse).
displayNoHuman-facing envelope. Show title and summary, then take the next input.
receiptNoOptional receipt, ledger tip, or TemporalLock/ForgeReceipts exit when the door stamped one.
refusalNoExplicit refuse object, code, or message when the door or engine refused.
engine_opNoResolved engine op when present (often inside result).
ledger_tipNoAsk/refuse ledger tip when the door stamped one.
provenanceNoProvenance / input packet when the pipeline attached one.
session_idNoRaw session id when session plumbing was used. Hidden unless the user asked for the chain.
engine_slugNoResolved engine slug when present (often inside result).
limitationsNoCapability limitations or Remain-OFF notes when present.
engine_digestNo64-hex engine_digest when a true in-process engine ran (often inside result).

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate destructiveHint=true and idempotentHint=true, and the description adds meaningful detail beyond that: destructive scope is limited to further exec/policy on that session_id only, receipts are not deleted, a second close returns session_closed (409) without reopening, missing sessions return session_not_found, and mutation requires confirm=true or dry_run=true. This enriches the agent's understanding of side effects and failure modes.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but each sentence earns its place by covering a distinct behavioral fact: scope, alternatives, destructiveness, idempotency, error cases, parameter aliases, and mutation gate. It is front-loaded with the core purpose and ends with return values. No filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is advanced and mutation-heavy with aliases, confirmation flags, destructive effects, and idempotency edge cases. The description covers all of these and also states the return content ('sealed session status, close receipt, and verified'). Given the output schema exists, nothing essential is missing for an agent to select and invoke this correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, but the description adds critical semantics: session_id or id are aliases and must not be sent with two different values, extra keys are ignored, confirm and dry_run are optional in the schema but required for mutation, and dry_run is preview-only. It also explains the pattern and origin of session_id. This goes well beyond the schema text.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb ('Seal') and resource ('raw session'), and states the exact effect: further exec or policy on that session_id is rejected. It explicitly disambiguates from chainlock_seal and fraggate_call, so an agent can distinguish it from siblings without opening their schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives explicit when-to-use ('when the user asked to close the session') and when-not-to-use ('ordinary completion, writing a ChainLock LOCKSET, or default product work'). It names concrete alternatives: TTL expiry, chainlock_seal, and fraggate_call. This fully routes the agent to the correct tool vs the sibling set.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

runtime_session_execAdvanced: raw session execA

[advanced/internal] Raw session exec on an already-open session_id (FragGate-admitted). Not fraggate_call and not runtime_run auto-open. Use this when you already have a session_id and were asked for raw session exec. Do not use it for the default agent exec path or opening a session; use fraggate_call or runtime_session_open instead. Side effects are operation-dependent (read, write, or refuse). Does not mint a session_id — missing id fails before admit. Sealed sessions refuse session_closed (409); TTL 6h refuses session_expired (410); receipt cap 64 refuses receipt_cap (409). Rate-limited (exec). Binding-only ops stay per-op proxy_fallback. Prefer fraggate_call. session_id or id, plus slug and op, are required. payload is optional and engine-specific; leftover keys are not auto-payload the way fraggate_call leftover keys are. Unknown slugs refuse FG-HALLUC-TOOL; stubs refuse FG-STUB. Mutation requires confirm=true (runtime gate) or dry_run=true (preview only, no write). confirm and dry_run stay optional on inputSchema.required. Returns exec result with engine_slug, engine_op, engine_digest, ran_in, receipt, and refusal when gated.

ParametersJSON Schema
NameRequiredDescriptionDefault
idNoAlias of session_id. The door accepts either key; do not send two different values.
opYesRequired allowlisted op. Stubs refuse FG-STUB. UI aliases still forward only after FragGate admit.
slugYesRequired catalog slug to exec. Alias: product. Unknown slugs refuse FG-HALLUC-TOOL. This tool does not auto-open.
confirmNoDocumented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true (preview, no write).
dry_runNoOptional preview flag. When true, return a would-mutate preview and do not write. Alternative to confirm=true. Does not mutate.
payloadNoOptional op payload object. Engine-specific. Unlike fraggate_call, leftover top-level keys are not used as payload.
productNoAlias of slug. Do not send two different values.
session_idYesRequired. Raw session id from runtime_session_open (sess_ + 32 lowercase hex). Alias: id. Missing both fails with session_id required; unknown id returns session_not_found.

Output Schema

ParametersJSON Schema
NameRequiredDescription
codeNoFragGate or fabric code when present: FG-OK, FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-UNKNOWN-OP, FG-GATE-REFUSE, FG-LAMB-REFUSE, or a module refuse such as MESH-* / AKM-*.
doorNoDoor name. The public door is fraggate.
ran_inNoExecution locale (for example aziel-runtime) when present.
resultNoExec body: session, receipt, engine_slug, engine_op, engine_digest, ran_in, refusal when gated. Errors: session_id required, session_closed, session_expired, receipt_cap, FG-HALLUC-TOOL, FG-STUB.
statusNoHTTP-like status when present on wrappers (200 ok; 400+ error / refuse).
displayNoHuman-facing envelope. Show title and summary, then take the next input.
receiptNoOptional receipt, ledger tip, or TemporalLock/ForgeReceipts exit when the door stamped one.
refusalNoExplicit refuse object, code, or message when the door or engine refused.
engine_opNoResolved engine op when present (often inside result).
ledger_tipNoAsk/refuse ledger tip when the door stamped one.
provenanceNoProvenance / input packet when the pipeline attached one.
session_idNoRaw session id when session plumbing was used. Hidden unless the user asked for the chain.
engine_slugNoResolved engine slug when present (often inside result).
limitationsNoCapability limitations or Remain-OFF notes when present.
engine_digestNo64-hex engine_digest when a true in-process engine ran (often inside result).

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Discloses side effects are operation-dependent, lists refusal codes (session_closed, session_expired, receipt_cap), rate limiting, and mutation requirements (confirm/dry_run). This adds substantial context beyond the annotations, which only indicate non-read-only and non-destructive. No contradictions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but every sentence carries essential operational detail. It is front-loaded with the core purpose and exclusions, and structured logically. Slightly verbose for a typical tool, but justified given the advanced nature and complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (8 params, nested objects, output schema), the description covers all necessary operational aspects: required fields, aliases, mutation gates, refusal conditions, rate limits, and return format. Nothing an agent needs to invoke correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, and the description enriches it further by explaining aliases (id/session_id, product/slug), that leftover keys are not auto-payload (unlike fraggate_call), and the semantics of confirm/dry_run. This goes well beyond the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: raw session exec on an already-open session_id. It distinguishes itself from fraggate_call and runtime_session_open by name, making its unique role obvious. The phrase 'Do not use it for the default agent exec path or opening a session' reinforces the specific resource and action.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use: when you already have a session_id and were asked for raw session exec. It names alternatives (fraggate_call, runtime_session_open) and explains when not to use them. This leaves no ambiguity about selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

runtime_session_openAdvanced: open a raw sessionA

[advanced/internal] Open a raw session object (session.id). First step of open → policy → exec → receipt(s) → close. Not the default exec path. Use this when you were explicitly asked for raw session plumbing. Do not use it for the default agent exec path or attaching policy to an existing id; use fraggate_call (default) or runtime_session_policy (existing session_id) instead. Write: creates a session with a 6h TTL and receipt cap 64. Re-open on an existing id returns already=true without resetting the chain. Expired sessions refuse session_expired (410). When REQUIRE_TOKEN=1, session mutate needs RUNTIME_TOKEN; missing SESSION binding returns session_binding_missing (503). Prefer leaving sessions to TTL expire. Not chainlock_seal. Empty {} mints sess_ + 32 hex. Optional id is accepted only when it already matches that pattern; otherwise bad_session_id. source is open metadata (default worker). Mutation requires confirm=true (runtime gate) or dry_run=true (preview only, no write). confirm and dry_run stay optional on inputSchema.required. Returns session.id plus the first receipt in the display envelope.

ParametersJSON Schema
NameRequiredDescriptionDefault
idNoOptional caller-chosen session id. Must already match sess_ + 32 lowercase hex or the open refuses bad_session_id. Omit to mint one.
sourceNoOptional open metadata label. Default worker. Not a permission and not a catalog slug.
confirmNoDocumented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true (preview, no write).
dry_runNoOptional preview flag. When true, return a would-mutate preview and do not write. Alternative to confirm=true. Does not mutate.

Output Schema

ParametersJSON Schema
NameRequiredDescription
codeNoFragGate or fabric code when present: FG-OK, FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-UNKNOWN-OP, FG-GATE-REFUSE, FG-LAMB-REFUSE, or a module refuse such as MESH-* / AKM-*.
doorNoDoor name. The public door is fraggate.
ran_inNoExecution locale (for example aziel-runtime) when present.
resultNoOpen body: session.id, receipts[0], already=true when the id already exists. Errors: bad_session_id, session_binding_missing, session_expired.
statusNoHTTP-like status when present on wrappers (200 ok; 400+ error / refuse).
displayNoHuman-facing envelope. Show title and summary, then take the next input.
receiptNoOptional receipt, ledger tip, or TemporalLock/ForgeReceipts exit when the door stamped one.
refusalNoExplicit refuse object, code, or message when the door or engine refused.
engine_opNoResolved engine op when present (often inside result).
ledger_tipNoAsk/refuse ledger tip when the door stamped one.
provenanceNoProvenance / input packet when the pipeline attached one.
session_idNoRaw session id when session plumbing was used. Hidden unless the user asked for the chain.
engine_slugNoResolved engine slug when present (often inside result).
limitationsNoCapability limitations or Remain-OFF notes when present.
engine_digestNo64-hex engine_digest when a true in-process engine ran (often inside result).

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Description discloses far more behavior than annotations: 6h TTL, receipt cap 64, re-open already=true without chain reset, expired session 410, REQUIRE_TOKEN/RUNTIME_TOKEN requirements, missing SESSION binding 503, and the confirm=true vs dry_run=true mutation gate. These are the runtime traits an agent needs and are entirely absent from the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The text is dense but every clause carries actionable detail, and the most important routing information is front-loaded. It is arguably a wall of semicoloned clauses rather than scannable structure, but the length is justified for an advanced internal tool with many error and edge-case behaviors.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Coverage is thorough: lifecycle context, when to use and not use, auth requirements, failure modes, mutation gates, id generation, and the high-level return shape. Detailed return structure is handled by the output schema, so nothing essential is missing for an agent to invoke this correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is already solid. The description adds meaningful cross-parameter semantics: confirm and dry_run are alternative gates, id must pre-match the pattern or be minted, source is metadata with a worker default, and extra keys may be stored as open metadata. It goes beyond the schema but also partially duplicates schema text, so it is not a 5.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Open a raw session object (session.id).' It also places the tool as the first step in a named open → policy → exec → receipt(s) → close chain, and explicitly distinguishes it from the default exec path. This makes it easy to tell apart from siblings like fraggate_call and runtime_session_policy.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It states the exact condition for use: 'Use this when you were explicitly asked for raw session plumbing.' It also gives explicit exclusions and alternatives: do not use for the default exec path or attaching policy to an existing id; use fraggate_call or runtime_session_policy instead. The lifecycle framing adds practical sequencing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

runtime_session_policyAdvanced: attach session policyA

[advanced/internal] Attach allow rules on an already-open raw session (allow_slugs / allow_ops). Policy overlay — not open and not exec. Identity remains Aziel Eliab. Use this when an already-open session needs tighter allow_slugs / allow_ops before exec. Do not use it for executing an op or opening a session; use runtime_session_exec or runtime_session_open (prefer fraggate_call, which applies defaults) instead. Write: mutates session policy only. A sealed session refuses session_closed (409). Expired sessions refuse session_expired (410). Missing both session_id and id fails before the door runs. Does not exec and does not mint a new id. session_id or id (aliases) required. allow_slugs / allow_ops replace the allow overlay when sent; omit them to leave the current lists. max_payload_bytes and kv_increment are optional overlays, not exec payload. Nested policy{} is accepted as the same overlay. Mutation requires confirm=true (runtime gate) or dry_run=true (preview only, no write). confirm and dry_run stay optional on inputSchema.required. Returns updated session policy plus a policy receipt.

ParametersJSON Schema
NameRequiredDescriptionDefault
idNoAlias of session_id. The door accepts either key; do not send two different values.
confirmNoDocumented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true (preview, no write).
dry_runNoOptional preview flag. When true, return a would-mutate preview and do not write. Alternative to confirm=true. Does not mutate.
allow_opsNoOptional replacement allowlist of ops this session may exec. Omit to keep the current list.
session_idYesRequired. Raw session id from runtime_session_open (sess_ + 32 lowercase hex). Alias: id. Missing both fails with session_id required; unknown id returns session_not_found.
allow_slugsNoOptional replacement allowlist of catalog slugs this session may exec. Omit to keep the current list.
kv_incrementNoOptional. When true, allow KV increment side effects on later exec. Not an increment itself.
max_payload_bytesNoOptional max payload size in bytes for later exec (integer 1..1048576). Overlay only; not the exec body. Out of range refuses bad_policy.

Output Schema

ParametersJSON Schema
NameRequiredDescription
codeNoFragGate or fabric code when present: FG-OK, FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-UNKNOWN-OP, FG-GATE-REFUSE, FG-LAMB-REFUSE, or a module refuse such as MESH-* / AKM-*.
doorNoDoor name. The public door is fraggate.
ran_inNoExecution locale (for example aziel-runtime) when present.
resultNoPolicy body: updated session allow lists and a policy receipt. Refuses session_id required, session_not_found, session_closed, session_expired.
statusNoHTTP-like status when present on wrappers (200 ok; 400+ error / refuse).
displayNoHuman-facing envelope. Show title and summary, then take the next input.
receiptNoOptional receipt, ledger tip, or TemporalLock/ForgeReceipts exit when the door stamped one.
refusalNoExplicit refuse object, code, or message when the door or engine refused.
engine_opNoResolved engine op when present (often inside result).
ledger_tipNoAsk/refuse ledger tip when the door stamped one.
provenanceNoProvenance / input packet when the pipeline attached one.
session_idNoRaw session id when session plumbing was used. Hidden unless the user asked for the chain.
engine_slugNoResolved engine slug when present (often inside result).
limitationsNoCapability limitations or Remain-OFF notes when present.
engine_digestNo64-hex engine_digest when a true in-process engine ran (often inside result).

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses mutation scope ('mutates session policy only'), failure modes (sealed/expired sessions, missing id), and critical preconditions (confirm=true or dry_run=true). It explicitly states it does not exec and does not mint a new id. These behaviors go well beyond the annotations, which only declare false hints, so the description carries the full burden and meets it.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but every sentence adds value. It is front-loaded with purpose and usage, then flows through behavior, parameters, and mutation requirements. No redundant phrases; the density is justified by the tool's complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the advanced nature, 8 parameters, and existing output schema, the description covers every aspect an agent needs: aliases, error conditions, mutation gates, parameter semantics, and alternatives. Nothing required for correct invocation is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Although the schema already documents all parameters, the description adds crucial semantic context: alias relationships (session_id/id), replace-vs-omit behavior for allowlists, the meaning of overlays vs exec payload, and the confirm/dry_run distinction. It also explains nested policy{} acceptance, which is absent from the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a precise verb+resource ('attach session policy') and immediately clarifies it is an 'advanced/internal' overlay, not an open or exec operation. It explicitly names the siblings it is not (runtime_session_open, runtime_session_exec) and the preferred alternative (fraggate_call), making the purpose unmistakable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage guidance is explicit: 'Use this when an already-open session needs tighter allow_slugs / allow_ops before exec.' It then lists what not to use it for and names the correct alternatives. The preference for fraggate_call is stated, giving clear decision rules.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

runtime_session_receiptAdvanced: last session receiptA
Read-onlyIdempotent

[advanced/internal] Read the last receipt only for a raw session — not the full chain. Use this when the user asked for the latest receipt on an open or sealed session. Do not use it for the full receipt chain or product output the user did not ask to audit; use runtime_session_receipts (full chain) or the product display from fraggate_call instead. Does not mutate the session. Unknown id returns session_not_found. An empty receipt list returns receipt=null rather than inventing one. Prefer product output (display) unless the user asked for the chain. session_id or id (aliases) required. No view/limit — this is always the last receipt plus a chain verified flag. Returns the last receipt object (or null) and verified.

ParametersJSON Schema
NameRequiredDescriptionDefault
idNoAlias of session_id. The door accepts either key; do not send two different values.
session_idYesRequired. Raw session id from runtime_session_open (sess_ + 32 lowercase hex). Alias: id. Missing both fails with session_id required; unknown id returns session_not_found.

