feat(notices): expose the recipient-scoped MCP inbox resource (#99 stage 3)

[ScriptedAlchemy]

Summary

Stage 3 of #99 per the #107 staging ("MCP inbox resource (available + observed re-read)"): generated stateful MCP servers now register a read-only notice-inbox resource at agent-bundle://notices/inbox exposing the invocation's own recipient-scoped pending notices.

• inbox() on the request notice handle: lists pending, unexpired notices matching the invocation's own observed identity (cross-recipient reads structurally impossible), each with its detached AgentDocumentSnapshot. Deterministic ordering (createdAt, then id); honest {"notices":[]} empty state.
• Honest availability evidence, not a new state: the v1 taxonomy stays pending|attempted|expired|unavailable|withdrawn. A served read dispatches one idempotent exposed ledger event (agent-notices:expose:<invocationId>) that updates a bounded per-notice exposure summary (channel, count, firstAt, lastAt, lastInvocationId) — first exposure is the availability evidence, later ones are observed re-reads. Reading NEVER marks attempted, never expires or withdraws, and never suppresses next-event delivery (proven directly: an inbox read followed by an admitted event still records attempted).
• Dual-time authorization: publish-time auth is unchanged; inbox reads run per-notice read-time authorization (new 'read' phase). unavailable omits the notice with no exposure and no durable transition; a throwing authorizer fails the read closed (unauthorized).
• Packaging boundary: injection is gated exactly on the project's state definition — stateless/notice-less projects emit no inbox resource, no runtime import, and their sources prove it. The React-bearing route module ships as its own @agent-bundle/runtime/notices/inbox-route entry so the lean ./notices ledger entry stays free of React.
• Collision guard: a compiled route claiming the reserved notice-inbox protocol name or the reserved URI fails the build with a clear diagnostic.
• Journal back-compat: exposure is optional in the notice schema; pre-existing published journal events replay cleanly with no state-definition id bump.

Proofs (all local)

• Ledger unit (18): listing, exposure/re-read evidence, cross-recipient exclusion, expired-at-read filtered without transition, read-then-event still attempts, read-auth omission + fail-closed, terminal states excluded, legacy journal replay.
• mcp-in-memory (12): stateful server lists + serves the inbox over the real SDK client (populated projection with snapshot + exposure), mismatched/absent identity reads honestly empty against the same durable store, stateless server registers no inbox.
• Built artifact (9, no new spawns): the existing stateless stdio session proves no inbox in sources or resources/list; the existing stateful warm session proves listing + honest empty read over real stdio.
• Template unit (16): entry + worker injection gated on state, collision guards, generated sources transpile.

Gates: pnpm build, pnpm typecheck, pnpm lint (0/0), pnpm lint:package, scoped unit 34/34, projection 12/12, integration 9/9 — on top of current main (c97a50f41).

Stage 4 (per-host delivered/read/acknowledged evidence and the delivery router) stays deferred per #107; #99 remains the tracking issue.

[changeset-bot]

🦋 Changeset detected

Latest commit: ef1bcdf

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
@agent-bundle/runtime	Minor
agent-bundle	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-02T02:58:22.287424Z	ef1bcdf	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.