refactor(dev)!: delete the runtime provider MCP contract (#855)

* refactor(dev)!: delete the runtime provider MCP contract

Nothing in the host consumes a provider's MCP registry, clientSurface(), or
run results' app binding since the runtime App path was removed (#852).
Delete them from agent-bundle: the RuntimeMcpRegistry implementation and
createRuntimeMcpRegistry, DevRuntimeSession.mcpRegistry and clientSurface(),
DevRuntimeInspectionEnvelope.app, the runtime.mcp.* events and their fields,
and every DevRuntimeMcp*/RuntimeMcp* type. The Workbench runtime client now
rejects an app field in run inspections.

Rework examples/rsc-agent-runtime so its dev provider no longer hosts an
in-process MCP registry or App client surface: activation commits only the
generation store, generation metadata drops the registry descriptors and
digests, and MCP tool runs no longer return an App binding. Hooks and MCP
tools still share the durable kernel, which a new lifecycles e2e step
checks end to end.

* fix(example): recover from a failed prepared-runtime reconcile

Return the runtime to active once a reconcile succeeds after a failed one,
abort a prepared activation when the test seam throws, cover a provider-path
latch on an active session, and describe what the dev session still serves.

* docs(changeset): reference #855

Author: ScriptedAlchemy

.changeset/remove-runtime-provider-mcp.md

@@ -0,0 +1,5 @@
+---
+"agent-bundle": minor
+---
+
+Remove the runtime provider MCP contract from `agent-bundle/api`. `DevRuntimeSession` no longer has `mcpRegistry` or `clientSurface()`, `createRuntimeMcpRegistry` and the `DevRuntimeMcp*`, `RuntimeMcp*`, `DevRuntimeProviderMcpRegistry`, and `DevRuntimeClientSurfaceEndpoint` types are gone, run inspections (`DevRuntimeInspectionEnvelope`) no longer carry `app`, and `DevRuntimeEventInput` and the root `RuntimeEvent` type drop the `runtime.mcp.*` events with their `mcpRegistryRevision`, `mcpSessionId`, and `mcpSessionRevision` fields. The Workbench rejects a run inspection that still includes `app` (`AB8206`). `createRuntimeGenerationStore` and the generation store contracts are unchanged. (#855)

agent-patterns/effect-errors.md

@@ -26,8 +26,8 @@ onto those classes at the boundary. It does not replace them.
 - Typed fail, framework-process class (dev seam / eval service, extends
   `YieldableFrameworkError` or `YieldableCodedError` from
   `packages/agent-bundle/src/effect/errors.ts`):
-  `return yield* new RuntimeMcpRegistryError('RUNTIME_MCP_REGISTRY_CLOSED', message)`.
-  `Effect.fail(new RuntimeMcpRegistryError(...))` is equally valid; do not
+  `return yield* new RuntimeGenerationStoreError('RUNTIME_GENERATION_CLOSED', message)`.
+  `Effect.fail(new RuntimeGenerationStoreError(...))` is equally valid; do not
   churn call sites for style.
 - Defect (bug): `Effect.die(defect)`: not for expected fail-closed states.
 - Recover: `Effect.catch`, `Effect.catchTag` when the error is tagged.

docs/architecture/rsc-runtime-workbench.md

@@ -39,7 +39,6 @@ packages/
     src/dev/runtime-app-message-limits.ts
     src/dev/runtime-controller.ts
     src/dev/runtime-generation-store.ts
-    src/dev/runtime-mcp-registry.ts
     src/dev/runtime-provider-loader.ts
     src/dev/runtime-provider.ts
     src/dev/runtime-routes.ts
@@ -80,7 +79,6 @@ packages/
     tests/rsc-runtime-optional-packaging.test.ts
     tests/rsc-runtime-topology-script.test.ts
     tests/runtime-generation-store.test.ts
-    tests/runtime-mcp-registry.test.ts
     tests/runtime-provider.test.ts
     tests/runtime-routes.test.ts
   workbench/
@@ -208,12 +206,10 @@ is local to that invocation. Durable Runtime export/evaluation promotion,
 provider adapters, authenticated APIs, and timeline UI ownership are not wired
 by this topology.
 
-Artifact epoch, runtime generation, state version, definition digest, MCP
-session, and run identity are separate axes. A generation is staged and
-validated, then atomically activated; leases keep the immutable generation
-available for a selected run. Failed preparation retains the last good active
-generation. Static MCP definitions and the broker survive independently of
-generation-pinned invocations and binding authority.
+Artifact epoch, runtime generation, state version, and run identity are
+separate axes. A generation is staged and validated, then atomically
+activated; leases keep the immutable generation available for a selected run.
+Failed preparation retains the last good active generation.
 