Output Schema

ParametersJSON Schema
NameRequiredDescription
codeNoFragGate or fabric code when present: FG-OK, FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-UNKNOWN-OP, FG-GATE-REFUSE, FG-LAMB-REFUSE, or a module refuse such as MESH-* / AKM-*.
doorNoDoor name. The public door is fraggate.
ran_inNoExecution locale (for example aziel-runtime) when present.
resultNoLast-receipt body: receipt (or null), verified chain flag, public session. Errors: session_id required, session_not_found.
statusNoHTTP-like status when present on wrappers (200 ok; 400+ error / refuse).
displayNoHuman-facing envelope. Show title and summary, then take the next input.
receiptNoOptional receipt, ledger tip, or TemporalLock/ForgeReceipts exit when the door stamped one.
refusalNoExplicit refuse object, code, or message when the door or engine refused.
engine_opNoResolved engine op when present (often inside result).
ledger_tipNoAsk/refuse ledger tip when the door stamped one.
provenanceNoProvenance / input packet when the pipeline attached one.
session_idNoRaw session id when session plumbing was used. Hidden unless the user asked for the chain.
engine_slugNoResolved engine slug when present (often inside result).
limitationsNoCapability limitations or Remain-OFF notes when present.
engine_digestNo64-hex engine_digest when a true in-process engine ran (often inside result).

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover the safety profile (readOnly, idempotent, non-destructive), but the description adds substantive edge-case behavior: unknown id yields session_not_found, empty receipt lists return receipt=null instead of fabricating one, and there is no view/limit parameterization. It also discloses the returned 'chain verified' flag, which is not evident from annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the core purpose and constraint set within a tight block, and every clause is informative. The closing 'Prefer product output (display) unless the user asked for the chain' mildly repeats the earlier exclusion, a small redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, the description need not explain return values yet still notes receipt object or null plus a verified flag. Error cases, scope, aliases, and alternatives are all covered, leaving nothing essential missing for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the schema already documents the session_id/id alias rule and the pattern. The description restates 'session_id or id (aliases) required' with no additional syntax or format detail beyond the schema, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Read the last receipt only for a raw session') and explicitly contrasts scope with the full-chain sibling runtime_session_receipts. An agent can distinguish it from runtime_session_receipts without opening either schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit when-to-use ('when the user asked for the latest receipt on an open or sealed session'), when-not ('Do not use it for the full receipt chain or product output the user did not ask to audit'), and names the alternatives (runtime_session_receipts, fraggate_call display). Also gives a default preference ('Prefer product output unless the user asked for the chain').

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

runtime_session_receiptsAdvanced: session receipt chainA
Read-onlyIdempotent

[advanced/internal] Read the full receipt chain for a raw session — not the last receipt only. Use this when the user asked for the whole receipt chain. Do not use it for only the last receipt or ordinary product output; use runtime_session_receipt or the product display from fraggate_call instead. Does not mutate the session. Unknown id returns session_not_found. List is the stored chain (cap 64), oldest to newest, plus verified. Prefer product output unless the user asked for the chain. session_id or id (aliases) required. No pagination — the cap is the runtime receipt cap, not a cursor. Returns the receipt list (capped at 64) and verified.

ParametersJSON Schema
NameRequiredDescriptionDefault
idNoAlias of session_id. The door accepts either key; do not send two different values.
session_idYesRequired. Raw session id from runtime_session_open (sess_ + 32 lowercase hex). Alias: id. Missing both fails with session_id required; unknown id returns session_not_found.

Output Schema

ParametersJSON Schema
NameRequiredDescription
codeNoFragGate or fabric code when present: FG-OK, FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-UNKNOWN-OP, FG-GATE-REFUSE, FG-LAMB-REFUSE, or a module refuse such as MESH-* / AKM-*.
doorNoDoor name. The public door is fraggate.
ran_inNoExecution locale (for example aziel-runtime) when present.
resultNoReceipt-chain body: receipts[] (cap 64), verified, public session. Errors: session_id required, session_not_found.
statusNoHTTP-like status when present on wrappers (200 ok; 400+ error / refuse).
displayNoHuman-facing envelope. Show title and summary, then take the next input.
receiptNoOptional receipt, ledger tip, or TemporalLock/ForgeReceipts exit when the door stamped one.
refusalNoExplicit refuse object, code, or message when the door or engine refused.
engine_opNoResolved engine op when present (often inside result).
ledger_tipNoAsk/refuse ledger tip when the door stamped one.
provenanceNoProvenance / input packet when the pipeline attached one.
session_idNoRaw session id when session plumbing was used. Hidden unless the user asked for the chain.
engine_slugNoResolved engine slug when present (often inside result).
limitationsNoCapability limitations or Remain-OFF notes when present.
engine_digestNo64-hex engine_digest when a true in-process engine ran (often inside result).

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover the safety profile (readOnlyHint, idempotentHint, destructiveHint=false), so the bar is lower. The description still adds real context beyond them: unknown id returns session_not_found, results are capped at 64, and the list is oldest-to-newest. The 'does not mutate' line duplicates destructiveHint=false.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded and mostly efficient, but it repeats itself: the cap of 64 appears twice and the 'prefer product output unless the user asked for the chain' guidance is stated twice. Those duplicated sentences do not earn their place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For this scope the definition is complete: purpose, usage boundaries, error behavior, cap, and ordering are all stated, and an output schema exists to cover the return values (the return sentence is redundant but harmless). An agent has everything needed to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents both keys, the alias relationship, and the pattern. The description's 'session_id or id (aliases) required' only restates the schema. Baseline 3 is correct.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (Read) and resource (the full receipt chain for a raw session), and explicitly contrasts itself with the single-receipt variant. An agent can distinguish it from runtime_session_receipt and fraggate_call without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit when (user asked for the whole chain), explicit when-not (not for only the last receipt or ordinary product output), and names the alternatives (runtime_session_receipt, product display from fraggate_call). Nothing is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

runtime_skillHow to use this softwareA
Read-onlyIdempotent

Read the agent how-to (one door — discover, route, refuse; pipeline fraggate_list → fraggate_describe → fraggate_call). This is playbook markdown, not a catalog and not a machine manifest. Use this when starting a session or choosing the door before any catalog call. Do not use it for listing hashed registry names, hub Software-tab cards, or executing an engine; use fraggate_list, runtime_software, or fraggate_call instead. Dual surface: agent chat has no technical UI chrome; Worker / Flutter / local install stay complete human software. Does not list slugs or run ops. Returns skill markdown plus display.title / display.summary.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
codeNoFragGate or fabric code when present: FG-OK, FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-UNKNOWN-OP, FG-GATE-REFUSE, FG-LAMB-REFUSE, or a module refuse such as MESH-* / AKM-*.
doorNoDoor name. The public door is fraggate.
ran_inNoExecution locale (for example aziel-runtime) when present.
resultNoMachine payload. FragGate-style results commonly include ok, code, slug, op, status, engine_slug, engine_op, engine_digest, ran_in, provenance, refusal, limitations, and ledger_tip.
statusNoHTTP-like status when present on wrappers (200 ok; 400+ error / refuse).
displayNoHuman-facing envelope. Show title and summary, then take the next input.
receiptNoOptional receipt, ledger tip, or TemporalLock/ForgeReceipts exit when the door stamped one.
refusalNoExplicit refuse object, code, or message when the door or engine refused.
engine_opNoResolved engine op when present (often inside result).
ledger_tipNoAsk/refuse ledger tip when the door stamped one.
provenanceNoProvenance / input packet when the pipeline attached one.
session_idNoRaw session id when session plumbing was used. Hidden unless the user asked for the chain.
engine_slugNoResolved engine slug when present (often inside result).
limitationsNoCapability limitations or Remain-OFF notes when present.
engine_digestNo64-hex engine_digest when a true in-process engine ran (often inside result).

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover read-only, idempotent, non-destructive behavior. The description adds value beyond them: it discloses the pipeline ordering (fraggate_list → fraggate_describe → fraggate_call), states the dual-surface behavior across agent chat vs human installs, and describes the return shape. It does not restate annotation facts.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the core purpose well, but the dual-surface sentence ('agent chat has no technical UI chrome; Worker / Flutter / local install stay complete human software') is tangential to the tool's invocation contract and dilutes an otherwise tight definition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Output schema exists so return values needn't be explained, yet the description still notes it returns skill markdown plus display.title/display.summary, and covers routing thoroughly. Slightly weakened by the unrelated dual-surface detail.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Zero parameters, so baseline is 4. The schema itself explains 'No arguments. Send {}.' and the description confirms it does not take slugs or run ops, which reinforces correct invocation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource: reads the agent how-to / playbook markdown. It explicitly distinguishes itself from siblings by naming what it is not (not a catalog, not a machine manifest) and naming the exact tools to use for those alternatives.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit when-to-use ('when starting a session or choosing the door before any catalog call') and explicit when-not-to-use with the correct alternative per case (fraggate_list for listing, runtime_software for cards, fraggate_call for executing). Routing is unambiguous.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

runtime_softwareAuthoritative software catalogA
Read-onlyIdempotent

Read hub Software-tab cards (GET /v1/software): every product including AZChat LIVE+bound, sorted Plain A–Z → Gate A–Z → Lock A–Z (Clock ≠ Lock). Not the hashed live/stub registry. Use this when a hub or client refreshes the Software tab. Do not use it for agent discovery of hashed registry status, compact skill URLs, or executing an op; use fraggate_list, runtime_bundle, or fraggate_call instead. Empty {} only. Never enables mesh radios and never execs. Same JSON as GET /v1/software (also /v1/fraggate/software). Cards carry name, slug, ops, worker_home — not live/stub/digest hashes. EmbryoLock is live-with-local-destructive-boundary (worker_home embryolock-download-tracker). Agent exec still uses fraggate_list → fraggate_describe → fraggate_call. Returns sorted software cards (name, slug, ops, worker_home) matching GET /v1/software.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
codeNoFragGate or fabric code when present: FG-OK, FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-UNKNOWN-OP, FG-GATE-REFUSE, FG-LAMB-REFUSE, or a module refuse such as MESH-* / AKM-*.
doorNoDoor name. The public door is fraggate.
ran_inNoExecution locale (for example aziel-runtime) when present.
resultNoSoftware-tab catalog JSON (products/cards with name, slug, ops, worker_home, sort lanes Plain→Gate→Lock). Not a hashed registry roster.
statusNoHTTP-like status when present on wrappers (200 ok; 400+ error / refuse).
displayNoHuman-facing envelope. Show title and summary, then take the next input.
receiptNoOptional receipt, ledger tip, or TemporalLock/ForgeReceipts exit when the door stamped one.
refusalNoExplicit refuse object, code, or message when the door or engine refused.
engine_opNoResolved engine op when present (often inside result).
ledger_tipNoAsk/refuse ledger tip when the door stamped one.
provenanceNoProvenance / input packet when the pipeline attached one.
session_idNoRaw session id when session plumbing was used. Hidden unless the user asked for the chain.
engine_slugNoResolved engine slug when present (often inside result).
limitationsNoCapability limitations or Remain-OFF notes when present.
engine_digestNo64-hex engine_digest when a true in-process engine ran (often inside result).

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnly/destructive/idempotent annotations, it discloses side-effect boundaries ('Never enables mesh radios and never execs'), a source-identity caveat ('Not the hashed live/stub registry'), and the exact card payload ('name, slug, ops, worker_home — not live/stub/digest hashes'). This is behaviorally richer than the annotations alone.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded and scannable at the start, but it repeats the same return description twice ('every product including...' and 'Returns sorted software cards... matching GET /v1/software') and includes tangential lines (EmbryoLock's destructive boundary, the repeated exec tool chain) that dilute focus.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present and zero parameters, the description still covers source, scope, ordering, exclusions, side effects, and payload shape. An agent has everything needed to select and call it correctly without opening other schemas.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Zero parameters, so the baseline is 4; the description reinforces 'Empty {} only' and the schema already carries 100% coverage with its own 'No arguments. Send {}.' note. No additional parameter meaning is required or missing.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

