Add a standalone offline MCP toolkit

.github/workflows/release.yml

@@ -0,0 +1,34 @@
+name: prepare-release
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  release:
+    if: github.ref == 'refs/heads/main'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version-file: .nvmrc
+          package-manager-cache: false
+      - name: Require a chosen reuse license
+        run: node -e "const p=require('./package.json'); if(!p.license || p.license==='UNLICENSED') throw new Error('Owner must choose a reuse license before release');"
+      - run: npm ci --ignore-scripts --no-audit --no-fund
+      - run: npm run check
+      - run: npm run release:prepare
+      - name: Create a draft experimental GitHub release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          version=$(node -p "require('./package.json').version")
+          gh release create "v$version" output/release/*.tgz output/release/SHA256SUMS --target "$GITHUB_SHA" --title "Hardwire $version — local MCP toolkit" --notes-file "docs/releases/v$version.md" --prerelease --draft

.github/workflows/test.yml

@@ -20,5 +20,5 @@ jobs:
         with:
           node-version-file: ".nvmrc"
           package-manager-cache: false
-      # No install step: the package has no dependencies by design.
+      - run: npm ci --ignore-scripts --no-audit --no-fund
       - run: npm run check

CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## 0.5.0 — 2026-11-12
+
+Standalone agent access without an owned application.
+
+- Adds `hardwire-mcp`: five fixed offline tools for panel inspection/compilation,
+  HTML inference, parameter validation and panel-bound trace verification.
+- Uses official MCP server SDK 2.4.0, with a separate official client dependency
+  for transport tests. Core format helpers retain their built-in-only imports.
+- Adds exact-path client configuration, first-task examples and troubleshooting.
+- Tests actual discovery/calls, invalid inputs and installed-command startup.
+  The clean-install test caught and fixed symlink-based executable detection.
+- Replaces the owned-app prerequisite with a standalone toolkit distribution path.
+
+Existing panel and trace formats are unchanged. Install dependencies with
+`npm ci --ignore-scripts` before running the full checks. The toolkit does not
+execute submitted ports or fetch websites. License selection remains pending.
+
 ## 0.4.1 — 2026-11-12
 
 Final use-readiness audit and runnable consumer pattern.

CONTRIBUTING.md

@@ -4,16 +4,19 @@ The repository's license has not been chosen. These instructions describe the
 owner's development workflow; they do not grant outside reuse rights or invite
 code contributions under an unspecified license.
 
-Use Node 24.16+ (`nvm use`). There are no dependencies or generated build files.
+Use Node 24.16+ (`nvm use`). The MCP transport uses the pinned official SDK.
+The core format modules still use only Node built-ins; no build step is needed.
 
 ```sh
+npm ci --ignore-scripts
 npm run check
 ```
 
 This runs unit/CLI tests, real loopback HTTP integration tests, panel validation
-and the offline API walkthrough, runnable consumer and package smoke check. The
-package check builds a tarball, installs it offline in a temporary project, then
-checks its ESM exports, CLI binary and included consumer example. CI runs the
+and the offline API walkthrough, runnable consumer, MCP transport and package checks. The
+package check builds a tarball, installs it with a fresh cache in a temporary project, then
+checks its ESM exports, CLI binaries, consumer and actual MCP calls through the
+installed symlink. The official SDK client is a development dependency. CI runs the
 same command on the exact `.nvmrc` version. All checks must pass before merging.
 The standalone `npm run corpus`
 command intentionally exits 1 on the current baseline; its expected scores and

README.md

@@ -9,38 +9,49 @@ Hardwire describes an application's operations in a small JSON file called a
 `read` or `payment`, and a declared confirmation requirement. An agent
 integration can inspect that contract instead of guessing which UI to click.
 
-**Status: 0.4.1 experimental foundation.** This Node.js library validates panels
-and arguments, compiles MCP tool descriptions, proposes panels from static HTML,
-and creates verifiable trace digests. It does **not** execute operations, provide
-an MCP server, log anyone in, or enforce human approval. No React dependency.
+**Status: 0.5.0 experimental MCP toolkit and Node.js library.** Connect an agent
+to five local tools for HTML inference, panel inspection, tool-description
+compilation, argument validation and trace verification. You do not need an app,
+a website, an API key or hosting. The toolkit processes supplied data; it does
+not browse websites, log in or execute the operations described in a panel.
 
-## Start in two minutes
+License selection is pending. The setup below is for the owner or users with
+separate permission; the public repository currently grants no reuse license.
 
