feat(mcp): add task operations and imports

.commitrail/INDEX.md

@@ -10,7 +10,7 @@ for current product capability.
 | [WS-GHPROOF-001](initiatives/WS-GHPROOF-001/OVERVIEW.md) | Planned | Plan recorded. Next: the GitHub facts adapter and the `harnessy.work_proof` comparison mode, independently; POST wiring follows PR #677. Proofs remain shape-checked only until that wiring lands. |
 | [WS-AGENT-001](initiatives/WS-AGENT-001/OVERVIEW.md) | Planned | Neutral document tools plus OpenAI Agents SDK and OmniCoreAgent original-guide qualifications are delivered through the same public API, durable worker, parser and MinIO path. Retain the exact external provider/account and selected-image AWS evidence, then prove the broader hosted Flow contribution journey before deployment claims. |
 | [WS-DB-002](initiatives/WS-DB-002/OVERVIEW.md) | Complete | Shared UUIDv7 record generation, native-UUID relationships and fresh v0.1 baseline; natural-owner retry custody and aligned CI/local setup |
-| [WS-MCP-002](initiatives/WS-MCP-002/OVERVIEW.md) | Planned | Ninety tools through WS-MCP-002-11 cover access, guide setup, contributor workspace, contribution policies, checker recovery and artifact operations; task execution/submissions, task operations/imports and assembled release proof remain. |
+| [WS-MCP-002](initiatives/WS-MCP-002/OVERVIEW.md) | Planned | 132 tools through WS-MCP-002-13 cover the current public product catalogue; assembled release proof remains. |
 | [WS-CLI-001](initiatives/WS-CLI-001/OVERVIEW.md) | Planned | Public Go CLI setup, contributor/manager workflows, administrative and operational commands, Finance policies and contribution exports are detailed in the overview; -43 proves the connected local unpaid automated-acceptance journey. -44 prepares four native release archives and a gated manual publisher; -47 hardens its administrator-bypass guard. Protected release-environment and immutable-tag ruleset configuration/verification, first publication and public-asset audit remain. -46 adds the separate system-reader project catalogue; -48 adds the opt-in read-only contributor TUI. Detailed findings/Evidence remain manual CLI handoffs; TUI writes/management, public human-review controls and hosted proof are separate. Current revision context never substitutes for historical evidence. |
 | [WS-ARCH-001](initiatives/WS-ARCH-001/OVERVIEW.md) | Planned | Public admission-backed initial/remediation Submission entry and supported false-policy guide activation are implemented over selected production delivery. New false/pass effects require LIVE REV; a known pre-effect non-live refusal has bounded retry, with exhausted delivery dead-lettered. The [bounded local public/worker drill](initiatives/WS-ARCH-001/planning/PLAN.md#first-complete-contributor-milestone) starts from public guide inputs with recorded inference; hosted operation and live human review remain. |
 | [WS-ART-001](initiatives/WS-ART-001/OVERVIEW.md) | Planned | Verified input/output custody, exact-cause replacement and public admission-backed ZIP/Submission entry are delivered. The bounded local public/worker drill passed; hosted operation and setup-fault handling remain separate. |

.commitrail/initiatives/WS-MCP-002/OVERVIEW.md

@@ -14,20 +14,24 @@
 - Project participation: [Project-role grants](WS-MCP-002-07.md), merged in PR #644.
 - Guide declarations: [Guide declarations and draft metadata](WS-MCP-002-08.md), merged in PR #655.
 - Contributor workspace and policies: [Workspace and contribution-policy tools](WS-MCP-002-10.md), merged in PR #669.
-- Current change: [Guide, checker and artifact operations](WS-MCP-002-11.md).
-- Next usable boundary: WS-MCP-002-12 task execution and submissions.
+- Guide, checker and artifact operations: [WS-MCP-002-11](WS-MCP-002-11.md), merged in PR #685.
+- Task execution and submissions: [WS-MCP-002-12](WS-MCP-002-12.md).
+- Current change: [Task operations and imports](WS-MCP-002-13.md).
+- Next usable boundary: assembled release proof for the complete public catalogue.
 