It names a specific verb and resource ('Read hub Software-tab cards (GET /v1/software)') and explicitly distinguishes itself from the hashed live/stub registry and from siblings. The heavy domain jargon ('AZChat LIVE+bound', 'Clock ≠ Lock') blurs the core statement somewhat, keeping it short of a clean 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit trigger ('Use this when a hub or client refreshes the Software tab') plus explicit exclusions ('Do not use it for agent discovery of hashed registry status, compact skill URLs, or executing an op') with three named alternatives. Nothing is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 17 tool updatesv2.0.2
    • Changedchainlock_append3 fields changed
      • changedInput schema / description
        Previous value: -"fact is required. Omit c/chain to stamp session. Extra keys such as s/f/kind are aliases; they do not change the append-only rule."New value: +"fact is required. Omit c/chain to stamp session. Extra keys such as s/f/kind are aliases; they do not change the append-only rule. Mutation requires confirm=true or dry_run=true."
      • addedInput schema / properties / confirm
        Added value: +{
        +  "description": "Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true (preview, no write).",
        +  "type": "boolean"
        +}
      • addedInput schema / properties / dry_run
        Added value: +{
        +  "description": "Optional preview flag. When true, return a would-mutate preview and do not write. Alternative to confirm=true. Does not mutate.",
        +  "type": "boolean"
        +}
    • Changedchainlock_seal3 fields changed
      • changedInput schema / description
        Previous value: -"No required arguments. Empty {} seals current live tips. Optional ts is TemporalLock metadata only."New value: +"No required arguments. Empty {} seals current live tips. Optional ts is TemporalLock metadata only. Mutation requires confirm=true or dry_run=true."
      • addedInput schema / properties / confirm
        Added value: +{
        +  "description": "Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true (preview, no write).",
        +  "type": "boolean"
        +}
      • addedInput schema / properties / dry_run
        Added value: +{
        +  "description": "Optional preview flag. When true, return a would-mutate preview and do not write. Alternative to confirm=true. Does not mutate.",
        +  "type": "boolean"
        +}
    • Changeddecisiongate_check3 fields changed
      • changedInput schema / description
        Previous value: -"All fields optional. Empty proposals still run the five gates and stamp the ledger."New value: +"All schema fields optional. Empty proposals still run the five gates and stamp the ledger. Live stamp still needs confirm=true at tools/call, or dry_run=true for a preview."
      • addedInput schema / properties / confirm
        Added value: +{
        +  "description": "Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true (preview, no write).",
        +  "type": "boolean"
        +}
      • addedInput schema / properties / dry_run
        Added value: +{
        +  "description": "Optional preview flag. When true, return a would-mutate preview and do not write. Alternative to confirm=true. Does not mutate.",
        +  "type": "boolean"
        +}
    • Changedfraggate_call3 fields changed
      • changedInput schema / description
        Previous value: -"Required: op. Also pass slug or name. Extra top-level keys other than name/slug/product/tool/op/verb/claim/proposal/ground/payload/session_id/id become the op payload when payload is omitted."New value: +"Required: op. Also pass slug or name. Extra top-level keys other than name/slug/product/tool/op/verb/claim/proposal/ground/payload/session_id/id become the op payload when payload is omitted. Mutation requires confirm=true or dry_run=true."
      • addedInput schema / properties / confirm
        Added value: +{
        +  "description": "Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true (preview, no write).",
        +  "type": "boolean"
        +}
      • addedInput schema / properties / dry_run
        Added value: +{
        +  "description": "Optional preview flag. When true, return a would-mutate preview and do not write. Alternative to confirm=true. Does not mutate.",
        +  "type": "boolean"
        +}
    • Changedmemory_calibrate3 fields changed
      • changedInput schema / description
        Previous value: -"subject or memory_id recommended. Extra keys are accepted."New value: +"subject or memory_id recommended. Extra keys are accepted. Mutation requires confirm=true or dry_run=true."
      • addedInput schema / properties / confirm
        Added value: +{
        +  "description": "Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true (preview, no write).",
        +  "type": "boolean"
        +}
      • addedInput schema / properties / dry_run
        Added value: +{
        +  "description": "Optional preview flag. When true, return a would-mutate preview and do not write. Alternative to confirm=true. Does not mutate.",
        +  "type": "boolean"
        +}
    • Changedmemory_observe3 fields changed
      • changedInput schema / description
        Previous value: -"fact is required. subject/memory_id/use_case optional."New value: +"fact is required. subject/memory_id/use_case optional. Mutation requires confirm=true or dry_run=true."
      • addedInput schema / properties / confirm
        Added value: +{
        +  "description": "Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true (preview, no write).",
        +  "type": "boolean"
        +}
      • addedInput schema / properties / dry_run
        Added value: +{
        +  "description": "Optional preview flag. When true, return a would-mutate preview and do not write. Alternative to confirm=true. Does not mutate.",
        +  "type": "boolean"
        +}
    • Changedmemory_resolve3 fields changed
      • changedInput schema / description
        Previous value: -"Requires memory_id or a previously observed subject. outcome may be omitted for UNKNOWN. Extra keys are accepted."New value: +"Requires memory_id or a previously observed subject. outcome may be omitted for UNKNOWN. Extra keys are accepted. Mutation requires confirm=true or dry_run=true."
      • addedInput schema / properties / confirm
        Added value: +{
        +  "description": "Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true (preview, no write).",
        +  "type": "boolean"
        +}
      • addedInput schema / properties / dry_run
        Added value: +{
        +  "description": "Optional preview flag. When true, return a would-mutate preview and do not write. Alternative to confirm=true. Does not mutate.",
        +  "type": "boolean"
        +}
    • Changedmesh_broadcast3 fields changed
      • changedInput schema / description
        Previous value: -"sha256 is required (64 hex). This is a receipt, not a blob upload."New value: +"sha256 is required (64 hex). This is a receipt, not a blob upload. Mutation requires confirm=true or dry_run=true."
      • addedInput schema / properties / confirm
        Added value: +{
        +  "description": "Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true (preview, no write).",
        +  "type": "boolean"
        +}
      • addedInput schema / properties / dry_run
        Added value: +{
        +  "description": "Optional preview flag. When true, return a would-mutate preview and do not write. Alternative to confirm=true. Does not mutate.",
        +  "type": "boolean"
        +}
    • Changedmesh_enable3 fields changed
      • changedInput schema / description
        Previous value: -"bearer is required. Empty object is MESH-ENABLE refuse."New value: +"bearer is required. Empty object is MESH-ENABLE refuse. Mutation requires confirm=true or dry_run=true."
      • addedInput schema / properties / confirm
        Added value: +{
        +  "description": "Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true (preview, no write).",
        +  "type": "boolean"
        +}
      • addedInput schema / properties / dry_run
        Added value: +{
        +  "description": "Optional preview flag. When true, return a would-mutate preview and do not write. Alternative to confirm=true. Does not mutate.",
        +  "type": "boolean"
        +}
    • Changedmesh_heartbeat3 fields changed
      • changedInput schema / description
        Previous value: -"node_id is required. Missing node_id refuses MESH-BAD-INPUT."New value: +"node_id is required. Missing node_id refuses MESH-BAD-INPUT. Mutation requires confirm=true or dry_run=true."
      • addedInput schema / properties / confirm
        Added value: +{
        +  "description": "Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true (preview, no write).",
        +  "type": "boolean"
        +}
      • addedInput schema / properties / dry_run
        Added value: +{
        +  "description": "Optional preview flag. When true, return a would-mutate preview and do not write. Alternative to confirm=true. Does not mutate.",
        +  "type": "boolean"
        +}
    • Changedmesh_join3 fields changed
      • changedInput schema / description
        Previous value: -"product is required. presence must be live|locked|isolated when set. node_id must be 8–80 [a-z0-9._-]."New value: +"product is required. presence must be live|locked|isolated when set. node_id must be 8–80 [a-z0-9._-]. Radios off refuses MESH-OFF. Mutation requires confirm=true or dry_run=true."
      • addedInput schema / properties / confirm
        Added value: +{
        +  "description": "Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true (preview, no write).",
        +  "type": "boolean"
        +}
      • addedInput schema / properties / dry_run
        Added value: +{
        +  "description": "Optional preview flag. When true, return a would-mutate preview and do not write. Alternative to confirm=true. Does not mutate.",
        +  "type": "boolean"
        +}
    • Changedmesh_leave3 fields changed
      • changedInput schema / description
        Previous value: -"node_id is required. Missing node_id refuses MESH-BAD-INPUT."New value: +"node_id is required. Missing node_id refuses MESH-BAD-INPUT. Mutation requires confirm=true or dry_run=true."
      • addedInput schema / properties / confirm
        Added value: +{
        +  "description": "Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true (preview, no write).",
        +  "type": "boolean"
        +}
      • addedInput schema / properties / dry_run
        Added value: +{
        +  "description": "Optional preview flag. When true, return a would-mutate preview and do not write. Alternative to confirm=true. Does not mutate.",
        +  "type": "boolean"
        +}
    • Changedruntime_run3 fields changed
      • changedInput schema / description
        Previous value: -"slug and op are required. Extra keys other than payload/session_id may be treated as payload."New value: +"slug and op are required. Extra keys other than payload/session_id may be treated as payload. Mutation requires confirm=true or dry_run=true."
      • addedInput schema / properties / confirm
        Added value: +{
        +  "description": "Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true (preview, no write).",
        +  "type": "boolean"
        +}
      • addedInput schema / properties / dry_run
        Added value: +{
        +  "description": "Optional preview flag. When true, return a would-mutate preview and do not write. Alternative to confirm=true. Does not mutate.",
        +  "type": "boolean"
        +}
    • Changedruntime_session_close3 fields changed
      • changedInput schema / description
        Previous value: -"session_id or id required. Extra keys are ignored. This is not chainlock_seal."New value: +"session_id or id required. Extra keys are ignored. This is not chainlock_seal. Mutation requires confirm=true or dry_run=true."
      • addedInput schema / properties / confirm
        Added value: +{
        +  "description": "Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true (preview, no write).",
        +  "type": "boolean"
        +}
      • addedInput schema / properties / dry_run
        Added value: +{
        +  "description": "Optional preview flag. When true, return a would-mutate preview and do not write. Alternative to confirm=true. Does not mutate.",
        +  "type": "boolean"
        +}
    • Changedruntime_session_exec3 fields changed
      • changedInput schema / description
        Previous value: -"session_id (or id), slug, and op are required. Extra keys besides payload are not treated as the op payload."New value: +"session_id (or id), slug, and op are required. Extra keys besides payload are not treated as the op payload. Mutation requires confirm=true or dry_run=true."
      • addedInput schema / properties / confirm
        Added value: +{
        +  "description": "Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true (preview, no write).",
        +  "type": "boolean"
        +}
      • addedInput schema / properties / dry_run
        Added value: +{
        +  "description": "Optional preview flag. When true, return a would-mutate preview and do not write. Alternative to confirm=true. Does not mutate.",
        +  "type": "boolean"
        +}
    • Changedruntime_session_open3 fields changed
      • changedInput schema / description
        Previous value: -"No required arguments. Empty {} mints a sess_ + 32 hex id. Extra keys may be stored as open metadata."New value: +"No required arguments. Empty {} mints a sess_ + 32 hex id. Extra keys may be stored as open metadata. Mutation requires confirm=true or dry_run=true."
      • addedInput schema / properties / confirm
        Added value: +{
        +  "description": "Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true (preview, no write).",
        +  "type": "boolean"
        +}
      • addedInput schema / properties / dry_run
        Added value: +{
        +  "description": "Optional preview flag. When true, return a would-mutate preview and do not write. Alternative to confirm=true. Does not mutate.",
        +  "type": "boolean"
        +}
    • Changedruntime_session_policy3 fields changed
      • changedInput schema / description
        Previous value: -"session_id or id required. Other fields are optional policy overlays (also accepted nested under policy)."New value: +"session_id or id required. Other fields are optional policy overlays (also accepted nested under policy). Mutation requires confirm=true or dry_run=true."
      • addedInput schema / properties / confirm
        Added value: +{
        +  "description": "Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true (preview, no write).",
        +  "type": "boolean"
        +}
      • addedInput schema / properties / dry_run
        Added value: +{
        +  "description": "Optional preview flag. When true, return a would-mutate preview and do not write. Alternative to confirm=true. Does not mutate.",
        +  "type": "boolean"
        +}
  2. 19 tool updatesv2.0.1
    • Changedchainlock_append7 fields changed
      • changedInput schema / description
        Previous value: -"fact is required (≤160). Hash-only cards without a fact refuse."New value: +"fact is required. Omit c/chain to stamp session. Extra keys such as s/f/kind are aliases; they do not change the append-only rule."
      • changedInput schema / properties / c / description
        Previous value: -"Optional chain name. One of genesis, identity, ssh, session, acts, evidence, recall, mesh, library, learn. Alias: chain."New value: +"Optional chain name. One of genesis, identity, ssh, session, acts, evidence, recall, mesh, library, learn. Alias: chain. Omit both to stamp the session chain."
      • addedInput schema / properties / chain
        Added value: +{
        +  "description": "Alias of c. Omit both to stamp the session chain.",
        +  "enum": [
        +    "genesis",
        +    "identity",
        +    "ssh",
        +    "session",
        +    "acts",
        +    "evidence",
        +    "recall",
        +    "mesh",
        +    "library",
        +    "learn"
        +  ],
        +  "type": "string"
        +}
      • changedInput schema / properties / fact / description
        Previous value: -"Required fact text clipped to 160 characters. Hash-only / empty fact refuses."New value: +"Required fact text clipped to 160 characters. Empty or hash-only after clip refuses no-fact. Alias: f."
      • changedInput schema / properties / k / description
        Previous value: -"Optional kind label for the stamp."New value: +"Optional kind label. Omit to store kind stamp. Alias: kind."
      • changedInput schema / properties / subject / description
        Previous value: -"Optional subject clipped to 80 characters."New value: +"Optional subject clipped to 80 characters. Alias: s."
      • changedOutput schema / properties / result / description
        Previous value: -"FragGate body: ok, code, door, slug, op, engine_digest, ran_in, provenance, refusal, limitations, receipt, plus the engine result. Unknown names refuse FG-HALLUC-TOOL; stubs refuse FG-STUB."New value: +"Append body: ok, stamp (id, c, k, fact, fh, stamp_sha256, prev), card, seq, vault path. Refuses: no-fact, unknown-chain, card-cap."
    • Changedchainlock_recall5 fields changed
      • changedInput schema / description
        Previous value: -"All fields optional. depth is 0 (tip) through 5 (genesis/budget)."New value: +"All fields optional. Default depth is 1. Default chains are session, acts, recall, learn."
      • changedInput schema / properties / c / description
        Previous value: -"Optional chain name to recall from. Omit to use the default recall path."New value: +"Optional chain name. One of genesis, identity, ssh, session, acts, evidence, recall, mesh, library, learn. Alias: chain. Omit both to scan session, acts, recall, and learn — not the full roster."
      • addedInput schema / properties / chain
        Added value: +{
        +  "description": "Alias of c. Omit both to scan session, acts, recall, and learn — not the full roster.",
        +  "enum": [
        +    "genesis",
        +    "identity",
        +    "ssh",
        +    "session",
        +    "acts",
        +    "evidence",
        +    "recall",
        +    "mesh",
        +    "library",
        +    "learn"
        +  ],
        +  "type": "string"
        +}
      • changedInput schema / properties / depth / description
        Previous value: -"Optional recall depth. 0 = tip only; 5 = genesis/budget maximum. Values outside 0–5 are clipped."New value: +"Optional recall depth. Omit for 1. 0 = tip only; 5 = genesis/budget maximum. Values outside 0–5 are clipped. Alias: d."
      • changedInput schema / properties / q / description
        Previous value: -"Optional query string to filter recalled cards. Does not invent matches."New value: +"Optional case-insensitive substring over subject/fact. Alias: query. Empty does not invent matches."
    • Changedchainlock_seal3 fields changed
      • changedInput schema / description
        Previous value: -"No required arguments. Optional ts may be passed through as TemporalLock timestamp metadata."New value: +"No required arguments. Empty {} seals current live tips. Optional ts is TemporalLock metadata only."
      • changedInput schema / properties / ts / description
        Previous value: -"Optional ISO-8601 timestamp for the TemporalLock block. Omit to use now. Does not backdate authority."New value: +"Optional ISO-8601 timestamp copied onto the TemporalLock block. Omit to use now. Never backdates authority, prior stamps, or godlock.uk."
      • changedOutput schema / properties / result / description
        Previous value: -"FragGate body: ok, code, door, slug, op, engine_digest, ran_in, provenance, refusal, limitations, receipt, plus the engine result. Unknown names refuse FG-HALLUC-TOOL; stubs refuse FG-STUB."New value: +"Seal body: ok, lockset (members, temporal, godlock, lockset_sha256), or refuse empty-vault when no live tips exist. Does not write godlock.uk."
    • Changedchainlock_tip4 fields changed
      • changedInput schema / description
        Previous value: -"c selects the chain. Omit for the default tip path."New value: +"Omit c/chain to read the session chain tip. Extra properties are rejected."
      • changedInput schema / properties / c / description
        Previous value: -"Optional chain name from the ChainLock roster."New value: +"Optional chain name. One of genesis, identity, ssh, session, acts, evidence, recall, mesh, library, learn. Alias: chain. Omit both to read the session chain tip."
      • addedInput schema / properties / chain
        Added value: +{
        +  "description": "Alias of c. Omit both to read the session chain tip.",
        +  "enum": [
        +    "genesis",
        +    "identity",
        +    "ssh",
        +    "session",
        +    "acts",
        +    "evidence",
        +    "recall",
        +    "mesh",
        +    "library",
        +    "learn"
        +  ],
        +  "type": "string"
        +}
      • changedOutput schema / properties / result / description
        Previous value: -"FragGate body: ok, code, door, slug, op, engine_digest, ran_in, provenance, refusal, limitations, receipt, plus the engine result. Unknown names refuse FG-HALLUC-TOOL; stubs refuse FG-STUB."New value: +"Tip body: ok, chain, tip card or null, empty flag, seq when a stamp exists. Empty chain is ok+empty, not an invented card."
    • Changedchainlock_verify4 fields changed
      • changedInput schema / description
        Previous value: -"Optional chain selector. Extra keys are ignored by verify."New value: +"Optional chain selector. Omit to verify the live vault / LOCKSET."
      • changedInput schema / properties / c / description
        Previous value: -"Optional chain name to focus verify. Omit to verify the live vault / LOCKSET."New value: +"Optional chain name. One of genesis, identity, ssh, session, acts, evidence, recall, mesh, library, learn. Alias: chain. Omit both to verify every roster chain plus the stored LOCKSET."
      • addedInput schema / properties / chain
        Added value: +{
        +  "description": "Alias of c. Omit both to verify every roster chain plus the stored LOCKSET.",
        +  "enum": [
        +    "genesis",
        +    "identity",
        +    "ssh",
        +    "session",
        +    "acts",
        +    "evidence",
        +    "recall",
        +    "mesh",
        +    "library",
        +    "learn"
        +  ],
        +  "type": "string"
        +}
      • addedInput schema / properties / require_seal
        Added value: +{
        +  "description": "Optional. When true, fail-closed if receipts/LOCKSET.json is missing. When omitted, a stored lockset is still checked if present.",
        +  "type": "boolean"
        +}
    • Changedfraggate_verify1 field changed
      • changedInput schema / description
        Previous value: -"Provide name, slug, and/or digest. Digest-only checks the whole registry hash."New value: +"Provide name, slug, and/or digest. Empty {} refuses FG-HALLUC-TOOL. Digest-only checks the whole registry hash."
    • Changedlibrary_lookup1 field changed
      • changedInput schema / properties / q / description
        Previous value: -"Optional query string for op=search. Empty q returns an empty or default hit set, not an invented cite."New value: +"Optional public-corpus query for op=search. Empty q returns an empty or default hit set, not an invented cite. Not a memory or ChainLock query."
    • Changedmemory_get5 fields changed
      • changedInput schema / description
        Previous value: -"Pass memory_id or id. view selects the explain slice."New value: +"Pass memory_id or id (aliases). Omit view for the node slice. Extra properties are rejected."
      • changedInput schema / properties / id / description
        Previous value: -"Alias of memory_id."New value: +"Alias of memory_id. Do not send two different values."
      • changedInput schema / properties / memory_id / description
        Previous value: -"Memory id to explain. Alternative to id."New value: +"Memory id to explain. Alternative to id. Missing both refuses AKM-NOT-FOUND."
      • changedInput schema / properties / view / description
        Previous value: -"Optional view: get (default node), history, or calibration."New value: +"Optional slice. Omit or get = stored node; history = events/resolutions; calibration = posterior, triad legs, effective N, Brier."
      • changedOutput schema / properties / result / description
        Previous value: -"FragGate body: ok, code, door, slug, op, engine_digest, ran_in, provenance, refusal, limitations, receipt, plus the engine result. Unknown names refuse FG-HALLUC-TOOL; stubs refuse FG-STUB."New value: +"Explain body: ok, memory_id, status, plus node or events or calibration fields. belief_is_not_truth. Refuses AKM-NOT-FOUND when the id is missing or unknown."
    • Changedmemory_recall6 fields changed
      • changedInput schema / description
        Previous value: -"All fields optional. depth follows ChainLock 0–5."New value: +"All fields optional. Default depth is 5. Empty q still runs verify-then-rank and does not invent facts."
      • changedInput schema / properties / depth / description
        Previous value: -"Optional recall depth 0–5 after ChainLock verify."New value: +"Optional ChainLock recall depth after verify. Omit for 5 (full budget). 0 is tip-only ranking."
      • addedInput schema / properties / limit
        Added value: +{
        +  "description": "Optional result cap. Hard ceiling is 16 (MEMORY_CONTEXT_CAP) even if a larger number is sent.",
        +  "maximum": 16,
        +  "minimum": 1,
        +  "type": "number"
        +}
      • changedInput schema / properties / q / description
        Previous value: -"Optional query to rank against. Empty query still runs verify-then-rank; it does not invent facts."New value: +"Optional lexical rank query (subject/fact). Alias: query. Empty still runs verify-then-rank; it does not invent facts."