-Use **Node 24.16 or newer** (`nvm use` if you use nvm). No dependencies, API keys,
-accounts, installation step, or paid services are needed.
+## Connect in five minutes
+
+Use **Node 24.16 or newer** (`nvm use` if you use nvm).
 
 ```sh
 git clone https://github.com/Automatron-workflows/hardwire.git
 cd hardwire
-node --version
-npm run walkthrough
-npm run consumer
-npm test
+npm ci --ignore-scripts
+npm run test:mcp
+npm run --silent mcp:config
 ```
 
-The offline walkthrough exercises the public API, verifies a trace, demonstrates
-password redaction, and scores a sample inference. `npm test` also starts a
-short-lived server on the loopback interface. In a sandbox that forbids listening
-sockets, run `npm run test:unit`; the integration suite must still pass in CI.
-
-`npm run consumer` goes one step further: it maps `search_catalogue` to a known
-application function, returns a matching demo product, checks the result and
-records a successful trace. It runs offline on fake data. This is a runnable
-integration pattern, not an MCP server or an authenticated deployment.
+The smoke check launches a real server, discovers all five tools and calls them
+with the official MCP client. The last command prints a client configuration
+with exact paths for this machine. Merge its `hardwire` entry into your MCP
+client's configuration. [Full setup, a first prompt and troubleshooting](docs/MCP.md).
 
-**Next:** [step-by-step experiments](docs/GETTING-STARTED.md),
-[API reference](docs/API.md), or [adding a panel to your app](docs/INTEGRATION.md).
-For adoption and packaging, see [distribution and first deployment](docs/DISTRIBUTION.md).
+| Tool | What it does |
+| --- | --- |
+| `hardwire_inspect_panel` | Validates a panel and summarizes declared effects. |
+| `hardwire_compile_panel` | Produces MCP descriptions as data, without registering them. |
+| `hardwire_infer_html` | Turns supplied static HTML into a draft that needs review. |
+| `hardwire_validate_params` | Checks arguments against a port without executing it. |
+| `hardwire_verify_trace` | Checks trace consistency and binding to a supplied panel. |
+
+To explore the library without an agent, run `npm run walkthrough` and
+`npm run consumer`. The consumer calls one fixed function on fake catalogue data.
+Run `npm run check` for all tests, including a clean package installation and
+MCP calls through the installed command. HTTP integration tests need loopback
+sockets; restricted sandboxes can run `npm run test:unit` as a partial check.
+
+**Next:** [MCP setup](docs/MCP.md), [library experiments](docs/GETTING-STARTED.md),
+[API reference](docs/API.md), [application integration](docs/INTEGRATION.md),
+or [release and distribution](docs/DISTRIBUTION.md).
 
 ## What a panel looks like
 
@@ -70,7 +81,7 @@ consumer needs an explicit implementation for each port it will call.
 | --- | --- |
 | Panel | The versioned description of an application's operations. |
 | Port | One operation, its argument schema and declared policy. |
-| Consumer / plug | Your integration that maps ports to real handlers. Not included. |
+| Consumer / plug | An integration mapping application ports to real handlers. See the demo consumer. |
 | Trace | A record of a caller's assertion, bound to a panel digest. Not proof of execution. |
 
 ## Try the commands

docs/API.md

@@ -1,6 +1,6 @@
 # Public API
 
-Node.js ESM, zero dependencies. Import from `hardwire` after a permitted local
+Node.js ESM. Core helpers use only Node built-ins; the MCP server uses the official SDK. Import from `hardwire` after a permitted local
 package install, or from `./src/index.mjs` inside the checkout. Subpath exports
 are listed in `package.json`. Functions are synchronous unless marked async.
 

docs/AUDIT-2026-11-12.md

@@ -55,3 +55,31 @@ also uses current SHA-pinned actions and the exact supported Node version.
 The remaining adoption blockers are product boundaries, not failing tests:
 license selection, an owned npm identity, and a real client adapter with scoped
 application access. See DISTRIBUTION.md. None is claimed to be released already.
+
+
+## Follow-up: standalone distribution, 0.5.0
+
+The first useful client integration no longer depends on owning an application.
+Five fixed offline tools are callable through the official SDK's stdio server.
+An SDK client exercises discovery, all handlers, rejection cases and shutdown.
+Compiled panel ports are not registered as executable tools.
+
+A clean package install found that entry-point detection compared a real module
+path with npm's symlink path, silently doing nothing when launched through the
+installed command. Resolve the entry-point symlink before comparison and test
+both `--version` and real MCP calls through the installed command.
+
+Documentation now separates the standalone toolkit from future partner-owned
+application execution. Public reuse still awaits an explicit license decision.
+
+Connected CI passed 107 unit/CLI tests and four HTTP integration tests, plus the
+official SDK client smoke check and a clean installed-command MCP check. The
+resolved dependency graph is committed with npm integrity hashes; CI uses
+`npm ci --ignore-scripts`. Local unit checks also pass. No external deployment,
+registry listing or model-host UI compatibility result is implied by these tests.
+
+Switching CI to `npm ci` exposed an obsolete test assumption: npm caches the
+locked tarballs without necessarily caching registry metadata. A new packed
+consumer install therefore cannot assume `--offline` works. The package test now
+uses a fresh temporary cache and the real online installation path. Runtime
+toolkit calls remain offline.