Expose AgentRequestContext (host/session/principal) to RSC operation handlers

[ScriptedAlchemy]

Summary

Wave 1 (#113 / parent #95) installs a full AgentRequestContext in runAgentRequest and exposes await agent() from the same ALS store, but RSC operation handlers still receive only { signal } on operation.execute. MCP wiring forwards native sessionId into the request store yet never supplies host identity; CLI marks host unavailable('unsupported-surface'). Plugin authors therefore cannot rely on transport-observed host/session in handler code or in structured audit fields without re-declaring identity in tool JSON.

This is a focused wiring/API slice on top of #95 (typed request context). It should be proven by the generated harness in #103, consumed by Workbench/event surfaces in #105, and guarded against source→installed drift in #218.

Evidence (current main-line behavior)

RscOperationContext exposes only signal:

// packages/rsc-runtime/src/operation.ts:6-8
export interface RscOperationContext {
  readonly signal: AbortSignal;
}

AgentRequestContext already carries observed host/session/actor/workspace:

// packages/rsc-runtime/src/agent-request.ts:128-137
export interface AgentRequestContext {
  readonly invocation: AgentInvocation;
  readonly host: Observed<AgentHostIdentity>;
  readonly session: Observed<AgentSessionIdentity>;
  readonly actor: Observed<AgentActorIdentity>;
  readonly workspace: Observed<AgentWorkspaceIdentity>;
  readonly capabilities: AgentRequestCapabilities;
  readonly progress: AgentProgressReporter;
  readonly signal: AbortSignal;
  readonly services: AgentServiceRegistry;
  readonly providers: AgentProviderValues;
  // ...
}

MCP: session from native context, but execute gets { signal } only — no host:

// packages/rsc-runtime/src/mcp-server.ts (tool handler)
async (input, context) => runAgentRequest({
  ...(context.http?.authInfo?.clientId === undefined
    ? {}
    : { actor: available({ id: context.http.authInfo.clientId }, 'native') }),
  invocation: { kind: 'tool', operationId: operation.id, surface: mcp.name },
  ...(typeof context.sessionId === 'string' && context.sessionId.trim() !== ''
    ? { session: available({ sessionId: context.sessionId }, 'native') }
    : {}),
  signal: context.mcpReq.signal,
}, async () => {
  const result = await operation.execute(input, { signal: context.mcpReq.signal });
  // ...
});

CLI: host explicitly unavailable:

// packages/rsc-runtime/src/cli.ts:44-45 (representative)
host: unavailable('unsupported-surface'),
// ...
async () => operation.execute(cli.parse(commandArguments), { signal })

Real-world impact (cargo-conductor)

In cargo-conductor, ledger rows cc-800 and cc-803 recorded session plan40-stage3-sol but host NULL, rendering UI as ? · plan40-stage3-sol. The conductor_request tool input had to ask agents to manually supply host/session in JSON. Transport already knew session (MCP native); host should be observed from adapter/plugin/client metadata where knowable. Plugins should not force callers to re-declare transport identity in business input.

Requested design

1. Extend RscOperationContext with the request-bound AgentRequestContext, or at minimum the observed host / session / actor / workspace / invocation fields, sourced from the same ALS store used by agent() during runAgentRequest (no second, divergent snapshot).

2. Populate MCP observed host from host adapter / plugin manifest / MCP client metadata where knowable (e.g. Cursor, Claude Code, Codex, Workbench dev proxy). Preserve unavailable with typed reason when not knowable — never fabricate placeholders.

3. CLI, Workbench, and semantic event routes should receive honest observed identities (derived or native as appropriate), not blanket unsupported-surface where the framework can observe more.

4. Generated test harness acceptance (#103):

   • Native MCP session (and host when adapter provides it) reaches operation.execute context (or await agent() parity).
   • Explicit user/tool input cannot spoof or override transport-observed identity unless route policy explicitly allows override.
   • unavailable remains typed with provenance/reason in assertions.

5. API shape: prefer a principal/context argument separate from operation business input (second parameter to execute, or documented await agent()) rather than auto-injecting host/session fields into the Zod input schema — keeps validation boundaries clear and prevents agents from forging transport identity via JSON.

Non-goals

• Replacing #95 provider discovery/typegen work.
• Inferring parent/subagent topology without host contract evidence (#95 non-goals).

Acceptance criteria

• operation.execute(input, ctx) (or equivalent) exposes the same observed identities available via await agent() for that invocation.
• MCP tool calls populate session and host (when knowable) without requiring duplicate fields in tool input.
• CLI/Workbench/event entrypoints document and test their host/session provenance.
• Harness tests cover spoof resistance and typed unavailable.
• cargo-conductor-style ledger/audit can use handler context instead of manual host/session args.

