feat(mcp): add task execution and submission tools

.commitrail/INDEX.md

@@ -10,7 +10,7 @@ for current product capability.
 | [WS-GHPROOF-001](initiatives/WS-GHPROOF-001/OVERVIEW.md) | Planned | Plan recorded. Next: the GitHub facts adapter and the `harnessy.work_proof` comparison mode, independently; POST wiring follows PR #677. Proofs remain shape-checked only until that wiring lands. |
 | [WS-AGENT-001](initiatives/WS-AGENT-001/OVERVIEW.md) | Planned | Neutral document tools plus OpenAI Agents SDK and OmniCoreAgent original-guide qualifications are delivered through the same public API, durable worker, parser and MinIO path. Retain the exact external provider/account and selected-image AWS evidence, then prove the broader hosted Flow contribution journey before deployment claims. |
 | [WS-DB-002](initiatives/WS-DB-002/OVERVIEW.md) | Complete | Shared UUIDv7 record generation, native-UUID relationships and fresh v0.1 baseline; natural-owner retry custody and aligned CI/local setup |
-| [WS-MCP-002](initiatives/WS-MCP-002/OVERVIEW.md) | Planned | Ninety tools through WS-MCP-002-11 cover access, guide setup, contributor workspace, contribution policies, checker recovery and artifact operations; task execution/submissions, task operations/imports and assembled release proof remain. |
+| [WS-MCP-002](initiatives/WS-MCP-002/OVERVIEW.md) | Planned | 108 tools through WS-MCP-002-12 cover access, guide setup, contributor workspace, contribution policies, checker/artifact operations and task execution/submissions; task operations/imports and assembled release proof remain. |
 | [WS-CLI-001](initiatives/WS-CLI-001/OVERVIEW.md) | Planned | Public Go CLI setup, contributor/manager workflows, administrative and operational commands, Finance policies and contribution exports are detailed in the overview; -43 proves the connected local unpaid automated-acceptance journey. -44 prepares four native release archives and a gated manual publisher; -47 hardens its administrator-bypass guard. Protected release-environment and immutable-tag ruleset configuration/verification, first publication and public-asset audit remain. -46 adds the separate system-reader project catalogue; -48 adds the opt-in read-only contributor TUI. Detailed findings/Evidence remain manual CLI handoffs; TUI writes/management, public human-review controls and hosted proof are separate. Current revision context never substitutes for historical evidence. |
 | [WS-ARCH-001](initiatives/WS-ARCH-001/OVERVIEW.md) | Planned | Public admission-backed initial/remediation Submission entry and supported false-policy guide activation are implemented over selected production delivery. New false/pass effects require LIVE REV; a known pre-effect non-live refusal has bounded retry, with exhausted delivery dead-lettered. The [bounded local public/worker drill](initiatives/WS-ARCH-001/planning/PLAN.md#first-complete-contributor-milestone) starts from public guide inputs with recorded inference; hosted operation and live human review remain. |
 | [WS-ART-001](initiatives/WS-ART-001/OVERVIEW.md) | Planned | Verified input/output custody, exact-cause replacement and public admission-backed ZIP/Submission entry are delivered. The bounded local public/worker drill passed; hosted operation and setup-fault handling remain separate. |

.commitrail/initiatives/WS-MCP-002/OVERVIEW.md

@@ -14,20 +14,22 @@
 - Project participation: [Project-role grants](WS-MCP-002-07.md), merged in PR #644.
 - Guide declarations: [Guide declarations and draft metadata](WS-MCP-002-08.md), merged in PR #655.
 - Contributor workspace and policies: [Workspace and contribution-policy tools](WS-MCP-002-10.md), merged in PR #669.
-- Current change: [Guide, checker and artifact operations](WS-MCP-002-11.md).
-- Next usable boundary: WS-MCP-002-12 task execution and submissions.
+- Guide, checker and artifact operations: [WS-MCP-002-11](WS-MCP-002-11.md), merged in PR #685.
+- Current change: [Task execution and submissions](WS-MCP-002-12.md).
+- Next usable boundary: WS-MCP-002-13 task operations and imports.
 