      • changedInput schema / properties / use_case / description
        Previous value: -"Optional use-case label that weights ranking. Not a permission."New value: +"Optional use-case label that weights triad_fit in ranking. Not a permission and not a truth claim."
      • changedOutput schema / properties / result / description
        Previous value: -"FragGate body: ok, code, door, slug, op, engine_digest, ran_in, provenance, refusal, limitations, receipt, plus the engine result. Unknown names refuse FG-HALLUC-TOOL; stubs refuse FG-STUB."New value: +"Adaptive recall body: ok, adaptive=true, verified, count, facts (ranked cards with score/retrieval), belief_is_not_truth, authorizes_action=false. Refuses CHAIN_VERIFY_FAIL or no-stamp."
    • Changedmesh_disable1 field changed
      • changedInput schema / description
        Previous value: -"No arguments. Send {}. Always allowed."New value: +"No arguments. Send {}. Public suite disable is refused."
    • Changedmesh_heartbeat2 fields changed
      • addedInput schema / properties / prev
        Added value: +{
        +  "description": "Optional 64-hex prev the receiver already holds. Same prev + a different tip_hash isolates this node (MESH-EQUIVOCATION).",
        +  "type": "string"
        +}
      • addedInput schema / properties / tip_hash
        Added value: +{
        +  "description": "Optional 64-hex tip hash on the fast tick. Fixed-size. No body. Split the wires.",
        +  "type": "string"
        +}
    • Changedruntime_pull4 fields changed
      • changedInput schema / description
        Previous value: -"slug is required. Extra keys are ignored by the pull helper."New value: +"slug or product required. Extra keys are ignored by the pull helper — not an exec payload."
      • addedInput schema / properties / product
        Added value: +{
        +  "description": "Alias of slug. Do not send two different values.",
        +  "type": "string"
        +}
      • changedInput schema / properties / slug / description
        Previous value: -"Required catalog slug from GET /v1/software or fraggate_list (for example foldlock). Not an exec path."New value: +"Required catalog slug from GET /v1/software or fraggate_list (for example foldlock). Alias: product. Not an exec path."
      • changedOutput schema / properties / result / description
        Previous value: -"Machine payload. FragGate-style results commonly include ok, code, slug, op, status, engine_slug, engine_op, engine_digest, ran_in, provenance, refusal, limitations, and ledger_tip."New value: +"One hub product card: name, version, skill markdown, download, ops, skill_source. Unknown slug is unknown product — not a FragGate FG-HALLUC-TOOL envelope."
    • Changedruntime_session_close5 fields changed
      • changedInput schema / description
        Previous value: -"session_id is required."New value: +"session_id or id required. Extra keys are ignored. This is not chainlock_seal."
      • addedInput schema / properties / id
        Added value: +{
        +  "description": "Alias of session_id. The door accepts either key; do not send two different values.",
        +  "pattern": "^sess_[a-f0-9]{32}$",
        +  "type": "string"
        +}
      • changedInput schema / properties / session_id / description
        Previous value: -"Required session id to seal. Further exec on this id is rejected."New value: +"Required. Raw session id from runtime_session_open (sess_ + 32 lowercase hex). Alias: id. Missing both fails with session_id required; unknown id returns session_not_found."
      • addedInput schema / properties / session_id / pattern
        Added value: +"^sess_[a-f0-9]{32}$"
      • changedOutput schema / properties / result / description
        Previous value: -"Machine payload. FragGate-style results commonly include ok, code, slug, op, status, engine_slug, engine_op, engine_digest, ran_in, provenance, refusal, limitations, and ledger_tip."New value: +"Close body: sealed session, close receipt, verified. Errors: session_id required, session_not_found, session_closed (already sealed; does not reopen)."
    • Changedruntime_session_exec9 fields changed
      • changedInput schema / description
        Previous value: -"session_id, slug, and op are required."New value: +"session_id (or id), slug, and op are required. Extra keys besides payload are not treated as the op payload."
      • addedInput schema / properties / id
        Added value: +{
        +  "description": "Alias of session_id. The door accepts either key; do not send two different values.",
        +  "pattern": "^sess_[a-f0-9]{32}$",
        +  "type": "string"
        +}
      • changedInput schema / properties / op / description
        Previous value: -"Required allowlisted op. Stubs refuse FG-STUB."New value: +"Required allowlisted op. Stubs refuse FG-STUB. UI aliases still forward only after FragGate admit."
      • changedInput schema / properties / payload / description
        Previous value: -"Optional op payload object. Engine-specific."New value: +"Optional op payload object. Engine-specific. Unlike fraggate_call, leftover top-level keys are not used as payload."
      • addedInput schema / properties / product
        Added value: +{
        +  "description": "Alias of slug. Do not send two different values.",
        +  "type": "string"
        +}
      • changedInput schema / properties / session_id / description
        Previous value: -"Required open session id. Alias: id."New value: +"Required. Raw session id from runtime_session_open (sess_ + 32 lowercase hex). Alias: id. Missing both fails with session_id required; unknown id returns session_not_found."
      • addedInput schema / properties / session_id / pattern
        Added value: +"^sess_[a-f0-9]{32}$"
      • changedInput schema / properties / slug / description
        Previous value: -"Required catalog slug to exec. Unknown slugs refuse FG-HALLUC-TOOL."New value: +"Required catalog slug to exec. Alias: product. Unknown slugs refuse FG-HALLUC-TOOL. This tool does not auto-open."
      • changedOutput schema / properties / result / description
        Previous value: -"Machine payload. FragGate-style results commonly include ok, code, slug, op, status, engine_slug, engine_op, engine_digest, ran_in, provenance, refusal, limitations, and ledger_tip."New value: +"Exec body: session, receipt, engine_slug, engine_op, engine_digest, ran_in, refusal when gated. Errors: session_id required, session_closed, session_expired, receipt_cap, FG-HALLUC-TOOL, FG-STUB."
    • Changedruntime_session_open4 fields changed
      • changedInput schema / description
        Previous value: -"No required arguments. Extra keys may be stored as open metadata. Prefer fraggate_call."New value: +"No required arguments. Empty {} mints a sess_ + 32 hex id. Extra keys may be stored as open metadata."
      • addedInput schema / properties / id
        Added value: +{
        +  "description": "Optional caller-chosen session id. Must already match sess_ + 32 lowercase hex or the open refuses bad_session_id. Omit to mint one.",
        +  "pattern": "^sess_[a-f0-9]{32}$",
        +  "type": "string"
        +}
      • addedInput schema / properties / source
        Added value: +{
        +  "description": "Optional open metadata label. Default worker. Not a permission and not a catalog slug.",
        +  "type": "string"
        +}
      • changedOutput schema / properties / result / description
        Previous value: -"Machine payload. FragGate-style results commonly include ok, code, slug, op, status, engine_slug, engine_op, engine_digest, ran_in, provenance, refusal, limitations, and ledger_tip."New value: +"Open body: session.id, receipts[0], already=true when the id already exists. Errors: bad_session_id, session_binding_missing, session_expired."
    • Changedruntime_session_policy11 fields changed
      • changedInput schema / description
        Previous value: -"session_id is required. Other fields are optional policy overlays."New value: +"session_id or id required. Other fields are optional policy overlays (also accepted nested under policy)."
      • changedInput schema / properties / allow_ops / description
        Previous value: -"Optional allowlist of ops this session may exec."New value: +"Optional replacement allowlist of ops this session may exec. Omit to keep the current list."
      • changedInput schema / properties / allow_slugs / description
        Previous value: -"Optional allowlist of catalog slugs this session may exec."New value: +"Optional replacement allowlist of catalog slugs this session may exec. Omit to keep the current list."
      • addedInput schema / properties / id
        Added value: +{
        +  "description": "Alias of session_id. The door accepts either key; do not send two different values.",
        +  "pattern": "^sess_[a-f0-9]{32}$",
        +  "type": "string"
        +}
      • changedInput schema / properties / kv_increment / description
        Previous value: -"Optional. When true, allow KV increment side effects on this session."New value: +"Optional. When true, allow KV increment side effects on later exec. Not an increment itself."
      • changedInput schema / properties / max_payload_bytes / description
        Previous value: -"Optional max payload size in bytes for later exec."New value: +"Optional max payload size in bytes for later exec (integer 1..1048576). Overlay only; not the exec body. Out of range refuses bad_policy."
      • addedInput schema / properties / max_payload_bytes / maximum
        Added value: +1048576
      • addedInput schema / properties / max_payload_bytes / minimum
        Added value: +1
      • changedInput schema / properties / session_id / description
        Previous value: -"Required raw session id from runtime_session_open. Alias: id."New value: +"Required. Raw session id from runtime_session_open (sess_ + 32 lowercase hex). Alias: id. Missing both fails with session_id required; unknown id returns session_not_found."
      • addedInput schema / properties / session_id / pattern
        Added value: +"^sess_[a-f0-9]{32}$"
      • changedOutput schema / properties / result / description
        Previous value: -"Machine payload. FragGate-style results commonly include ok, code, slug, op, status, engine_slug, engine_op, engine_digest, ran_in, provenance, refusal, limitations, and ledger_tip."New value: +"Policy body: updated session allow lists and a policy receipt. Refuses session_id required, session_not_found, session_closed, session_expired."
    • Changedruntime_session_receipt5 fields changed
      • changedInput schema / description
        Previous value: -"session_id is required."New value: +"session_id or id required. Extra keys are ignored."
      • addedInput schema / properties / id
        Added value: +{
        +  "description": "Alias of session_id. The door accepts either key; do not send two different values.",
        +  "pattern": "^sess_[a-f0-9]{32}$",
        +  "type": "string"
        +}
      • changedInput schema / properties / session_id / description
        Previous value: -"Required session id whose last receipt to read. Alias: id."New value: +"Required. Raw session id from runtime_session_open (sess_ + 32 lowercase hex). Alias: id. Missing both fails with session_id required; unknown id returns session_not_found."
      • addedInput schema / properties / session_id / pattern
        Added value: +"^sess_[a-f0-9]{32}$"
      • changedOutput schema / properties / result / description
        Previous value: -"Machine payload. FragGate-style results commonly include ok, code, slug, op, status, engine_slug, engine_op, engine_digest, ran_in, provenance, refusal, limitations, and ledger_tip."New value: +"Last-receipt body: receipt (or null), verified chain flag, public session. Errors: session_id required, session_not_found."
    • Changedruntime_session_receipts5 fields changed
      • changedInput schema / description
        Previous value: -"session_id is required."New value: +"session_id or id required. Extra keys are ignored. No cursor/limit."
      • addedInput schema / properties / id
        Added value: +{
        +  "description": "Alias of session_id. The door accepts either key; do not send two different values.",
        +  "pattern": "^sess_[a-f0-9]{32}$",
        +  "type": "string"
        +}
      • changedInput schema / properties / session_id / description
        Previous value: -"Required session id whose receipt list to read. Alias: id."New value: +"Required. Raw session id from runtime_session_open (sess_ + 32 lowercase hex). Alias: id. Missing both fails with session_id required; unknown id returns session_not_found."
      • addedInput schema / properties / session_id / pattern
        Added value: +"^sess_[a-f0-9]{32}$"
      • changedOutput schema / properties / result / description
        Previous value: -"Machine payload. FragGate-style results commonly include ok, code, slug, op, status, engine_slug, engine_op, engine_digest, ran_in, provenance, refusal, limitations, and ledger_tip."New value: +"Receipt-chain body: receipts[] (cap 64), verified, public session. Errors: session_id required, session_not_found."
    • Changedruntime_software2 fields changed
      • changedInput schema / description
        Previous value: -"No arguments. Send {}. Hub/client helper — not exec."New value: +"No arguments. Send {}. Hub/client helper — not exec and not fraggate_list."
      • changedOutput schema / properties / result / description
        Previous value: -"Machine payload. FragGate-style results commonly include ok, code, slug, op, status, engine_slug, engine_op, engine_digest, ran_in, provenance, refusal, limitations, and ledger_tip."New value: +"Software-tab catalog JSON (products/cards with name, slug, ops, worker_home, sort lanes Plain→Gate→Lock). Not a hashed registry roster."
  3. 36 tool updatesv1.6.2
    • Addedchainlock_append
    • Addedchainlock_recall
    • Addedchainlock_seal
    • Addedchainlock_tip
    • Addedchainlock_verify
    • Changeddecisiongate_check8 fields changed
      • addedInput schema / description
        Added value: +"All fields optional. Empty proposals still run the five gates and stamp the ledger."
      • addedInput schema / properties / accountable / description
        Added value: +"Optional accountable party string."
      • addedInput schema / properties / evidence / description
        Added value: +"Optional evidence strings. Missing evidence can fail a gate."
      • addedInput schema / properties / impact_neg / description
        Added value: +"Optional negative-impact list."
      • addedInput schema / properties / impact_pos / description
        Added value: +"Optional positive-impact list."
      • addedInput schema / properties / statement / description
        Added value: +"Optional proposal statement to evaluate."
      • addedInput schema / properties / values / description
        Added value: +"Optional values list."
      • changedOutput schema / (root)
        Previous value: -nullNew value: +{
        +  "additionalProperties": true,
        +  "description": "Display envelope shown to the user (display.title / display.summary) plus the machine result. Extra engine fields may appear.",
        +  "properties": {
        +    "code": {
        +      "description": "FragGate or fabric code when present: FG-OK, FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-UNKNOWN-OP, FG-GATE-REFUSE, FG-LAMB-REFUSE, or a module refuse such as MESH-* / AKM-*.",
        +      "type": "string"
        +    },
        +    "display": {
        +      "additionalProperties": true,
        +      "description": "Human-facing envelope. Show title and summary, then take the next input.",
        +      "properties": {
        +        "fields": {
        +          "description": "Optional labeled scalars copied from the result for display.",
        +          "items": {
        +            "additionalProperties": true,
        +            "properties": {
        +              "label": {
        +                "description": "Field label.",
        +                "type": "string"
        +              },
        +              "value": {
        +                "description": "Field value as text.",
        +                "type": "string"
        +              }
        +            },
        +            "type": "object"
        +          },
        +          "type": "array"
        +        },
        +        "next": {
        +          "description": "What the agent should do after showing this output.",
        +          "type": "string"
        +        },
        +        "summary": {
        +          "description": "One-line outcome or refuse reason.",
        +          "type": "string"
        +        },
        +        "title": {
        +          "description": "Short result title for the AI client.",
        +          "type": "string"
        +        }
        +      },
        +      "type": "object"
        +    },
        +    "door": {
        +      "description": "Door name. The public door is fraggate.",
        +      "type": "string"
        +    },
        +    "engine_digest": {
        +      "description": "64-hex engine_digest when a true in-process engine ran (often inside result).",
        +      "type": "string"
        +    },
        +    "engine_op": {
        +      "description": "Resolved engine op when present (often inside result).",
        +      "type": "string"
        +    },
        +    "engine_slug": {
        +      "description": "Resolved engine slug when present (often inside result).",
        +      "type": "string"
        +    },
        +    "ledger_tip": {
        +      "description": "Ask/refuse ledger tip when the door stamped one."
        +    },
        +    "limitations": {
        +      "description": "Capability limitations or Remain-OFF notes when present."
        +    },
        +    "provenance": {
        +      "description": "Provenance / input packet when the pipeline attached one."
        +    },
        +    "ran_in": {
        +      "description": "Execution locale (for example aziel-runtime) when present.",
        +      "type": "string"
        +    },
        +    "receipt": {
        +      "description": "Optional receipt, ledger tip, or TemporalLock/ForgeReceipts exit when the door stamped one."
        +    },
        +    "refusal": {
        +      "description": "Explicit refuse object, code, or message when the door or engine refused."
        +    },
        +    "result": {
        +      "description": "FragGate body: ok, code, door, slug, op, engine_digest, ran_in, provenance, refusal, limitations, receipt, plus the engine result. Unknown names refuse FG-HALLUC-TOOL; stubs refuse FG-STUB."
        +    },
        +    "session_id": {
        +      "description": "Raw session id when session plumbing was used. Hidden unless the user asked for the chain.",
        +      "type": "string"
        +    },
        +    "status": {
        +      "description": "HTTP-like status when present on wrappers (200 ok; 400+ error / refuse).",
        +      "type": "integer"
        +    }
        +  },
        +  "type": "object"
        +}
    • Changedfraggate_call10 fields changed
      • addedInput schema / description
        Added value: +"Required: op. Also pass slug or name. Extra top-level keys other than name/slug/product/tool/op/verb/claim/proposal/ground/payload/session_id/id become the op payload when payload is omitted."
      • addedInput schema / properties / claim / additionalProperties
        Added value: +true
      • changedInput schema / properties / claim / description
        Previous value: -"Optional DecisionGATE proposal (statement, evidence, impacts, values, accountable)"New value: +"Optional DecisionGATE proposal attached to this call. Also runs automatically inside the door even when omitted (defaults). Freedom without clarity is chaos."
      • addedInput schema / properties / claim / properties
        Added value: +{
        +  "accountable": {
        +    "description": "Optional accountable party. Identity on this runtime is Aziel Eliab only.",
        +    "type": "string"
        +  },
        +  "evidence": {
        +    "description": "Optional evidence strings supporting the statement.",
        +    "items": {
        +      "type": "string"
        +    },
        +    "type": "array"
        +  },
        +  "impact_neg": {
        +    "description": "Optional negative impacts.",
        +    "items": {
        +      "type": "string"
        +    },
        +    "type": "array"
        +  },
        +  "impact_pos": {
        +    "description": "Optional positive impacts.",
        +    "items": {
        +      "type": "string"
        +    },
        +    "type": "array"
        +  },
        +  "statement": {
        +    "description": "Optional proposal statement (what is being asked).",
        +    "type": "string"
        +  },
        +  "values": {
        +    "description": "Optional values the proposal claims to honor.",
        +    "items": {
        +      "type": "string"
        +    },
        +    "type": "array"
        +  }
        +}
      • changedInput schema / properties / name / description
        Previous value: -"Registry name or slug"New value: +"Optional registry display name (for example FoldLock, EmbryoLock, AZHub). Use name or slug — one is enough. Combined name/op forms such as foldlock/fold-preview are accepted by the door parser. Unknown names refuse FG-HALLUC-TOOL."
      • changedInput schema / properties / op / description
        Previous value: -"Public allowlisted op"New value: +"Required public allowlisted op from fraggate_describe (for example fold-preview, ethical_search, blank_key_status). UI aliases (list_modules, place, genesis_boot, hold, airlock, home, classify, doctor, pair) forward to catalog ops. Unknown ops refuse FG-UNKNOWN-OP; stubs refuse FG-STUB."
      • addedInput schema / properties / payload / additionalProperties
        Added value: +true
      • addedInput schema / properties / payload / description
        Added value: +"Optional op payload object. Shape is engine-specific (see fraggate_describe). Malformed fields are refused by the engine, not by this door schema. If omitted, leftover top-level keys are used as the payload."
      • addedInput schema / properties / slug / description
        Added value: +"Optional catalog slug (lowercase a-z0-9-, for example foldlock, embryolock, azhub). Alternative to name. Prefer the slug returned by fraggate_list or GET /v1/software."
      • changedOutput schema / (root)
        Previous value: -nullNew value: +{
        +  "additionalProperties": true,
        +  "description": "Display envelope shown to the user (display.title / display.summary) plus the machine result. Extra engine fields may appear.",
        +  "properties": {
        +    "code": {
        +      "description": "FragGate or fabric code when present: FG-OK, FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-UNKNOWN-OP, FG-GATE-REFUSE, FG-LAMB-REFUSE, or a module refuse such as MESH-* / AKM-*.",
        +      "type": "string"
        +    },
        +    "display": {
        +      "additionalProperties": true,
        +      "description": "Human-facing envelope. Show title and summary, then take the next input.",
        +      "properties": {
        +        "fields": {
        +          "description": "Optional labeled scalars copied from the result for display.",
        +          "items": {
        +            "additionalProperties": true,
        +            "properties": {
        +              "label": {
        +                "description": "Field label.",
        +                "type": "string"
        +              },
        +              "value": {
        +                "description": "Field value as text.",
        +                "type": "string"
        +              }
        +            },
        +            "type": "object"
        +          },
        +          "type": "array"
        +        },
        +        "next": {
        +          "description": "What the agent should do after showing this output.",
        +          "type": "string"
        +        },
        +        "summary": {
        +          "description": "One-line outcome or refuse reason.",
        +          "type": "string"
        +        },
        +        "title": {
        +          "description": "Short result title for the AI client.",
        +          "type": "string"
        +        }
        +      },
        +      "type": "object"
        +    },
        +    "door": {
        +      "description": "Door name. The public door is fraggate.",
        +      "type": "string"
        +    },
        +    "engine_digest": {
        +      "description": "64-hex engine_digest when a true in-process engine ran (often inside result).",
        +      "type": "string"
        +    },
        +    "engine_op": {
        +      "description": "Resolved engine op when present (often inside result).",
        +      "type": "string"
        +    },
        +    "engine_slug": {
        +      "description": "Resolved engine slug when present (often inside result).",
        +      "type": "string"
        +    },
        +    "ledger_tip": {
        +      "description": "Ask/refuse ledger tip when the door stamped one."
        +    },
        +    "limitations": {
        +      "description": "Capability limitations or Remain-OFF notes when present."
        +    },
        +    "provenance": {
        +      "description": "Provenance / input packet when the pipeline attached one."
        +    },
        +    "ran_in": {
        +      "description": "Execution locale (for example aziel-runtime) when present.",
        +      "type": "string"
        +    },
        +    "receipt": {
        +      "description": "Optional receipt, ledger tip, or TemporalLock/ForgeReceipts exit when the door stamped one."
