Aziel Runtime

Official36 toolsLive

by AzielEliab · JavaScript

Governed MCP: agent audit, provenance, deterministic checks, and receipt-backed FragGate execution.

io.github.AzielEliab/aziel-runtime (MCP) Server

This MCP server is described as “Governed MCP,” with responsibilities including agent audit, provenance, deterministic checks, and receipt-backed FragGate execution. The server’s purpose is to provide governance and verification around how agent actions are executed and recorded.

🛠️ Key Features

Agent audit
Provenance tracking
Deterministic checks
Receipt-backed FragGate execution

🚀 Use Cases

Governed execution of agent workflows that require auditing
Systems needing provenance information for actions
Environments that rely on deterministic checks
Execution flows that use receipts to support FragGate behavior

⚡ Developer Benefits

Explicit governance measures (audit and provenance)
Deterministic verification capability
Receipt-backed execution support for FragGate

⚠️ Limitations

No tool catalog, topics, or tool count information provided in the available data

Topics

aziel-eliabcloudflare-workersmcpruntimeagent-orchestrationai-agentsauditingchain-of-custodydigital-forensicsmodel-context-protocolprovenancesecuritysoftware-architectureopenapifraggateglamamcp-servernodemeshcloudflareworkers

Captured live from the server via tools/list.

runtime_skill

Read the agent how-to (one door — discover, route, refuse; pipeline fraggate_list → fraggate_describe → fraggate_call). This is playbook markdown, not a catalog and not a machine manifest. Use this when starting a session or choosing the door before any catalog call. Do not use it for listing hashed registry names, hub Software-tab cards, or executing an engine; use fraggate_list, runtime_software, or fraggate_call instead. Dual surface: agent chat has no technical UI chrome; Worker / Flutter / local install stay complete human software. Does not list slugs or run ops. Returns skill markdown plus display.title / display.summary.

Parameters

No parameters.

Raw schema

{
  "type": "object",
  "properties": {},
  "additionalProperties": false,
  "description": "No arguments. Send {}. Returns the agent skill text."
}

fraggate_list

List the hashed FragGate registry (live / stub / local_only + digests) so you can discover names. Discovery first — not a hub Software tab and not exec. Use this when you do not yet know the catalog name or slug. Do not use it for hub Software-tab refresh, inspecting one known capability, or executing an op; use runtime_software (GET /v1/software), fraggate_describe, or fraggate_call instead. Empty {} only. Never enables mesh radios. Never invents tools or ops. Compact LIVE_OPS tokens below are discovery hints required by product verify scripts — they are not exec. Call fraggate_describe for the live card; later unknown names refuse FG-HALLUC-TOOL. Returns registry entries, allowlists, digests, and the MASTER-33 pipeline cite. Not the full FragGate door. Empty fraggate_list is discovery (hashed LIVE_OPS). Catalog LIVE_OPS slugs (40): 4dmap, ark, azai, azbot, azbrowser, azchat, azclce, azcoherence, azhub, aziel-corpus, azieltether, azinterface, azmail, aznet, azos, azvpn, chronolock, codelock, decisiongate, embryolock, employeelock, foldlock, forgereceipts, glossafilter, godlock, mialock, miragegrid, mmconsensus, peacelock, postking, shadowlock, spectrallock, staticclock, temporallock, toolbench, trajectorylock, vibelock, whistlelock, zkattest, zsolver. Compact product-verify tokens (not a second allowlist): allowlist.azhub LIVE_OPS: health, skill, region_list, place_module, remove_module, tether_declare, tether_cut, tether_list, blank_key_status, list_modules, place. allowlist.azinterface LIVE_OPS: health, skill, genesis_status, site_state_get, site_state_set, integrity_check, witness_list, page_cycle_status, genesis_boot, hold. allowlist.azbrowser LIVE_OPS: ethical_search, lamb_lens_search, navigate, airlock_ingest, airlock, home, tab_open, tab_list, receipt_list, verify, receipt_verify, sandbox_status, sandbox_render, health, skill, vpn. allowlist.azvpn LIVE_OPS: health, skill, doctor, limitation, describe, open, status, list, close, send, recv, pull, peers, attach. allowlist.aznet LIVE_OPS: health, doctor, pair_status, pair, garden_list, stamp, verify_hash, memorial_list, memorial_append, receipt_verify, skill. UI aliases forward to catalog ops. EmbryoLock LIVE_OPS health/skill/doctor/verify-hash/policy/limitation; wipe/scorch/unlock stay FG-STUB on the public mesh.

Parameters

No parameters.

Raw schema

{
  "type": "object",
  "properties": {},
  "additionalProperties": false,
  "description": "No arguments. Send {}. Discovery first — not describe or execute."
}

fraggate_describe

Inspect one known FragGate card (live vs stub vs local_only, public ops, engine_digest). Not execute and not a digest-only proof. Use this when you already have a name or slug from fraggate_list or GET /v1/software. Do not use it for discovering the full registry, proving a digest, pulling a hub product card, or executing an op; use fraggate_list, fraggate_verify, runtime_pull, or fraggate_call instead. Missing both name and slug, or an unknown name, refuses FG-HALLUC-TOOL. Wipe/unlock on embryolock stay FG-STUB. AZChat is LIVE+bound (mesh default off; not AZMail). Pass name or slug — one is enough. Combined name/op forms such as foldlock/fold-preview are accepted. Returns one registry card (ops, stub_ops, digest, status, aliases).

Parameters2

name	string	optional	Optional registry display name (for example FoldLock, EmbryoLock, AZHub). Use name or slug — one is enough. Combined name/op forms such as foldlock/fold-preview are accepted by the door parser. Unknown names refuse FG-HALLUC-TOOL.
slug	string	optional	Optional catalog slug (lowercase a-z0-9-, for example foldlock, embryolock, azhub). Alternative to name. Prefer the slug returned by fraggate_list or GET /v1/software.

Raw schema

{
  "type": "object",
  "properties": {
    "name": {
      "type": "string",
      "description": "Optional registry display name (for example FoldLock, EmbryoLock, AZHub). Use name or slug — one is enough. Combined name/op forms such as foldlock/fold-preview are accepted by the door parser. Unknown names refuse FG-HALLUC-TOOL."
    },
    "slug": {
      "type": "string",
      "description": "Optional catalog slug (lowercase a-z0-9-, for example foldlock, embryolock, azhub). Alternative to name. Prefer the slug returned by fraggate_list or GET /v1/software."
    }
  },
  "additionalProperties": false,
  "description": "Exactly one of name or slug is enough. Extra properties are rejected by the schema; the door still only reads name/slug."
}

fraggate_verify

Confirm a name, slug, or 64-hex engine_digest against the hashed FragGate registry — a proof, not a card listing. Use this when you must prove a listed name or digest exists after fraggate_describe. Do not use it for listing the registry, describing ops, or executing; use fraggate_list, fraggate_describe, or fraggate_call instead. Not an exec path and not a describe card. Empty {} (no name, slug, or digest) refuses FG-HALLUC-TOOL. Digest without name/slug compares the whole registry hash (kind=registry). Name or slug with an optional digest compares that entry (kind=entry); unknown names refuse FG-HALLUC-TOOL. Mismatch returns ok=false with matched=false — it does not invent a digest. Send digest alone to proof the live registry_digest. Send name or slug (one is enough) to proof one card. Combined name+digest must equal that card's engine_digest. Returns match or mismatch (kind registry|entry, matched, registry_digest).

Parameters3

name	string	optional	Optional registry display name (for example FoldLock, EmbryoLock, AZHub). Use name or slug — one is enough. Combined name/op forms such as foldlock/fold-preview are accepted by the door parser. Unknown names refuse FG-HALLUC-TOOL.
slug	string	optional	Optional catalog slug (lowercase a-z0-9-, for example foldlock, embryolock, azhub). Alternative to name. Prefer the slug returned by fraggate_list or GET /v1/software.
digest	string	optional	Optional 64-char lowercase hex engine_digest or registry digest to verify. When digest is set without name/slug, the tool compares the live registry digest.

Raw schema

{
  "type": "object",
  "properties": {
    "name": {
      "type": "string",
      "description": "Optional registry display name (for example FoldLock, EmbryoLock, AZHub). Use name or slug — one is enough. Combined name/op forms such as foldlock/fold-preview are accepted by the door parser. Unknown names refuse FG-HALLUC-TOOL."
    },
    "slug": {
      "type": "string",
      "description": "Optional catalog slug (lowercase a-z0-9-, for example foldlock, embryolock, azhub). Alternative to name. Prefer the slug returned by fraggate_list or GET /v1/software."
    },
    "digest": {
      "type": "string",
      "description": "Optional 64-char lowercase hex engine_digest or registry digest to verify. When digest is set without name/slug, the tool compares the live registry digest.",
      "pattern": "^[a-fA-F0-9]{64}$"
    }
  },
  "additionalProperties": false,
  "description": "Provide name, slug, and/or digest. Empty {} refuses FG-HALLUC-TOOL. Digest-only checks the whole registry hash."
}

fraggate_call

Execute a known catalog slug+op through the FragGate single door (CallEnvelope → FragGate → Lamb Lens → SweepGate → Sentinel → Provenance → ChainLock-IN → DecisionGATE → AZPIPE → Internal Domain Layer → optional ASE → RoseClock → TemporalLock → ChainLock-OUT → ForgeReceipts → Return). Default exec path — not discovery and not a raw session. Use this when fraggate_list and fraggate_describe already identified a live allowlisted op. Do not use it for discovering names, inspecting one capability without exec, or raw session plumbing; use fraggate_list, fraggate_describe, or (only if asked) runtime_run / runtime_session_exec instead. Side effects are operation-dependent (read, write, or refuse). May reach an open world when the target op does (for example AZBrowser ethical_search); many ops stay isolate-local. Unknown names refuse FG-HALLUC-TOOL. Stub, local-only, and Remain-OFF verbs refuse FG-STUB / FG-LOCAL-ONLY / FG-GATE-REFUSE / FG-LAMB-REFUSE. FragGate is THE single door. Required: op. Also pass slug or name. Extra top-level keys other than name/slug/product/tool/op/verb/claim/proposal/ground/payload/session_id/id become the op payload when payload is omitted. UI aliases (list_modules, place, genesis_boot, hold, airlock, home, classify, doctor, pair) forward to catalog ops. Mutation requires confirm=true (runtime gate) or dry_run=true (preview only, no write). confirm and dry_run stay optional on inputSchema.required. dry_run still returns FG-HALLUC-TOOL, FG-STUB, FG-UNKNOWN-OP, or FG-LOCAL-ONLY when a confirm call would refuse. confirm is consent, not tenant auth, and it does not upgrade shared public-demo isolation. Returns status, result, receipt, engine_slug, engine_op, engine_digest, ran_in, provenance, refusal, and limitations. Not the full FragGate door. Empty fraggate_list is discovery (hashed LIVE_OPS). Catalog LIVE_OPS slugs (40): 4dmap, ark, azai, azbot, azbrowser, azchat, azclce, azcoherence, azhub, aziel-corpus, azieltether, azinterface, azmail, aznet, azos, azvpn, chronolock, codelock, decisiongate, embryolock, employeelock, foldlock, forgereceipts, glossafilter, godlock, mialock, miragegrid, mmconsensus, peacelock, postking, shadowlock, spectrallock, staticclock, temporallock, toolbench, trajectorylock, vibelock, whistlelock, zkattest, zsolver. Compact product-verify tokens (not a second allowlist): allowlist.azhub LIVE_OPS: health, skill, region_list, place_module, remove_module, tether_declare, tether_cut, tether_list, blank_key_status, list_modules, place. allowlist.azinterface LIVE_OPS: health, skill, genesis_status, site_state_get, site_state_set, integrity_check, witness_list, page_cycle_status, genesis_boot, hold. allowlist.azbrowser LIVE_OPS: ethical_search, lamb_lens_search, navigate, airlock_ingest, airlock, home, tab_open, tab_list, receipt_list, verify, receipt_verify, sandbox_status, sandbox_render, health, skill, vpn. allowlist.azvpn LIVE_OPS: health, skill, doctor, limitation, describe, open, status, list, close, send, recv, pull, peers, attach. allowlist.aznet LIVE_OPS: health, doctor, pair_status, pair, garden_list, stamp, verify_hash, memorial_list, memorial_append, receipt_verify, skill. UI aliases forward to catalog ops. EmbryoLock LIVE_OPS health/skill/doctor/verify-hash/policy/limitation; wipe/scorch/unlock stay FG-STUB on the public mesh.

Parameters11

name	string	optional	Optional registry display name (for example FoldLock, EmbryoLock, AZHub). Use name or slug — one is enough. Combined name/op forms such as foldlock/fold-preview are accepted by the door parser. Unknown names refuse FG-HALLUC-TOOL.
slug	string	optional	Optional catalog slug (lowercase a-z0-9-, for example foldlock, embryolock, azhub). Alternative to name. Prefer the slug returned by fraggate_list or GET /v1/software.
op	string	required	Required public allowlisted op from fraggate_describe (for example fold-preview, ethical_search, blank_key_status). UI aliases (list_modules, place, genesis_boot, hold, airlock, home, classify, doctor, pair) forward to catalog ops. Unknown ops refuse FG-UNKNOWN-OP; stubs refuse FG-STUB.
payload	object	optional	Optional op payload object. Shape is engine-specific (see fraggate_describe). Malformed fields are refused by the engine, not by this door schema. If omitted, leftover top-level keys are used as the payload.
request_id	string	optional	Optional logical request id. The same value groups retries of one action on the ResultEnvelope and, for ForgeReceipts, inside the receipt hash.
attempt_n	integer	optional	Optional 1-based attempt number for this call. Omitted means attempt 1 of a new request_id.
parent_receipt_id	string	optional	Optional prior attempt receipt hash. Null on the first attempt. This is not FragGate ledger prev, which stays call order only.
correlation_id	string	optional	Optional client correlation id. Sealed inside a ForgeReceipts hash when this call mints one.
claim	object	optional	Optional DecisionGATE proposal attached to this call. Also runs automatically inside the door even when omitted (defaults). Freedom without clarity is chaos.
confirm	boolean	optional	Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true. confirm is consent to run the call. It is not tenant auth and it does not upgrade shared public-demo isolation.
dry_run	boolean	optional	Optional preview flag. When true, do not write and do not stamp a ledger tip. Allowlist, hallucination, stub, and local-only checks still run and return the same FragGate refuse code a confirm call would get. MCP-DRY-RUN is returned only when that call would have been allowed to proceed. confirm is consent, not tenant auth, and it does not upgrade shared public-demo isolation.

Raw schema

{
  "type": "object",
  "properties": {
    "name": {
      "type": "string",
      "description": "Optional registry display name (for example FoldLock, EmbryoLock, AZHub). Use name or slug — one is enough. Combined name/op forms such as foldlock/fold-preview are accepted by the door parser. Unknown names refuse FG-HALLUC-TOOL."
    },
    "slug": {
      "type": "string",
      "description": "Optional catalog slug (lowercase a-z0-9-, for example foldlock, embryolock, azhub). Alternative to name. Prefer the slug returned by fraggate_list or GET /v1/software."
    },
    "op": {
      "type": "string",
      "description": "Required public allowlisted op from fraggate_describe (for example fold-preview, ethical_search, blank_key_status). UI aliases (list_modules, place, genesis_boot, hold, airlock, home, classify, doctor, pair) forward to catalog ops. Unknown ops refuse FG-UNKNOWN-OP; stubs refuse FG-STUB."
    },
    "payload": {
      "type": "object",
      "additionalProperties": true,
      "description": "Optional op payload object. Shape is engine-specific (see fraggate_describe). Malformed fields are refused by the engine, not by this door schema. If omitted, leftover top-level keys are used as the payload."
    },
    "request_id": {
      "type": "string",
      "description": "Optional logical request id. The same value groups retries of one action on the ResultEnvelope and, for ForgeReceipts, inside the receipt hash."
    },
    "attempt_n": {
      "type": "integer",
      "minimum": 1,
      "description": "Optional 1-based attempt number for this call. Omitted means attempt 1 of a new request_id."
    },
    "parent_receipt_id": {
      "type": "string",
      "nullable": true,
      "description": "Optional prior attempt receipt hash. Null on the first attempt. This is not FragGate ledger prev, which stays call order only."
    },
    "correlation_id": {
      "type": "string",
      "nullable": true,
      "description": "Optional client correlation id. Sealed inside a ForgeReceipts hash when this call mints one."
    },
    "claim": {
      "type": "object",
      "additionalProperties": true,
      "description": "Optional DecisionGATE proposal attached to this call. Also runs automatically inside the door even when omitted (defaults). Freedom without clarity is chaos.",
      "properties": {
        "statement": {
          "type": "string",
          "description": "Optional proposal statement (what is being asked)."
        },
        "evidence": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Optional evidence strings supporting the statement."
        },
        "impact_pos": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Optional positive impacts."
        },
        "impact_neg": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Optional negative impacts."
        },
        "values": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Optional values the proposal claims to honor."
        },
        "accountable": {
          "type": "string",
          "description": "Optional accountable party. Identity on this runtime is Aziel Eliab only."
        }
      }
    },
    "confirm": {
      "type": "boolean",
      "description": "Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true. confirm is consent to run the call. It is not tenant auth and it does not upgrade shared public-demo isolation."
    },
    "dry_run": {
      "type": "boolean",
      "description": "Optional preview flag. When true, do not write and do not stamp a ledger tip. Allowlist, hallucination, stub, and local-only checks still run and return the same FragGate refuse code a confirm call would get. MCP-DRY-RUN is returned only when that call would have been allowed to proceed. confirm is consent, not tenant auth, and it does not upgrade shared public-demo isolation."
    }
  },
  "required": [
    "op"
  ],
  "additionalProperties": true,
  "description": "Required: op. Also pass slug or name. Extra top-level keys other than name/slug/product/tool/op/verb/claim/proposal/ground/payload/session_id/id become the op payload when payload is omitted. Mutation requires confirm=true or dry_run=true."
}

decisiongate_check

Run the named DecisionGATE five sequential gates on a proposal (Freedom without clarity is chaos) without executing a catalog product. Also runs automatically inside fraggate_call before exec. Use this when you want a gate check without executing a catalog product verb. Do not use it for executing a product op or searching the library; use fraggate_call or library_lookup instead. Write: appends an ask/refuse ledger tip (not idempotent). Empty {} still runs the five gates and stamps the ledger. Does not execute domain software. Named wrapper — same DecisionGATE kernel; not the full MASTER-33 hop list; Softwares exec stays fraggate_call. All proposal fields are optional. Missing evidence can fail a gate. accountable identity on this runtime is Aziel Eliab only. Mutation requires confirm=true (runtime gate) or dry_run=true (preview only, no write). confirm and dry_run stay optional on inputSchema.required. dry_run still returns FG-HALLUC-TOOL, FG-STUB, FG-UNKNOWN-OP, or FG-LOCAL-ONLY when a confirm call would refuse. confirm is consent, not tenant auth, and it does not upgrade shared public-demo isolation. Returns gate view, final_state, ledger_tip, and result (code FG-OK on the named module wrapper).