 Host-facing adoption is a further, separately gated axis (#179 / #218 stage 4).
 `EpochAdoptionPolicy` sits between `artifact.available` and the two surfaces a

docs/effect-conventions.md

@@ -66,8 +66,7 @@ Internals keep the existing classes.
 
 Framework-process error classes, the ones raised inside Effect programs in
 the dev seam and the eval service whose declarations no package export
-reaches (today: `DevCoordinatorCloseError`, `RuntimeMcpRegistryError` /
-`RuntimeMcpRegistryCloseError`, `RuntimeGenerationStoreError` /
+reaches (today: `DevCoordinatorCloseError`, `RuntimeGenerationStoreError` /
 `RuntimeGenerationStoreCloseError`, `DevRuntimeProviderLoadError`,
 `ScriptPlaygroundFailure` / `ScriptPlaygroundAbortError`,
 `LifecycleReplayRequestError`, `ArtifactInspectionServiceError`,

examples/rsc-agent-runtime/README.md

@@ -80,15 +80,18 @@ console before rejecting.
 The published Agent Bundle library is built with Rslib. This example's separate
 production RSC/runtime artifacts are built by its explicit Rsbuild production
 command (`pnpm --filter @agent-bundle/rsc-agent-runtime-demo build`); its provider
-uses a separate long-lived Rsbuild development/HMR session only when an
-`agent-bundle dev` project opts into `dev.runtime.provider`. The session uses
-development entries, output roots, and HMR topology while compiling every
+uses a separate long-lived Rsbuild development session only when an
+`agent-bundle dev` project opts into `dev.runtime.provider`. That session
+compiles each change into a runtime generation, publishes its hook, MCP tool,
+resource, and App surfaces to the Workbench runtime routes, and serves
+generation assets through them; no browser connects to its loopback Rsbuild
+server. The session uses development entries and output roots while compiling every
 environment in production mode: production decoders cannot read development
 Flight payloads, and Rsbuild only inlines the App's scripts and styles in
 production mode. `@rsbuild/plugin-react` is configured as
-`pluginReact({ fastRefresh: false })`: the compiler App is an opaque srcdoc
-child with `hmr: false`, and the runtime-surface outer document owns the one
-HMR socket. The `widget` and `app` web environments set
+`pluginReact({ fastRefresh: false })` and the App environment sets
+`hmr: false`: the self-contained App document never receives a browser HMR
+credential or connection. The `widget` and `app` web environments set
 `overrideBrowserslist: ['chrome >= 144']` for the Chromium MCP App hosts
 (Cursor 3.18.25 still ships Chromium 144; Claude Desktop Electron 42 and
 Cursor 3.19.7 ship Chromium 148; ChatGPT/Codex Desktop reports Chromium 151).

examples/rsc-agent-runtime/rsbuild.config.ts

@@ -5,7 +5,6 @@ import { dirname, join } from 'node:path';
 import {
   defineConfig,
   type RsbuildConfig,
-  type RsbuildDevServer,
   type RsbuildPlugin,
   type Rspack,
 } from '@rsbuild/core';
@@ -29,11 +28,10 @@ import { emitRuntimeArtifacts } from './src/build/emit-artifacts.js';
 export const rscRuntimeBrowserHost = Object.freeze(['chrome >= 144'] as const);
 
 /**
- * The compiler App is an opaque srcdoc child (`hmr: false`) and the
- * runtime-surface outer document owns the one HMR socket. Fast Refresh
- * would inject a refresh runtime into a self-contained HTML document that
- * must never receive a browser HMR credential. The Flight widget is client
- * JS, not a refreshable SPA.
+ * The development session serves no browser client (`hmr: false`). Fast
+ * Refresh would inject a refresh runtime into a self-contained HTML document
+ * that must never receive a browser HMR credential. The Flight widget is
+ * client JS, not a refreshable SPA.
  */
 export const rscRuntimeReactPluginOptions = Object.freeze({ fastRefresh: false } as const);
 
@@ -75,13 +73,6 @@ const isCompileEnvironmentName = (value: string): value is RscRuntimeCompileEnvi
 export interface RscRuntimeRsbuildConfigOptions {
   readonly compilerRoot?: string;
   readonly mode: 'development' | 'production';
-  /**
-   * Provider-owned reload signal: invoked once for each later successful,
-   * changed App environment compilation. This callback replaces
-   * `hot.send('full-reload')`, so no consumer has to parse Rsbuild's private
-   * WebSocket envelope to learn that the App surface changed.
-   */
-  readonly onAppReload?: () => void;
   readonly onCompile?: Readonly<{
     /**
      * Allocates the monotonic identity for one completed MultiStats cohort.
@@ -122,65 +113,6 @@ export interface RscRuntimeRsbuildConfigOptions {
   }>;
 }
 