        +    },
        +    "refusal": {
        +      "description": "Explicit refuse object, code, or message when the door or engine refused."
        +    },
        +    "result": {
        +      "description": "FragGate body: ok, code, door, slug, op, engine_digest, ran_in, provenance, refusal, limitations, receipt, plus the engine result. Unknown names refuse FG-HALLUC-TOOL; stubs refuse FG-STUB."
        +    },
        +    "session_id": {
        +      "description": "Raw session id when session plumbing was used. Hidden unless the user asked for the chain.",
        +      "type": "string"
        +    },
        +    "status": {
        +      "description": "HTTP-like status when present on wrappers (200 ok; 400+ error / refuse).",
        +      "type": "integer"
        +    }
        +  },
        +  "type": "object"
        +}
    • Changedfraggate_describe5 fields changed
      • changedInput schema / additionalProperties
        Previous value: -trueNew value: +false
      • addedInput schema / description
        Added value: +"Exactly one of name or slug is enough. Extra properties are rejected by the schema; the door still only reads name/slug."
      • addedInput schema / properties / name / description
        Added value: +"Optional registry display name (for example FoldLock, EmbryoLock, AZHub). Use name or slug — one is enough. Combined name/op forms such as foldlock/fold-preview are accepted by the door parser. Unknown names refuse FG-HALLUC-TOOL."
      • addedInput schema / properties / slug / description
        Added value: +"Optional catalog slug (lowercase a-z0-9-, for example foldlock, embryolock, azhub). Alternative to name. Prefer the slug returned by fraggate_list or GET /v1/software."
      • changedOutput schema / (root)
        Previous value: -nullNew value: +{
        +  "additionalProperties": true,
        +  "description": "Display envelope shown to the user (display.title / display.summary) plus the machine result. Extra engine fields may appear.",
        +  "properties": {
        +    "code": {
        +      "description": "FragGate or fabric code when present: FG-OK, FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-UNKNOWN-OP, FG-GATE-REFUSE, FG-LAMB-REFUSE, or a module refuse such as MESH-* / AKM-*.",
        +      "type": "string"
        +    },
        +    "display": {
        +      "additionalProperties": true,
        +      "description": "Human-facing envelope. Show title and summary, then take the next input.",
        +      "properties": {
        +        "fields": {
        +          "description": "Optional labeled scalars copied from the result for display.",
        +          "items": {
        +            "additionalProperties": true,
        +            "properties": {
        +              "label": {
        +                "description": "Field label.",
        +                "type": "string"
        +              },
        +              "value": {
        +                "description": "Field value as text.",
        +                "type": "string"
        +              }
        +            },
        +            "type": "object"
        +          },
        +          "type": "array"
        +        },
        +        "next": {
        +          "description": "What the agent should do after showing this output.",
        +          "type": "string"
        +        },
        +        "summary": {
        +          "description": "One-line outcome or refuse reason.",
        +          "type": "string"
        +        },
        +        "title": {
        +          "description": "Short result title for the AI client.",
        +          "type": "string"
        +        }
        +      },
        +      "type": "object"
        +    },
        +    "door": {
        +      "description": "Door name. The public door is fraggate.",
        +      "type": "string"
        +    },
        +    "engine_digest": {
        +      "description": "64-hex engine_digest when a true in-process engine ran (often inside result).",
        +      "type": "string"
        +    },
        +    "engine_op": {
        +      "description": "Resolved engine op when present (often inside result).",
        +      "type": "string"
        +    },
        +    "engine_slug": {
        +      "description": "Resolved engine slug when present (often inside result).",
        +      "type": "string"
        +    },
        +    "ledger_tip": {
        +      "description": "Ask/refuse ledger tip when the door stamped one."
        +    },
        +    "limitations": {
        +      "description": "Capability limitations or Remain-OFF notes when present."
        +    },
        +    "provenance": {
        +      "description": "Provenance / input packet when the pipeline attached one."
        +    },
        +    "ran_in": {
        +      "description": "Execution locale (for example aziel-runtime) when present.",
        +      "type": "string"
        +    },
        +    "receipt": {
        +      "description": "Optional receipt, ledger tip, or TemporalLock/ForgeReceipts exit when the door stamped one."
        +    },
        +    "refusal": {
        +      "description": "Explicit refuse object, code, or message when the door or engine refused."
        +    },
        +    "result": {
        +      "description": "FragGate body: ok, code, door, slug, op, engine_digest, ran_in, provenance, refusal, limitations, receipt, plus the engine result. Unknown names refuse FG-HALLUC-TOOL; stubs refuse FG-STUB."
        +    },
        +    "session_id": {
        +      "description": "Raw session id when session plumbing was used. Hidden unless the user asked for the chain.",
        +      "type": "string"
        +    },
        +    "status": {
        +      "description": "HTTP-like status when present on wrappers (200 ok; 400+ error / refuse).",
        +      "type": "integer"
        +    }
        +  },
        +  "type": "object"
        +}
    • Changedfraggate_list4 fields changed
      • changedInput schema / additionalProperties
        Previous value: -trueNew value: +false
      • addedInput schema / description
        Added value: +"No arguments. Send {}. Discovery first — not describe or execute."
      • addedInput schema / properties
        Added value: +{}
      • changedOutput schema / (root)
        Previous value: -nullNew value: +{
        +  "additionalProperties": true,
        +  "description": "Display envelope shown to the user (display.title / display.summary) plus the machine result. Extra engine fields may appear.",
        +  "properties": {
        +    "code": {
        +      "description": "FragGate or fabric code when present: FG-OK, FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-UNKNOWN-OP, FG-GATE-REFUSE, FG-LAMB-REFUSE, or a module refuse such as MESH-* / AKM-*.",
        +      "type": "string"
        +    },
        +    "display": {
        +      "additionalProperties": true,
        +      "description": "Human-facing envelope. Show title and summary, then take the next input.",
        +      "properties": {
        +        "fields": {
        +          "description": "Optional labeled scalars copied from the result for display.",
        +          "items": {
        +            "additionalProperties": true,
        +            "properties": {
        +              "label": {
        +                "description": "Field label.",
        +                "type": "string"
        +              },
        +              "value": {
        +                "description": "Field value as text.",
        +                "type": "string"
        +              }
        +            },
        +            "type": "object"
        +          },
        +          "type": "array"
        +        },
        +        "next": {
        +          "description": "What the agent should do after showing this output.",
        +          "type": "string"
        +        },
        +        "summary": {
        +          "description": "One-line outcome or refuse reason.",
        +          "type": "string"
        +        },
        +        "title": {
        +          "description": "Short result title for the AI client.",
        +          "type": "string"
        +        }
        +      },
        +      "type": "object"
        +    },
        +    "door": {
        +      "description": "Door name. The public door is fraggate.",
        +      "type": "string"
        +    },
        +    "engine_digest": {
        +      "description": "64-hex engine_digest when a true in-process engine ran (often inside result).",
        +      "type": "string"
        +    },
        +    "engine_op": {
        +      "description": "Resolved engine op when present (often inside result).",
        +      "type": "string"
        +    },
        +    "engine_slug": {
        +      "description": "Resolved engine slug when present (often inside result).",
        +      "type": "string"
        +    },
        +    "ledger_tip": {
        +      "description": "Ask/refuse ledger tip when the door stamped one."
        +    },
        +    "limitations": {
        +      "description": "Capability limitations or Remain-OFF notes when present."
        +    },
        +    "provenance": {
        +      "description": "Provenance / input packet when the pipeline attached one."
        +    },
        +    "ran_in": {
        +      "description": "Execution locale (for example aziel-runtime) when present.",
        +      "type": "string"
        +    },
        +    "receipt": {
        +      "description": "Optional receipt, ledger tip, or TemporalLock/ForgeReceipts exit when the door stamped one."
        +    },
        +    "refusal": {
        +      "description": "Explicit refuse object, code, or message when the door or engine refused."
        +    },
        +    "result": {
        +      "description": "FragGate body: ok, code, door, slug, op, engine_digest, ran_in, provenance, refusal, limitations, receipt, plus the engine result. Unknown names refuse FG-HALLUC-TOOL; stubs refuse FG-STUB."
        +    },
        +    "session_id": {
        +      "description": "Raw session id when session plumbing was used. Hidden unless the user asked for the chain.",
        +      "type": "string"
        +    },
        +    "status": {
        +      "description": "HTTP-like status when present on wrappers (200 ok; 400+ error / refuse).",
        +      "type": "integer"
        +    }
        +  },
        +  "type": "object"
        +}
    • Changedfraggate_verify7 fields changed
      • changedInput schema / additionalProperties
        Previous value: -trueNew value: +false
      • addedInput schema / description
        Added value: +"Provide name, slug, and/or digest. Digest-only checks the whole registry hash."
      • addedInput schema / properties / digest / description
        Added value: +"Optional 64-char lowercase hex engine_digest or registry digest to verify. When digest is set without name/slug, the tool compares the live registry digest."
      • addedInput schema / properties / digest / pattern
        Added value: +"^[a-fA-F0-9]{64}$"
      • addedInput schema / properties / name / description
        Added value: +"Optional registry display name (for example FoldLock, EmbryoLock, AZHub). Use name or slug — one is enough. Combined name/op forms such as foldlock/fold-preview are accepted by the door parser. Unknown names refuse FG-HALLUC-TOOL."
      • addedInput schema / properties / slug / description
        Added value: +"Optional catalog slug (lowercase a-z0-9-, for example foldlock, embryolock, azhub). Alternative to name. Prefer the slug returned by fraggate_list or GET /v1/software."
      • changedOutput schema / (root)
        Previous value: -nullNew value: +{
        +  "additionalProperties": true,
        +  "description": "Display envelope shown to the user (display.title / display.summary) plus the machine result. Extra engine fields may appear.",
        +  "properties": {
        +    "code": {
        +      "description": "FragGate or fabric code when present: FG-OK, FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-UNKNOWN-OP, FG-GATE-REFUSE, FG-LAMB-REFUSE, or a module refuse such as MESH-* / AKM-*.",
        +      "type": "string"
        +    },
        +    "display": {
        +      "additionalProperties": true,
        +      "description": "Human-facing envelope. Show title and summary, then take the next input.",
        +      "properties": {
        +        "fields": {
        +          "description": "Optional labeled scalars copied from the result for display.",
        +          "items": {
        +            "additionalProperties": true,
        +            "properties": {
        +              "label": {
        +                "description": "Field label.",
        +                "type": "string"
        +              },
        +              "value": {
        +                "description": "Field value as text.",
        +                "type": "string"
        +              }
        +            },
        +            "type": "object"
        +          },
        +          "type": "array"
        +        },
        +        "next": {
        +          "description": "What the agent should do after showing this output.",
        +          "type": "string"
        +        },
        +        "summary": {
        +          "description": "One-line outcome or refuse reason.",
        +          "type": "string"
        +        },
        +        "title": {
        +          "description": "Short result title for the AI client.",
        +          "type": "string"
        +        }
        +      },
        +      "type": "object"
        +    },
        +    "door": {
        +      "description": "Door name. The public door is fraggate.",
        +      "type": "string"
        +    },
        +    "engine_digest": {
        +      "description": "64-hex engine_digest when a true in-process engine ran (often inside result).",
        +      "type": "string"
        +    },
        +    "engine_op": {
        +      "description": "Resolved engine op when present (often inside result).",
        +      "type": "string"
        +    },
        +    "engine_slug": {
        +      "description": "Resolved engine slug when present (often inside result).",
        +      "type": "string"
        +    },
        +    "ledger_tip": {
        +      "description": "Ask/refuse ledger tip when the door stamped one."
        +    },
        +    "limitations": {
        +      "description": "Capability limitations or Remain-OFF notes when present."
        +    },
        +    "provenance": {
        +      "description": "Provenance / input packet when the pipeline attached one."
        +    },
        +    "ran_in": {
        +      "description": "Execution locale (for example aziel-runtime) when present.",
        +      "type": "string"
        +    },
        +    "receipt": {
        +      "description": "Optional receipt, ledger tip, or TemporalLock/ForgeReceipts exit when the door stamped one."
        +    },
        +    "refusal": {
        +      "description": "Explicit refuse object, code, or message when the door or engine refused."
        +    },
        +    "result": {
        +      "description": "FragGate body: ok, code, door, slug, op, engine_digest, ran_in, provenance, refusal, limitations, receipt, plus the engine result. Unknown names refuse FG-HALLUC-TOOL; stubs refuse FG-STUB."
        +    },
        +    "session_id": {
        +      "description": "Raw session id when session plumbing was used. Hidden unless the user asked for the chain.",
        +      "type": "string"
        +    },
        +    "status": {
        +      "description": "HTTP-like status when present on wrappers (200 ok; 400+ error / refuse).",
        +      "type": "integer"
        +    }
        +  },
        +  "type": "object"
        +}
    • Changedlibrary_lookup5 fields changed
      • addedInput schema / description
        Added value: +"q is the search text. op selects the library verb. Extra keys are forwarded as corpus payload."
      • changedInput schema / properties / op / description
        Previous value: -"search (default), example, or skill"New value: +"Optional library verb. search (default) looks up public corpus text; example returns a sample; skill returns the library skill; health is liveness. Other values refuse FG-UNKNOWN-OP."
      • addedInput schema / properties / op / enum
        Added value: +[
        +  "search",
        +  "example",
        +  "skill",
        +  "health"
        +]
      • addedInput schema / properties / q / description
        Added value: +"Optional query string for op=search. Empty q returns an empty or default hit set, not an invented cite."
      • changedOutput schema / (root)
        Previous value: -nullNew value: +{
        +  "additionalProperties": true,
        +  "description": "Display envelope shown to the user (display.title / display.summary) plus the machine result. Extra engine fields may appear.",
        +  "properties": {
        +    "code": {
        +      "description": "FragGate or fabric code when present: FG-OK, FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-UNKNOWN-OP, FG-GATE-REFUSE, FG-LAMB-REFUSE, or a module refuse such as MESH-* / AKM-*.",
        +      "type": "string"
        +    },
        +    "display": {
        +      "additionalProperties": true,
        +      "description": "Human-facing envelope. Show title and summary, then take the next input.",
        +      "properties": {
        +        "fields": {
        +          "description": "Optional labeled scalars copied from the result for display.",
        +          "items": {
        +            "additionalProperties": true,
        +            "properties": {
        +              "label": {
        +                "description": "Field label.",
        +                "type": "string"
        +              },
        +              "value": {
        +                "description": "Field value as text.",
        +                "type": "string"
        +              }
        +            },
        +            "type": "object"
        +          },
        +          "type": "array"
        +        },
        +        "next": {
        +          "description": "What the agent should do after showing this output.",
        +          "type": "string"
        +        },
        +        "summary": {
        +          "description": "One-line outcome or refuse reason.",
        +          "type": "string"
        +        },
        +        "title": {
        +          "description": "Short result title for the AI client.",
        +          "type": "string"
        +        }
        +      },
        +      "type": "object"
        +    },
        +    "door": {
        +      "description": "Door name. The public door is fraggate.",
        +      "type": "string"
        +    },
        +    "engine_digest": {
        +      "description": "64-hex engine_digest when a true in-process engine ran (often inside result).",
        +      "type": "string"
        +    },
        +    "engine_op": {
        +      "description": "Resolved engine op when present (often inside result).",
        +      "type": "string"
        +    },
        +    "engine_slug": {
        +      "description": "Resolved engine slug when present (often inside result).",
        +      "type": "string"
        +    },
        +    "ledger_tip": {
        +      "description": "Ask/refuse ledger tip when the door stamped one."
        +    },
        +    "limitations": {
        +      "description": "Capability limitations or Remain-OFF notes when present."
        +    },
        +    "provenance": {
        +      "description": "Provenance / input packet when the pipeline attached one."
        +    },
        +    "ran_in": {
        +      "description": "Execution locale (for example aziel-runtime) when present.",
        +      "type": "string"
        +    },
        +    "receipt": {
        +      "description": "Optional receipt, ledger tip, or TemporalLock/ForgeReceipts exit when the door stamped one."
        +    },
        +    "refusal": {
        +      "description": "Explicit refuse object, code, or message when the door or engine refused."
        +    },
        +    "result": {
        +      "description": "FragGate body: ok, code, door, slug, op, engine_digest, ran_in, provenance, refusal, limitations, receipt, plus the engine result. Unknown names refuse FG-HALLUC-TOOL; stubs refuse FG-STUB."
        +    },
        +    "session_id": {
        +      "description": "Raw session id when session plumbing was used. Hidden unless the user asked for the chain.",
        +      "type": "string"
        +    },
        +    "status": {
        +      "description": "HTTP-like status when present on wrappers (200 ok; 400+ error / refuse).",
        +      "type": "integer"
        +    }
        +  },
        +  "type": "object"
        +}
    • Addedmemory_calibrate
    • Addedmemory_get
    • Addedmemory_observe
    • Addedmemory_recall
    • Addedmemory_resolve
    • Addedmesh_broadcast
    • Addedmesh_disable
    • Addedmesh_enable
    • Addedmesh_heartbeat
    • Addedmesh_join
    • Addedmesh_leave
    • Addedmesh_nodes
    • Addedmesh_status
    • Changedruntime_bundle4 fields changed
      • changedInput schema / additionalProperties
        Previous value: -trueNew value: +false
      • addedInput schema / description
        Added value: +"No arguments. Send {}."
      • addedInput schema / properties
        Added value: +{}
      • changedOutput schema / (root)
        Previous value: -nullNew value: +{
        +  "additionalProperties": true,
        +  "description": "Display envelope shown to the user (display.title / display.summary) plus the machine result. Extra engine fields may appear.",
        +  "properties": {
        +    "code": {
        +      "description": "FragGate or fabric code when present: FG-OK, FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-UNKNOWN-OP, FG-GATE-REFUSE, FG-LAMB-REFUSE, or a module refuse such as MESH-* / AKM-*.",
        +      "type": "string"
        +    },
        +    "display": {
        +      "additionalProperties": true,
        +      "description": "Human-facing envelope. Show title and summary, then take the next input.",
        +      "properties": {
        +        "fields": {
        +          "description": "Optional labeled scalars copied from the result for display.",
        +          "items": {
        +            "additionalProperties": true,
        +            "properties": {
        +              "label": {
        +                "description": "Field label.",
        +                "type": "string"
        +              },
        +              "value": {
        +                "description": "Field value as text.",
        +                "type": "string"
        +              }
        +            },
        +            "type": "object"
        +          },
        +          "type": "array"
        +        },
        +        "next": {
        +          "description": "What the agent should do after showing this output.",
        +          "type": "string"
        +        },
        +        "summary": {
        +          "description": "One-line outcome or refuse reason.",
        +          "type": "string"
        +        },
        +        "title": {
        +          "description": "Short result title for the AI client.",
        +          "type": "string"
        +        }
        +      },
        +      "type": "object"
        +    },
        +    "door": {
        +      "description": "Door name. The public door is fraggate.",
        +      "type": "string"
        +    },
        +    "engine_digest": {
        +      "description": "64-hex engine_digest when a true in-process engine ran (often inside result).",
        +      "type": "string"
        +    },
        +    "engine_op": {
        +      "description": "Resolved engine op when present (often inside result).",
        +      "type": "string"
        +    },
        +    "engine_slug": {
        +      "description": "Resolved engine slug when present (often inside result).",
        +      "type": "string"
        +    },
        +    "ledger_tip": {
        +      "description": "Ask/refuse ledger tip when the door stamped one."
        +    },
        +    "limitations": {
        +      "description": "Capability limitations or Remain-OFF notes when present."
        +    },
        +    "provenance": {
        +      "description": "Provenance / input packet when the pipeline attached one."
        +    },
        +    "ran_in": {
        +      "description": "Execution locale (for example aziel-runtime) when present.",
        +      "type": "string"
        +    },
        +    "receipt": {
        +      "description": "Optional receipt, ledger tip, or TemporalLock/ForgeReceipts exit when the door stamped one."
        +    },
        +    "refusal": {
        +      "description": "Explicit refuse object, code, or message when the door or engine refused."
        +    },
        +    "result": {
        +      "description": "Machine payload. FragGate-style results commonly include ok, code, slug, op, status, engine_slug, engine_op, engine_digest, ran_in, provenance, refusal, limitations, and ledger_tip."
        +    },
        +    "session_id": {
        +      "description": "Raw session id when session plumbing was used. Hidden unless the user asked for the chain.",
        +      "type": "string"
        +    },
        +    "status": {
        +      "description": "HTTP-like status when present on wrappers (200 ok; 400+ error / refuse).",
        +      "type": "integer"
        +    }
        +  },