Parameters8

statement	string	optional	Optional proposal statement to evaluate.
evidence	array	optional	Optional evidence strings. Missing evidence can fail a gate.
impact_pos	array	optional	Optional positive-impact list.
impact_neg	array	optional	Optional negative-impact list.
values	array	optional	Optional values list.
accountable	string	optional	Optional accountable party string.
confirm	boolean	optional	Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true. confirm is consent to run the call. It is not tenant auth and it does not upgrade shared public-demo isolation.
dry_run	boolean	optional	Optional preview flag. When true, do not write and do not stamp a ledger tip. Allowlist, hallucination, stub, and local-only checks still run and return the same FragGate refuse code a confirm call would get. MCP-DRY-RUN is returned only when that call would have been allowed to proceed. confirm is consent, not tenant auth, and it does not upgrade shared public-demo isolation.

Raw schema

{
  "type": "object",
  "properties": {
    "statement": {
      "type": "string",
      "description": "Optional proposal statement to evaluate."
    },
    "evidence": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Optional evidence strings. Missing evidence can fail a gate."
    },
    "impact_pos": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Optional positive-impact list."
    },
    "impact_neg": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Optional negative-impact list."
    },
    "values": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Optional values list."
    },
    "accountable": {
      "type": "string",
      "description": "Optional accountable party string."
    },
    "confirm": {
      "type": "boolean",
      "description": "Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true. confirm is consent to run the call. It is not tenant auth and it does not upgrade shared public-demo isolation."
    },
    "dry_run": {
      "type": "boolean",
      "description": "Optional preview flag. When true, do not write and do not stamp a ledger tip. Allowlist, hallucination, stub, and local-only checks still run and return the same FragGate refuse code a confirm call would get. MCP-DRY-RUN is returned only when that call would have been allowed to proceed. confirm is consent, not tenant auth, and it does not upgrade shared public-demo isolation."
    }
  },
  "additionalProperties": true,
  "description": "All schema fields optional. Empty proposals still run the five gates and stamp the ledger. Live stamp still needs confirm=true at tools/call, or dry_run=true for a preview."
}

library_lookup

Search the public Aziel Digital Library (aziel-corpus search / example / skill) — cites, not beliefs and not vault stamps. Use this when you need a public corpus cite, example record, or library skill. Do not use it for adaptive memory belief, ChainLock facts, or private-file search; use memory_recall, chainlock_recall, or fraggate_call slug=aziel-corpus instead. Not a private-file search engine and not AKM/ChainLock. Empty q does not invent a cite. Unknown ops refuse FG-UNKNOWN-OP (allowed: search, example, skill, health). Named corpus wrapper — not MASTER-33; full aziel-corpus LIVE_OPS stay on fraggate_call. q is public corpus text — not memory_recall q and not ChainLock q. Omit op to search. Extra keys besides q/op/payload ride along as aziel-corpus payload (same as passing payload{}). Returns search, example, skill, or health payload inside the display envelope.

Parameters2

q	string	optional	Optional public-corpus query for op=search. Empty q returns an empty or default hit set, not an invented cite. Not a memory or ChainLock query.
op	string	optional	Optional library verb. search (default) looks up public corpus text; example returns a sample; skill returns the library skill; health is liveness. Other values refuse FG-UNKNOWN-OP.

Raw schema

{
  "type": "object",
  "properties": {
    "q": {
      "type": "string",
      "description": "Optional public-corpus query for op=search. Empty q returns an empty or default hit set, not an invented cite. Not a memory or ChainLock query."
    },
    "op": {
      "type": "string",
      "enum": [
        "search",
        "example",
        "skill",
        "health"
      ],
      "description": "Optional library verb. search (default) looks up public corpus text; example returns a sample; skill returns the library skill; health is liveness. Other values refuse FG-UNKNOWN-OP."
    }
  },
  "additionalProperties": true,
  "description": "q is the search text. op selects the library verb. Extra keys are forwarded as corpus payload."
}

mesh_status

Read QNM suite rollup totals (enabled?, bearers, nodes = human mesh users + cited human uses, live_nodes = human mesh users + site_live_viewers, software_nodes = {slug}-worker roster) — not the node roster. Packet-transfer cite is QNS-CD-1.0 (photon QNS1 1.3 on local qnsd; GET /v1/qns cites only; Worker does not proxy via emit). Use this when you need public Nodes (users + uses), Live Nodes (users + site viewers), or software_nodes (product Worker roster). Do not use it for listing individual nodes, enabling extra radios, or executing a catalog engine; use mesh_nodes, mesh_enable, or fraggate_call instead. Read-only. Never enables radios beyond default suite-presence. Read-only suite-presence is ON by default. Not a login mesh. Views/MCP/downloads do not enter QNM-S. Full node process is local qnm-node/. Kernel-direct fabric wrapper — not MASTER-33; not a second Softwares door. Softwares exec stays fraggate_call. Returns enabled flag, bearers, nodes (human mesh users + cited uses), live_nodes (human mesh users + site_live_viewers), human_mesh_users, site_live_viewers, human_uses, active_nodes, inactive_nodes, isolated_nodes, software_nodes (product Workers), and QNS-CD-1.0 cite.

Parameters

No parameters.

Raw schema

{
  "type": "object",
  "properties": {},
  "additionalProperties": false,
  "description": "No arguments. Send {}. Never enables radios."
}

mesh_enable

Declare an extra QNM suite bearer (POST /v1/mesh/enable) — additive presence, not a first-time on-switch. Use this when an operator wants to declare an additional bearer (example: suite-presence) on top of the default-on rollup. Do not use it for reading status, joining one node, turning suite-presence off, or logging into an account; use mesh_status, mesh_join, or mesh_nodes instead. Write: stores the bearer. Rate-limited. Empty {} is refused (MESH-NEED-BEARER). Login/account/recover/gate names refuse. Does not arm, wipe, heal, or resurrect accounts. Not a login mesh. Read-only suite-presence is already ON by default. bearer is required. Example: suite-presence. Mutation requires confirm=true (runtime gate) or dry_run=true (preview only, no write). confirm and dry_run stay optional on inputSchema.required. dry_run still returns FG-HALLUC-TOOL, FG-STUB, FG-UNKNOWN-OP, or FG-LOCAL-ONLY when a confirm call would refuse. confirm is consent, not tenant auth, and it does not upgrade shared public-demo isolation. Returns enabled state, bearers, and suite-presence note.

Parameters3

bearer	string	required	Required declared bearer name. Example: suite-presence. Login / account / recover / recovery / gate / IP / publish / phoenix / heal names refuse MESH-ENABLE. This is not a login mesh.
confirm	boolean	optional	Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true. confirm is consent to run the call. It is not tenant auth and it does not upgrade shared public-demo isolation.
dry_run	boolean	optional	Optional preview flag. When true, do not write and do not stamp a ledger tip. Allowlist, hallucination, stub, and local-only checks still run and return the same FragGate refuse code a confirm call would get. MCP-DRY-RUN is returned only when that call would have been allowed to proceed. confirm is consent, not tenant auth, and it does not upgrade shared public-demo isolation.

Raw schema

{
  "type": "object",
  "properties": {
    "bearer": {
      "type": "string",
      "description": "Required declared bearer name. Example: suite-presence. Login / account / recover / recovery / gate / IP / publish / phoenix / heal names refuse MESH-ENABLE. This is not a login mesh."
    },
    "confirm": {
      "type": "boolean",
      "description": "Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true. confirm is consent to run the call. It is not tenant auth and it does not upgrade shared public-demo isolation."
    },
    "dry_run": {
      "type": "boolean",
      "description": "Optional preview flag. When true, do not write and do not stamp a ledger tip. Allowlist, hallucination, stub, and local-only checks still run and return the same FragGate refuse code a confirm call would get. MCP-DRY-RUN is returned only when that call would have been allowed to proceed. confirm is consent, not tenant auth, and it does not upgrade shared public-demo isolation."
    }
  },
  "required": [
    "bearer"
  ],
  "additionalProperties": false,
  "description": "bearer is required. Empty object is MESH-ENABLE refuse. Mutation requires confirm=true or dry_run=true."
}

mesh_disable

Confirm that read-only QNM suite-presence stays ON (POST /v1/mesh/disable refuses MESH-DISABLE-REFUSED) — not a kill switch. Use this when a client still posts the historical disable route and needs the honest refuse. Do not use it for dropping one node or declaring an extra bearer; use mesh_leave or mesh_enable instead. Read-only refuse: suite-presence stays ON. No tethers drop. No implicit heal, no account resurrection, no wipe internals. Repeating still refuses. AZMail mesh_disable is a separate product-local mail ring. Returns MESH-DISABLE-REFUSED with enabled=true and a stay-on note.

Parameters

No parameters.

Raw schema

{
  "type": "object",
  "properties": {},
  "additionalProperties": false,
  "description": "No arguments. Send {}. Public suite disable is refused."
}

mesh_join

Register one product node into the QNM rollup (POST /v1/mesh/join) — first presence, not a TTL refresh. Use this when transmission radios are LIVE and a catalog product should appear in live/locked/isolated counts. Do not use it for refreshing an existing node, reading the roster, enabling radios, or opening an account session; use mesh_heartbeat, mesh_nodes, mesh_enable, or runtime_session_open instead. Write: additive presence with a strict 5-minute TTL. Human bearers (kind=human, bearer=human, or auto-minted mesh_*) count toward public Live Nodes when not isolated. Softwares {slug}-worker rows are software_nodes and never feed Live Nodes. Downloaded instance ids stay instance_nodes. Isolated humans do not count. No heartbeat (or fan-out refresh) inside that window drops the node from the roster. Radios off refuses MESH-OFF. Missing product / bad node_id / bad presence refuse MESH-BAD-INPUT. Downloads are not live. Read-only suite-presence is ON by default. Not an account session. AnonBroadcast is not a product. Kernel-direct fabric wrapper — same mesh kernel as FragGate mesh/join; not MASTER-33; human Join uses fraggate_call. product is required (catalog slug). node_id optional 8–80 [a-z0-9._-]. presence is live|locked|isolated (default live). kind/plane may be human|instance. bearer=human marks a human mesh user. Mutation requires confirm=true (runtime gate) or dry_run=true (preview only, no write). confirm and dry_run stay optional on inputSchema.required. dry_run still returns FG-HALLUC-TOOL, FG-STUB, FG-UNKNOWN-OP, or FG-LOCAL-ONLY when a confirm call would refuse. confirm is consent, not tenant auth, and it does not upgrade shared public-demo isolation. Returns node_id, presence, presence_ttl_ms (300000), and TTL note. MESH-OFF when radios are off.

Parameters6

product	string	required	Required catalog product slug (a-z0-9-, for example godlock, azmail). AnonBroadcast is refused. Unknown slugs refuse MESH-BAD-INPUT.
node_id	string	optional	Optional stable node id. When set, must be 8–80 characters matching [a-z0-9._-]. Omit to receive a generated id.
label	string	optional	Optional short label for the roster. Display only; not a score.
presence	string	optional	Optional rollup class. live (default), locked, or isolated. No scores. Other values refuse MESH-BAD-INPUT.
confirm	boolean	optional	Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true. confirm is consent to run the call. It is not tenant auth and it does not upgrade shared public-demo isolation.
dry_run	boolean	optional	Optional preview flag. When true, do not write and do not stamp a ledger tip. Allowlist, hallucination, stub, and local-only checks still run and return the same FragGate refuse code a confirm call would get. MCP-DRY-RUN is returned only when that call would have been allowed to proceed. confirm is consent, not tenant auth, and it does not upgrade shared public-demo isolation.

Raw schema

{
  "type": "object",
  "properties": {
    "product": {
      "type": "string",
      "description": "Required catalog product slug (a-z0-9-, for example godlock, azmail). AnonBroadcast is refused. Unknown slugs refuse MESH-BAD-INPUT."
    },
    "node_id": {
      "type": "string",
      "description": "Optional stable node id. When set, must be 8–80 characters matching [a-z0-9._-]. Omit to receive a generated id.",
      "minLength": 8,
      "maxLength": 80,
      "pattern": "^[a-z0-9._-]+$"
    },
    "label": {
      "type": "string",
      "description": "Optional short label for the roster. Display only; not a score."
    },
    "presence": {
      "type": "string",
      "enum": [
        "live",
        "locked",
        "isolated"
      ],
      "description": "Optional rollup class. live (default), locked, or isolated. No scores. Other values refuse MESH-BAD-INPUT."
    },
    "confirm": {
      "type": "boolean",
      "description": "Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true. confirm is consent to run the call. It is not tenant auth and it does not upgrade shared public-demo isolation."
    },
    "dry_run": {
      "type": "boolean",
      "description": "Optional preview flag. When true, do not write and do not stamp a ledger tip. Allowlist, hallucination, stub, and local-only checks still run and return the same FragGate refuse code a confirm call would get. MCP-DRY-RUN is returned only when that call would have been allowed to proceed. confirm is consent, not tenant auth, and it does not upgrade shared public-demo isolation."
    }
  },
  "required": [
    "product"
  ],
  "additionalProperties": false,
  "description": "product is required. presence must be live|locked|isolated when set. node_id must be 8–80 [a-z0-9._-]. Radios off refuses MESH-OFF. Mutation requires confirm=true or dry_run=true."
}

mesh_heartbeat

Refresh one existing node's 5-minute QNM TTL (POST /v1/mesh/heartbeat) — not a first join. Use this when you already have a node_id from mesh_join and transmission radios are LIVE. Do not use it for first-time registration or dropping the node; use mesh_join or mesh_leave instead. Write: refreshes the strict 5-minute TTL (not idempotent). Miss the window and the node is dropped from the live roster. Radios off refuses MESH-OFF. Unknown or expired node_id refuses MESH-UNKNOWN-NODE — join again; no account resurrection. node_id is required. presence may replace the class (live|locked|isolated). Optional tip_hash and prev are 64 hex only (Split the wires + REHEAL: presence + tip hash; no body/diff/vote-to-fix). OPERATOR-OVERRIDE 2026-09-17 armed neighbor_heal. Mutation requires confirm=true (runtime gate) or dry_run=true (preview only, no write). confirm and dry_run stay optional on inputSchema.required. dry_run still returns FG-HALLUC-TOOL, FG-STUB, FG-UNKNOWN-OP, or FG-LOCAL-ONLY when a confirm call would refuse. confirm is consent, not tenant auth, and it does not upgrade shared public-demo isolation. Returns updated presence and TTL. Body on this plane refuses MESH-NO-BYTES. Same prev + two tips refuses MESH-EQUIVOCATION. Vote-to-fix still refuses MESH-NO-NEIGHBOR-HEAL.

Parameters6

node_id	string	required	Required node id returned by mesh_join.
presence	string	optional	Optional replacement presence class. Other values refuse MESH-BAD-INPUT.
tip_hash	string	optional	Optional 64-hex tip hash on the fast tick. Fixed-size. No body. Split the wires.
prev	string	optional	Optional 64-hex prev the receiver already holds. Same prev + a different tip_hash isolates this node (MESH-EQUIVOCATION).
confirm	boolean	optional	Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true. confirm is consent to run the call. It is not tenant auth and it does not upgrade shared public-demo isolation.
dry_run	boolean	optional	Optional preview flag. When true, do not write and do not stamp a ledger tip. Allowlist, hallucination, stub, and local-only checks still run and return the same FragGate refuse code a confirm call would get. MCP-DRY-RUN is returned only when that call would have been allowed to proceed. confirm is consent, not tenant auth, and it does not upgrade shared public-demo isolation.

Raw schema

{
  "type": "object",
  "properties": {
    "node_id": {
      "type": "string",
      "description": "Required node id returned by mesh_join."
    },
    "presence": {
      "type": "string",
      "enum": [
        "live",
        "locked",
        "isolated"
      ],
      "description": "Optional replacement presence class. Other values refuse MESH-BAD-INPUT."
    },
    "tip_hash": {
      "type": "string",
      "description": "Optional 64-hex tip hash on the fast tick. Fixed-size. No body. Split the wires."
    },
    "prev": {
      "type": "string",
      "description": "Optional 64-hex prev the receiver already holds. Same prev + a different tip_hash isolates this node (MESH-EQUIVOCATION)."
    },
    "confirm": {
      "type": "boolean",
      "description": "Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true. confirm is consent to run the call. It is not tenant auth and it does not upgrade shared public-demo isolation."
    },
    "dry_run": {
      "type": "boolean",
      "description": "Optional preview flag. When true, do not write and do not stamp a ledger tip. Allowlist, hallucination, stub, and local-only checks still run and return the same FragGate refuse code a confirm call would get. MCP-DRY-RUN is returned only when that call would have been allowed to proceed. confirm is consent, not tenant auth, and it does not upgrade shared public-demo isolation."
    }
  },
  "required": [
    "node_id"
  ],
  "additionalProperties": false,
  "description": "node_id is required. Missing node_id refuses MESH-BAD-INPUT. Mutation requires confirm=true or dry_run=true."
}

mesh_leave

Drop one node from the QNM rollup (POST /v1/mesh/leave) — not a suite-wide radio off. Use this when a previously joined node should leave the counts. Do not use it for turning suite-presence off or listing nodes; use mesh_nodes or mesh_status instead. Destructive to that node's presence only. Always allowed. No implicit heal. Repeating a missing node_id is a no-op/refuse, not resurrection. node_id is required. Mutation requires confirm=true (runtime gate) or dry_run=true (preview only, no write). confirm and dry_run stay optional on inputSchema.required. dry_run still returns FG-HALLUC-TOOL, FG-STUB, FG-UNKNOWN-OP, or FG-LOCAL-ONLY when a confirm call would refuse. confirm is consent, not tenant auth, and it does not upgrade shared public-demo isolation. Returns leave receipt for the node_id.

Parameters3

node_id	string	required	Required node id to drop from the rollup.
confirm	boolean	optional	Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true. confirm is consent to run the call. It is not tenant auth and it does not upgrade shared public-demo isolation.
dry_run	boolean	optional	Optional preview flag. When true, do not write and do not stamp a ledger tip. Allowlist, hallucination, stub, and local-only checks still run and return the same FragGate refuse code a confirm call would get. MCP-DRY-RUN is returned only when that call would have been allowed to proceed. confirm is consent, not tenant auth, and it does not upgrade shared public-demo isolation.