Stack links

• Builds on: #95, #94
• Proof: #103, #218
• Surfaces: #105, #102

[ScriptedAlchemy]

The handler-context slice landed in #273 (merge 074c87c).

Delivered against the acceptance criteria

• operation.execute(input, ctx) now exposes the request context: RscOperationContext gains optional readonly request?: AgentRequestContext, resolved by the defineOperation wrapper from the same ALS store agent() uses — the handler observes the identical handle (ctx.request === await agent(), proven by test), never a second snapshot. Additive: single-argument handlers and direct execute(input, { signal }) callers are unchanged; outside runAgentRequest the field is honestly absent.
• The rsc-runtime MCP server now populates host from the negotiated client identity (getClientVersion().name, source native) beside the existing native sessionId session and authInfo.clientId actor — no duplicate fields in tool input, proven over the real SDK wire pair.
• Spoof resistance + typed unavailable are covered at every proof level: wire test (input carrying host/session lookalikes cannot alter observed axes), route-unit (renderRoute context injection seam documented + tested via the new tool:harness/context fixture), mcp-in-memory projection (asserts the axes the level actually installs — all typed not-provided), and generated-server integration.
• CLI provenance is now tested (derived cwd workspace, unavailable('unsupported-surface') host); route components keep the sanctioned await agent() path (the route graph retired the execute/render split via AB4811), now documented on ToolRouteProps/CliRouteProps/AgentEventRouteProps and in docs/entry-conventions.md.

Honest findings encoded as assertions (remaining scope — leaving this open)

• Generated MCP tool scopes forward no host/session/workspace into the Flight worker (stdio supplies no native session), so generated tool handlers observe all identity axes as typed unavailable('not-provided'). The generated event scopes do mount native host/session/workspace. Populating tool-scope identity from adapter/plugin/client metadata (design item 2 for the generated server) is the main remaining wiring.
• Generated event scopes mount no actor principal (per the finding recorded on Track remaining #98 state-kernel scope: warm-runtime process state, generated-runtime state mounting, budgets, lifetime visibility #233 from the Add a worktree-proximity reference application #104 journey suite); the contract types it absent rather than fabricating. Actor derivation stays follow-up lineage on Track remaining #98 state-kernel scope: warm-runtime process state, generated-runtime state mounting, budgets, lifetime visibility #233.
• Workbench entrypoint provenance remains undocumented/untested (acceptance item 3, Workbench portion).

cargo-conductor-style handlers on the operations model can now read ctx.request.host/.session directly instead of asking callers to re-declare identity in tool JSON; conventional generated tools get the same the moment tool-scope forwarding lands.

[ScriptedAlchemy]

The generated tool-scope transport slice landed in #276 (squash 69c20ab8b), completing the remainder recorded in the #273 delivery note.

Delivered

• Generated MCP tool, resource, and prompt request scopes now observe transport identity and forward it into the Flight worker (the forwarding seam already existed; the host-scope installation was the gap): host from the negotiated client identity (getClientVersion().name, native, resolved per request), session from native sessionId where the transport supplies one, actor from authInfo.clientId where present, workspace derived from the server process cwd — the established CLI derivation. Sources stay faithful (native vs derived) and axes the transport genuinely lacks stay typed unavailable('not-provided'): bare stdio supplies neither sessionId nor authInfo, so session and actor remain honestly absent there.
• The in-memory projection level now mirrors the Flight-worker boundary (host-scope axes forwarded into the render scope, harness context seam still winning), so mcp-in-memory proofs stay faithful to the artifact.
• Assertions flipped from honest absence to the positive contract at three proof levels: generated-server integration (inspect: native host + derived workspace, stdio session/actor honestly absent), mcp-in-memory (tool:harness/context, now also proving lookalike host/session business-input fields cannot alter observed axes), and the packed journey (context axes asserted inside the existing packed session — native agent-bundle-packed-proof host, derived project-cwd workspace, typed-absent session/actor). Also repaired the packed listTools expectations left stale by the feat(runtime): expose typed request context to operation handlers and the test harness (#223) #273 context and feat(cli): project MCP tools into the routed CLI via routes.mcpCommands (#102 stage 4) #275 mutation-probe fixture additions.
• docs/entry-conventions.md now records the generated MCP request-scope provenance contract.