 ## Current implementation
 
 [`mcp_server/`](../../../mcp_server/README.md) is an independently packaged
-Streamable HTTP adapter with ninety tools: three self-service tools for profile read,
+Streamable HTTP adapter with 108 tools: three self-service tools for profile read,
 profile update and exact-project authorization context, plus six administrative
 reads for permission/role definitions, grants and actor/identity projections, two
 administrative grant mutations, five actor/identity lifecycle mutations, two
 project-shell tools, five project-participation tools, two guide-metadata tools
 and two draft-policy tools, plus twenty contributor workspace, contribution
 evidence and contribution-policy tools, twenty-four complete guide-lifecycle
-tools, ten checker/delivery/registry tools and nine operator-artifact tools. It includes a container,
+tools, ten checker/delivery/registry tools, nine operator-artifact tools and
+eighteen task-execution/submission tools. It includes a container,
 selected response-schema validation and additive CI. Its integration tests
 exercise the installed adapter against the real Workstream API. Workstream
 still owns token verification and authorization. This is delivered packaging,
@@ -489,7 +491,8 @@ batches; row 11 combines the adjacent guide/checker/artifact work after the
 maintainer requested larger parallel PRs. `/api/v1/health` is excluded because it is operational liveness, not a
 user capability. Every batch preserves fixed routes, caller-token forwarding,
 selected OpenAPI contracts, no private imports and Workstream-owned authority.
-Release proof follows the assembled 128-tool product catalogue.
+WS-MCP-002-12 adds the eighteen task execution and submission bindings, bringing
+the catalogue to 108. Release proof follows the assembled 128-tool product catalogue.
 