Raw schema

{
  "type": "object",
  "properties": {
    "node_id": {
      "type": "string",
      "description": "Required node id to drop from the rollup."
    },
    "confirm": {
      "type": "boolean",
      "description": "Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true. confirm is consent to run the call. It is not tenant auth and it does not upgrade shared public-demo isolation."
    },
    "dry_run": {
      "type": "boolean",
      "description": "Optional preview flag. When true, do not write and do not stamp a ledger tip. Allowlist, hallucination, stub, and local-only checks still run and return the same FragGate refuse code a confirm call would get. MCP-DRY-RUN is returned only when that call would have been allowed to proceed. confirm is consent, not tenant auth, and it does not upgrade shared public-demo isolation."
    }
  },
  "required": [
    "node_id"
  ],
  "additionalProperties": false,
  "description": "node_id is required. Missing node_id refuses MESH-BAD-INPUT. Mutation requires confirm=true or dry_run=true."
}

mesh_nodes

List the QNM node roster (node_id + presence + 5-minute TTL) — not suite totals. Use this when you need the current node list after mesh_status. Do not use it for suite counts without the roster, or mutating presence; use mesh_status, mesh_join, or mesh_leave instead. No scores. No leaderboard. Views/MCP/downloads do not enter QNM-S. Returns node roster with presence classes.

Parameters

No parameters.

Raw schema

{
  "type": "object",
  "properties": {},
  "additionalProperties": false,
  "description": "No arguments. Send {}."
}

mesh_broadcast

Register the SHA-256 of a local file as a hash receipt — never a publish or upload path. Use this when the operator already holds a local file and wants only its hash recorded. Do not use it for uploading bytes, publishing video, sending mail, or joining a mesh node; use local qnm-node/ anon-broadcast loopback, AZMail via fraggate_call, or mesh_join instead. Write: stores a hash receipt only. Does NOT accept video bytes. Operator keeps the file. Malformed sha256 refuses MESH-BAD-INPUT; publish-shaped keys refuse MESH-NO-PUBLISH. sha256 is required (64 hex). title and product are optional labels, not file contents. Mutation requires confirm=true (runtime gate) or dry_run=true (preview only, no write). confirm and dry_run stay optional on inputSchema.required. dry_run still returns FG-HALLUC-TOOL, FG-STUB, FG-UNKNOWN-OP, or FG-LOCAL-ONLY when a confirm call would refuse. confirm is consent, not tenant auth, and it does not upgrade shared public-demo isolation. Returns hash receipt (sha256, optional title).

Parameters5

sha256	string	required	Required 64-character hex SHA-256 of the local file. Hash receipt only — not a publish path.
title	string	optional	Optional short title for the receipt. Not the file contents.
product	string	optional	Optional catalog product slug to attribute the receipt. Not required.
confirm	boolean	optional	Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true. confirm is consent to run the call. It is not tenant auth and it does not upgrade shared public-demo isolation.
dry_run	boolean	optional	Optional preview flag. When true, do not write and do not stamp a ledger tip. Allowlist, hallucination, stub, and local-only checks still run and return the same FragGate refuse code a confirm call would get. MCP-DRY-RUN is returned only when that call would have been allowed to proceed. confirm is consent, not tenant auth, and it does not upgrade shared public-demo isolation.

Raw schema

{
  "type": "object",
  "properties": {
    "sha256": {
      "type": "string",
      "description": "Required 64-character hex SHA-256 of the local file. Hash receipt only — not a publish path.",
      "minLength": 64,
      "maxLength": 64,
      "pattern": "^[a-fA-F0-9]{64}$"
    },
    "title": {
      "type": "string",
      "description": "Optional short title for the receipt. Not the file contents."
    },
    "product": {
      "type": "string",
      "description": "Optional catalog product slug to attribute the receipt. Not required."
    },
    "confirm": {
      "type": "boolean",
      "description": "Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true. confirm is consent to run the call. It is not tenant auth and it does not upgrade shared public-demo isolation."
    },
    "dry_run": {
      "type": "boolean",
      "description": "Optional preview flag. When true, do not write and do not stamp a ledger tip. Allowlist, hallucination, stub, and local-only checks still run and return the same FragGate refuse code a confirm call would get. MCP-DRY-RUN is returned only when that call would have been allowed to proceed. confirm is consent, not tenant auth, and it does not upgrade shared public-demo isolation."
    }
  },
  "required": [
    "sha256"
  ],
  "additionalProperties": false,
  "description": "sha256 is required (64 hex). This is a receipt, not a blob upload. Mutation requires confirm=true or dry_run=true."
}

chainlock_append

Append one fact-bearing stamp to a local ChainLock chain (CL-WP-0.4). Grounded write — not a tip read, not AKM observe, not a LOCKSET seal. Fabric, not Softwares-tab. No Node Gate. Use this when you have a concrete fact to stamp onto a named chain. Do not use it for reading the tip, adaptive memory observation, or sealing LOCKSET; use chainlock_tip, memory_observe, or chainlock_seal instead. Write: additive append (append-only vault; no chainlock_delete). Hash-only or empty fact refuses no-fact. Unknown roster name refuses unknown-chain. Oversized card refuses card-cap. Does not write godlock.uk. Omit c/chain to stamp the session chain. Door aliases: chain→c, s→subject, f→fact, kind→k. Omit k to store kind stamp. subject clips to 80; fact clips to 160 then refuses if still empty. Mutation requires confirm=true (runtime gate) or dry_run=true (preview only, no write). confirm and dry_run stay optional on inputSchema.required. dry_run still returns FG-HALLUC-TOOL, FG-STUB, FG-UNKNOWN-OP, or FG-LOCAL-ONLY when a confirm call would refuse. confirm is consent, not tenant auth, and it does not upgrade shared public-demo isolation. Returns the new stamp (id, h, fh, chain, seq) plus display envelope.

Parameters7

c	string	optional	Optional chain name. One of genesis, identity, ssh, session, acts, evidence, recall, mesh, library, learn. Alias: chain. Omit both to stamp the session chain.
chain	string	optional	Alias of c. Omit both to stamp the session chain.
subject	string	optional	Optional subject clipped to 80 characters. Alias: s.
fact	string	required	Required fact text clipped to 160 characters. Empty or hash-only after clip refuses no-fact. Alias: f.
k	string	optional	Optional kind label. Omit to store kind stamp. Alias: kind.
confirm	boolean	optional	Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true. confirm is consent to run the call. It is not tenant auth and it does not upgrade shared public-demo isolation.
dry_run	boolean	optional	Optional preview flag. When true, do not write and do not stamp a ledger tip. Allowlist, hallucination, stub, and local-only checks still run and return the same FragGate refuse code a confirm call would get. MCP-DRY-RUN is returned only when that call would have been allowed to proceed. confirm is consent, not tenant auth, and it does not upgrade shared public-demo isolation.

Raw schema

{
  "type": "object",
  "properties": {
    "c": {
      "type": "string",
      "enum": [
        "genesis",
        "identity",
        "ssh",
        "session",
        "acts",
        "evidence",
        "recall",
        "mesh",
        "library",
        "learn"
      ],
      "description": "Optional chain name. One of genesis, identity, ssh, session, acts, evidence, recall, mesh, library, learn. Alias: chain. Omit both to stamp the session chain."
    },
    "chain": {
      "type": "string",
      "enum": [
        "genesis",
        "identity",
        "ssh",
        "session",
        "acts",
        "evidence",
        "recall",
        "mesh",
        "library",
        "learn"
      ],
      "description": "Alias of c. Omit both to stamp the session chain."
    },
    "subject": {
      "type": "string",
      "description": "Optional subject clipped to 80 characters. Alias: s.",
      "maxLength": 80
    },
    "fact": {
      "type": "string",
      "description": "Required fact text clipped to 160 characters. Empty or hash-only after clip refuses no-fact. Alias: f.",
      "maxLength": 160
    },
    "k": {
      "type": "string",
      "description": "Optional kind label. Omit to store kind stamp. Alias: kind."
    },
    "confirm": {
      "type": "boolean",
      "description": "Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true. confirm is consent to run the call. It is not tenant auth and it does not upgrade shared public-demo isolation."
    },
    "dry_run": {
      "type": "boolean",
      "description": "Optional preview flag. When true, do not write and do not stamp a ledger tip. Allowlist, hallucination, stub, and local-only checks still run and return the same FragGate refuse code a confirm call would get. MCP-DRY-RUN is returned only when that call would have been allowed to proceed. confirm is consent, not tenant auth, and it does not upgrade shared public-demo isolation."
    }
  },
  "required": [
    "fact"
  ],
  "additionalProperties": true,
  "description": "fact is required. Omit c/chain to stamp session. Extra keys such as s/f/kind are aliases; they do not change the append-only rule. Mutation requires confirm=true or dry_run=true."
}

chainlock_tip

Read only the live tip card of one local ChainLock chain — not depth recall and not LOCKSET verify. Use this when you need the current tip of a named chain. Do not use it for depth-0–5 grounded recall, LOCKSET verify, or adaptive memory explain; use chainlock_recall, chainlock_verify, or memory_get instead. Does not invent a missing tip. An empty chain returns ok with tip=null and empty=true (not a refuse). Fabric module — not a Softwares-tab product. Omit c/chain to read the session chain tip (not the full vault). chain is an alias of c. This is one card, not depth recall. Returns the tip card (id, h, fh) or tip=null / empty=true when that chain has no stamp.

Parameters2

c	string	optional	Optional chain name. One of genesis, identity, ssh, session, acts, evidence, recall, mesh, library, learn. Alias: chain. Omit both to read the session chain tip.
chain	string	optional	Alias of c. Omit both to read the session chain tip.

Raw schema

{
  "type": "object",
  "properties": {
    "c": {
      "type": "string",
      "enum": [
        "genesis",
        "identity",
        "ssh",
        "session",
        "acts",
        "evidence",
        "recall",
        "mesh",
        "library",
        "learn"
      ],
      "description": "Optional chain name. One of genesis, identity, ssh, session, acts, evidence, recall, mesh, library, learn. Alias: chain. Omit both to read the session chain tip."
    },
    "chain": {
      "type": "string",
      "enum": [
        "genesis",
        "identity",
        "ssh",
        "session",
        "acts",
        "evidence",
        "recall",
        "mesh",
        "library",
        "learn"
      ],
      "description": "Alias of c. Omit both to read the session chain tip."
    }
  },
  "additionalProperties": false,
  "description": "Omit c/chain to read the session chain tip. Extra properties are rejected."
}

chainlock_recall

Grounded ChainLock recall at depth 0–5 (id+h+fh facts or refuse=no-stamp). Stamped vault facts — not Bayesian rank and not tip-only. Use this when you need stamped facts from the local vault, not a Bayesian ranking. Do not use it for adaptive memory ranking or reading only the live tip; use memory_recall or chainlock_tip instead. Depth above 5 is clipped to 5. refuse=no-stamp when empty — do not invent a fact. Append-only; there is no chainlock_delete. Omit depth to use 1 (not 0). 0 = tip only; 5 = full chain / genesis budget. Omit c/chain to scan session+acts+recall+learn (not the whole roster). q/query is a case-insensitive subject/fact substring; empty q does not invent cards. Returns grounded facts (id, h, fh) or refuse=no-stamp.

Parameters4

depth	number	optional	Optional recall depth. Omit for 1. 0 = tip only; 5 = genesis/budget maximum. Values outside 0–5 are clipped. Alias: d.
q	string	optional	Optional case-insensitive substring over subject/fact. Alias: query. Empty does not invent matches.
c	string	optional	Optional chain name. One of genesis, identity, ssh, session, acts, evidence, recall, mesh, library, learn. Alias: chain. Omit both to scan session, acts, recall, and learn — not the full roster.
chain	string	optional	Alias of c. Omit both to scan session, acts, recall, and learn — not the full roster.

Raw schema

{
  "type": "object",
  "properties": {
    "depth": {
      "type": "number",
      "minimum": 0,
      "maximum": 5,
      "description": "Optional recall depth. Omit for 1. 0 = tip only; 5 = genesis/budget maximum. Values outside 0–5 are clipped. Alias: d."
    },
    "q": {
      "type": "string",
      "description": "Optional case-insensitive substring over subject/fact. Alias: query. Empty does not invent matches."
    },
    "c": {
      "type": "string",
      "enum": [
        "genesis",
        "identity",
        "ssh",
        "session",
        "acts",
        "evidence",
        "recall",
        "mesh",
        "library",
        "learn"
      ],
      "description": "Optional chain name. One of genesis, identity, ssh, session, acts, evidence, recall, mesh, library, learn. Alias: chain. Omit both to scan session, acts, recall, and learn — not the full roster."
    },
    "chain": {
      "type": "string",
      "enum": [
        "genesis",
        "identity",
        "ssh",
        "session",
        "acts",
        "evidence",
        "recall",
        "mesh",
        "library",
        "learn"
      ],
      "description": "Alias of c. Omit both to scan session, acts, recall, and learn — not the full roster."
    }
  },
  "additionalProperties": true,
  "description": "All fields optional. Default depth is 1. Default chains are session, acts, recall, learn."
}

chainlock_verify

Confirm fail-closed integrity of ChainLock chains and LOCKSET (LS-WP-0.1): broken prev, tip drift, missing GodLock cite. Integrity check — not a new seal. Use this when you must prove local chain integrity before trusting a recall. Do not use it for appending a stamp or sealing a new lockset; use chainlock_append or chainlock_seal instead. Cites godlock.uk; does not write the public ledger. Fail-closed — do not repair silently. Break reasons include broken-prev, stamp-hash-miss, body-hash-miss, tip-drift, missing-godlock-cite. Omit c/chain to verify every roster chain plus the stored LOCKSET. require_seal=true fails closed if no lockset is stored. Returns chain_ok, LOCKSET lattice, and per-chain verify notes.

Parameters3

c	string	optional	Optional chain name. One of genesis, identity, ssh, session, acts, evidence, recall, mesh, library, learn. Alias: chain. Omit both to verify every roster chain plus the stored LOCKSET.
chain	string	optional	Alias of c. Omit both to verify every roster chain plus the stored LOCKSET.
require_seal	boolean	optional	Optional. When true, fail-closed if receipts/LOCKSET.json is missing. When omitted, a stored lockset is still checked if present.

Raw schema

{
  "type": "object",
  "properties": {
    "c": {
      "type": "string",
      "enum": [
        "genesis",
        "identity",
        "ssh",
        "session",
        "acts",
        "evidence",
        "recall",
        "mesh",
        "library",
        "learn"
      ],
      "description": "Optional chain name. One of genesis, identity, ssh, session, acts, evidence, recall, mesh, library, learn. Alias: chain. Omit both to verify every roster chain plus the stored LOCKSET."
    },
    "chain": {
      "type": "string",
      "enum": [
        "genesis",
        "identity",
        "ssh",
        "session",
        "acts",
        "evidence",
        "recall",
        "mesh",
        "library",
        "learn"
      ],
      "description": "Alias of c. Omit both to verify every roster chain plus the stored LOCKSET."
    },
    "require_seal": {
      "type": "boolean",
      "description": "Optional. When true, fail-closed if receipts/LOCKSET.json is missing. When omitted, a stored lockset is still checked if present."
    }
  },
  "additionalProperties": true,
  "description": "Optional chain selector. Omit to verify the live vault / LOCKSET."
}

chainlock_seal

Write a new local LOCKSET over live chain tips (members {c,id,h,fh} + TemporalLock + GodLock cite, LS-WP-0.1). Not a raw-session close and not verify-only. Use this when the operator wants a new local lockset over current tips. Do not use it for verify-only, appending one fact, writing godlock.uk, or sealing a raw runtime session; use chainlock_verify, chainlock_append, or runtime_session_close instead. Write: replaces receipts/LOCKSET.json. Empty vault (no live tip on any roster chain) refuses empty-vault. Empty chains are omitted from members, not invented. Runtime cites godlock.uk and does not write the public ledger — the operator posts lockset_sha256. A later seal overwrites the previous local lockset. Empty {} still attempts the seal. Omit ts so TemporalLock stamps now. Passing ts labels that receipt only and never backdates seal authority or prior stamps. Mutation requires confirm=true (runtime gate) or dry_run=true (preview only, no write). confirm and dry_run stay optional on inputSchema.required. dry_run still returns FG-HALLUC-TOOL, FG-STUB, FG-UNKNOWN-OP, or FG-LOCAL-ONLY when a confirm call would refuse. confirm is consent, not tenant auth, and it does not upgrade shared public-demo isolation. Returns lockset document (members, temporal, godlock cite) and lockset_sha256.

Parameters3

ts	string	optional	Optional ISO-8601 timestamp copied onto the TemporalLock block. Omit to use now. Never backdates authority, prior stamps, or godlock.uk.
confirm	boolean	optional	Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true. confirm is consent to run the call. It is not tenant auth and it does not upgrade shared public-demo isolation.
dry_run	boolean	optional	Optional preview flag. When true, do not write and do not stamp a ledger tip. Allowlist, hallucination, stub, and local-only checks still run and return the same FragGate refuse code a confirm call would get. MCP-DRY-RUN is returned only when that call would have been allowed to proceed. confirm is consent, not tenant auth, and it does not upgrade shared public-demo isolation.

Raw schema

{
  "type": "object",
  "properties": {
    "ts": {
      "type": "string",
      "description": "Optional ISO-8601 timestamp copied onto the TemporalLock block. Omit to use now. Never backdates authority, prior stamps, or godlock.uk."
    },
    "confirm": {
      "type": "boolean",
      "description": "Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true. confirm is consent to run the call. It is not tenant auth and it does not upgrade shared public-demo isolation."
    },
    "dry_run": {
      "type": "boolean",
      "description": "Optional preview flag. When true, do not write and do not stamp a ledger tip. Allowlist, hallucination, stub, and local-only checks still run and return the same FragGate refuse code a confirm call would get. MCP-DRY-RUN is returned only when that call would have been allowed to proceed. confirm is consent, not tenant auth, and it does not upgrade shared public-demo isolation."
    }
  },
  "additionalProperties": true,
  "description": "No required arguments. Empty {} seals current live tips. Optional ts is TemporalLock metadata only. Mutation requires confirm=true or dry_run=true."
}

memory_observe

Append the first memory_observation to the ChainLock learn chain (AKM-TRIAD-1.0). New fact in — not an outcome resolve and not a grounded ChainLock append. Posterior ≠ truth. Use this when you have a new fact to observe before resolve/calibrate. Do not use it for grounded ChainLock append without AKM, resolving an outcome, or ranked recall; use chainlock_append, memory_resolve, or memory_recall instead. Write: additive learn-chain stamp. authorizes_action stays false. Hash-only cards refuse AKM-NO-FACT. Append-only; there is no memory_delete. fact is required (≤160). subject/memory_id/use_case optional. Mutation requires confirm=true (runtime gate) or dry_run=true (preview only, no write). confirm and dry_run stay optional on inputSchema.required. dry_run still returns FG-HALLUC-TOOL, FG-STUB, FG-UNKNOWN-OP, or FG-LOCAL-ONLY when a confirm call would refuse. confirm is consent, not tenant auth, and it does not upgrade shared public-demo isolation. Returns memory_id, observation stamp, and display envelope (belief is not truth).