Acceptance ledger after this slice

• ✅ operation.execute(input, ctx) parity with await agent() (feat(runtime): expose typed request context to operation handlers and the test harness (#223) #273)
• ✅ MCP tool calls populate session and host without duplicate tool-input fields — rsc-runtime server (feat(runtime): expose typed request context to operation handlers and the test harness (#223) #273) and generated server (feat(runtime): thread transport-observed identity into generated MCP tool scopes (#223) #276)
• ✅ Harness spoof resistance + typed unavailable (feat(runtime): expose typed request context to operation handlers and the test harness (#223) #273, extended to the generated runtime in feat(runtime): thread transport-observed identity into generated MCP tool scopes (#223) #276)
• ✅ cargo-conductor-style handlers read ctx.request.host/.session (or await agent() in conventional routes) instead of manual identity args
• ⬜ Remaining: Workbench entrypoint provenance (acceptance item 3, Workbench portion) — undocumented and untested; this is the only open item this issue still owns. Event-scope actor mounting stays follow-up lineage on Track remaining #98 state-kernel scope: warm-runtime process state, generated-runtime state mounting, budgets, lifetime visibility #233/Workbench state-lifetime catalog display and runtime-instance identity introspection (#98 visibility remainder) #269 as previously recorded.

Leaving this open scoped to the Workbench provenance remainder.

Note for whoever picks up the packed pool: the packed journey's later requestEventRuntime IPC step fails identically on unchanged main (reproduced via A/B with only the stale listTools repair applied) — pre-existing, unrelated to #276, and invisible to per-PR CI since the packed pool is not a PR gate.

[ScriptedAlchemy]

Follow-up to #223 (comment): the packed-pool drift is fixed and merged in #280 (9b7f4e27d5b649a436c630b90ff26a5e16352788).

Root causes were cumulative: #273 put the handler-context actor probe into the strict native event result value, so the live requestEventRuntime call reached the server but failed projection with an unrecognized actor key; #268/#255 made the public JS/declaration closure require the optional runtime peer; and #279, which landed during the repair, pulled React-backed event rendering into the public API import path.

The actor probe now uses Agent.Context, optional peer types/defaults are owned structurally by agent-bundle, and React-backed rendering is split from peer-free event projection. Local pnpm test:packed is green (9 files, 23 passed, 1 skipped); pnpm typecheck and pnpm lint are also green. Merged with --admin without waiting on CI.

[ScriptedAlchemy]

Completed the sole remaining #223 Workbench acceptance item in #322 (squash merge 0e3c444a).

Already complete before this PR

• Handler-context parity with the same ALS request handle (feat(runtime): expose typed request context to operation handlers and the test harness (#223) #273).
• Generated MCP tool/resource/prompt transport axes and spoof resistance (feat(runtime): thread transport-observed identity into generated MCP tool scopes (#223) #276).
• Packed event actor projection repair through Agent.Context (fix(packed): restore optional peer boundaries #280).

Final Workbench scope delivered

• Added a dedicated credential-free request-provenance wire contract for invocation, host, session, actor, and workspace.
• Lifecycle replay mounts those exact axes into the actual route render request scope and returns the same projection to the Workbench; there is no parallel context snapshot.
• Workbench lifecycle decoding uses strict Zod objects and rejects surplus fields at the envelope, request-context, and nested-axis boundaries.
• The Lifecycles view surfaces each axis and its provenance. Replay-derived host/session/workspace values are honestly labeled receipt, not native; missing actor/session/workspace values remain visibly typed unavailable with their reason.
• No new client state was needed, so no atoms module was introduced. G6 remains server-authoritative; G6/G7 mutation surfaces are unchanged and G6 read paths remain read-only.
• Added documentation and a minor changeset.

Evidence

• Scoped lifecycle unit suite — 26/26 green
• Route-unit lifecycle acceptance — 2/2 green
• Real default-pool lifecycle dev-server integration — green
• pnpm typecheck — green
• pnpm lint — green (0 errors, 0 warnings)
• 1440×900 Workbench E2E — green for populated Claude/Codex receipt axes, typed actor absence, and the documented stale-manifest refresh/repair flow

All acceptance owned by #223 is now complete; closing.

[ScriptedAlchemy]

2026-09-03 — maintainer decision: agent-bundle will not surface operator/user identity (no actor-principal derivation for event scopes, no user_email handling). The actor-principal follow-up parked here was tracked as #391 and is now closed as not planned. request.lineage (parent session, root, sub-agent parent chain; #421, #422/#423/#424) is the only identity-adjacent surface. actor stays what it is today: the HTTP-authenticated MCP client on streamable transports, unavailable elsewhere.