 ## References
 

.commitrail/initiatives/WS-MCP-002/WS-MCP-002-12.md

@@ -0,0 +1,91 @@
+# WS-MCP-002-12 - Task execution and submissions
+
+- Initiative: `WS-MCP-002`
+- Durable disposition: `Complete`
+- Intended merge outcome: Expand the independent MCP adapter from 90 to 108
+  tools with the current public task execution, preparation and submission APIs.
+
+## Intent
+
+Let authorized contributors and project managers execute the supported task and
+submission workflows through fixed MCP tools. The adapter forwards the caller
+bearer unchanged. Workstream remains the only identity, authorization,
+idempotency, lifecycle and submission authority.
+
+## Bounded change
+
+### Allowed
+
+- `mcp_server/`: eighteen selected public contracts, one task-execution tool
+  module, fixed gateway/schema/registry bindings, focused tests and package docs.
+- `.github/workflows/mcp.yml`: exact 108-tool container and contract assertions.
+- This record, the initiative overview/index and affected capability status.
+
+### Not allowed
+
+- No backend, CLI, database, authorization or identity behavior changes.
+- No generic HTTP tool, private backend import, direct database access, local
+  authorization/lifecycle/replay state, generated mutation key or automatic retry.
+- No task-management override, import, audit, service-actor or health tools.
+
+## Design and decisions
+
+The change adds three preparation operations, eight contributor task operations,
+three contributor submission operations and four manager task/submission reads.
+Each tool owns one fixed method/path/status tuple captured from current backend
+OpenAPI. Callers cannot provide a URL, HTTP method or bearer as tool input.
+
+Preparation accepts one bounded Base64 ZIP plus typed assignment, idempotency and
+optional submission/revision header fields. The adapter decodes it once and sends
+raw `application/zip` bytes. It stores no packet or replay state. Assigned guide
+documents reuse the bounded binary-read projection: media type, Base64 bytes,
+server-observed byte count and SHA-256. Ordinary JSON keeps its separate 64 KiB
+response bound.
+
+Screen, release, claim and start require caller-provided UUID idempotency keys.
+Claim dispatches only claim; it never starts the task. Submission creation uses
+the backend's ready admission and assignment identifiers and is deliberately
+unkeyed because the current public contract is unkeyed. Workstream performs every
+fresh authority, state, preparation, checker and admission decision.
+
+Successful reads bind returned task, project, preparation or submission selectors
+where the public response exposes them. Successful mutations bind available
+authoritative selectors. A malformed or substituted read fails as an invalid API
+response; a malformed mutation result is uncertain execution. The adapter never
+retries a mutation automatically.
+
+## Acceptance criteria
+
+- [x] Exactly 108 unique tools and zero resources/prompts.
+- [x] Eighteen selected OpenAPI snapshots are tamper-evident and drift-tested.
+- [x] Every fixed method/path/status binding matches its reviewed snapshot.
+- [x] Invalid input and substituted success responses fail closed before reuse.
+- [x] Preparation and guide-document bytes are bounded and never logged.
+- [x] Caller bearer and mutation keys are forwarded unchanged and never generated.
+- [x] Claim never dispatches start; no mutation is retried automatically.
+- [x] No local authorization, replay state, database access or private backend import.
+
+## Risk and review routing
+
+- Risk class: `L1`
+- Required reviewers: security/authorization, architecture/reuse, QA/test delta,
+  documentation and CI integrity.
+- Human review focus: fixed routes and headers, binary bounds, claim/start
+  separation, submission-admission binding, uncertain execution and token privacy.
+
+## Evidence
+
+| Claim | Command or proof | Result | Remaining uncertainty |
+| --- | --- | --- | --- |
+| Focused behavior and contracts | `pytest -q tests/test_task_execution.py tests/test_task_execution_contract_drift.py tests/test_catalogue.py` | PASS | Real PostgreSQL parity remains hosted proof |
+| Current OpenAPI | `WORKSTREAM_MCP_OPENAPI_COMMAND=... pytest -q tests/test_task_execution_contract_drift.py` | PASS: 20 passed against backend source at `f04313855` | Later backend changes must rerun drift proof |
+| Static and full local suite | Ruff, strict mypy and `pytest -q --ignore=tests/integration --cov=workstream_mcp` | PASS: 816 passed, 4 environment-gated skips, 92% coverage | Hosted Linux checks still repeat the result |
+| Package/catalogue | Build wheel, clean Python 3.12 install and package-independence proof | PASS | Container execution remains hosted proof |
+
+## Reconciliation
+
+- Current-source reconciliation: selected contracts were recaptured from backend
+  OpenAPI at `f04313855` before implementation.
+- Next usable boundary: WS-MCP-002-13 task operations and imports.
+- Remaining risks: isolated PostgreSQL parity, deployed proxy behavior and the
+  final twenty product tools remain separate proof.