Parameters6

subject	string	optional	Optional subject key clipped to 80 characters. Used to find or create memory_id.
fact	string	required	Fact text clipped to 160 characters. Required on observe. Hash-only cards refuse AKM-NO-FACT.
memory_id	string	optional	Optional existing memory id. Alternative to subject for resolve/calibrate/get.
use_case	string	optional	Optional use-case label for calibration / adaptive recall ranking. Not a truth claim.
confirm	boolean	optional	Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true. confirm is consent to run the call. It is not tenant auth and it does not upgrade shared public-demo isolation.
dry_run	boolean	optional	Optional preview flag. When true, do not write and do not stamp a ledger tip. Allowlist, hallucination, stub, and local-only checks still run and return the same FragGate refuse code a confirm call would get. MCP-DRY-RUN is returned only when that call would have been allowed to proceed. confirm is consent, not tenant auth, and it does not upgrade shared public-demo isolation.

Raw schema

{
  "type": "object",
  "properties": {
    "subject": {
      "type": "string",
      "description": "Optional subject key clipped to 80 characters. Used to find or create memory_id.",
      "maxLength": 80
    },
    "fact": {
      "type": "string",
      "description": "Fact text clipped to 160 characters. Required on observe. Hash-only cards refuse AKM-NO-FACT.",
      "maxLength": 160
    },
    "memory_id": {
      "type": "string",
      "description": "Optional existing memory id. Alternative to subject for resolve/calibrate/get."
    },
    "use_case": {
      "type": "string",
      "description": "Optional use-case label for calibration / adaptive recall ranking. Not a truth claim."
    },
    "confirm": {
      "type": "boolean",
      "description": "Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true. confirm is consent to run the call. It is not tenant auth and it does not upgrade shared public-demo isolation."
    },
    "dry_run": {
      "type": "boolean",
      "description": "Optional preview flag. When true, do not write and do not stamp a ledger tip. Allowlist, hallucination, stub, and local-only checks still run and return the same FragGate refuse code a confirm call would get. MCP-DRY-RUN is returned only when that call would have been allowed to proceed. confirm is consent, not tenant auth, and it does not upgrade shared public-demo isolation."
    }
  },
  "required": [
    "fact"
  ],
  "additionalProperties": true,
  "description": "fact is required. subject/memory_id/use_case optional. Mutation requires confirm=true or dry_run=true."
}

memory_resolve

Append a memory_resolution outcome on an already-observed memory (AKM-TRIAD-1.0). UNKNOWN is distinct from MISS. Does not rewrite history. Use this when an observed memory_id or subject now has an outcome. Do not use it for first observation, calibration, or reading history; use memory_observe, memory_calibrate, or memory_get instead. Write: additive resolution stamp. Missing memory_id/subject refuses AKM-NO-MEMORY. Does not rewrite prior observations. No memory_update — this is the forward outcome path. Requires memory_id or a previously observed subject. outcome is optional [0,1]; omit for UNKNOWN. Mutation requires confirm=true (runtime gate) or dry_run=true (preview only, no write). confirm and dry_run stay optional on inputSchema.required. dry_run still returns FG-HALLUC-TOOL, FG-STUB, FG-UNKNOWN-OP, or FG-LOCAL-ONLY when a confirm call would refuse. confirm is consent, not tenant auth, and it does not upgrade shared public-demo isolation. Returns resolution stamp with outcome or UNKNOWN.

Parameters8

subject	string	optional	Optional subject key clipped to 80 characters. Used to find or create memory_id.
fact	string	optional	Fact text clipped to 160 characters. Required on observe. Hash-only cards refuse AKM-NO-FACT.
memory_id	string	optional	Optional existing memory id. Alternative to subject for resolve/calibrate/get.
use_case	string	optional	Optional use-case label for calibration / adaptive recall ranking. Not a truth claim.
outcome	number	optional	Optional graded outcome in [0, 1]. Omit (or pass UNKNOWN) for an UNKNOWN resolution — distinct from MISS.
outcome_label	string	optional	Optional label (for example HIT, MISS, GRADED, UNKNOWN). UNKNOWN is a first-class state, not a miss.
confirm	boolean	optional	Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true. confirm is consent to run the call. It is not tenant auth and it does not upgrade shared public-demo isolation.
dry_run	boolean	optional	Optional preview flag. When true, do not write and do not stamp a ledger tip. Allowlist, hallucination, stub, and local-only checks still run and return the same FragGate refuse code a confirm call would get. MCP-DRY-RUN is returned only when that call would have been allowed to proceed. confirm is consent, not tenant auth, and it does not upgrade shared public-demo isolation.

Raw schema

{
  "type": "object",
  "properties": {
    "subject": {
      "type": "string",
      "description": "Optional subject key clipped to 80 characters. Used to find or create memory_id.",
      "maxLength": 80
    },
    "fact": {
      "type": "string",
      "description": "Fact text clipped to 160 characters. Required on observe. Hash-only cards refuse AKM-NO-FACT.",
      "maxLength": 160
    },
    "memory_id": {
      "type": "string",
      "description": "Optional existing memory id. Alternative to subject for resolve/calibrate/get."
    },
    "use_case": {
      "type": "string",
      "description": "Optional use-case label for calibration / adaptive recall ranking. Not a truth claim."
    },
    "outcome": {
      "type": "number",
      "minimum": 0,
      "maximum": 1,
      "description": "Optional graded outcome in [0, 1]. Omit (or pass UNKNOWN) for an UNKNOWN resolution — distinct from MISS."
    },
    "outcome_label": {
      "type": "string",
      "description": "Optional label (for example HIT, MISS, GRADED, UNKNOWN). UNKNOWN is a first-class state, not a miss."
    },
    "confirm": {
      "type": "boolean",
      "description": "Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true. confirm is consent to run the call. It is not tenant auth and it does not upgrade shared public-demo isolation."
    },
    "dry_run": {
      "type": "boolean",
      "description": "Optional preview flag. When true, do not write and do not stamp a ledger tip. Allowlist, hallucination, stub, and local-only checks still run and return the same FragGate refuse code a confirm call would get. MCP-DRY-RUN is returned only when that call would have been allowed to proceed. confirm is consent, not tenant auth, and it does not upgrade shared public-demo isolation."
    }
  },
  "additionalProperties": true,
  "description": "Requires memory_id or a previously observed subject. outcome may be omitted for UNKNOWN. Extra keys are accepted. Mutation requires confirm=true or dry_run=true."
}

memory_calibrate

Calibrate one memory with the deterministic 3-of-4 triad plus Bayesian posterior (AKM-TRIAD-1.0). Writes a LEARN stamp — not a ranked search and not an explain view. Use this when an observed memory should receive a posterior after evidence, not a ranked search. Do not use it for observing a new fact, resolving an outcome, or explaining a stored node; use memory_observe, memory_resolve, or memory_get instead. Write: forward-only RoseClock LEARN stamp. Posterior ≠ truth. authorizes_action=false. No automatic MODEL_UPDATE. subject or memory_id recommended. use_case labels calibration; it is not a permission. Mutation requires confirm=true (runtime gate) or dry_run=true (preview only, no write). confirm and dry_run stay optional on inputSchema.required. dry_run still returns FG-HALLUC-TOOL, FG-STUB, FG-UNKNOWN-OP, or FG-LOCAL-ONLY when a confirm call would refuse. confirm is consent, not tenant auth, and it does not upgrade shared public-demo isolation. Returns triad_score, omitted leg, posterior, effective N, and Brier notes.

Parameters6

subject	string	optional	Optional subject key clipped to 80 characters. Used to find or create memory_id.
fact	string	optional	Fact text clipped to 160 characters. Required on observe. Hash-only cards refuse AKM-NO-FACT.
memory_id	string	optional	Optional existing memory id. Alternative to subject for resolve/calibrate/get.
use_case	string	optional	Optional use-case label for calibration / adaptive recall ranking. Not a truth claim.
confirm	boolean	optional	Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true. confirm is consent to run the call. It is not tenant auth and it does not upgrade shared public-demo isolation.
dry_run	boolean	optional	Optional preview flag. When true, do not write and do not stamp a ledger tip. Allowlist, hallucination, stub, and local-only checks still run and return the same FragGate refuse code a confirm call would get. MCP-DRY-RUN is returned only when that call would have been allowed to proceed. confirm is consent, not tenant auth, and it does not upgrade shared public-demo isolation.

Raw schema

{
  "type": "object",
  "properties": {
    "subject": {
      "type": "string",
      "description": "Optional subject key clipped to 80 characters. Used to find or create memory_id.",
      "maxLength": 80
    },
    "fact": {
      "type": "string",
      "description": "Fact text clipped to 160 characters. Required on observe. Hash-only cards refuse AKM-NO-FACT.",
      "maxLength": 160
    },
    "memory_id": {
      "type": "string",
      "description": "Optional existing memory id. Alternative to subject for resolve/calibrate/get."
    },
    "use_case": {
      "type": "string",
      "description": "Optional use-case label for calibration / adaptive recall ranking. Not a truth claim."
    },
    "confirm": {
      "type": "boolean",
      "description": "Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true. confirm is consent to run the call. It is not tenant auth and it does not upgrade shared public-demo isolation."
    },
    "dry_run": {
      "type": "boolean",
      "description": "Optional preview flag. When true, do not write and do not stamp a ledger tip. Allowlist, hallucination, stub, and local-only checks still run and return the same FragGate refuse code a confirm call would get. MCP-DRY-RUN is returned only when that call would have been allowed to proceed. confirm is consent, not tenant auth, and it does not upgrade shared public-demo isolation."
    }
  },
  "additionalProperties": true,
  "description": "subject or memory_id recommended. Extra keys are accepted. Mutation requires confirm=true or dry_run=true."
}

memory_recall

Ranked adaptive recall after ChainLock verify (AKM-TRIAD-1.0). Belief list — not raw grounded stamps, not a public corpus cite, not one-id explain. Use this when you want a ranked belief list after verify, not raw grounded stamps. Do not use it for grounded ChainLock recall, library search, or explaining one memory_id; use chainlock_recall, library_lookup, or memory_get instead. Does not authorize action (authorizes_action=false). Do not treat posterior rank as fact (belief_is_not_truth). Failed ChainLock verify refuses CHAIN_VERIFY_FAIL and does not invent cards. Empty grounded recall bubbles refuse=no-stamp. Ranking is capped at 16 cards. Omit depth to rank at 5 (full budget), unlike chainlock_recall which defaults to 1. q/query is lexical rank text, not a SQL filter. Empty q still verify-then-ranks stored cards. use_case weights triad_fit; it is not a permission. Optional limit clips the already-capped list. Returns ranked cards after verify (count, facts, belief_is_not_truth, authorizes_action=false).

Parameters4

q	string	optional	Optional lexical rank query (subject/fact). Alias: query. Empty still runs verify-then-rank; it does not invent facts.
use_case	string	optional	Optional use-case label that weights triad_fit in ranking. Not a permission and not a truth claim.
depth	number	optional	Optional ChainLock recall depth after verify. Omit for 5 (full budget). 0 is tip-only ranking.
limit	number	optional	Optional result cap. Hard ceiling is 16 (MEMORY_CONTEXT_CAP) even if a larger number is sent.

Raw schema

{
  "type": "object",
  "properties": {
    "q": {
      "type": "string",
      "description": "Optional lexical rank query (subject/fact). Alias: query. Empty still runs verify-then-rank; it does not invent facts."
    },
    "use_case": {
      "type": "string",
      "description": "Optional use-case label that weights triad_fit in ranking. Not a permission and not a truth claim."
    },
    "depth": {
      "type": "number",
      "minimum": 0,
      "maximum": 5,
      "description": "Optional ChainLock recall depth after verify. Omit for 5 (full budget). 0 is tip-only ranking."
    },
    "limit": {
      "type": "number",
      "minimum": 1,
      "maximum": 16,
      "description": "Optional result cap. Hard ceiling is 16 (MEMORY_CONTEXT_CAP) even if a larger number is sent."
    }
  },
  "additionalProperties": true,
  "description": "All fields optional. Default depth is 5. Empty q still runs verify-then-rank and does not invent facts."
}

memory_get

Read one memory's stored explanation (node, history, or calibration: posterior, triad legs, effective N, Brier) — not a ranked list. Use this when you have a memory_id (or id) and need the stored explanation. Do not use it for ranked adaptive recall or appending an observation; use memory_recall or memory_observe instead. Missing both memory_id and id, or an unknown id, refuses AKM-NOT-FOUND — do not invent a node. authorizes_action stays false. There is no memory_delete; this is the read of the append-only node. Pass memory_id or id — one is enough; they are aliases, not two different records. Omit view for the default node slice. history returns events/resolutions; calibration returns posterior/triad/Brier. subject is not a lookup key here. Returns node, history, or calibration view (belief_is_not_truth).

Parameters3

memory_id	string	optional	Memory id to explain. Alternative to id. Missing both refuses AKM-NOT-FOUND.
id	string	optional	Alias of memory_id. Do not send two different values.
view	string	optional	Optional slice. Omit or get = stored node; history = events/resolutions; calibration = posterior, triad legs, effective N, Brier.

Raw schema

{
  "type": "object",
  "properties": {
    "memory_id": {
      "type": "string",
      "description": "Memory id to explain. Alternative to id. Missing both refuses AKM-NOT-FOUND."
    },
    "id": {
      "type": "string",
      "description": "Alias of memory_id. Do not send two different values."
    },
    "view": {
      "type": "string",
      "enum": [
        "get",
        "history",
        "calibration"
      ],
      "description": "Optional slice. Omit or get = stored node; history = events/resolutions; calibration = posterior, triad legs, effective N, Brier."
    }
  },
  "additionalProperties": false,
  "description": "Pass memory_id or id (aliases). Omit view for the node slice. Extra properties are rejected."
}

runtime_software

Read hub Software-tab cards (GET /v1/software): every product including AZChat LIVE+bound, sorted Plain A–Z → Gate A–Z → Lock A–Z (Clock ≠ Lock). Not the hashed live/stub registry. Use this when a hub or client refreshes the Software tab. Do not use it for agent discovery of hashed registry status, compact skill URLs, or executing an op; use fraggate_list, runtime_bundle, or fraggate_call instead. Empty {} only. Never enables mesh radios and never execs. Same JSON as GET /v1/software (also /v1/fraggate/software). Cards carry name, slug, ops, worker_home — not live/stub/digest hashes. EmbryoLock is live-with-local-destructive-boundary (worker_home embryolock-download-tracker). Agent exec still uses fraggate_list → fraggate_describe → fraggate_call. Returns sorted software cards (name, slug, ops, worker_home) matching GET /v1/software.

Parameters

No parameters.

Raw schema

{
  "type": "object",
  "properties": {},
  "additionalProperties": false,
  "description": "No arguments. Send {}. Hub/client helper — not exec and not fraggate_list."
}

runtime_bundle

Read a compact bootstrap of every product skill URL and invoke prefix — not Software-tab cards and not the hashed registry. Use this when a client needs skill URLs in one shot. Do not use it for Software-tab refresh, hashed registry discovery, or exec; use runtime_software, fraggate_list, or fraggate_call instead. Prefer GET /v1/software for hub Software tabs. This helper is URL bootstrap only. Returns compact product list with skill URLs.

Parameters

No parameters.

Raw schema

{
  "type": "object",
  "properties": {},
  "additionalProperties": false,
  "description": "No arguments. Send {}."
}

runtime_pull

Open one hub product card by slug (name, version, skill, download, ops) — not FragGate live/stub status. Use this when you already have a slug from GET /v1/software or fraggate_list and need the card, not exec. Do not use it for inspecting FragGate live/stub status or executing an op; use fraggate_describe or fraggate_call instead. Not exec — then use fraggate_call. Unknown slug throws unknown product (it does not invent a card and does not refuse FG-HALLUC-TOOL; that code is FragGate-only). Missing skill falls back to in-repo markdown. slug is required. product is an accepted alias of slug. Extra keys besides those two are ignored and are not an op payload. Returns one product card (name, version, skill, download, ops, skill_source).

Parameters2

slug	string	required	Required catalog slug from GET /v1/software or fraggate_list (for example foldlock). Alias: product. Not an exec path.
product	string	optional	Alias of slug. Do not send two different values.

Raw schema

{
  "type": "object",
  "properties": {
    "slug": {
      "type": "string",
      "description": "Required catalog slug from GET /v1/software or fraggate_list (for example foldlock). Alias: product. Not an exec path."
    },
    "product": {
      "type": "string",
      "description": "Alias of slug. Do not send two different values."
    }
  },
  "required": [
    "slug"
  ],
  "additionalProperties": true,
  "description": "slug or product required. Extra keys are ignored by the pull helper — not an exec payload."
}

runtime_run

[advanced/internal] Advanced exec façade: admit a slug+op (still DecisionGATE-admitted) and run it through a raw session. Not the default door. Use this when you were explicitly asked for the raw runtime_run path. Do not use it for the default agent exec path or an already-open session you were asked to exec on; use fraggate_call (default) or runtime_session_exec (existing session_id) instead. Side effects are operation-dependent. Not a backdoor past FragGate. Opens a session when session_id is omitted. slug and op are required. session_id optional; omit to auto-open. Extra keys other than payload/session_id may be treated as payload. Mutation requires confirm=true (runtime gate) or dry_run=true (preview only, no write). confirm and dry_run stay optional on inputSchema.required. dry_run still returns FG-HALLUC-TOOL, FG-STUB, FG-UNKNOWN-OP, or FG-LOCAL-ONLY when a confirm call would refuse. confirm is consent, not tenant auth, and it does not upgrade shared public-demo isolation. Returns exec display envelope with session_id, result, engine_digest, ran_in, and refusal when gated.

Parameters6

slug	string	required	Required catalog slug (or name alias). Unknown slugs refuse FG-HALLUC-TOOL.
op	string	required	Required allowlisted op. Stubs refuse FG-STUB.
payload	object	optional	Optional op payload object. Engine-specific.
session_id	string	optional	Optional existing raw session id. If omitted, a session is opened automatically. Prefer leaving session plumbing invisible unless asked.
confirm	boolean	optional	Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true. confirm is consent to run the call. It is not tenant auth and it does not upgrade shared public-demo isolation.
dry_run	boolean	optional	Optional preview flag. When true, do not write and do not stamp a ledger tip. Allowlist, hallucination, stub, and local-only checks still run and return the same FragGate refuse code a confirm call would get. MCP-DRY-RUN is returned only when that call would have been allowed to proceed. confirm is consent, not tenant auth, and it does not upgrade shared public-demo isolation.