-const appOutputContentHash = (stats: Rspack.Stats): string | undefined => {
-  try {
-    const assets = [...stats.compilation.getAssets()].sort((left, right) =>
-      left.name < right.name ? -1 : left.name > right.name ? 1 : 0);
-    const hash = createHash('sha256');
-    hash.update(`${assets.length}:`);
-    for (const asset of assets) {
-      const name = Buffer.from(asset.name);
-      const content = asset.source.buffer();
-      hash.update(`${name.byteLength}:`);
-      hash.update(name);
-      hash.update(`${content.byteLength}:`);
-      hash.update(content);
-    }
-    return hash.digest('hex');
-  } catch {
-    return undefined;
-  }
-};
-
-const runtimeAppReloadPlugin = (
-  onAppReload: NonNullable<RscRuntimeRsbuildConfigOptions['onAppReload']>,
-): RsbuildPlugin => {
-  let devServer: RsbuildDevServer | undefined;
-  let lastAppOutput: string | undefined;
-  return {
-    name: 'agent-bundle:rsc-runtime-app-reload',
-    setup(api) {
-      api.onAfterCreateCompiler(({ environments }) => {
-        if (environments.app === undefined) {
-          throw new Error('RSC runtime compiler did not expose the App environment.');
-        }
-      });
-      api.onBeforeStartDevServer(({ server }) => {
-        devServer = server;
-        lastAppOutput = undefined;
-      });
-      api.onCloseDevServer(() => {
-        devServer = undefined;
-        lastAppOutput = undefined;
-      });
-      api.onAfterEnvironmentCompile(({ environment, isFirstCompile, stats }) => {
-        if (devServer === undefined || environment.name !== 'app' || stats === undefined || stats.hasErrors()) return;
-        // Rspack stats hashes can change across watch completions whose
-        // emitted App bytes are identical. The complete asset set is the
-        // browser-visible identity; an unreadable set remains unidentifiable
-        // and reloads at least once without clobbering the retained identity.
-        const output = appOutputContentHash(stats);
-        if (output !== undefined) {
-          if (lastAppOutput === output) return;
-          lastAppOutput = output;
-        }
-        if (isFirstCompile) return;
-        onAppReload();
-      });
-    },
-  };
-};
-
 const emitRuntimeManifest = (): RsbuildPlugin => ({
   apply: 'build',
   name: 'emit-rsc-agent-runtime-manifest',
@@ -316,10 +248,10 @@ const runtimeCompileObserverPlugin = (
           const environmentHashes = Object.freeze(Object.fromEntries(
             compileEnvironmentNames.map((name) => [name, cohortHashes.get(name) as string]),
           )) as RscRuntimeCompileEnvironmentHashes;
-          // The App environment ships through its own dev-server surface, so
-          // only the rsc and widget children define the source revision that
-          // decides whether a new runtime generation is needed. The App child
-          // hash still selects which staged App checkpoint joins the cohort.
+          // Only the rsc and widget children define the source revision that
+          // decides whether a new runtime generation is needed; an App-only
+          // edit joins the next generation. The App child hash still selects
+          // which staged App checkpoint joins the cohort.
           const hashes = (['rsc', 'widget'] as const).map((name) => [name, cohortHashes.get(name) as string]);
           const sourceRevision = createHash('sha256').update(JSON.stringify(hashes)).digest('hex');
           snapshot = await observer.capture({
@@ -383,16 +315,14 @@ export const createRscRuntimeRsbuildConfig = (
       // Port 0 lets the OS assign the listener. Rsbuild's default (3000 with an
       // incrementing probe) makes every concurrent runtime session on a host
       // race for the same first candidate, which surfaces as EADDRINUSE when
-      // suites run in parallel. Consumers read the resolved port back from
-      // `rsbuild.context.devServer`.
+      // suites run in parallel.
       server: { host: '127.0.0.1', port: 0, printUrls: false },
     } : {}),
     plugins: [
       pluginReact(rscRuntimeReactPluginOptions),
       pluginRSC({ environments: { server: 'rsc', client: 'widget' } }),
       emitRuntimeManifest(),
       selfContainedAppPlugin(),
-      ...(options.onAppReload === undefined ? [] : [runtimeAppReloadPlugin(options.onAppReload)]),
       ...(options.onCompile === undefined ? [] : [runtimeCompileObserverPlugin(options.onCompile)]),
     ],
     environments: {
@@ -456,9 +386,8 @@ export const createRscRuntimeRsbuildConfig = (
       app: {
         ...(development ? {
           dev: {
-            // The trusted runtime-surface outer document owns the one HMR
-            // socket.  The compiler App itself runs in an opaque srcdoc child
-            // and must never receive a browser HMR credential or connection.
+            // The development session serves no browser client; the compiled
+            // App must never receive a browser HMR credential or connection.
             hmr: false,
             liveReload: false,
           },