 ## Current implementation
 
 [`mcp_server/`](../../../mcp_server/README.md) is an independently packaged
-Streamable HTTP adapter with ninety tools: three self-service tools for profile read,
+Streamable HTTP adapter with 132 tools: three self-service tools for profile read,
 profile update and exact-project authorization context, plus six administrative
 reads for permission/role definitions, grants and actor/identity projections, two
 administrative grant mutations, five actor/identity lifecycle mutations, two
 project-shell tools, five project-participation tools, two guide-metadata tools
 and two draft-policy tools, plus twenty contributor workspace, contribution
 evidence and contribution-policy tools, twenty-four complete guide-lifecycle
-tools, ten checker/delivery/registry tools and nine operator-artifact tools. It includes a container,
+tools, ten checker/delivery/registry tools, nine operator-artifact tools and
+eighteen task-execution/submission tools and twenty-four current project-list,
+task-management, audit, import, service-actor and model-operation tools. It includes a container,
 selected response-schema validation and additive CI. Its integration tests
 exercise the installed adapter against the real Workstream API. Workstream
 still owns token verification and authorization. This is delivered packaging,
@@ -440,7 +444,7 @@ assembled release proof follows those bindings rather than occupying row 10.
 | WS-MCP-002-10: contributor workspace and contribution policies | 09; current public contracts | `tools/workspace_reads.py`, `tools/contribution_policies.py`; 20 tools | Caller/project workspace, JSON contribution evidence and exact policy lifecycle; catalogue reaches 47. |
 | WS-MCP-002-11: guide, checker and artifact operations | Current guide/checker/ART contracts | `tools/guide_lifecycle.py`, `tools/checker_artifacts.py`; 43 tools | Complete public guide setup/activation, checker recovery and operator artifact inspection/recovery; catalogue reaches 90. |
 | WS-MCP-002-12: task execution and submissions | Current task/submission contracts | Eighteen contributor and manager execution/submission tools | Preparation, claim/start, context and submission workflows; catalogue reaches 108. |
-| WS-MCP-002-13: task operations and imports | Current project/task/import/AUTH contracts | Twenty project-list, management, audit, import and service-actor tools | Public product catalogue reaches 128; both health routes remain operational liveness, not user tools. |
+| WS-MCP-002-13: task operations and imports | Current project/task/import/AUTH/model contracts | Twenty-four project-list, management, audit, import, service-actor and model-operation tools | Public product catalogue reaches 132; both health routes remain operational liveness, not user tools. Four model operations landed after the earlier 128-operation census and are included from current OpenAPI. |
 
 The dependency column describes technical prerequisites, not permission to start another chunk automatically. Default delivery follows row order. Independent branches may be proposed only after checking shared registry/schema ownership. One chunk finishes with its checks, focused review and human review/merge direction before beginning the next. If a chunk grows beyond its coherent behavior, revise its contract/map before adding unrelated implementation; do not silently combine rows into one PR.
 
@@ -484,12 +488,15 @@ independently deployed custom bearer-header adapter, not a public deployment.
 
 The maintainer subsequently requested broader MCP coverage against the public
 API and explicitly allowed multiple larger PRs to proceed concurrently. Rows
-10 through 13 divide the 101 remaining product operations into four coherent
+10 through 13 divide the 105 remaining product operations into four coherent
 batches; row 11 combines the adjacent guide/checker/artifact work after the
-maintainer requested larger parallel PRs. `/api/v1/health` is excluded because it is operational liveness, not a
-user capability. Every batch preserves fixed routes, caller-token forwarding,
+maintainer requested larger parallel PRs. Both health routes are excluded because
+they are operational liveness, not user capabilities. Every batch preserves fixed routes, caller-token forwarding,
 selected OpenAPI contracts, no private imports and Workstream-owned authority.
-Release proof follows the assembled 128-tool product catalogue.
+WS-MCP-002-12 adds the eighteen task execution and submission bindings, bringing
+the catalogue to 108. WS-MCP-002-13 adds the remaining twenty-four current
+product operations, including four model operations added after the earlier
+census. Release proof follows the assembled 132-tool product catalogue.
 