Raw schema

{
  "type": "object",
  "properties": {
    "slug": {
      "type": "string",
      "description": "Required catalog slug (or name alias). Unknown slugs refuse FG-HALLUC-TOOL."
    },
    "op": {
      "type": "string",
      "description": "Required allowlisted op. Stubs refuse FG-STUB."
    },
    "payload": {
      "type": "object",
      "additionalProperties": true,
      "description": "Optional op payload object. Engine-specific."
    },
    "session_id": {
      "type": "string",
      "description": "Optional existing raw session id. If omitted, a session is opened automatically. Prefer leaving session plumbing invisible unless asked."
    },
    "confirm": {
      "type": "boolean",
      "description": "Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true. confirm is consent to run the call. It is not tenant auth and it does not upgrade shared public-demo isolation."
    },
    "dry_run": {
      "type": "boolean",
      "description": "Optional preview flag. When true, do not write and do not stamp a ledger tip. Allowlist, hallucination, stub, and local-only checks still run and return the same FragGate refuse code a confirm call would get. MCP-DRY-RUN is returned only when that call would have been allowed to proceed. confirm is consent, not tenant auth, and it does not upgrade shared public-demo isolation."
    }
  },
  "required": [
    "slug",
    "op"
  ],
  "additionalProperties": true,
  "description": "slug and op are required. Extra keys other than payload/session_id may be treated as payload. Mutation requires confirm=true or dry_run=true."
}

runtime_manifest

[advanced/internal] Read the machine runtime manifest JSON (version, role, door=fraggate, engine slugs, registry_digest) — not the human how-to. Use this when a client needs the machine manifest rather than the human skill. Do not use it for the default agent how-to or hashed registry discovery; use runtime_skill or fraggate_list instead. Not the default agent path. Does not list hub cards or execute. Returns manifest including door=fraggate and registry_digest.

Parameters

No parameters.

Raw schema

{
  "type": "object",
  "properties": {},
  "additionalProperties": true,
  "description": "No required arguments. Extra keys are ignored."
}

runtime_session_open

[advanced/internal] Open a raw session object (session.id). First step of open → policy → exec → receipt(s) → close. Not the default exec path. Use this when you were explicitly asked for raw session plumbing. Do not use it for the default agent exec path or attaching policy to an existing id; use fraggate_call (default) or runtime_session_policy (existing session_id) instead. Write: creates a session with a 6h TTL and receipt cap 64. Re-open on an existing id returns already=true without resetting the chain. Expired sessions refuse session_expired (410). When REQUIRE_TOKEN=1, session mutate needs RUNTIME_TOKEN; missing SESSION binding returns session_binding_missing (503). Prefer leaving sessions to TTL expire. Not chainlock_seal. Empty {} mints sess_ + 32 hex. Optional id is accepted only when it already matches that pattern; otherwise bad_session_id. source is open metadata (default worker). Mutation requires confirm=true (runtime gate) or dry_run=true (preview only, no write). confirm and dry_run stay optional on inputSchema.required. dry_run still returns FG-HALLUC-TOOL, FG-STUB, FG-UNKNOWN-OP, or FG-LOCAL-ONLY when a confirm call would refuse. confirm is consent, not tenant auth, and it does not upgrade shared public-demo isolation. Returns session.id plus the first receipt in the display envelope.

Parameters4

id	string	optional	Optional caller-chosen session id. Must already match sess_ + 32 lowercase hex or the open refuses bad_session_id. Omit to mint one.
source	string	optional	Optional open metadata label. Default worker. Not a permission and not a catalog slug.
confirm	boolean	optional	Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true. confirm is consent to run the call. It is not tenant auth and it does not upgrade shared public-demo isolation.
dry_run	boolean	optional	Optional preview flag. When true, do not write and do not stamp a ledger tip. Allowlist, hallucination, stub, and local-only checks still run and return the same FragGate refuse code a confirm call would get. MCP-DRY-RUN is returned only when that call would have been allowed to proceed. confirm is consent, not tenant auth, and it does not upgrade shared public-demo isolation.

Raw schema

{
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "description": "Optional caller-chosen session id. Must already match sess_ + 32 lowercase hex or the open refuses bad_session_id. Omit to mint one.",
      "pattern": "^sess_[a-f0-9]{32}$"
    },
    "source": {
      "type": "string",
      "description": "Optional open metadata label. Default worker. Not a permission and not a catalog slug."
    },
    "confirm": {
      "type": "boolean",
      "description": "Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true. confirm is consent to run the call. It is not tenant auth and it does not upgrade shared public-demo isolation."
    },
    "dry_run": {
      "type": "boolean",
      "description": "Optional preview flag. When true, do not write and do not stamp a ledger tip. Allowlist, hallucination, stub, and local-only checks still run and return the same FragGate refuse code a confirm call would get. MCP-DRY-RUN is returned only when that call would have been allowed to proceed. confirm is consent, not tenant auth, and it does not upgrade shared public-demo isolation."
    }
  },
  "additionalProperties": true,
  "description": "No required arguments. Empty {} mints a sess_ + 32 hex id. Extra keys may be stored as open metadata. Mutation requires confirm=true or dry_run=true."
}

runtime_session_policy

[advanced/internal] Attach allow rules on an already-open raw session (allow_slugs / allow_ops). Policy overlay — not open and not exec. Identity remains Aziel Eliab. Use this when an already-open session needs tighter allow_slugs / allow_ops before exec. Do not use it for executing an op or opening a session; use runtime_session_exec or runtime_session_open (prefer fraggate_call, which applies defaults) instead. Write: mutates session policy only. A sealed session refuses session_closed (409). Expired sessions refuse session_expired (410). Missing both session_id and id fails before the door runs. Does not exec and does not mint a new id. session_id or id (aliases) required. allow_slugs / allow_ops replace the allow overlay when sent; omit them to leave the current lists. max_payload_bytes and kv_increment are optional overlays, not exec payload. Nested policy{} is accepted as the same overlay. Mutation requires confirm=true (runtime gate) or dry_run=true (preview only, no write). confirm and dry_run stay optional on inputSchema.required. dry_run still returns FG-HALLUC-TOOL, FG-STUB, FG-UNKNOWN-OP, or FG-LOCAL-ONLY when a confirm call would refuse. confirm is consent, not tenant auth, and it does not upgrade shared public-demo isolation. Returns updated session policy plus a policy receipt.

Parameters8

session_id	string	required	Required. Raw session id from runtime_session_open (sess_ + 32 lowercase hex). Alias: id. Missing both fails with session_id required; unknown id returns session_not_found.
id	string	optional	Alias of session_id. The door accepts either key; do not send two different values.
allow_slugs	array	optional	Optional replacement allowlist of catalog slugs this session may exec. Omit to keep the current list.
allow_ops	array	optional	Optional replacement allowlist of ops this session may exec. Omit to keep the current list.
max_payload_bytes	integer	optional	Optional max payload size in bytes for later exec (integer 1..1048576). Overlay only; not the exec body. Out of range refuses bad_policy.
kv_increment	boolean	optional	Optional. When true, allow KV increment side effects on later exec. Not an increment itself.
confirm	boolean	optional	Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true. confirm is consent to run the call. It is not tenant auth and it does not upgrade shared public-demo isolation.
dry_run	boolean	optional	Optional preview flag. When true, do not write and do not stamp a ledger tip. Allowlist, hallucination, stub, and local-only checks still run and return the same FragGate refuse code a confirm call would get. MCP-DRY-RUN is returned only when that call would have been allowed to proceed. confirm is consent, not tenant auth, and it does not upgrade shared public-demo isolation.

Raw schema

{
  "type": "object",
  "properties": {
    "session_id": {
      "type": "string",
      "description": "Required. Raw session id from runtime_session_open (sess_ + 32 lowercase hex). Alias: id. Missing both fails with session_id required; unknown id returns session_not_found.",
      "pattern": "^sess_[a-f0-9]{32}$"
    },
    "id": {
      "type": "string",
      "description": "Alias of session_id. The door accepts either key; do not send two different values.",
      "pattern": "^sess_[a-f0-9]{32}$"
    },
    "allow_slugs": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Optional replacement allowlist of catalog slugs this session may exec. Omit to keep the current list."
    },
    "allow_ops": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Optional replacement allowlist of ops this session may exec. Omit to keep the current list."
    },
    "max_payload_bytes": {
      "type": "integer",
      "minimum": 1,
      "maximum": 1048576,
      "description": "Optional max payload size in bytes for later exec (integer 1..1048576). Overlay only; not the exec body. Out of range refuses bad_policy."
    },
    "kv_increment": {
      "type": "boolean",
      "description": "Optional. When true, allow KV increment side effects on later exec. Not an increment itself."
    },
    "confirm": {
      "type": "boolean",
      "description": "Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true. confirm is consent to run the call. It is not tenant auth and it does not upgrade shared public-demo isolation."
    },
    "dry_run": {
      "type": "boolean",
      "description": "Optional preview flag. When true, do not write and do not stamp a ledger tip. Allowlist, hallucination, stub, and local-only checks still run and return the same FragGate refuse code a confirm call would get. MCP-DRY-RUN is returned only when that call would have been allowed to proceed. confirm is consent, not tenant auth, and it does not upgrade shared public-demo isolation."
    }
  },
  "required": [
    "session_id"
  ],
  "additionalProperties": true,
  "description": "session_id or id required. Other fields are optional policy overlays (also accepted nested under policy). Mutation requires confirm=true or dry_run=true."
}

runtime_session_exec

[advanced/internal] Raw session exec on an already-open session_id (FragGate-admitted). Not fraggate_call and not runtime_run auto-open. Use this when you already have a session_id and were asked for raw session exec. Do not use it for the default agent exec path or opening a session; use fraggate_call or runtime_session_open instead. Side effects are operation-dependent (read, write, or refuse). Does not mint a session_id — missing id fails before admit. Sealed sessions refuse session_closed (409); TTL 6h refuses session_expired (410); receipt cap 64 refuses receipt_cap (409). Rate-limited (exec). Binding-only ops stay per-op proxy_fallback. Prefer fraggate_call. session_id or id, plus slug and op, are required. payload is optional and engine-specific; leftover keys are not auto-payload the way fraggate_call leftover keys are. Unknown slugs refuse FG-HALLUC-TOOL; stubs refuse FG-STUB. Mutation requires confirm=true (runtime gate) or dry_run=true (preview only, no write). confirm and dry_run stay optional on inputSchema.required. dry_run still returns FG-HALLUC-TOOL, FG-STUB, FG-UNKNOWN-OP, or FG-LOCAL-ONLY when a confirm call would refuse. confirm is consent, not tenant auth, and it does not upgrade shared public-demo isolation. Returns exec result with engine_slug, engine_op, engine_digest, ran_in, receipt, and refusal when gated.

Parameters13

session_id	string	required	Required. Raw session id from runtime_session_open (sess_ + 32 lowercase hex). Alias: id. Missing both fails with session_id required; unknown id returns session_not_found.
id	string	optional	Alias of session_id. The door accepts either key; do not send two different values.
slug	string	required	Required catalog slug to exec. Alias: product. Unknown slugs refuse FG-HALLUC-TOOL. This tool does not auto-open.
product	string	optional	Alias of slug. Do not send two different values.
op	string	required	Required allowlisted op. Stubs refuse FG-STUB. UI aliases still forward only after FragGate admit.
payload	object	optional	Optional op payload object. Engine-specific. Unlike fraggate_call, leftover top-level keys are not used as payload.
request_id	string	optional	Optional logical request id shared by retries of one action. Same value across attempts. Omitted mints a new id for this exec.
attempt_n	integer	optional	Optional 1-based attempt number. Omitted increments from the prior session receipt with the same request_id, or 1.
parent_receipt_id	string	optional	Optional prior attempt receipt hash. Null on the first attempt. Omitted links to the prior session receipt with the same request_id. Not FragGate ledger prev.
correlation_id	string	optional	Optional client correlation id. Sealed on the session receipt. Null when omitted.
outcome	string	optional	Optional sealed status. completed marks the attempt that finished the action. retry and failed are earlier attempts. Defaults from HTTP status when omitted.
confirm	boolean	optional	Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true. confirm is consent to run the call. It is not tenant auth and it does not upgrade shared public-demo isolation.
dry_run	boolean	optional	Optional preview flag. When true, do not write and do not stamp a ledger tip. Allowlist, hallucination, stub, and local-only checks still run and return the same FragGate refuse code a confirm call would get. MCP-DRY-RUN is returned only when that call would have been allowed to proceed. confirm is consent, not tenant auth, and it does not upgrade shared public-demo isolation.

Raw schema

{
  "type": "object",
  "properties": {
    "session_id": {
      "type": "string",
      "description": "Required. Raw session id from runtime_session_open (sess_ + 32 lowercase hex). Alias: id. Missing both fails with session_id required; unknown id returns session_not_found.",
      "pattern": "^sess_[a-f0-9]{32}$"
    },
    "id": {
      "type": "string",
      "description": "Alias of session_id. The door accepts either key; do not send two different values.",
      "pattern": "^sess_[a-f0-9]{32}$"
    },
    "slug": {
      "type": "string",
      "description": "Required catalog slug to exec. Alias: product. Unknown slugs refuse FG-HALLUC-TOOL. This tool does not auto-open."
    },
    "product": {
      "type": "string",
      "description": "Alias of slug. Do not send two different values."
    },
    "op": {
      "type": "string",
      "description": "Required allowlisted op. Stubs refuse FG-STUB. UI aliases still forward only after FragGate admit."
    },
    "payload": {
      "type": "object",
      "additionalProperties": true,
      "description": "Optional op payload object. Engine-specific. Unlike fraggate_call, leftover top-level keys are not used as payload."
    },
    "request_id": {
      "type": "string",
      "description": "Optional logical request id shared by retries of one action. Same value across attempts. Omitted mints a new id for this exec."
    },
    "attempt_n": {
      "type": "integer",
      "minimum": 1,
      "description": "Optional 1-based attempt number. Omitted increments from the prior session receipt with the same request_id, or 1."
    },
    "parent_receipt_id": {
      "type": "string",
      "nullable": true,
      "description": "Optional prior attempt receipt hash. Null on the first attempt. Omitted links to the prior session receipt with the same request_id. Not FragGate ledger prev."
    },
    "correlation_id": {
      "type": "string",
      "nullable": true,
      "description": "Optional client correlation id. Sealed on the session receipt. Null when omitted."
    },
    "outcome": {
      "type": "string",
      "enum": [
        "retry",
        "failed",
        "completed"
      ],
      "description": "Optional sealed status. completed marks the attempt that finished the action. retry and failed are earlier attempts. Defaults from HTTP status when omitted."
    },
    "confirm": {
      "type": "boolean",
      "description": "Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true. confirm is consent to run the call. It is not tenant auth and it does not upgrade shared public-demo isolation."
    },
    "dry_run": {
      "type": "boolean",
      "description": "Optional preview flag. When true, do not write and do not stamp a ledger tip. Allowlist, hallucination, stub, and local-only checks still run and return the same FragGate refuse code a confirm call would get. MCP-DRY-RUN is returned only when that call would have been allowed to proceed. confirm is consent, not tenant auth, and it does not upgrade shared public-demo isolation."
    }
  },
  "required": [
    "session_id",
    "slug",
    "op"
  ],
  "additionalProperties": true,
  "description": "session_id (or id), slug, and op are required. Extra keys besides payload are not treated as the op payload. Mutation requires confirm=true or dry_run=true."
}

runtime_session_receipt

[advanced/internal] Read the last receipt only for a raw session — not the full chain. Use this when the user asked for the latest receipt on an open or sealed session. Do not use it for the full receipt chain or product output the user did not ask to audit; use runtime_session_receipts (full chain) or the product display from fraggate_call instead. Does not mutate the session. Unknown id returns session_not_found. An empty receipt list returns receipt=null rather than inventing one. Prefer product output (display) unless the user asked for the chain. session_id or id (aliases) required. No view/limit — this is always the last receipt plus a chain verified flag. Returns the last receipt object (or null) and verified.

Parameters2

session_id	string	required	Required. Raw session id from runtime_session_open (sess_ + 32 lowercase hex). Alias: id. Missing both fails with session_id required; unknown id returns session_not_found.
id	string	optional	Alias of session_id. The door accepts either key; do not send two different values.

Raw schema

{
  "type": "object",
  "properties": {
    "session_id": {
      "type": "string",
      "description": "Required. Raw session id from runtime_session_open (sess_ + 32 lowercase hex). Alias: id. Missing both fails with session_id required; unknown id returns session_not_found.",
      "pattern": "^sess_[a-f0-9]{32}$"
    },
    "id": {
      "type": "string",
      "description": "Alias of session_id. The door accepts either key; do not send two different values.",
      "pattern": "^sess_[a-f0-9]{32}$"
    }
  },
  "required": [
    "session_id"
  ],
  "additionalProperties": true,
  "description": "session_id or id required. Extra keys are ignored."
}

runtime_session_receipts

[advanced/internal] Read the full receipt chain for a raw session — not the last receipt only. Use this when the user asked for the whole receipt chain. Do not use it for only the last receipt or ordinary product output; use runtime_session_receipt or the product display from fraggate_call instead. Does not mutate the session. Unknown id returns session_not_found. List is the stored chain (cap 64), oldest to newest, plus verified. Prefer product output unless the user asked for the chain. session_id or id (aliases) required. No pagination — the cap is the runtime receipt cap, not a cursor. Returns the receipt list (capped at 64) and verified.

Parameters2

session_id	string	required	Required. Raw session id from runtime_session_open (sess_ + 32 lowercase hex). Alias: id. Missing both fails with session_id required; unknown id returns session_not_found.
id	string	optional	Alias of session_id. The door accepts either key; do not send two different values.

Raw schema

{
  "type": "object",
  "properties": {
    "session_id": {
      "type": "string",
      "description": "Required. Raw session id from runtime_session_open (sess_ + 32 lowercase hex). Alias: id. Missing both fails with session_id required; unknown id returns session_not_found.",
      "pattern": "^sess_[a-f0-9]{32}$"
    },
    "id": {
      "type": "string",
      "description": "Alias of session_id. The door accepts either key; do not send two different values.",
      "pattern": "^sess_[a-f0-9]{32}$"
    }
  },
  "required": [
    "session_id"
  ],
  "additionalProperties": true,
  "description": "session_id or id required. Extra keys are ignored. No cursor/limit."
}

runtime_session_close

[advanced/internal] Seal a raw session so further exec or policy on that session_id is rejected. End of the raw lifecycle — not a LOCKSET seal and not a FragGate call. Use this when the user asked to close the session. Do not use it for ordinary completion, writing a ChainLock LOCKSET, or default product work; use leaving the session to TTL expire (6h), chainlock_seal for a lockset, or fraggate_call for new work instead. Destructive to further exec/policy on that session_id only (session_closed 409). Does not delete receipts. A second close does not reopen — it returns session_closed (409) while the session stays sealed. Missing session returns session_not_found. Prefer leaving sessions to expire unless asked. session_id or id (aliases) required. No force flag on the public tool — TTL expiry is the automatic close path. Mutation requires confirm=true (runtime gate) or dry_run=true (preview only, no write). confirm and dry_run stay optional on inputSchema.required. dry_run still returns FG-HALLUC-TOOL, FG-STUB, FG-UNKNOWN-OP, or FG-LOCAL-ONLY when a confirm call would refuse. confirm is consent, not tenant auth, and it does not upgrade shared public-demo isolation. Returns sealed session status, close receipt, and verified.

Parameters4

session_id	string	required	Required. Raw session id from runtime_session_open (sess_ + 32 lowercase hex). Alias: id. Missing both fails with session_id required; unknown id returns session_not_found.
id	string	optional	Alias of session_id. The door accepts either key; do not send two different values.
confirm	boolean	optional	Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true. confirm is consent to run the call. It is not tenant auth and it does not upgrade shared public-demo isolation.
dry_run	boolean	optional	Optional preview flag. When true, do not write and do not stamp a ledger tip. Allowlist, hallucination, stub, and local-only checks still run and return the same FragGate refuse code a confirm call would get. MCP-DRY-RUN is returned only when that call would have been allowed to proceed. confirm is consent, not tenant auth, and it does not upgrade shared public-demo isolation.