        +  "type": "object"
        +}
    • Changedruntime_manifest3 fields changed
      • addedInput schema / description
        Added value: +"No required arguments. Extra keys are ignored."
      • addedInput schema / properties
        Added value: +{}
      • changedOutput schema / (root)
        Previous value: -nullNew value: +{
        +  "additionalProperties": true,
        +  "description": "Display envelope shown to the user (display.title / display.summary) plus the machine result. Extra engine fields may appear.",
        +  "properties": {
        +    "code": {
        +      "description": "FragGate or fabric code when present: FG-OK, FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-UNKNOWN-OP, FG-GATE-REFUSE, FG-LAMB-REFUSE, or a module refuse such as MESH-* / AKM-*.",
        +      "type": "string"
        +    },
        +    "display": {
        +      "additionalProperties": true,
        +      "description": "Human-facing envelope. Show title and summary, then take the next input.",
        +      "properties": {
        +        "fields": {
        +          "description": "Optional labeled scalars copied from the result for display.",
        +          "items": {
        +            "additionalProperties": true,
        +            "properties": {
        +              "label": {
        +                "description": "Field label.",
        +                "type": "string"
        +              },
        +              "value": {
        +                "description": "Field value as text.",
        +                "type": "string"
        +              }
        +            },
        +            "type": "object"
        +          },
        +          "type": "array"
        +        },
        +        "next": {
        +          "description": "What the agent should do after showing this output.",
        +          "type": "string"
        +        },
        +        "summary": {
        +          "description": "One-line outcome or refuse reason.",
        +          "type": "string"
        +        },
        +        "title": {
        +          "description": "Short result title for the AI client.",
        +          "type": "string"
        +        }
        +      },
        +      "type": "object"
        +    },
        +    "door": {
        +      "description": "Door name. The public door is fraggate.",
        +      "type": "string"
        +    },
        +    "engine_digest": {
        +      "description": "64-hex engine_digest when a true in-process engine ran (often inside result).",
        +      "type": "string"
        +    },
        +    "engine_op": {
        +      "description": "Resolved engine op when present (often inside result).",
        +      "type": "string"
        +    },
        +    "engine_slug": {
        +      "description": "Resolved engine slug when present (often inside result).",
        +      "type": "string"
        +    },
        +    "ledger_tip": {
        +      "description": "Ask/refuse ledger tip when the door stamped one."
        +    },
        +    "limitations": {
        +      "description": "Capability limitations or Remain-OFF notes when present."
        +    },
        +    "provenance": {
        +      "description": "Provenance / input packet when the pipeline attached one."
        +    },
        +    "ran_in": {
        +      "description": "Execution locale (for example aziel-runtime) when present.",
        +      "type": "string"
        +    },
        +    "receipt": {
        +      "description": "Optional receipt, ledger tip, or TemporalLock/ForgeReceipts exit when the door stamped one."
        +    },
        +    "refusal": {
        +      "description": "Explicit refuse object, code, or message when the door or engine refused."
        +    },
        +    "result": {
        +      "description": "Machine payload. FragGate-style results commonly include ok, code, slug, op, status, engine_slug, engine_op, engine_digest, ran_in, provenance, refusal, limitations, and ledger_tip."
        +    },
        +    "session_id": {
        +      "description": "Raw session id when session plumbing was used. Hidden unless the user asked for the chain.",
        +      "type": "string"
        +    },
        +    "status": {
        +      "description": "HTTP-like status when present on wrappers (200 ok; 400+ error / refuse).",
        +      "type": "integer"
        +    }
        +  },
        +  "type": "object"
        +}
    • Changedruntime_pull3 fields changed
      • addedInput schema / description
        Added value: +"slug is required. Extra keys are ignored by the pull helper."
      • addedInput schema / properties / slug / description
        Added value: +"Required catalog slug from GET /v1/software or fraggate_list (for example foldlock). Not an exec path."
      • changedOutput schema / (root)
        Previous value: -nullNew value: +{
        +  "additionalProperties": true,
        +  "description": "Display envelope shown to the user (display.title / display.summary) plus the machine result. Extra engine fields may appear.",
        +  "properties": {
        +    "code": {
        +      "description": "FragGate or fabric code when present: FG-OK, FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-UNKNOWN-OP, FG-GATE-REFUSE, FG-LAMB-REFUSE, or a module refuse such as MESH-* / AKM-*.",
        +      "type": "string"
        +    },
        +    "display": {
        +      "additionalProperties": true,
        +      "description": "Human-facing envelope. Show title and summary, then take the next input.",
        +      "properties": {
        +        "fields": {
        +          "description": "Optional labeled scalars copied from the result for display.",
        +          "items": {
        +            "additionalProperties": true,
        +            "properties": {
        +              "label": {
        +                "description": "Field label.",
        +                "type": "string"
        +              },
        +              "value": {
        +                "description": "Field value as text.",
        +                "type": "string"
        +              }
        +            },
        +            "type": "object"
        +          },
        +          "type": "array"
        +        },
        +        "next": {
        +          "description": "What the agent should do after showing this output.",
        +          "type": "string"
        +        },
        +        "summary": {
        +          "description": "One-line outcome or refuse reason.",
        +          "type": "string"
        +        },
        +        "title": {
        +          "description": "Short result title for the AI client.",
        +          "type": "string"
        +        }
        +      },
        +      "type": "object"
        +    },
        +    "door": {
        +      "description": "Door name. The public door is fraggate.",
        +      "type": "string"
        +    },
        +    "engine_digest": {
        +      "description": "64-hex engine_digest when a true in-process engine ran (often inside result).",
        +      "type": "string"
        +    },
        +    "engine_op": {
        +      "description": "Resolved engine op when present (often inside result).",
        +      "type": "string"
        +    },
        +    "engine_slug": {
        +      "description": "Resolved engine slug when present (often inside result).",
        +      "type": "string"
        +    },
        +    "ledger_tip": {
        +      "description": "Ask/refuse ledger tip when the door stamped one."
        +    },
        +    "limitations": {
        +      "description": "Capability limitations or Remain-OFF notes when present."
        +    },
        +    "provenance": {
        +      "description": "Provenance / input packet when the pipeline attached one."
        +    },
        +    "ran_in": {
        +      "description": "Execution locale (for example aziel-runtime) when present.",
        +      "type": "string"
        +    },
        +    "receipt": {
        +      "description": "Optional receipt, ledger tip, or TemporalLock/ForgeReceipts exit when the door stamped one."
        +    },
        +    "refusal": {
        +      "description": "Explicit refuse object, code, or message when the door or engine refused."
        +    },
        +    "result": {
        +      "description": "Machine payload. FragGate-style results commonly include ok, code, slug, op, status, engine_slug, engine_op, engine_digest, ran_in, provenance, refusal, limitations, and ledger_tip."
        +    },
        +    "session_id": {
        +      "description": "Raw session id when session plumbing was used. Hidden unless the user asked for the chain.",
        +      "type": "string"
        +    },
        +    "status": {
        +      "description": "HTTP-like status when present on wrappers (200 ok; 400+ error / refuse).",
        +      "type": "integer"
        +    }
        +  },
        +  "type": "object"
        +}
    • Changedruntime_run7 fields changed
      • addedInput schema / description
        Added value: +"slug and op are required. Extra keys other than payload/session_id may be treated as payload."
      • addedInput schema / properties / op / description
        Added value: +"Required allowlisted op. Stubs refuse FG-STUB."
      • addedInput schema / properties / payload / additionalProperties
        Added value: +true
      • addedInput schema / properties / payload / description
        Added value: +"Optional op payload object. Engine-specific."
      • addedInput schema / properties / session_id / description
        Added value: +"Optional existing raw session id. If omitted, a session is opened automatically. Prefer leaving session plumbing invisible unless asked."
      • addedInput schema / properties / slug / description
        Added value: +"Required catalog slug (or name alias). Unknown slugs refuse FG-HALLUC-TOOL."
      • changedOutput schema / (root)
        Previous value: -nullNew value: +{
        +  "additionalProperties": true,
        +  "description": "Display envelope shown to the user (display.title / display.summary) plus the machine result. Extra engine fields may appear.",
        +  "properties": {
        +    "code": {
        +      "description": "FragGate or fabric code when present: FG-OK, FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-UNKNOWN-OP, FG-GATE-REFUSE, FG-LAMB-REFUSE, or a module refuse such as MESH-* / AKM-*.",
        +      "type": "string"
        +    },
        +    "display": {
        +      "additionalProperties": true,
        +      "description": "Human-facing envelope. Show title and summary, then take the next input.",
        +      "properties": {
        +        "fields": {
        +          "description": "Optional labeled scalars copied from the result for display.",
        +          "items": {
        +            "additionalProperties": true,
        +            "properties": {
        +              "label": {
        +                "description": "Field label.",
        +                "type": "string"
        +              },
        +              "value": {
        +                "description": "Field value as text.",
        +                "type": "string"
        +              }
        +            },
        +            "type": "object"
        +          },
        +          "type": "array"
        +        },
        +        "next": {
        +          "description": "What the agent should do after showing this output.",
        +          "type": "string"
        +        },
        +        "summary": {
        +          "description": "One-line outcome or refuse reason.",
        +          "type": "string"
        +        },
        +        "title": {
        +          "description": "Short result title for the AI client.",
        +          "type": "string"
        +        }
        +      },
        +      "type": "object"
        +    },
        +    "door": {
        +      "description": "Door name. The public door is fraggate.",
        +      "type": "string"
        +    },
        +    "engine_digest": {
        +      "description": "64-hex engine_digest when a true in-process engine ran (often inside result).",
        +      "type": "string"
        +    },
        +    "engine_op": {
        +      "description": "Resolved engine op when present (often inside result).",
        +      "type": "string"
        +    },
        +    "engine_slug": {
        +      "description": "Resolved engine slug when present (often inside result).",
        +      "type": "string"
        +    },
        +    "ledger_tip": {
        +      "description": "Ask/refuse ledger tip when the door stamped one."
        +    },
        +    "limitations": {
        +      "description": "Capability limitations or Remain-OFF notes when present."
        +    },
        +    "provenance": {
        +      "description": "Provenance / input packet when the pipeline attached one."
        +    },
        +    "ran_in": {
        +      "description": "Execution locale (for example aziel-runtime) when present.",
        +      "type": "string"
        +    },
        +    "receipt": {
        +      "description": "Optional receipt, ledger tip, or TemporalLock/ForgeReceipts exit when the door stamped one."
        +    },
        +    "refusal": {
        +      "description": "Explicit refuse object, code, or message when the door or engine refused."
        +    },
        +    "result": {
        +      "description": "Machine payload. FragGate-style results commonly include ok, code, slug, op, status, engine_slug, engine_op, engine_digest, ran_in, provenance, refusal, limitations, and ledger_tip."
        +    },
        +    "session_id": {
        +      "description": "Raw session id when session plumbing was used. Hidden unless the user asked for the chain.",
        +      "type": "string"
        +    },
        +    "status": {
        +      "description": "HTTP-like status when present on wrappers (200 ok; 400+ error / refuse).",
        +      "type": "integer"
        +    }
        +  },
        +  "type": "object"
        +}
    • Changedruntime_session_close3 fields changed
      • addedInput schema / description
        Added value: +"session_id is required."
      • addedInput schema / properties / session_id / description
        Added value: +"Required session id to seal. Further exec on this id is rejected."
      • changedOutput schema / (root)
        Previous value: -nullNew value: +{
        +  "additionalProperties": true,
        +  "description": "Display envelope shown to the user (display.title / display.summary) plus the machine result. Extra engine fields may appear.",
        +  "properties": {
        +    "code": {
        +      "description": "FragGate or fabric code when present: FG-OK, FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-UNKNOWN-OP, FG-GATE-REFUSE, FG-LAMB-REFUSE, or a module refuse such as MESH-* / AKM-*.",
        +      "type": "string"
        +    },
        +    "display": {
        +      "additionalProperties": true,
        +      "description": "Human-facing envelope. Show title and summary, then take the next input.",
        +      "properties": {
        +        "fields": {
        +          "description": "Optional labeled scalars copied from the result for display.",
        +          "items": {
        +            "additionalProperties": true,
        +            "properties": {
        +              "label": {
        +                "description": "Field label.",
        +                "type": "string"
        +              },
        +              "value": {
        +                "description": "Field value as text.",
        +                "type": "string"
        +              }
        +            },
        +            "type": "object"
        +          },
        +          "type": "array"
        +        },
        +        "next": {
        +          "description": "What the agent should do after showing this output.",
        +          "type": "string"
        +        },
        +        "summary": {
        +          "description": "One-line outcome or refuse reason.",
        +          "type": "string"
        +        },
        +        "title": {
        +          "description": "Short result title for the AI client.",
        +          "type": "string"
        +        }
        +      },
        +      "type": "object"
        +    },
        +    "door": {
        +      "description": "Door name. The public door is fraggate.",
        +      "type": "string"
        +    },
        +    "engine_digest": {
        +      "description": "64-hex engine_digest when a true in-process engine ran (often inside result).",
        +      "type": "string"
        +    },
        +    "engine_op": {
        +      "description": "Resolved engine op when present (often inside result).",
        +      "type": "string"
        +    },
        +    "engine_slug": {
        +      "description": "Resolved engine slug when present (often inside result).",
        +      "type": "string"
        +    },
        +    "ledger_tip": {
        +      "description": "Ask/refuse ledger tip when the door stamped one."
        +    },
        +    "limitations": {
        +      "description": "Capability limitations or Remain-OFF notes when present."
        +    },
        +    "provenance": {
        +      "description": "Provenance / input packet when the pipeline attached one."
        +    },
        +    "ran_in": {
        +      "description": "Execution locale (for example aziel-runtime) when present.",
        +      "type": "string"
        +    },
        +    "receipt": {
        +      "description": "Optional receipt, ledger tip, or TemporalLock/ForgeReceipts exit when the door stamped one."
        +    },
        +    "refusal": {
        +      "description": "Explicit refuse object, code, or message when the door or engine refused."
        +    },
        +    "result": {
        +      "description": "Machine payload. FragGate-style results commonly include ok, code, slug, op, status, engine_slug, engine_op, engine_digest, ran_in, provenance, refusal, limitations, and ledger_tip."
        +    },
        +    "session_id": {
        +      "description": "Raw session id when session plumbing was used. Hidden unless the user asked for the chain.",
        +      "type": "string"
        +    },
        +    "status": {
        +      "description": "HTTP-like status when present on wrappers (200 ok; 400+ error / refuse).",
        +      "type": "integer"
        +    }
        +  },
        +  "type": "object"
        +}
    • Changedruntime_session_exec7 fields changed
      • addedInput schema / description
        Added value: +"session_id, slug, and op are required."
      • addedInput schema / properties / op / description
        Added value: +"Required allowlisted op. Stubs refuse FG-STUB."
      • addedInput schema / properties / payload / additionalProperties
        Added value: +true
      • addedInput schema / properties / payload / description
        Added value: +"Optional op payload object. Engine-specific."
      • addedInput schema / properties / session_id / description
        Added value: +"Required open session id. Alias: id."
      • addedInput schema / properties / slug / description
        Added value: +"Required catalog slug to exec. Unknown slugs refuse FG-HALLUC-TOOL."
      • changedOutput schema / (root)
        Previous value: -nullNew value: +{
        +  "additionalProperties": true,
        +  "description": "Display envelope shown to the user (display.title / display.summary) plus the machine result. Extra engine fields may appear.",
        +  "properties": {
        +    "code": {
        +      "description": "FragGate or fabric code when present: FG-OK, FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-UNKNOWN-OP, FG-GATE-REFUSE, FG-LAMB-REFUSE, or a module refuse such as MESH-* / AKM-*.",
        +      "type": "string"
        +    },
        +    "display": {
        +      "additionalProperties": true,
        +      "description": "Human-facing envelope. Show title and summary, then take the next input.",
        +      "properties": {
        +        "fields": {
        +          "description": "Optional labeled scalars copied from the result for display.",
        +          "items": {
        +            "additionalProperties": true,
        +            "properties": {
        +              "label": {
        +                "description": "Field label.",
        +                "type": "string"
        +              },
        +              "value": {
        +                "description": "Field value as text.",
        +                "type": "string"
        +              }
        +            },
        +            "type": "object"
        +          },
        +          "type": "array"
        +        },
        +        "next": {
        +          "description": "What the agent should do after showing this output.",
        +          "type": "string"
        +        },
        +        "summary": {
        +          "description": "One-line outcome or refuse reason.",
        +          "type": "string"
        +        },
        +        "title": {
        +          "description": "Short result title for the AI client.",
        +          "type": "string"
        +        }
        +      },
        +      "type": "object"
        +    },
        +    "door": {
        +      "description": "Door name. The public door is fraggate.",
        +      "type": "string"
        +    },
        +    "engine_digest": {
        +      "description": "64-hex engine_digest when a true in-process engine ran (often inside result).",
        +      "type": "string"
        +    },
        +    "engine_op": {
        +      "description": "Resolved engine op when present (often inside result).",
        +      "type": "string"
        +    },
        +    "engine_slug": {
        +      "description": "Resolved engine slug when present (often inside result).",
        +      "type": "string"
        +    },
        +    "ledger_tip": {
        +      "description": "Ask/refuse ledger tip when the door stamped one."
        +    },
        +    "limitations": {
        +      "description": "Capability limitations or Remain-OFF notes when present."
        +    },
        +    "provenance": {
        +      "description": "Provenance / input packet when the pipeline attached one."
        +    },
        +    "ran_in": {
        +      "description": "Execution locale (for example aziel-runtime) when present.",
        +      "type": "string"
        +    },
        +    "receipt": {
        +      "description": "Optional receipt, ledger tip, or TemporalLock/ForgeReceipts exit when the door stamped one."
        +    },
        +    "refusal": {
        +      "description": "Explicit refuse object, code, or message when the door or engine refused."
        +    },
        +    "result": {
        +      "description": "Machine payload. FragGate-style results commonly include ok, code, slug, op, status, engine_slug, engine_op, engine_digest, ran_in, provenance, refusal, limitations, and ledger_tip."
        +    },
        +    "session_id": {
        +      "description": "Raw session id when session plumbing was used. Hidden unless the user asked for the chain.",
        +      "type": "string"
        +    },
        +    "status": {
        +      "description": "HTTP-like status when present on wrappers (200 ok; 400+ error / refuse).",
        +      "type": "integer"
        +    }
        +  },
        +  "type": "object"
        +}
    • Changedruntime_session_open3 fields changed
      • addedInput schema / description
        Added value: +"No required arguments. Extra keys may be stored as open metadata. Prefer fraggate_call."
      • addedInput schema / properties
        Added value: +{}
      • changedOutput schema / (root)
        Previous value: -nullNew value: +{
        +  "additionalProperties": true,
        +  "description": "Display envelope shown to the user (display.title / display.summary) plus the machine result. Extra engine fields may appear.",
        +  "properties": {
        +    "code": {
        +      "description": "FragGate or fabric code when present: FG-OK, FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-UNKNOWN-OP, FG-GATE-REFUSE, FG-LAMB-REFUSE, or a module refuse such as MESH-* / AKM-*.",
        +      "type": "string"
        +    },
        +    "display": {
        +      "additionalProperties": true,
        +      "description": "Human-facing envelope. Show title and summary, then take the next input.",
        +      "properties": {
        +        "fields": {
        +          "description": "Optional labeled scalars copied from the result for display.",
        +          "items": {
        +            "additionalProperties": true,
        +            "properties": {
        +              "label": {
        +                "description": "Field label.",
        +                "type": "string"
        +              },
        +              "value": {
        +                "description": "Field value as text.",
        +                "type": "string"
        +              }
        +            },
        +            "type": "object"
        +          },
        +          "type": "array"
        +        },
        +        "next": {
        +          "description": "What the agent should do after showing this output.",
        +          "type": "string"
        +        },
        +        "summary": {
        +          "description": "One-line outcome or refuse reason.",
        +          "type": "string"
        +        },
        +        "title": {