 ## References
 

.commitrail/initiatives/WS-MCP-002/WS-MCP-002-12.md

@@ -0,0 +1,91 @@
+# WS-MCP-002-12 - Task execution and submissions
+
+- Initiative: `WS-MCP-002`
+- Durable disposition: `Complete`
+- Intended merge outcome: Expand the independent MCP adapter from 90 to 108
+  tools with the current public task execution, preparation and submission APIs.
+
+## Intent
+
+Let authorized contributors and project managers execute the supported task and
+submission workflows through fixed MCP tools. The adapter forwards the caller
+bearer unchanged. Workstream remains the only identity, authorization,
+idempotency, lifecycle and submission authority.
+
+## Bounded change
+
+### Allowed
+
+- `mcp_server/`: eighteen selected public contracts, one task-execution tool
+  module, fixed gateway/schema/registry bindings, focused tests and package docs.
+- `.github/workflows/mcp.yml`: exact 108-tool container and contract assertions.
+- This record, the initiative overview/index and affected capability status.
+
+### Not allowed
+
+- No backend, CLI, database, authorization or identity behavior changes.
+- No generic HTTP tool, private backend import, direct database access, local
+  authorization/lifecycle/replay state, generated mutation key or automatic retry.
+- No task-management override, import, audit, service-actor or health tools.
+
+## Design and decisions
+
+The change adds three preparation operations, eight contributor task operations,
+three contributor submission operations and four manager task/submission reads.
+Each tool owns one fixed method/path/status tuple captured from current backend
+OpenAPI. Callers cannot provide a URL, HTTP method or bearer as tool input.
+
+Preparation accepts one bounded Base64 ZIP plus typed assignment, idempotency and
+optional submission/revision header fields. The adapter decodes it once and sends
+raw `application/zip` bytes. It stores no packet or replay state. Assigned guide
+documents reuse the bounded binary-read projection: media type, Base64 bytes,
+server-observed byte count and SHA-256. Ordinary JSON keeps its separate 64 KiB
+response bound.
+
+Screen, release, claim and start require caller-provided UUID idempotency keys.
+Claim dispatches only claim; it never starts the task. Submission creation uses
+the backend's ready admission and assignment identifiers and is deliberately
+unkeyed because the current public contract is unkeyed. Workstream performs every
+fresh authority, state, preparation, checker and admission decision.
+
+Successful reads bind returned task, project, preparation or submission selectors
+where the public response exposes them. Successful mutations bind available
+authoritative selectors. A malformed or substituted read fails as an invalid API
+response; a malformed mutation result is uncertain execution. The adapter never
+retries a mutation automatically.
+
+## Acceptance criteria
+
+- [x] Exactly 108 unique tools and zero resources/prompts.
+- [x] Eighteen selected OpenAPI snapshots are tamper-evident and drift-tested.
+- [x] Every fixed method/path/status binding matches its reviewed snapshot.
+- [x] Invalid input and substituted success responses fail closed before reuse.
+- [x] Preparation and guide-document bytes are bounded and never logged.
+- [x] Caller bearer and mutation keys are forwarded unchanged and never generated.
+- [x] Claim never dispatches start; no mutation is retried automatically.
+- [x] No local authorization, replay state, database access or private backend import.
+
+## Risk and review routing
+
+- Risk class: `L1`
+- Required reviewers: security/authorization, architecture/reuse, QA/test delta,
+  documentation and CI integrity.
+- Human review focus: fixed routes and headers, binary bounds, claim/start
+  separation, submission-admission binding, uncertain execution and token privacy.
+
+## Evidence
+
+| Claim | Command or proof | Result | Remaining uncertainty |
+| --- | --- | --- | --- |
+| Focused behavior and contracts | `pytest -q tests/test_task_execution.py tests/test_task_execution_contract_drift.py tests/test_catalogue.py` | PASS | Real PostgreSQL parity remains hosted proof |
+| Current OpenAPI | `WORKSTREAM_MCP_OPENAPI_COMMAND=... pytest -q tests/test_task_execution_contract_drift.py` | PASS: 20 passed against backend source at `f04313855` | Later backend changes must rerun drift proof |
+| Static and full local suite | Ruff, strict mypy and `pytest -q --ignore=tests/integration --cov=workstream_mcp` | PASS: 816 passed, 4 environment-gated skips, 92% coverage | Hosted Linux checks still repeat the result |
+| Package/catalogue | Build wheel, clean Python 3.12 install and package-independence proof | PASS | Container execution remains hosted proof |
+
+## Reconciliation
+
+- Current-source reconciliation: selected contracts were recaptured from backend
+  OpenAPI at `f04313855` before implementation.
+- Next usable boundary: WS-MCP-002-13 task operations and imports.
+- Remaining risks: isolated PostgreSQL parity, deployed proxy behavior and the
+  final twenty product tools remain separate proof.