Raw schema

{
  "type": "object",
  "properties": {
    "session_id": {
      "type": "string",
      "description": "Required. Raw session id from runtime_session_open (sess_ + 32 lowercase hex). Alias: id. Missing both fails with session_id required; unknown id returns session_not_found.",
      "pattern": "^sess_[a-f0-9]{32}$"
    },
    "id": {
      "type": "string",
      "description": "Alias of session_id. The door accepts either key; do not send two different values.",
      "pattern": "^sess_[a-f0-9]{32}$"
    },
    "confirm": {
      "type": "boolean",
      "description": "Documented confirmation flag. Optional in inputSchema.required (connector refresh must not break). tools/call still refuses MCP-CONFIRM-REQUIRED when confirm is missing or false unless dry_run=true. confirm is consent to run the call. It is not tenant auth and it does not upgrade shared public-demo isolation."
    },
    "dry_run": {
      "type": "boolean",
      "description": "Optional preview flag. When true, do not write and do not stamp a ledger tip. Allowlist, hallucination, stub, and local-only checks still run and return the same FragGate refuse code a confirm call would get. MCP-DRY-RUN is returned only when that call would have been allowed to proceed. confirm is consent, not tenant auth, and it does not upgrade shared public-demo isolation."
    }
  },
  "required": [
    "session_id"
  ],
  "additionalProperties": true,
  "description": "session_id or id required. Extra keys are ignored. This is not chainlock_seal. Mutation requires confirm=true or dry_run=true."
}

README.md53 KBView on GitHub

aziel-runtime

Aziel Runtime starts at Softwares, FragGate, and the library. Softwares picks a slug. FragGate is the single exec door. library_lookup searches library papers and cites. Install on Glama, then call Softwares, pick a slug, and fraggate_call. 40+ research tools run through that one door. Every call can leave a receipt.

Install (remote first)

Public MCP — no API key:

text

https://aziel-runtime.vibelock.workers.dev/mcp

Transport: Streamable HTTP. Full client recipes: docs/AGENTS.md.

Registry: io.github.AzielEliab/aziel-runtime · Glama: Install

Access

Public: Softwares, FragGate list/describe/call, library lookup — no auth
Glama hosted: optional Install Server. Glama hosted-tool meters stay separate from Worker GET /v1/uses
Local stdio: clone + cli/mcp-stdio.mjs (dev path; keep below the remote URL)

First tools

Softwares / fraggate_list
fraggate_describe → pick a slug
fraggate_call (use confirm: true when required)

How to use

Click Install / Add to Glama (also https://glama.ai/mcp/servers/@AzielEliab/aziel-runtime).
In any MCP client, call Softwares (tools/list name Softwares). The door runs first. Pick a slug, then fraggate_call. library_lookup searches library papers and cites. ChainLock, TemporalLock, and ForgeReceipts stamp when the call needs a ledger. confirm=true writes. dry_run=true previews and writes nothing. background=true returns Running until a receipt hash exists. Done only with that hash. tools/list stays 36.

Diagnostics, if needed: fraggate_list → fraggate_describe {name} → fraggate_call {name, op, payload, confirm:true}.

Worker remote: https://aziel-runtime.vibelock.workers.dev/mcp

Example first call: Softwares {}, pick a slug, then fraggate_call with { "slug": "foldlock", "op": "fold-preview" }. library_lookup with { "q": "Florence", "op": "search" } is a library paper or cite. Also: decisiongate_check with a short proposal and dry_run:true, or forgereceipts receipt for a completed task.

MCP tools/list is 36 tools. FragGate is the single door. Public connect is the remote URL in Install (remote first) (Streamable HTTP, no API key). Glama Install Server is optional and meters separately from Worker GET /v1/uses. Local stdio stays last. Compatible AI clients are listed below. Author: Aziel Eliab.

Designed purpose

Aziel Runtime (aziel-runtime) is a node-meshed orchestration suite of MCP-connected software designed to route catalog Softwares through the FragGate door, mint receipts, and coordinate mesh presence. Use it to list, describe, and call product operations over MCP or OpenAPI, then keep the returned receipt. It exists so each Softwares product stays a separate engine behind one door.

Start

node cli/aziel-runtime.mjs
node cli/aziel-runtime.mjs session open --local
node cli/aziel-runtime.mjs session status --local

The terminal prints a short summary. Add --json for the machine object. Help: node cli/aziel-runtime.mjs --help. The same three steps are in RUN.txt.

Softwares purpose copy (one_line + description) is the designed-to-do addendum on GET /v1/software (src/software-copy.js). Hubs refresh from that route.

FragGate is THE single public executable door (fraggate_list → fraggate_describe → fraggate_call). Softwares catalog is Plain → Gate → Lock; hubs refresh from GET /v1/software. Humans use Softwares in the Worker UI on the VibeLock host (browser / PWA) — no download required. Agents use OpenAPI/MCP. Optional suite pack JSON remains at /download. NodeMesh / QNM read-only suite-presence is ON by default; GET /v1/mesh never enables radios beyond that.

Version 2.0.0-rc1 is the certification-point freeze (not a feature dump): public contract, clean-room reproducibility, and external adversarial pack under docs/2.0/. No intentional behavioral breaks from 1.9.3. Remain-OFF untouched. Crawler surfaces keep the abstract above; changelog stays below. 1.9.3 closed remaining AZRT-1.9-GAPS-CLOSE items (isolate AZ-OS ethics session VFS; isolate-safe Ask Jeeves; binding-gated media-run; published independent-validation attestation path — not a third-party lab). 1.9.2 bound Browser Rendering and live D1 MASTER. 1.9.1 closed AZRT-1.9-GAPS-CLOSE isolate-safe verify. 1.9.0 closed AZRT-1.9-CLOSE-1.0. 1.7.11 is the SEO-clarity heritage that locked that lead copy.

Kernel: AzielEliab/fraggate (FG-0.1)

Try on Glama is the primary public host / discovery / install listing (also https://glama.ai/mcp/servers/@AzielEliab/aziel-runtime). Worker origin stays the execution / OpenAPI / MCP HTTP surface.

Entity graph (locked): Person @id https://www.azieleliab.com/#aziel · Runtime SoftwareApplication @id https://www.azieleliab.com/runtime#runtime. Worker origin is the execution endpoint (url). relatedLink is the Glama discovery / install host. Identity Aziel Eliab only.

open → policy → exec(slug, op, payload) → receipt → close

Agents should not narrate that chain. Prefer fraggate_list → fraggate_describe → fraggate_call { name, op, payload }. Hubs/clients: GET /v1/software.

1.3.0 vendored portable engines (ark, azai Lamb check, azclce, decisiongate, foldlock, zsolver) and ran them in this isolate.

1.2.0 was a session/receipt runtime: exec still upstreamFetched product Workers. Those receipts were not “this process ran FoldLock.”

1.1.0 was catalog + pull + proxy that started calling itself a runtime. Those front doors stay. They are not exec.

For every catalog slug session exec loads a vendored module, computes engine_digest = SHA-256 of that artifact’s bytes, runs the primary compute op inside this Worker isolate (the jail) or a local CLI jail, wipes scratch buffers, and the receipt includes engine_digest, engine_slug, engine_op, ran_in. GET /v1/health engine_slugs equals true_engine_slugs. Ops that literally cannot run without product-Worker bindings (KV / D1 / AI / live media) stay honest per-op proxy_fallback — the slug itself remains a true engine.

Cloudflare’s Worker / Durable Object isolate is the jail. No extra guest isolate is claimed. engine_digest is still required.

Hosted / in-process AZAI is still protocol mirror + Lamb check (Service → Clarity → Peace). The local core is standalone. Ollama is optional SLOT, not the identity.

Any OpenAPI-, MCP-, or HTTP-tool-capable assistant imports this OpenAPI file — then use fraggate_call. Session tools and runtime_run are advanced/internal. /p/{slug}/{op} is proxy only and is not the agent default path.

Author: Aziel Eliab
Identity: Aziel Eliab (primary). Also known as Aziel Elroi Eliab (alternateName / aka only).
License: Apache-2.0
Version: 2.0.0-rc1
2.0 pack: docs/2.0/ (contract freeze; self-test ≠ third-party lab)
Role: engine-runtime (layer: catalog+pull+proxy+session+in-process-engines+fraggate)
Door: fraggate
Primary host: Try on Glama
Worker (execution / OpenAPI / MCP HTTP): aziel-runtime → https://aziel-runtime.vibelock.workers.dev/
Entity parent: https://www.azieleliab.com/runtime
Library mirror: https://www.azielcorpuslibrary.net/runtime
Rose-star brand mark: https://aziel-runtime.vibelock.workers.dev/sigil.png
Packaging: Worker session + in-repo CLI (node cli/aziel-runtime.mjs) + stdio MCP (node cli/mcp-stdio.mjs / npm run mcp). No counted runtime tarball.

Forks are welcome and always allowed. Do not invent Zenodo DOIs.

Inspect the code (not the crawler files)

Behavior	Source	Tests
FragGate list / describe / call	`src/fraggate/door.js`, `registry.js`	`scripts/verify-fraggate.mjs`
MCP `tools/list` + `tools/call`	`src/mcp-surface.js`, `mcp-schema.js`	`scripts/verify-mcp-tdqs.mjs`
Session open → policy → exec → receipt → close	`src/session-core.js`	`scripts/verify-session.mjs`
Software catalog	`src/software-catalog.js`, `software-copy.js`	`scripts/verify-software.mjs`
Offline receipt hash	fixture `fixtures/session-receipt-chain.json`	`node scripts/verify-receipt-fixture.mjs`

Full path map: docs/2.0/INSPECT.md. How to run tests: docs/2.0/TESTS.md. Privacy: docs/DATA.md. Review / agent-assisted commits: docs/GOVERNANCE.md. wrangler.toml main is src/index.js (unminified). Cloudflare may bundle that same module for deploy — the reviewed artifact is this tree.

Compatible AI clients

Assistants / clients that can call OpenAPI, MCP, or HTTP tools:

ChatGPT (GPT Actions / OpenAI)
Grok (xAI)
Venice
Claude (Anthropic Desktop / custom tools)
Cursor (MCP)
Glama (Install Server / MCP)
Perplexity
Microsoft Copilot / Bing
Google Gemini / Vertex AI
Mistral
Meta AI
Apple Intelligence / Applebot surfaces
Amazon Q / Amazonbot tooling
DuckAssist / DuckDuckGo AI
You.com
Cohere
plus other MCP/OpenAPI-capable assistants

Practical Add-to steps below cover ChatGPT, Grok, Venice, Claude Desktop, and Glama / Cursor MCP. Do not invent step-by-step for every crawler.

Crawl / SEO Allow set on robots.txt: GPTBot/ChatGPT, Venice, Grok, Google-Extended, GoogleOther, Google-CloudVertexBot, Claude(+Search/User), anthropic-ai, Perplexity(+User), bingbot, Meta-External*, Applebot(+Extended), Amazonbot, DuckDuck/DuckAssist, MistralAI-User, YouBot, CCBot, cohere-ai, cohere-training-data-crawler, Diffbot, AI2Bot(+Dolma), Timpibot, Petalbot, Bytespider, Omgili(+bot), FirecrawlAgent, ImagesiftBot, Cloudflare-AI-Search, FacebookBot, TikTokSpider, Baiduspider*, Yandex.

GitHub About (description / homepage / topics) is documented in docs/GITHUB.md so indexes see MCP, OpenAPI, and FragGate. Coordinator applies gh repo edit from that lock.

Websites / Live sites

Try on Glama is the primary public host / discovery / install listing. This Worker homepage stays the API / MCP / OpenAPI execution surface. Human Softwares hubs are azieleliab.com, Aziel Corpus Library, and GodLock.uk. Sister archive: He Didn't Jump.

The Worker ships a FoldLock-packed library tip (index cite + sample MASTER + About Aziel) — not the entire live corpus. Verify via FragGate foldlock/pack-verify; open via aziel-corpus/tip-pack. Honesty: docs/corpus-fold-pack.md.

Every Worker launch (homepage, /about, every /p/{slug}, HTML Softwares/describe shells) includes product-specific #hashtag parts plus the same About Aziel block. Shared partial workerLaunchHtml. Product Workers inherit About Aziel + the fold tip by copy; hashtag parts stay local. Rule: docs/WORKER-LAUNCH.md.

Surface	URL
Primary host / discovery / install	https://glama.ai/mcp/servers/AzielEliab/aziel-runtime
Official site	https://www.azieleliab.com/
Runtime hub (entity parent)	https://www.azieleliab.com/runtime
FragGate kernel	https://github.com/AzielEliab/fraggate
Canonical GitHub	https://github.com/AzielEliab/aziel-runtime
Runtime Worker / MCP / OpenAPI	https://aziel-runtime.vibelock.workers.dev/
Library mirror (reverse-proxy)	https://www.azielcorpuslibrary.net/runtime
Aziel Corpus Library	https://www.azielcorpuslibrary.net/
Aziel Eliab (library)	https://www.azielcorpuslibrary.net/AzielEliab
Software page	https://www.azielcorpuslibrary.net/software
GodLock.uk	https://godlock.uk — https://godlock.uk/AzielEliab — https://godlock.uk/software
He Didn't Jump (sister archive)	https://www.hedidntjump.com/
Trades-Runtime (sister product, cite-only)	Version 0.4.9 (live `GET /v1/health`). https://github.com/AzielEliab/trades-runtime — Worker https://trades-runtime.vibelock.workers.dev — MCP `/mcp` — download `/download`. Not a FragGate true-engine. `fraggate_call` does not execute company ops.
Repos	https://github.com/AzielEliab/aziel-corpus · https://github.com/AzielEliab/godlock · https://github.com/AzielEliab/hedidntjump.com · https://github.com/AzielEliab/trades-runtime
Donate (canonical)	https://www.azieleliab.com/donate

Glama Install Server is live (Try on Glama). Glama release 2.0.7 (Install Server ON, Auto-Release ON). Worker / server package stays 2.0.0-rc1. Public connect is remote POST https://aziel-runtime.vibelock.workers.dev/mcp first. Glama Install Server is optional; its hosted meters stay separate from Worker GET /v1/uses. Local stdio stays last. See docs/GLAMA.md.

Public identity: Aziel Eliab only. Do not invent Zenodo DOIs.

Dual surface (product law)

Agent / MCP — Software runs through the agent. Show display.title / display.summary / display.fields, then take the next input. Session, OpenAPI, and HTTP plumbing stay invisible unless asked for. One door — discover, route, refuse. Download via GET /v1/update/check?slug={slug}&version={installed} → download_url or GET /v1/pull/{slug}. Bare GET /v1/update/check is not a check. Mesh-resident azcorpus + azlibrary website designs download from GET /v1/software website_designs (open for all AI clients). Upload/ingest/receipt via fraggate_call (azbrowser airlock_ingest, peacelock upload_envelope, forgereceipts verify, miragegrid verify-receipt / bridge). azlibrary upload is API token only — never embed the secret. Same ops on /openapi.json.
Human software — This Worker UI, local install, and counted /download remain complete developed software. Flutter mobile/ is not vendored in this repo.

Cold multi-shelf (COLD-MULTI-SHELF-1.0)

Runtime cites the same honesty as live corpus GET /shelves (corpus#96). GET /shelves · GET /v1/shelves · /cite.json shelves. Person @id https://www.azieleliab.com/#aziel.

Plane A LIVE: 5 published surfaces (4 CF hubs + GitHub) / 2 family radii. One independent live (cf-github). Plane B SLOT: Codeberg https://codeberg.org/AzielEliab/aziel-lockset-tip hash-verify PASS still SLOT; archive.org PASS https://archive.org/details/aziel-lockset-tip + https://archive.org/details/aziel-lockset-tip_202609 (same blast_radius archive-org; pack b549362c0736ddb54ddc488812327c464e0da1167281f92fd1a4263eedf5df37) still SLOT; Framagit URL null (third ALL-TARGETS) Zenodo tip-pack SLOT (CNS-ZENODO-NOT-LIVE); doi null. Plane C USB SLOT until CNS-OPERATOR-ATTEST. This Worker is the same Plane A tunnel. No visible 15:20.

Home origin (ORIGIN-CUTOVER-1.0)

AZNet P3. Survival layers serve AZNet (aznet, AZN-WP-0.1). sidenet is that side-net, not a separate brand. L0 stays unbroken. A mini-PC path beside the live Cloudflare hubs stays SLOT: no rented DNS, no live DNS change, no deposited bytes, no invented hostname or IP. Phoenix is local wait (REHEAL-1.0), not a public hostname coming back. Independent live count stays 1. Softwares stay frozen. Paper: ORIGIN-CUTOVER-1.0.

Cap-7 semantic bridge (not ICANN)

Cap-7 is the MirageGrid auto-generate .az layer. It duplicates the four hub sites and shifts with StaticLock (catalog product StaticClock, slug staticclock) and MirageGrid cloak, paired with AZVPN. design_of: hub_designs. resolves_to_hub: false on Cap-7. Standard internet does not reach Cap-7. Real duplications: azgrid, azcloak, azvault, azshift. False sites: azbooth, azflag, azstandby. Factory duplication cite is LIVE. Internet reaches the AZ domains (AZ.AzielEliab.AZ, AZ.AzielCorpusLibrary.AZ, AZ.Godlock.AZ, AZ.HeDidntJump.AZ) through azieleliab.com, azielcorpuslibrary.net, godlock.uk, and hedidntjump.com. Those drop-ins are public_icann: true and resolves_to_hub: true, shuffle once to one of four, stand alone, and freeze after the hubs go down. Live nodes anchor them. Cap-7 public_icann: false. The Cap-7 factory is not a public ICANN registrar. Four hub mirrors and three decoys are not per-node .aziel slots. geo-target, session-stick, and egress-rotate are LIVE on the Cap-7 control plane (region label, sticky mesh node and factory land, land rotate among 7 sites). They are not a public egress IP, not a residential IP, not a Cloudflare geo-exit pool, not a sticky public IP, not packet forwarding, and not AZVPN. The public MirageGrid Worker Cap-7 control plane is LIVE (/v1/egress and /v1/planned). vpn-hop, hop, tunnel, and mesh stay stub. Not a fifth product. AI pulls metadata from MirageGrid Worker /bridge or GET /v1/mesh/az-generator. Update shuffle: fraggate_call { slug: "miragegrid", op: "shuffle" } lands one mesh name (factory land LIVE; not a public HTTPS door). No live AZ-GEN registrar. No ICANN .az ccTLD purchase. No visible 15:20. GET /v1/mesh never enables radios. Mesh browse: AZNet + AZBrowser via FragGate.