.github/workflows/mcp.yml

@@ -75,7 +75,7 @@ jobs:
               --header 'Content-Type: application/json' \
               --data '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}' \
               http://127.0.0.1:18080/mcp \
-              | python -c 'import json, sys; tools = [tool["name"] for tool in json.load(sys.stdin)["result"]["tools"]]; assert len(tools) == len(set(tools)) == 90; assert tools[-43:] == ["workstream_project_guides_list", "workstream_project_guide_get", "workstream_guide_activate", "workstream_guide_activation_readiness_get", "workstream_guide_proposal_correct", "workstream_guide_correction_dispatch", "workstream_guide_post_policy_get", "workstream_guide_post_policy_approve", "workstream_guide_post_policy_correct", "workstream_guide_pre_submission_approve", "workstream_guide_proposal_get", "workstream_guide_document_upload", "workstream_guide_document_content_get", "workstream_guide_effective_submission_artifact_policy_get", "workstream_guide_pre_submit_checker_policy_get", "workstream_guide_setup_latest_get", "workstream_guide_submission_artifact_policies_list", "workstream_guide_submission_artifact_policy_create", "workstream_guide_submission_artifact_policy_get", "workstream_guide_submission_artifact_policy_update", "workstream_guide_sufficiency_reports_list", "workstream_guide_sufficiency_report_create", "workstream_guide_sufficiency_report_get", "workstream_guide_sufficiency_warnings_acknowledge", "workstream_submission_checker_runs_list", "workstream_submission_checker_runs_get", "workstream_project_checker_runs_list", "workstream_project_checker_runs_get", "workstream_checker_retry_sources_list", "workstream_checker_runs_retry", "workstream_post_submit_deliveries_list", "workstream_post_submit_deliveries_reconcile", "workstream_checker_registry_read", "workstream_checker_registry_register", "workstream_artifact_readiness_get", "workstream_artifact_bindings_list", "workstream_artifact_replicas_list", "workstream_artifact_receipts_list", "workstream_artifact_verification_job_get", "workstream_artifact_verification_job_retry", "workstream_artifact_recovery_attempt_get", "workstream_artifact_admission_usage_get", "workstream_artifact_audit_events_list"]'; then
+              | python -c 'import json, sys; tools = [tool["name"] for tool in json.load(sys.stdin)["result"]["tools"]]; assert len(tools) == len(set(tools)) == 108; assert tools[-18:] == ["workstream_preparation_create", "workstream_preparations_list", "workstream_preparation_get", "workstream_task_get", "workstream_task_submission_requirements_get", "workstream_task_screen", "workstream_task_release", "workstream_task_claim", "workstream_task_start", "workstream_task_work_context_get", "workstream_task_guide_document_content_get", "workstream_submission_create", "workstream_task_submissions_list", "workstream_submission_get", "workstream_management_task_submissions_list", "workstream_management_submission_get", "workstream_management_task_work_context_get", "workstream_management_task_submission_requirements_get"]'; then
               exit 0
             fi
             sleep 1
@@ -140,7 +140,8 @@ jobs:
         run: |
           set -euo pipefail
           export WORKSTREAM_MCP_OPENAPI_COMMAND="uv run --frozen python -c 'import json; from app.main import app; print(json.dumps(app.openapi()))'"
-          uv run --frozen pytest -q tests/test_contract_drift.py
+          uv run --frozen pytest -q tests/test_contract_drift.py \
+            tests/test_task_execution_contract_drift.py
 
       - name: Run real isolated API-to-MCP lifecycle parity
         working-directory: backend

docs/roadmap_status.md

@@ -296,11 +296,12 @@ Selected production request/completion composition and
 supported false-guide activation are implemented. A known pre-effect non-live REV refusal returns bounded OUTBOX retry after rollback; exhaustion dead-letters without automatic reopen. A setup-fault hold is future safety work because no current selected production result emits `task_setup_blocked`. Human review/revision, conditional fulfillment, operations and
 release proof remain later v0.1 work.
 
-The [independent MCP package](../mcp_server/README.md) implements ninety
+The [independent MCP package](../mcp_server/README.md) implements 108
 self-service, administrative access, actor/identity-lifecycle, project-shell,
 project-participation, guide-metadata, draft-policy, contributor-workspace,
 contribution-evidence, contribution-policy, complete guide-lifecycle,
-checker/delivery/registry and operator-artifact tools through WS-MCP-002-11. The
+checker/delivery/registry, operator-artifact, task-execution and submission tools
+through WS-MCP-002-12. The
 [Go CLI](../cli/README.md) provides caller-profile and exact-project authorization
 reads plus human self-profile editing, exact-project inspection and manager
 task queue/detail reads, contributor ready-work/instruction reads and public
@@ -697,8 +698,8 @@ cannot be reused as post-submission review-gate evidence. See the
   review and revision policy selection and completes the original 27-tool catalogue;
   WS-MCP-002-10 adds 20 workspace/evidence/policy bindings. WS-MCP-002-11 adds
   43 guide lifecycle, checker/delivery/registry and operator-artifact bindings.
-  Task execution/submissions, task operations/imports and assembled release
-  proof remain. This is still a custom
+  WS-MCP-002-12 adds 18 task execution, preparation, context and submission
+  bindings. Task operations/imports and assembled release proof remain. This is still a custom
   authentication adapter, not a public deployment or a certified release.
   The [CLI foundation](../.commitrail/initiatives/WS-CLI-001/WS-CLI-001-01.md)
   provides `whoami` and `project access PROJECT_ID` through those public REST