Implement the thin MCP command/query surface and redacted envelopes

Outcome

A cold host agent can discover and call the reviewed tools without business rules leaking into wrappers.

Scope

• Mount the pinned Python MCP SDK over streamable HTTP.
• Implement provisional tool schemas as thin auth/validation/core/redaction adapters, including search_trip operation IDs and get_search_result reads.
• Normalize principal context and enforce read/act scopes.
• Return stable error codes, safe messages, terminal receipt status distinct from business status, named next actions, and non-authorizing purpose-bound handoff locators.

Acceptance

• Every mutating tool requires an intent key and exactly the expected_versions entries assigned by its aggregate consistency set; callers cannot select append/guard roles or policies.
• Tool wrappers contain no lifecycle or mandate override logic.
• Read cursors/search IDs are bound to principal and run.
• Links contain only opaque locators, never reusable bearer/session/capability/Stripe credentials or PII; a locator alone cannot authorize mutation.
• Accepted provider work returns an operation ID and named read; replay returns the original receipt rather than rewriting it with later outcome state.
• Cold-agent tool-selection tests identify no blocking ambiguity.

Dependencies

• #10 must pass.
• #11, #12, and #15 interfaces.

Review

Independent agent-surface and redaction review.

Start by reviewing the interfaces and prerequisites in issues #10, #11, #12, and #15, then inspect the pinned Python MCP SDK and its streamable HTTP integration. Define the thin tool adapters and run the cold-agent tool-selection tests. Done means the acceptance checks pass for scopes, expected versions, principal-bound reads, opaque links, stable receipts, and redacted errors.