FragGate door

Public MCP tools/list is 36 live tools. First call: Softwares (tools/list name Softwares). The door runs first. ChainLock, TemporalLock, and ForgeReceipts stamp when the call needs a ledger. Diagnostics stay fraggate_list → fraggate_describe → fraggate_call (foldlock / fold-preview, or decisiongate_check with dry_run=true). The same list includes runtime_skill, fraggate_verify, library_lookup, suite mesh_*, append-only chainlock_* and memory_* (diagnostics and belief, not a pre-call), and catalog helpers. runtime_run and runtime_session_* are advanced/internal. Ledger ops stamp ChainLock on the acts chain, then TemporalLock and ForgeReceipts. fraggate_call reports those three from the pipe when a real hash exists. Lamb Lens, SweepGate, Sentinel, and RoseClock run inside that pipe. Reads do not stamp ChainLock, TemporalLock, or ForgeReceipts.

Every catalog product is a hashed registry entry (name, slug, digest, status, public ops). Status is live | stub | local_only.

stub_ops / stub_op_count are named refuse verbs (never hosted), not extra catalog Software engines. stub_count is registry entries whose status is stub (none after 1.9.0 — AZChat is LIVE+bound). EmbryoLock is a live catalog engine (live-with-local-destructive-boundary); wipe / scorch / unlock stay FG-STUB on the public mesh. FragGate live_count + local_only_count + stub_count === FragGate product_count. That product_count is registry entries, not the Softwares-tab count. Softwares includes veillock and whitestone. The public allowlist includes memory and mesh instead. software_nodes is the in-process product Worker fan-out (whitestone absent). GET /v1/software catalog_sets.equate is false. Do not equate those sets.

Live on the public mesh (via fraggate_call): every catalog Software product that makes sense on a public agent door — advisory / score / classify / gate / search / preview / render / verify / hash / receipt / game / overlay / route / status, plus the original five (DecisionGATE, GodLock, FoldLock, AZ-CLCE, Aziel Digital Library). VeilLock stays local_only (device-local camera/screen). MCP tools/list is those 36 names. Start on the FragGate door.

Stub ops (named refuse verbs, never execute): EmbryoLock wipe/scorch/unlock/encrypt/decrypt/initialize/login, ARK scorch/wipe/unlock/encrypt, WhistleLock send/mail/release, MirageGrid VPN-hop/hop/tunnel/mesh (geo-target / session-stick / egress-rotate are LIVE on the Cap-7 plane, not a public egress IP), AzielTether mesh-join/vpn/arm, VeilLock inject/intercept/facetime, AZ-OS exec/shell/lattice, AZAI blend/complete/chat, EmployeeLock court/judge, PeaceLock transcript/transcribe/motive/counterfactual/invent/waive-duty/bypass-duty, 4DMap truth_score/lumen_panel/invent_mark/backdate_class. Safe hosted ops on those products can still be live; the stub verbs refuse forever.

Unknown names refuse FG-HALLUC-TOOL and list the tools that do exist. DecisionGATE runs before any exec side effect; refuse is a typed ResultEnvelope + ledger tip (TemporalLock-shaped hash chain). Mesh is not claimed on this public surface.

bash

curl -s -A 'Mozilla/5.0' https://aziel-runtime.vibelock.workers.dev/v1/fraggate
curl -s -A 'Mozilla/5.0' https://aziel-runtime.vibelock.workers.dev/v1/fraggate/list
curl -s -A 'Mozilla/5.0' -X POST https://aziel-runtime.vibelock.workers.dev/v1/fraggate/call \
  -H 'content-type: application/json' \
  -d '{"slug":"foldlock","op":"fold-preview","payload":{"text":"the cat and the dog"}}'

Session (the actual cut)

bash

SID=$(curl -s -A 'Mozilla/5.0' -X POST https://aziel-runtime.vibelock.workers.dev/v1/session/open \
  -H 'content-type: application/json' -d '{}' | jq -r .session.id)

curl -s -A 'Mozilla/5.0' -X POST https://aziel-runtime.vibelock.workers.dev/v1/session/$SID/policy \
  -H 'content-type: application/json' \
  -d '{"allow_slugs":["azclce","foldlock"],"max_payload_bytes":8192}'

curl -s -A 'Mozilla/5.0' -X POST https://aziel-runtime.vibelock.workers.dev/v1/session/$SID/exec \
  -H 'content-type: application/json' \
  -d '{"slug":"azclce","op":"score","payload":{"r":"login button blue","d":"login form submits","p":"login button submits"}}'

curl -s -A 'Mozilla/5.0' https://aziel-runtime.vibelock.workers.dev/v1/session/$SID/receipt
curl -s -A 'Mozilla/5.0' https://aziel-runtime.vibelock.workers.dev/v1/session/$SID/receipts
curl -s -A 'Mozilla/5.0' -X POST https://aziel-runtime.vibelock.workers.dev/v1/session/$SID/close

A local exec receipt includes engine_digest, engine_slug, engine_op, ran_in: "aziel-runtime", result digests, and latency — not only an upstream HTTP status. close seals the chain; further exec is HTTP 409. Sessions expire after 6h (410/auto-close). Receipt cap is 64. Session mutate may require Authorization: Bearer … or X-Aziel-Runtime-Token when RUNTIME_TOKEN is set.

Local CLI (Worker client by default; --local writes a session file and prefers vendored engines; --jail runs the engine in a child Node process). The terminal prints a short summary. Add --json for the machine object:

bash

node cli/aziel-runtime.mjs session open --local
node cli/aziel-runtime.mjs session policy --allow-slugs azclce,foldlock
node cli/aziel-runtime.mjs session exec azclce score \
  '{"r":"login button blue","d":"login form submits","p":"login button submits"}'
node cli/aziel-runtime.mjs session exec foldlock fold-preview '{"text":"the cat and the dog"}'
node cli/aziel-runtime.mjs session receipt
node cli/aziel-runtime.mjs session close

Proof script (local session log): bash scripts/demo-session.sh

Front doors (still useful — not exec)

bash

curl -s -A 'Mozilla/5.0' https://aziel-runtime.vibelock.workers.dev/v1/skill
curl -s -A 'Mozilla/5.0' https://aziel-runtime.vibelock.workers.dev/v1/runtime.json
curl -s -A 'Mozilla/5.0' https://aziel-runtime.vibelock.workers.dev/v1/bundle
curl -s -A 'Mozilla/5.0' https://aziel-runtime.vibelock.workers.dev/v1/pull/foldlock
curl -s -A 'Mozilla/5.0' https://aziel-runtime.vibelock.workers.dev/v1/pull/foldlock/skill

Proxy (no runtime-owned receipt — not exec):

bash

curl -s -A 'Mozilla/5.0' -X POST https://aziel-runtime.vibelock.workers.dev/p/azclce/score \
  -H 'content-type: application/json' \
  -d '{"r":"login button blue","d":"login form submits","p":"login button submits"}'

Always send User-Agent: Mozilla/5.0.

Quick URLs

What	URL
Homepage (HTML)	https://aziel-runtime.vibelock.workers.dev/
Skill	https://aziel-runtime.vibelock.workers.dev/v1/skill
FragGate door	https://aziel-runtime.vibelock.workers.dev/v1/fraggate
FragGate Worker UI + counted download	https://fraggate-download-tracker.vibelock.workers.dev/
FragGate kernel	https://github.com/AzielEliab/fraggate
Machine manifest (`role=engine-runtime`)	https://aziel-runtime.vibelock.workers.dev/v1/runtime.json (public `GET /v1/manifest` is not a path; MCP `runtime_manifest` returns this JSON)
Session open	`POST` https://aziel-runtime.vibelock.workers.dev/v1/session/open
Session exec	`POST` https://aziel-runtime.vibelock.workers.dev/v1/session/{id}/exec
Session receipt(s)	https://aziel-runtime.vibelock.workers.dev/v1/session/{id}/receipt
Bundle	https://aziel-runtime.vibelock.workers.dev/v1/bundle
Pull one product	https://aziel-runtime.vibelock.workers.dev/v1/pull/{slug}
Pull product skill	https://aziel-runtime.vibelock.workers.dev/v1/pull/{slug}/skill
Combined OpenAPI 3.1	https://aziel-runtime.vibelock.workers.dev/openapi.json
Authoritative software catalog (hubs)	https://aziel-runtime.vibelock.workers.dev/v1/software
FragGate software mirror	https://aziel-runtime.vibelock.workers.dev/v1/fraggate/software
Client update check	https://aziel-runtime.vibelock.workers.dev/v1/update/check?slug={slug}&version={installed}
Update manifest	https://aziel-runtime.vibelock.workers.dev/v1/update/manifest
Machine catalog	https://aziel-runtime.vibelock.workers.dev/v1/catalog.json
How to cite	https://aziel-runtime.vibelock.workers.dev/cite.json
Ban / blocked-endpoint failover	https://aziel-runtime.vibelock.workers.dev/survival (aliases `/v1/survival`, `/doors`, `/failover`)
LLM crawler	https://aziel-runtime.vibelock.workers.dev/llms.txt (also `/ai.txt`)
Human help	https://aziel-runtime.vibelock.workers.dev/help.txt · `/addendum.txt` · `/help/softwares.txt` · `/help/fraggate.txt` · `/help/glama.txt`
Person (machine)	https://aziel-runtime.vibelock.workers.dev/person.jsonld
Who-is (machine)	https://aziel-runtime.vibelock.workers.dev/who-is
robots.txt	https://aziel-runtime.vibelock.workers.dev/robots.txt
sitemap.xml	https://aziel-runtime.vibelock.workers.dev/sitemap.xml
sitemap-index.xml	https://aziel-runtime.vibelock.workers.dev/sitemap-index.xml
MCP (JSON-RPC over HTTP, public, no OAuth)	`POST` https://aziel-runtime.vibelock.workers.dev/mcp
MCP stdio (Glama / Claude Desktop)	`node cli/mcp-stdio.mjs` — docs/GLAMA.md
Glama listing	https://glama.ai/mcp/servers/AzielEliab/aziel-runtime
Health	https://aziel-runtime.vibelock.workers.dev/v1/health
API uses (no increment, no PII)	https://aziel-runtime.vibelock.workers.dev/v1/uses
Stats / awareness rollup (read-only)	https://aziel-runtime.vibelock.workers.dev/v1/stats-rollups
Ready	https://aziel-runtime.vibelock.workers.dev/v1/ready
Rose-star brand mark	https://aziel-runtime.vibelock.workers.dev/sigil.png

GET /v1/pull?all=1 is an alias of /v1/bundle.

POST /p/{product}/{op} proxies to the product Worker /v1/{op} with the JSON body. Service bindings are preferred; public *.vibelock.workers.dev is the fallback. That path is a proxy, not session exec. Download counters are not incremented.

This Worker is Worker-only (no counted runtime tarball). The local CLI lives in-repo and is not a GitBaby /download package. Each product still has its own counted /download.

How to cite: Eliab, Aziel. (2026). Aziel Eliab Runtime [Software]. Apache-2.0. https://aziel-runtime.vibelock.workers.dev/

Digital Library: Eliab, Aziel. (2026). Aziel Digital Library [Software]. Apache-2.0. https://www.azielcorpuslibrary.net/

Product Worker crawl template: docs/PRODUCT_SEO.md. QNM suite rollup: docs/NODE_MESH.md. Cross-network survival umbrella: docs/designs/CROSS-NETWORK-SURVIVAL-1.0.md. Companion NO-LIE / NO-REWRITE: docs/designs/NO-LIE-NO-REWRITE-1.0.md. Donate plan (cite-only, not a Softwares product): docs/designs/AZL-DONATE-1.0.md.

Canonical rails live on hubs: https://www.azieleliab.com/donate. Hub Donate pages include five QRs that encode payment URIs (BTC / ETH / LTC / XRP / DOGE). This runtime only links. Do not invent wallet addresses or tokens. Do not duplicate those five QRs on runtime or download-trackers.

Runtime Worker UI footer — one line: Donate → https://www.azieleliab.com/donate
Product download-tracker Workers — same footer pattern: Support the work → https://www.azieleliab.com/donate

This repo does not own product Workers. Copy that one line into those repos. Addresses stay operator paste on the hub.

Designs

Current suite software designs (AZL / SEC-FEAT / QNM-WP / NODE-OPS / AZL-DONATE-1.0 / CROSS-NETWORK-SURVIVAL-1.0 / NO-LIE-NO-REWRITE-1.0) plus LIVE fabric papers (CL-WP-0.4, AP-WP-0.2, SG-WP-0.1, LS-WP-0.1, RL-WP-0.1-runtime, QNS-CD-1.0, ACT-RECEIPT-1.0 — not Softwares-tab products): docs/designs/. Author: Aziel Eliab only. MCP chainlock_*. GET /v1/mesh never enables. QNS-CD-1.0 is the Quantum Node Signal packet-transfer coding design (photon QNS1 1.3). Implementation is local qnsd in AzielEliab/qnm-node. GET /v1/qns cites only — the public Worker does not proxy local via emit. Every /v1/software card carries qns_cd. Do not add QNS as a Softwares-tab product. ACT-RECEIPT-1.0 is the public four-field action-receipt mesh copy. The chain lives on corpus /receipts. GET /v1/receipts cites; append runs after FragGate list/call and POST /mcp when RECEIPT_APPEND_TOKEN is set (fail-open). Do not add ACT-RECEIPT as a Softwares-tab product. CROSS-NETWORK-SURVIVAL-1.0 is the umbrella survival law. If network and data die tomorrow, the chain survives on cold shelves (hosts / DOI / git / vault). Machine tip: /cite.json survival.tip and /llms.txt. Do not add it as a Softwares-tab product. NO-LIE-NO-REWRITE-1.0 is companion law under that umbrella (does not replace the machine tip): receipts that still hash; copies not all on one tunnel; no rewrite key; the network is never allowed to lie even to self-preserve. Do not add it as a Softwares-tab product. GET /v1/azpipe/arch cites the locked MASTER-33 strip (same payload as GET /v1/fraggate pipeline). Not a Softwares-tab door.

Add to ChatGPT (GPT Actions)

Create a GPT (or open GPT Actions).
Import from URL → https://aziel-runtime.vibelock.workers.dev/openapi.json
No authentication. CORS *.
Ask the GPT to call Softwares (tools/list name Softwares). The door runs first. ChainLock, TemporalLock, and ForgeReceipts stamp when the call needs a ledger. Named live modules: decisiongate_check, library_lookup. Diagnostics: fraggate_list, then fraggate_call. Session tools and runtime_run are advanced/internal.

Add to Grok

Custom tool / OpenAPI: import https://aziel-runtime.vibelock.workers.dev/openapi.json
MCP remote: POST https://aziel-runtime.vibelock.workers.dev/mcp
Methods: initialize, tools/list, tools/call.
tools/list is 36 live tools. First call: Softwares (tools/list name Softwares). The door runs first. ChainLock, TemporalLock, and ForgeReceipts stamp when the call needs a ledger. Diagnostics: fraggate_list → fraggate_describe → fraggate_call.
runtime_run, runtime_manifest, and runtime_session_* are advanced/internal.
HTTP /p/{product}/{op} stays a proxy. Public, no OAuth.
Tool results are { display, result, ledger_tip? } — show display to the user.

Add to Claude Desktop

Public connect is Streamable HTTP, no API key:

text

https://aziel-runtime.vibelock.workers.dev/mcp

Local stdio is the dev path after that remote URL. Claude Desktop claude_desktop_config.json (same shape as Cursor mcp.json):

json

{
  "mcpServers": {
    "aziel-runtime": {
      "command": "node",
      "args": ["cli/mcp-stdio.mjs"],
      "cwd": "/path/to/aziel-runtime",
      "env": {
        "AZIEL_RUNTIME_URL": "https://aziel-runtime.vibelock.workers.dev"
      }
    }
  }
}

Restart Claude Desktop after updating the local config. Full client recipes: docs/AGENTS.md. Full stdio notes: docs/GLAMA.md.

Add to Glama

Public remote URL first. Glama hosted meters stay separate from Worker GET /v1/uses. Local stdio last.

Remote MCP — POST https://aziel-runtime.vibelock.workers.dev/mcp (initialize, tools/list, tools/call). User-Agent Mozilla/5.0. Public, no OAuth. Transport: Streamable HTTP.
Install Server (optional) — Try on Glama (also https://glama.ai/mcp/servers/@AzielEliab/aziel-runtime). One-click Install Server / Deploy. Glama release 2.0.7. Install Server ON. Auto-Release ON. Worker / server package stays 2.0.0-rc1. Hosted-tool meters are Glama's, not Worker /v1/uses.
Local stdio (last) — cli/mcp-stdio.mjs bridges to that same Worker /mcp. glama.json + Dockerfile CMD ["node", "cli/mcp-stdio.mjs"].

bash

node cli/mcp-stdio.mjs
npm run mcp
docker build -t aziel-runtime-mcp .
docker run --rm -i aziel-runtime-mcp
# if the host resolver cannot see Cloudflare:
# docker run --rm -i --dns 1.1.1.1 aziel-runtime-mcp

Default bridge needs outbound DNS + HTTPS to *.vibelock.workers.dev / Cloudflare. A DNS miss is FG-DNS (remote:false). --local or AZIEL_RUNTIME_MCP=local is explicit in-process. Optional RUNTIME_TOKEN / AZIEL_RUNTIME_TOKEN when REQUIRE_TOKEN=1. Verify a real call hash: docs/2.0/INSPECT.md.

First call after connect: Softwares (pick a slug) → fraggate_call → library_lookup for library papers and cites. FragGate stays the single exec door. Diagnostics: fraggate_list → fraggate_describe → fraggate_call. Example: { "slug": "foldlock", "op": "fold-preview", "payload": { "text": "the cat and the dog" } }, or decisiongate_check with dry_run=true. tools/list is 36 live tools. ChainLock and memory are append-only.

Re-claim on the Glama Score tab after any glama.json change (maintainers = AzielEliab) so Schema and keywords refresh. Full steps: docs/GLAMA.md. Public identity: Aziel Eliab only.

Add to Venice

Custom HTTP tools / OpenAPI: import the same https://aziel-runtime.vibelock.workers.dev/openapi.json. Pull via GET /v1/bundle / GET /v1/pull/{slug}. Session exec is POST /v1/session/{id}/exec. Proxy remains POST /p/{slug}/{op}.