.commitrail/initiatives/WS-MCP-002/WS-MCP-002-13.md

@@ -0,0 +1,94 @@
+# WS-MCP-002-13 - Task operations and imports
+
+- Initiative: `WS-MCP-002`
+- Durable disposition: `Complete`
+- Intended merge outcome: Expand the independent MCP adapter from 108 to 132
+  tools and cover the current public Workstream product API catalogue.
+
+## Intent
+
+Let authorized system readers, project managers, operators and auditors use the
+remaining public project, task, import, service-actor and model operations through
+fixed MCP tools. The adapter forwards the caller bearer unchanged. Workstream
+remains the identity, authorization, lifecycle, idempotency and storage authority.
+
+## Bounded change
+
+### Allowed
+
+- `mcp_server/`: twenty-four current OpenAPI snapshots, one task-operations tool
+  module, fixed gateway/schema/registry bindings, focused tests and package docs.
+- `.github/workflows/mcp.yml`: exact 132-tool container and drift assertions.
+- This record, the initiative overview/index and affected capability status.
+
+### Not allowed
+
+- No backend, CLI, database, authorization or identity behavior changes.
+- No generic HTTP tool, private backend import, direct database access, local
+  authorization/replay state, generated idempotency key or automatic retry.
+- No health tool, service-actor login, hidden task operation or local object store.
+
+## Design and decisions
+
+The change binds twenty-four current public operations: system project listing;
+service-actor provisioning; project-manager and operator task queues; task create,
+detail, locked-context, audit-evidence, revision repair and operator start override;
+task-import source declaration, exact JSON byte upload/read/status and batch
+create/screen/release/status; and four project model profile, budget, usage and
+recovery operations. Each tool owns one fixed method/path/status tuple captured
+from backend OpenAPI at `f0431385573eb53353c5ffc3c6cdb6a93d206b73`.
+
+The earlier plan expected twenty tools and a 128-tool total. Four public model
+operations landed after that census. Current OpenAPI therefore has 132 product
+operations after excluding both health routes, so this chunk includes those four
+instead of knowingly leaving the current catalogue incomplete.
+
+Import source upload accepts bounded Base64, decodes once and forwards the exact
+bytes as `application/json`. Import source read returns only bounded Base64,
+media type, server-observed byte count and SHA-256. The adapter owns no source
+bytes, replay records or import state. The 8 MiB limit matches the backend public
+contract without enlarging the ordinary 64 KiB JSON response budget.
+
+Caller-provided UUID idempotency keys are exposed only where the current public
+operation requires them. Project model profile and budget bodies must name the
+same project as the fixed path. Successful reads and mutations bind every
+selector exposed by the response. A substituted read fails as invalid API data;
+a substituted mutation result is uncertain execution. The adapter never retries
+a mutation automatically.
+
+## Acceptance criteria
+
+- [x] Exactly 132 unique tools and zero resources/prompts.
+- [x] Twenty-four selected OpenAPI snapshots are tamper-evident and drift-tested.
+- [x] Every fixed method/path/status binding matches its reviewed snapshot.
+- [x] Required keys and bodies are typed tool fields, never ambient MCP metadata.
+- [x] Import source bytes are bounded, integrity-projected and never logged.
+- [x] Project/body and response selectors fail closed before reuse.
+- [x] Caller bearer and keys are forwarded unchanged and never generated.
+- [x] No local authorization, replay state, database access or private import.
+
+## Risk and review routing
+
+- Risk class: `L1`
+- Required reviewers: security/authorization, architecture/reuse, QA/test delta,
+  documentation and CI integrity.
+- Human review focus: exact route census, raw import bytes, selector binding,
+  mutation uncertainty, model project binding, package inclusion and token privacy.
+
+## Evidence
+
+| Claim | Command or proof | Result | Remaining uncertainty |
+| --- | --- | --- | --- |
+| Focused behavior and contracts | `pytest -q tests/test_catalogue.py tests/test_checker_artifacts.py tests/test_task_execution.py tests/test_task_operations.py tests/test_task_operation_contract_drift.py` | PASS: 151 passed, 1 environment-gated skip | Real PostgreSQL parity remains hosted proof |
+| Current OpenAPI | `WORKSTREAM_MCP_OPENAPI_COMMAND=... pytest -q tests/test_task_operation_contract_drift.py` | PASS: 26 passed against backend source at `f04313855` | Later backend changes must rerun drift proof |
+| Static and full local suite | Ruff, strict mypy and full MCP pytest with coverage | PASS: 874 passed, 5 environment-gated skips, 92% coverage | Hosted Linux checks repeat the result |
+| Package/catalogue | Build wheel, clean Python 3.12 install, 132-contract inspection and package-independence proof | PASS | Container execution remains hosted proof |
+
+## Reconciliation
+
+- Current-source reconciliation: all uncovered product operations were recaptured
+  from current backend OpenAPI before implementation; both health routes remain
+  operational liveness rather than MCP user tools.
+- Next usable boundary: assembled installed-adapter and real-API release proof.
+- Remaining risks: isolated PostgreSQL parity, deployed proxy behavior and public
+  release evidence remain separate proof.