        +          "description": "Short result title for the AI client.",
        +          "type": "string"
        +        }
        +      },
        +      "type": "object"
        +    },
        +    "door": {
        +      "description": "Door name. The public door is fraggate.",
        +      "type": "string"
        +    },
        +    "engine_digest": {
        +      "description": "64-hex engine_digest when a true in-process engine ran (often inside result).",
        +      "type": "string"
        +    },
        +    "engine_op": {
        +      "description": "Resolved engine op when present (often inside result).",
        +      "type": "string"
        +    },
        +    "engine_slug": {
        +      "description": "Resolved engine slug when present (often inside result).",
        +      "type": "string"
        +    },
        +    "ledger_tip": {
        +      "description": "Ask/refuse ledger tip when the door stamped one."
        +    },
        +    "limitations": {
        +      "description": "Capability limitations or Remain-OFF notes when present."
        +    },
        +    "provenance": {
        +      "description": "Provenance / input packet when the pipeline attached one."
        +    },
        +    "ran_in": {
        +      "description": "Execution locale (for example aziel-runtime) when present.",
        +      "type": "string"
        +    },
        +    "receipt": {
        +      "description": "Optional receipt, ledger tip, or TemporalLock/ForgeReceipts exit when the door stamped one."
        +    },
        +    "refusal": {
        +      "description": "Explicit refuse object, code, or message when the door or engine refused."
        +    },
        +    "result": {
        +      "description": "Machine payload. FragGate-style results commonly include ok, code, slug, op, status, engine_slug, engine_op, engine_digest, ran_in, provenance, refusal, limitations, and ledger_tip."
        +    },
        +    "session_id": {
        +      "description": "Raw session id when session plumbing was used. Hidden unless the user asked for the chain.",
        +      "type": "string"
        +    },
        +    "status": {
        +      "description": "HTTP-like status when present on wrappers (200 ok; 400+ error / refuse).",
        +      "type": "integer"
        +    }
        +  },
        +  "type": "object"
        +}
    • Changedruntime_session_policy7 fields changed
      • addedInput schema / description
        Added value: +"session_id is required. Other fields are optional policy overlays."
      • addedInput schema / properties / allow_ops / description
        Added value: +"Optional allowlist of ops this session may exec."
      • addedInput schema / properties / allow_slugs / description
        Added value: +"Optional allowlist of catalog slugs this session may exec."
      • addedInput schema / properties / kv_increment / description
        Added value: +"Optional. When true, allow KV increment side effects on this session."
      • addedInput schema / properties / max_payload_bytes / description
        Added value: +"Optional max payload size in bytes for later exec."
      • addedInput schema / properties / session_id / description
        Added value: +"Required raw session id from runtime_session_open. Alias: id."
      • changedOutput schema / (root)
        Previous value: -nullNew value: +{
        +  "additionalProperties": true,
        +  "description": "Display envelope shown to the user (display.title / display.summary) plus the machine result. Extra engine fields may appear.",
        +  "properties": {
        +    "code": {
        +      "description": "FragGate or fabric code when present: FG-OK, FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-UNKNOWN-OP, FG-GATE-REFUSE, FG-LAMB-REFUSE, or a module refuse such as MESH-* / AKM-*.",
        +      "type": "string"
        +    },
        +    "display": {
        +      "additionalProperties": true,
        +      "description": "Human-facing envelope. Show title and summary, then take the next input.",
        +      "properties": {
        +        "fields": {
        +          "description": "Optional labeled scalars copied from the result for display.",
        +          "items": {
        +            "additionalProperties": true,
        +            "properties": {
        +              "label": {
        +                "description": "Field label.",
        +                "type": "string"
        +              },
        +              "value": {
        +                "description": "Field value as text.",
        +                "type": "string"
        +              }
        +            },
        +            "type": "object"
        +          },
        +          "type": "array"
        +        },
        +        "next": {
        +          "description": "What the agent should do after showing this output.",
        +          "type": "string"
        +        },
        +        "summary": {
        +          "description": "One-line outcome or refuse reason.",
        +          "type": "string"
        +        },
        +        "title": {
        +          "description": "Short result title for the AI client.",
        +          "type": "string"
        +        }
        +      },
        +      "type": "object"
        +    },
        +    "door": {
        +      "description": "Door name. The public door is fraggate.",
        +      "type": "string"
        +    },
        +    "engine_digest": {
        +      "description": "64-hex engine_digest when a true in-process engine ran (often inside result).",
        +      "type": "string"
        +    },
        +    "engine_op": {
        +      "description": "Resolved engine op when present (often inside result).",
        +      "type": "string"
        +    },
        +    "engine_slug": {
        +      "description": "Resolved engine slug when present (often inside result).",
        +      "type": "string"
        +    },
        +    "ledger_tip": {
        +      "description": "Ask/refuse ledger tip when the door stamped one."
        +    },
        +    "limitations": {
        +      "description": "Capability limitations or Remain-OFF notes when present."
        +    },
        +    "provenance": {
        +      "description": "Provenance / input packet when the pipeline attached one."
        +    },
        +    "ran_in": {
        +      "description": "Execution locale (for example aziel-runtime) when present.",
        +      "type": "string"
        +    },
        +    "receipt": {
        +      "description": "Optional receipt, ledger tip, or TemporalLock/ForgeReceipts exit when the door stamped one."
        +    },
        +    "refusal": {
        +      "description": "Explicit refuse object, code, or message when the door or engine refused."
        +    },
        +    "result": {
        +      "description": "Machine payload. FragGate-style results commonly include ok, code, slug, op, status, engine_slug, engine_op, engine_digest, ran_in, provenance, refusal, limitations, and ledger_tip."
        +    },
        +    "session_id": {
        +      "description": "Raw session id when session plumbing was used. Hidden unless the user asked for the chain.",
        +      "type": "string"
        +    },
        +    "status": {
        +      "description": "HTTP-like status when present on wrappers (200 ok; 400+ error / refuse).",
        +      "type": "integer"
        +    }
        +  },
        +  "type": "object"
        +}
    • Changedruntime_session_receipt3 fields changed
      • addedInput schema / description
        Added value: +"session_id is required."
      • addedInput schema / properties / session_id / description
        Added value: +"Required session id whose last receipt to read. Alias: id."
      • changedOutput schema / (root)
        Previous value: -nullNew value: +{
        +  "additionalProperties": true,
        +  "description": "Display envelope shown to the user (display.title / display.summary) plus the machine result. Extra engine fields may appear.",
        +  "properties": {
        +    "code": {
        +      "description": "FragGate or fabric code when present: FG-OK, FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-UNKNOWN-OP, FG-GATE-REFUSE, FG-LAMB-REFUSE, or a module refuse such as MESH-* / AKM-*.",
        +      "type": "string"
        +    },
        +    "display": {
        +      "additionalProperties": true,
        +      "description": "Human-facing envelope. Show title and summary, then take the next input.",
        +      "properties": {
        +        "fields": {
        +          "description": "Optional labeled scalars copied from the result for display.",
        +          "items": {
        +            "additionalProperties": true,
        +            "properties": {
        +              "label": {
        +                "description": "Field label.",
        +                "type": "string"
        +              },
        +              "value": {
        +                "description": "Field value as text.",
        +                "type": "string"
        +              }
        +            },
        +            "type": "object"
        +          },
        +          "type": "array"
        +        },
        +        "next": {
        +          "description": "What the agent should do after showing this output.",
        +          "type": "string"
        +        },
        +        "summary": {
        +          "description": "One-line outcome or refuse reason.",
        +          "type": "string"
        +        },
        +        "title": {
        +          "description": "Short result title for the AI client.",
        +          "type": "string"
        +        }
        +      },
        +      "type": "object"
        +    },
        +    "door": {
        +      "description": "Door name. The public door is fraggate.",
        +      "type": "string"
        +    },
        +    "engine_digest": {
        +      "description": "64-hex engine_digest when a true in-process engine ran (often inside result).",
        +      "type": "string"
        +    },
        +    "engine_op": {
        +      "description": "Resolved engine op when present (often inside result).",
        +      "type": "string"
        +    },
        +    "engine_slug": {
        +      "description": "Resolved engine slug when present (often inside result).",
        +      "type": "string"
        +    },
        +    "ledger_tip": {
        +      "description": "Ask/refuse ledger tip when the door stamped one."
        +    },
        +    "limitations": {
        +      "description": "Capability limitations or Remain-OFF notes when present."
        +    },
        +    "provenance": {
        +      "description": "Provenance / input packet when the pipeline attached one."
        +    },
        +    "ran_in": {
        +      "description": "Execution locale (for example aziel-runtime) when present.",
        +      "type": "string"
        +    },
        +    "receipt": {
        +      "description": "Optional receipt, ledger tip, or TemporalLock/ForgeReceipts exit when the door stamped one."
        +    },
        +    "refusal": {
        +      "description": "Explicit refuse object, code, or message when the door or engine refused."
        +    },
        +    "result": {
        +      "description": "Machine payload. FragGate-style results commonly include ok, code, slug, op, status, engine_slug, engine_op, engine_digest, ran_in, provenance, refusal, limitations, and ledger_tip."
        +    },
        +    "session_id": {
        +      "description": "Raw session id when session plumbing was used. Hidden unless the user asked for the chain.",
        +      "type": "string"
        +    },
        +    "status": {
        +      "description": "HTTP-like status when present on wrappers (200 ok; 400+ error / refuse).",
        +      "type": "integer"
        +    }
        +  },
        +  "type": "object"
        +}
    • Changedruntime_session_receipts3 fields changed
      • addedInput schema / description
        Added value: +"session_id is required."
      • addedInput schema / properties / session_id / description
        Added value: +"Required session id whose receipt list to read. Alias: id."
      • changedOutput schema / (root)
        Previous value: -nullNew value: +{
        +  "additionalProperties": true,
        +  "description": "Display envelope shown to the user (display.title / display.summary) plus the machine result. Extra engine fields may appear.",
        +  "properties": {
        +    "code": {
        +      "description": "FragGate or fabric code when present: FG-OK, FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-UNKNOWN-OP, FG-GATE-REFUSE, FG-LAMB-REFUSE, or a module refuse such as MESH-* / AKM-*.",
        +      "type": "string"
        +    },
        +    "display": {
        +      "additionalProperties": true,
        +      "description": "Human-facing envelope. Show title and summary, then take the next input.",
        +      "properties": {
        +        "fields": {
        +          "description": "Optional labeled scalars copied from the result for display.",
        +          "items": {
        +            "additionalProperties": true,
        +            "properties": {
        +              "label": {
        +                "description": "Field label.",
        +                "type": "string"
        +              },
        +              "value": {
        +                "description": "Field value as text.",
        +                "type": "string"
        +              }
        +            },
        +            "type": "object"
        +          },
        +          "type": "array"
        +        },
        +        "next": {
        +          "description": "What the agent should do after showing this output.",
        +          "type": "string"
        +        },
        +        "summary": {
        +          "description": "One-line outcome or refuse reason.",
        +          "type": "string"
        +        },
        +        "title": {
        +          "description": "Short result title for the AI client.",
        +          "type": "string"
        +        }
        +      },
        +      "type": "object"
        +    },
        +    "door": {
        +      "description": "Door name. The public door is fraggate.",
        +      "type": "string"
        +    },
        +    "engine_digest": {
        +      "description": "64-hex engine_digest when a true in-process engine ran (often inside result).",
        +      "type": "string"
        +    },
        +    "engine_op": {
        +      "description": "Resolved engine op when present (often inside result).",
        +      "type": "string"
        +    },
        +    "engine_slug": {
        +      "description": "Resolved engine slug when present (often inside result).",
        +      "type": "string"
        +    },
        +    "ledger_tip": {
        +      "description": "Ask/refuse ledger tip when the door stamped one."
        +    },
        +    "limitations": {
        +      "description": "Capability limitations or Remain-OFF notes when present."
        +    },
        +    "provenance": {
        +      "description": "Provenance / input packet when the pipeline attached one."
        +    },
        +    "ran_in": {
        +      "description": "Execution locale (for example aziel-runtime) when present.",
        +      "type": "string"
        +    },
        +    "receipt": {
        +      "description": "Optional receipt, ledger tip, or TemporalLock/ForgeReceipts exit when the door stamped one."
        +    },
        +    "refusal": {
        +      "description": "Explicit refuse object, code, or message when the door or engine refused."
        +    },
        +    "result": {
        +      "description": "Machine payload. FragGate-style results commonly include ok, code, slug, op, status, engine_slug, engine_op, engine_digest, ran_in, provenance, refusal, limitations, and ledger_tip."
        +    },
        +    "session_id": {
        +      "description": "Raw session id when session plumbing was used. Hidden unless the user asked for the chain.",
        +      "type": "string"
        +    },
        +    "status": {
        +      "description": "HTTP-like status when present on wrappers (200 ok; 400+ error / refuse).",
        +      "type": "integer"
        +    }
        +  },
        +  "type": "object"
        +}
    • Changedruntime_skill4 fields changed
      • changedInput schema / additionalProperties
        Previous value: -trueNew value: +false
      • addedInput schema / description
        Added value: +"No arguments. Send {}. Returns the agent skill text."
      • addedInput schema / properties
        Added value: +{}
      • changedOutput schema / (root)
        Previous value: -nullNew value: +{
        +  "additionalProperties": true,
        +  "description": "Display envelope shown to the user (display.title / display.summary) plus the machine result. Extra engine fields may appear.",
        +  "properties": {
        +    "code": {
        +      "description": "FragGate or fabric code when present: FG-OK, FG-HALLUC-TOOL, FG-STUB, FG-LOCAL-ONLY, FG-UNKNOWN-OP, FG-GATE-REFUSE, FG-LAMB-REFUSE, or a module refuse such as MESH-* / AKM-*.",
        +      "type": "string"
        +    },
        +    "display": {
        +      "additionalProperties": true,
        +      "description": "Human-facing envelope. Show title and summary, then take the next input.",
        +      "properties": {
        +        "fields": {
        +          "description": "Optional labeled scalars copied from the result for display.",
        +          "items": {
        +            "additionalProperties": true,
        +            "properties": {
        +              "label": {
        +                "description": "Field label.",
        +                "type": "string"
        +              },
        +              "value": {
        +                "description": "Field value as text.",
        +                "type": "string"
        +              }
        +            },
        +            "type": "object"
        +          },
        +          "type": "array"
        +        },
        +        "next": {
        +          "description": "What the agent should do after showing this output.",
        +          "type": "string"
        +        },
        +        "summary": {
        +          "description": "One-line outcome or refuse reason.",
        +          "type": "string"
        +        },
        +        "title": {
        +          "description": "Short result title for the AI client.",
        +          "type": "string"
        +        }
        +      },
        +      "type": "object"
        +    },
        +    "door": {
        +      "description": "Door name. The public door is fraggate.",
        +      "type": "string"
        +    },
        +    "engine_digest": {
        +      "description": "64-hex engine_digest when a true in-process engine ran (often inside result).",
        +      "type": "string"
        +    },
        +    "engine_op": {
        +      "description": "Resolved engine op when present (often inside result).",
        +      "type": "string"
        +    },
        +    "engine_slug": {
        +      "description": "Resolved engine slug when present (often inside result).",
        +      "type": "string"
        +    },
        +    "ledger_tip": {
        +      "description": "Ask/refuse ledger tip when the door stamped one."
        +    },
        +    "limitations": {
        +      "description": "Capability limitations or Remain-OFF notes when present."
        +    },
        +    "provenance": {
        +      "description": "Provenance / input packet when the pipeline attached one."
        +    },
        +    "ran_in": {
        +      "description": "Execution locale (for example aziel-runtime) when present.",
        +      "type": "string"
        +    },
        +    "receipt": {
        +      "description": "Optional receipt, ledger tip, or TemporalLock/ForgeReceipts exit when the door stamped one."
        +    },
        +    "refusal": {
        +      "description": "Explicit refuse object, code, or message when the door or engine refused."
        +    },
        +    "result": {
        +      "description": "Machine payload. FragGate-style results commonly include ok, code, slug, op, status, engine_slug, engine_op, engine_digest, ran_in, provenance, refusal, limitations, and ledger_tip."
        +    },
        +    "session_id": {
        +      "description": "Raw session id when session plumbing was used. Hidden unless the user asked for the chain.",
        +      "type": "string"
        +    },
        +    "status": {
        +      "description": "HTTP-like status when present on wrappers (200 ok; 400+ error / refuse).",
        +      "type": "integer"
        +    }
        +  },
        +  "type": "object"
        +}
    • Addedruntime_software
  4. 110 tool updates
    • Removedark_health
    • Removedark_levels
    • Removedark_skill
    • Removedark_sweep
    • Removedazai_health
    • Removedazai_lamb_check
    • Removedazai_lamb-check
    • Removedazai_skill
    • Removedazbot_health
    • Removedazbot_route
    • Removedazbot_skill
    • Removedazclce_classify
    • Removedazclce_gate
    • Removedazclce_health
    • Removedazclce_score
    • Removedazclce_skill
    • Removedaziel-corpus_example
    • Removedaziel-corpus_health
    • Removedaziel-corpus_search
    • Removedaziel-corpus_skill
    • Removedazieltether_health
    • Removedazieltether_skill
    • Removedazieltether_verify
    • Removedazos_health
    • Removedazos_skill
    • Removedazos_status
    • Removedchronolock_advisory
    • Removedchronolock_anchors
    • Removedchronolock_health
    • Removedchronolock_skill
    • Removedcodelock_health
    • Removedcodelock_render
    • Removedcodelock_skill
    • Changeddecisiongate_check2 fields changed
      • removedInput schema / description
        Removed value: -"Pass { statement, evidence, impact_pos, impact_neg, values, accountable }. Freedom without clarity is chaos"
      • addedInput schema / properties
        Added value: +{
        +  "accountable": {
        +    "type": "string"
        +  },
        +  "evidence": {
        +    "items": {
        +      "type": "string"
        +    },
        +    "type": "array"
        +  },
        +  "impact_neg": {
        +    "items": {
        +      "type": "string"
        +    },
        +    "type": "array"
        +  },
        +  "impact_pos": {
        +    "items": {
        +      "type": "string"
        +    },
        +    "type": "array"
        +  },
        +  "statement": {
        +    "type": "string"
        +  },
        +  "values": {
        +    "items": {
        +      "type": "string"
        +    },
        +    "type": "array"
        +  }
        +}
    • Removeddecisiongate_health
    • Removeddecisiongate_skill
    • Removedemployeelock_append-preview
    • Removedemployeelock_health
    • Removedemployeelock_skill
    • Removedemployeelock_verify-canonical
    • Removedfoldlock_fold-preview
    • Removedfoldlock_health
    • Removedfoldlock_skill
    • Removedfoldlock_unfold-preview
    • Removedforgereceipts_health
    • Removedforgereceipts_receipt
    • Removedforgereceipts_skill
    • Addedfraggate_call
    • Addedfraggate_describe
    • Addedfraggate_list
    • Addedfraggate_verify
    • Removedglossafilter_health
    • Removedglossafilter_render
    • Removedglossafilter_skill
    • Removedgodlock_health
    • Removedgodlock_score
    • Removedgodlock_skill
    • Removedgodlock_submit
    • Addedlibrary_lookup
    • Removedmialock_coverage
    • Removedmialock_doe-match
    • Removedmialock_example
    • Removedmialock_health
    • Removedmialock_map
    • Removedmialock_queries
    • Removedmialock_search-options
    • Removedmialock_skill
    • Removedmiragegrid_assign
    • Removedmiragegrid_health
    • Removedmiragegrid_skill
    • Removedpostking_health
    • Removedpostking_move
    • Removedpostking_new
    • Removedpostking_skill
    • Removedpostking_status
    • Changedruntime_run4 fields changed
      • removedInput schema / properties / op / description
        Removed value: -"Product verb, e.g. fold-preview, submit, score"
      • removedInput schema / properties / payload / description
        Removed value: -"What the software needs as input"
      • removedInput schema / properties / session_id / description
        Removed value: -"Optional. Reuse an open session."
      • removedInput schema / properties / slug / description
        Removed value: -"Product slug, e.g. foldlock, godlock, azclce"
    • Removedshadowlock_health
    • Removedshadowlock_observe
    • Removedshadowlock_skill
    • Removedspectrallock_health
    • Removedspectrallock_modes
    • Removedspectrallock_overlay
    • Removedspectrallock_skill
    • Removedstaticclock_advise
    • Removedstaticclock_health
    • Removedstaticclock_skill
    • Removedtemporallock_append
    • Removedtemporallock_genesis
    • Removedtemporallock_health
    • Removedtemporallock_skill
    • Removedtemporallock_verify
    • Removedtrajectorylock_analyze
    • Removedtrajectorylock_example
    • Removedtrajectorylock_health
    • Removedtrajectorylock_skill
    • Removedveillock_apps
    • Removedveillock_health
    • Removedveillock_skill
    • Removedvibelock_analyze
    • Removedvibelock_health
    • Removedvibelock_skill
    • Removedwhistlelock_canon-preview
    • Removedwhistlelock_hash-preview
    • Removedwhistlelock_health
    • Removedwhistlelock_skill
    • Removedzsolver_health
    • Removedzsolver_patterns
    • Removedzsolver_score
    • Removedzsolver_session
    • Removedzsolver_skill