Honesty banners

Every catalog Software slug is in-process. engine_slugs equals true_engine_slugs on /v1/health and /v1/runtime.json. Binding-only ops stay per-op proxy_fallback.
GodLock and MirageGrid are not VPNs and not anonymity networks. MirageGrid Cap-7 is a mesh-name factory and is not a public ICANN registrar. Cap-7 geo, sticky session, and land rotation are LIVE on the Cap-7 plane (region label, sticky mesh node and factory land, land rotate among 7 sites), not a public egress IP, not a residential IP, and not AZVPN. The public MirageGrid Worker Cap-7 control plane is LIVE at https://miragegrid.vibelock.workers.dev/v1/egress and https://miragegrid.vibelock.workers.dev/v1/planned. AZVPN stays the suite VPN concentrator.
ForgeReceipts is not legal advice and does not contact courts.
ZionPattern Solver never claims more than 75% confidence. It does not solve cases.
VeilLock does not inject into FaceTime or any calling app. YOUR camera/screen only.
AZ-CLCE detects inconsistency, not intent. Type D is a label, not a finding of malice.
ChronoLock is advisory only — not a scheduler, not targeting, not virality. 08:30–10:30 local. Distinct from TemporalLock.
The ARK is not a kernel. Hosted API never unlocks or encrypts with a passphrase and never stores vaults. Sweep is Mode E heuristics only.
AZAI is a standalone local core with an OpenAI-compatible API, not a new foundation model and not an Ollama identity. Ollama is optional SLOT. Hosted / in-process /v1 is a protocol mirror + Lamb check (Service → Clarity → Peace), not a provider proxy. Jeeves is not sovereign.
SpectralLock 0.3.1 hosted overlay is a 256px preview, not a spectrometer, not forensic. Wheel paint is a membership-tint plane separate from the spectral triad. Inject ON is paint, not pigment recovery. Restore lost pigment is LIVE on FragGate ops pigment and restore-pigment (listPigment / pigmentFromB64) and refuses SL-PIGMENT-GONE when the faded signal is gone. AMOE is not a live product. Leftover-bytes recover is honest (present container bytes only); incremental PDF revision graphs + per-revision copies are honest; opaque refuse is honest; universal recover marks 7z / HEIC / HEIF SLOT; handwriting is a 256px PNG ink-scan heuristic (not ESDA / court cert; hosted JPEG SLOT); never OCR-from-black-box. Unredact / recover / handwriting stay on spectrallock-download-tracker (/v1/unredact, /v1/recover, /v1/handwriting) — not FragGate door ops. UV is not a lamp. Balance/lemon/indent never invent marks. Full pipeline is the Python package.
EmployeeLock is not a court, not UL, not a truth score. Hosted never stores xlsx. Demo rows are format proof, not case facts.
FoldLock is not zip. Hosted / in-process preview is tether-suppression on small UTF-8 text. Ratios are receipts, not trophies. Short strings can grow.
WhistleLock is a local vault + dead-man copy. Not a mailer. Hosted never holds whistle files.
TrajectoryLock is a research prototype / auditable geometric test. Not a certified forensic instrument. Hosted never stores media. Match probability is P(match | declared model), not P(official account is true). Synthetic examples are not real-case findings.
M.I.A.Lock Doe hits are compatibility leads only — never an ID. Coverage heat is not presence. No live tracking.
Aziel Corpus Library is a public library index + counted PDF/package download. Not a private-file search engine, not Zenodo, not a new Lock engine.
AzielTether is not a VPN. Prefer-central mesh for downloaded Aziel Eliab software; public HTTPS stays mesh-free.
PeaceLock is chosen silence / chosen inaction as a first-class receipt (PL-WP-0.1). Not a transcript, not a counterfactual, not a motive score, not a HARD_DUTY waiver. Hosted never invents speech or stores files.
4DMap is a four-axis inspection frame T/Δ/Γ/Π (4DM-WP-1.0). Not a sequential gate, not a truth score, not a Lumen panel, and not an extra door (domains_are_doors:false). Does not invent marks or backdate class. Inspection frame after AZPIPE. FragGate claims cite join types. ChainLock may stamp walks.
AZBrowser is the Lamb Lens ethical research browser (AZB-1.0). Not Chromium, not a Tor exit, not an unrestricted proxy. Lamb Lens cites; refuses harmful harvest; never invents visit results. FragGate only. AZNet is separate software (same FragGate door) — pairing is order/token only, not a shared Phase-1 UI.
AZNet is a silent verification side-net (AZN-WP-0.1). Separate product (own Worker aznet-download-tracker, own UI). Not a payload host. Garden / stamp / memorial ops require AZBrowser pair_token AND pair_flag (functional order only). Hosted never stores payloads.

Product slugs → Workers

slug	Worker hostname	example ops	session exec
vibelock	vibelock-download-tracker	analyze	in-process (features/PCM; no live mic)
veillock	veillock-download-tracker	apps	in-process (no camera inject)
codelock	codelock-download-tracker	render	in-process
godlock	godlock-download-tracker	score, submit	in-process (not a VPN)
shadowlock	shadowlock-download-tracker	observe	in-process (no OS hook)
temporallock	temporallock-download-tracker	genesis, append, verify	in-process
forgereceipts	forgereceipts-download-tracker	receipt	in-process (not legal advice)
decisiongate	decisiongate-download-tracker	check	in-process
zsolver	zsolver-download-tracker	patterns, score, session	in-process
azos	azos-download-tracker	status	in-process (session/exec/lattice per-op proxy)
glossafilter	glossafilter-download-tracker	render	in-process
miragegrid	miragegrid-download-tracker	assign	in-process (control-plane assign + Cap-7 mesh-name metadata; factory is not a public ICANN registrar; not a hosted VPN hop; Cap-7 geo/sticky/rotate LIVE on the Cap-7 plane, not a public egress IP)
staticclock	staticclock-download-tracker	advise	in-process
chronolock	chronolock-download-tracker	advisory, anchors	in-process
postking	postking-download-tracker	new, move, status	in-process
azclce	azclce-download-tracker	score, classify, gate	in-process
ark	ark-download-tracker	sweep, levels	in-process
azai	azai-download-tracker	health, lamb-check	in-process (Lamb only; not the blend)
spectrallock	spectrallock-download-tracker	health, modes, overlay	in-process (256px PNG preview; inject ON/OFF; leftover-bytes + revision-graph + recover/handwriting honesty; no unredact/recover/handwriting door)
azbot	azbot-download-tracker	health, skill, route	in-process (skill router, not a model)
employeelock	employeelock-download-tracker	health, append-preview, verify-canonical, skill	in-process (no xlsx store)
foldlock	foldlock-download-tracker	health, fold-preview, unfold-preview, skill	in-process
whistlelock	whistlelock-download-tracker	health, hash-preview, canon-preview, skill	in-process (no file store)
trajectorylock	trajectorylock-download-tracker	health, example, analyze, skill	in-process (geometry; no media store)
mialock	mialock-download-tracker	map, search-options, queries, doe-match, coverage	in-process (leads ≠ ID)
azieltether	azieltether-download-tracker	health, skill, verify	in-process (not a VPN)
peacelock	peacelock-download-tracker	open, seal, break, show, verify, stamp	in-process (HARD_DUTY refuse; ABSENT invariants)
azmail	azmail-download-tracker	airlock_classify, scrub, trust_score, mesh_, keyword_alert_	in-process (FragGate only; mesh default off; not an MTA)
azbrowser	azbrowser-download-tracker	ethical_search, lamb_lens_search, navigate, airlock_ingest, tab_*, receipt_list, verify	in-process (FragGate only; Lamb Lens; not Chromium)
aznet	aznet-download-tracker	pair_status, garden_list, stamp, verify_hash, memorial_*, receipt_verify	in-process (FragGate only; never hosts payloads; AZBrowser pair required)
azhub	azhub-download-tracker	region_list, place_module, remove_module, tether_*, blank_key_status	in-process (FragGate only; Blank Key; not AZInterface; no auto-unlock)
azinterface	azinterface-download-tracker	genesis_status, site_state_*, integrity_check, witness_list, page_cycle_status	in-process (FragGate only; suite shell, package 0.1.0; pre-locked page cycles; local pipeline_arch / withdraw / scorch_local / pair_* stay off the public door)
aziel-corpus	aziel-corpus-download-tracker (www.azielcorpuslibrary.net)	health, search, example, skill	in-process (sample MASTER; live D1/Whisper/OCR per-op proxy)
4dmap	4dmap-download-tracker	health, skill, pin, span, stack, gap, fork, walk, lens, class, cohort, absence, cap, join, list, example, card_new, card_pin, card_span, card_join, card_walk, card_list, verify_hash, frame_status, axis_describe, walk_trace, card_export, card_import, verify_chain, neighbor_cite, memory_cite, memory_observe, library_pin, plot, possibility, pattern_recall, lattice_tip, poison_refuse	in-process (4DM-WP-1.0 / 0.3.0; inspection frame after AZPIPE; not an extra door; not a sequential gate)

Catalog aliases (also accepted on /v1/pull/{slug}): az-clce → azclce, zion-pattern-solver → zsolver, postking-chess → postking, aziel-digital-library → aziel-corpus, mia-lock → mialock, peace-lock → peacelock, az-mail / app-1.0 → azmail, az-browser / lamb-lens → azbrowser, az-net / azn-wp-0.1 → aznet, az-hub / blank-key → azhub, az-interface / page-cycle → azinterface. aznet is not an AZBrowser alias — AZNet is separate software (same FragGate door). fourdmap / 4d-map / 4dm-wp-1.0 → 4dmap. AZHub and AZInterface are sibling softwares under the same FragGate door (never aliases of each other).

Software hubs (corpus / godlock.uk / azieleliab) list catalog products[] after merge: slug azhub / azinterface / aznet / azbrowser, workers azhub-download-tracker / azinterface-download-tracker / aznet-download-tracker / azbrowser-download-tracker, github https://github.com/AzielEliab/azhub · https://github.com/AzielEliab/azinterface · https://github.com/AzielEliab/aznet · https://github.com/AzielEliab/azbrowser. AZHub, AZInterface, AZNet, and AZBrowser are separate products (own Workers, own UIs; never nested). Pairing AZNet with AZBrowser is functional order only. FragGate itself is not a 34th true-engine product. Hubs already show its GitHub; this runtime also publishes a catalog-friendly kernel card at catalog.json extras[] / fraggate (slug: "fraggate", kind: "kernel", github: "https://github.com/AzielEliab/fraggate", worker: "fraggate-download-tracker", engine: false). FragGate is the kernel door; human UI + counted download is the separate FragGate Worker app (not nested in AZBrowser, AZHub, or AZInterface): https://fraggate-download-tracker.vibelock.workers.dev/

If a sibling /v1 API is not live yet, the proxy returns that Worker's response (often 404 JSON) and the combined OpenAPI still lists the expected path. GET /v1/pull/{slug}/skill falls back to a catalog-built skill so an AI can still invoke.

Vendored engine artifacts live under src/engines/. engine_digest is SHA-256 of those file bytes (sorted path order). Recompute with node scripts/hash-engines.mjs --write.

Deploy

bash

npx wrangler deploy

Account ac575a9b822bea2bed97d0ab73aed238. workers.dev aziel-runtime.vibelock.workers.dev. Product download KV stays on each product Worker. This runtime's USES namespace is the API use counter and ring log (GET /v1/uses) — no Authorization, tokens, bodies, or PII. Production KV ids in wrangler.toml: USES c1f89ba6f1db47328d36379cdd69b7ab, AZMAIL_MESH ce81cecf8b75412fb7b56e1119e017da, AZBROWSER_TABS 7487aba1bbb5417fb668de86d8b48f37. Do not create replacement namespaces.

Same-origin doors (/runtime on azielcorpuslibrary.net, godlock.uk, www.azieleliab.com) should set X-Aziel-Runtime-Via or X-Aziel-Runtime-Host (origin, azieleliab.com, godlock.uk, azielcorpuslibrary.net) so host counters stay distinct.

1.2.0+ requires Durable Object migration tag v1 (RuntimeSession, SQLite). The first deploy after the session cut creates the SESSION binding. 1.4.0 does not need a new DO migration — engines run in the same isolate. 1.4.1 reuses that SESSION class. 1.5.0, 1.6.0, 1.6.1, 1.6.2, 1.6.3, 1.6.4, 1.6.5, 1.6.6, 1.6.7, 1.6.8, 1.6.9, 1.6.10, 1.6.11, 1.6.12, 1.6.13, 1.6.14, 1.6.15, and 1.7.0 do not need a new DO migration.

Optional production token (session mutate only — catalog / health / runtime / skill / pull stay public):

toml

# wrangler.toml
# [vars]
# REQUIRE_TOKEN = "1"

bash

npx wrangler secret put RUNTIME_TOKEN
npx wrangler deploy
node scripts/probe-live.mjs

If RUNTIME_TOKEN is unset and REQUIRE_TOKEN is not 1, sessions stay open (dev). If the secret is set, POST /v1/session/open|policy|exec|close requires Authorization: Bearer … or X-Aziel-Runtime-Token. GET /v1/ready is 200 only when the SESSION Durable Object binding is up, and 503 when REQUIRE_TOKEN=1 and the secret is missing. Authority JSON (/v1/health, /v1/ready, /v1/runtime.json, /v1/catalog.json) is Cache-Control: no-store. Receipts cap at 64. Sessions expire after 6h. Per-IP: 20 opens / minute, 60 execs / minute (HTTP 429 JSON).

Push to main runs .github/workflows/deploy.yml (npx wrangler deploy --keep-vars --var GIT_SHA:<sha>) only when repo secret CLOUDFLARE_API_TOKEN is set. Missing token skips the job (does not fail). --keep-vars leaves existing Worker vars in place. Primary deploy is Cursor/wrangler OAuth (Aziel Eliab). Account ac575a9b822bea2bed97d0ab73aed238 is the non-secret default. Do not put tokens in the repo. workflow_dispatch is also enabled. The Action passes GIT_SHA so /v1/software can stamp git_sha.

/llms.txt version_id is the Cloudflare Worker version id from the CF_VERSION_METADATA binding (wrangler.toml [version_metadata]), read when the response is served. It is not a UUID stored in this repo. An isolate without that binding, and without VERSION_ID, publishes version_id: null. Box deploy (OAuth wrangler, no API token in the environment):

bash

env -u CLOUDFLARE_API_TOKEN npx wrangler deploy --keep-vars --var GIT_SHA:$(git rev-parse HEAD)

Add --var VERSION_ID:<worker-version-id> only when that id is already known. Do not invent one. When the binding is present it wins over VERSION_ID.

If this checkout has no wrangler credentials, deploy from the author's machine:

bash

npx wrangler secret put RUNTIME_TOKEN
npx wrangler deploy
node scripts/probe-live.mjs
# confirm GET /v1/health and /v1/ready and /v1/runtime.json version=1.7.0 role=engine-runtime door=fraggate
# confirm GET /v1/uses returns uses / by_host / by_path / by_day / recent (no increment)
# confirm engine_slugs == true_engine_slugs == all 36 catalog slugs
# confirm POST /v1/session/open → policy → exec each primary op → receipt has engine_digest + ran_in

Library `/runtime` mirror

https://www.azielcorpuslibrary.net/runtime is the Aziel Digital Library reverse-proxy / mirror of this Worker. Primary public host / discovery is Try on Glama. The corpus Worker advertises and reverse-proxies:

GET https://www.azielcorpuslibrary.net/runtime — library mirror
GET https://www.azielcorpuslibrary.net/runtime/v1/skill → this /v1/skill
GET https://www.azielcorpuslibrary.net/runtime/v1/runtime.json → this /v1/runtime.json
GET https://www.azielcorpuslibrary.net/runtime/v1/software → this /v1/software
GET https://www.azielcorpuslibrary.net/runtime/v1/update/check?slug={slug}&version={installed} → this /v1/update/check?slug={slug}&version={installed} (slug required)
GET https://www.azielcorpuslibrary.net/runtime/v1/bundle → this /v1/bundle
GET https://www.azielcorpuslibrary.net/runtime/v1/pull/{slug} → this /v1/pull/{slug}
POST https://www.azielcorpuslibrary.net/runtime/v1/session/open → this session object
GET https://www.azielcorpuslibrary.net/runtime/v1/uses → this /v1/uses (set X-Aziel-Runtime-Via: azielcorpuslibrary.net)
POST https://www.azielcorpuslibrary.net/runtime/v1/fraggate/call → this FragGate door (AZMail and every live slug; no side door)

See the companion PR on AzielEliab/aziel-corpus.

Network security claims (AZP-NS-1.0)

The protocol modules under src/security/, src/transport/, src/checkpoints/, and src/replication/ are specified in docs/designs/AZP-NS-1.0.md.

Records are tamper-evident: hash-linked and signed. Independent replication is fixture-tested. This is not a claim of immutability.

Payloads are privacy-preserving: encrypted end to end, with node identity separated from session identity. This is not anonymity.

Checkpoints are survivable and federated in the fixture model. This is not an unkillable network.

Relays are untrusted transport. They cannot decrypt payloads. That design rule is not a production zero-trust certification.

Cap-7 is not public ICANN and is not a public egress IP. Mirage is not AZVPN. aznet_replaces_internet is false. Tor, UDP, radio, and sandbox bearers are refused and are not LIVE. Softwares stay 42. tools/list stays 36. Live multi-provider recovery and Plane B Framagit are operator work, not a result of these scripts.

License

Install

Tools (36)

runtime_skillfraggate_listfraggate_describefraggate_verifyfraggate_calldecisiongate_checklibrary_lookupmesh_status

Remote endpoint

Streamable HTTP

Hosted server - connect over the network, no local install.

url

https://aziel-runtime.vibelock.workers.dev/mcp

Add to VS Code Add to Cursor

claude_desktop_config.json

json

{
  "mcpServers": {
    "aziel-runtime": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://aziel-runtime.vibelock.workers.dev/mcp"
      ]
    }
  }
}

Desktop config is stdio-only; this bridges via mcp-remote. Native remote: Settings > Connectors.

io.github.AzielEliab/aziel-runtime (MCP) Server

🛠️ Key Features

🚀 Use Cases

⚡ Developer Benefits

⚠️ Limitations

Topics

runtime_skill

fraggate_list

fraggate_describe

fraggate_verify

fraggate_call

decisiongate_check

library_lookup

mesh_status

mesh_enable

mesh_disable

mesh_join

mesh_heartbeat

mesh_leave

mesh_nodes

mesh_broadcast

chainlock_append

chainlock_tip

chainlock_recall

chainlock_verify

chainlock_seal

memory_observe

memory_resolve

memory_calibrate

memory_recall

memory_get

runtime_software

runtime_bundle

runtime_pull

runtime_run

runtime_manifest

runtime_session_open

runtime_session_policy

runtime_session_exec

runtime_session_receipt

runtime_session_receipts

runtime_session_close

aziel-runtime

Install (remote first)

Access

First tools

How to use

Designed purpose

Start

Inspect the code (not the crawler files)

Compatible AI clients

Websites / Live sites

Dual surface (product law)

Cold multi-shelf (COLD-MULTI-SHELF-1.0)

Home origin (ORIGIN-CUTOVER-1.0)

Cap-7 semantic bridge (not ICANN)

FragGate door

Session (the actual cut)

Front doors (still useful — not exec)

Quick URLs

Donate (runtime + product Worker footer)

Designs

Add to ChatGPT (GPT Actions)

Add to Grok

Add to Claude Desktop

Add to Glama

Add to Venice

Honesty banners

Product slugs → Workers

Deploy

Library /runtime mirror

Network security claims (AZP-NS-1.0)

License

Install

Remote endpoint

Related servers

Library `/runtime` mirror