Design

The TypeScript server, the on-disk session store, the path every authenticated tool call follows, the MCP protocol on the wire, and the guards and tests that keep workflow definitions valid.

• Server anatomy

  Startup, tool registration, the module map, and the cross-cutting layer every handler passes through.

  Server anatomy

• Request lifecycle

  Seven stages inside one authenticated tool call — seal verification through trace signing — using next_activity as the worked example.

  Request lifecycle

• Protocol

  Call order, error and warning taxonomy, trace tokens, reference delivery, and dispatch on the wire.

  Protocol

• Session store

  session.json on disk: the planning folder, derived session_index, embedded child sessions, HMAC seals, and append-only history.

  Session store

• Quality system

  Guard scripts, Vitest suites, generated-then-guarded docs, and agent smoke runs.

  Quality system