TDQS

A4.1/5.0

Scored across 36 tools

Disambiguation3/5

The set is organized into clear subsystem families (fraggate/mesh/memory/chainlock/runtime_session), and each tool's description aggressively points to its specific role. However, there are several near-overlapping clusters—three exec paths (fraggate_call, runtime_run, runtime_session_exec), multiple listing tools (fraggate_list, runtime_software, runtime_bundle), and paired recall tools (memory_recall vs chainlock_recall)—so an agent can still misroute without reading the long descriptions carefully.

Naming Consistency4/5

All names use a consistent lowercase snake_case domain-prefix convention (fraggate_*, mesh_*, memory_*, chainlock_*, runtime_*), which makes the tool families predictable. Minor deviations exist—read-only nouns like runtime_skill, runtime_manifest, and mesh_nodes sit alongside action verbs, and mesh_disable actually refuses rather than disables—but the overall pattern is coherent.

Tool Count2/5

36 tools is well beyond the 25-tool threshold and will impose a heavy selection burden on an agent even though the server spans several subsystems. The count reflects five or six distinct domains bundled into one MCP surface, and could reasonably be split into separate servers (FragGate, mesh, chainlock, memory, session).

Completeness4/5

Each subsystem has a fairly complete lifecycle: FragGate has list/describe/verify/call, mesh has status/nodes/join/heartbeat/leave/enable, ChainLock has append/tip/recall/verify/seal, memory has observe/calibrate/resolve/recall/get, and raw sessions have open/policy/exec/close/receipts. The main gaps are deliberate (no memory_delete/chainlock_delete, mesh_disable refuses by design), and there is no direct product install/remove tool, though those ops appear reachable through fraggate_call.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers