WebCodex v0.5 has one canonical ToolRuntime and no GPT Actions adapter, feature, frozen tool-name snapshots, or generated Action OpenAPI document. Model clients use MCP; operational clients use the authenticated Runtime API.
ToolDefinition owns tool identity, category, model visibility, schemas, effects,
authority, execution semantics, and optional Direct presentation policy. Keep
tool-contract-guidelines.md authoritative for names
and sparse model results. An intentional tool rename replaces the name everywhere;
no old-name aliases or alternate registry remain.
MCP offers dedicated descriptors plus the admitted call_runtime_tool gateway.
Its closed envelope is {tool, arguments}. Runtime HTTP uses /api/tools/call
with {tool, params, recording_session_id?}. Recorder metadata is not a business
Session selector. Both adapters enter the canonical kernel; neither may bypass
OAuth/PAT scopes, Project authority, permission, Runner capability, path policy,
Session fences, destructive confirmation or uncertain-effect handling.
Hidden/App-only tools remain independently capability-admitted. A gateway cannot turn presentation metadata into authority or call an unadmitted hidden tool. Host schema refresh and workflow guidance refresh remain distinct operations.
The MCP adapter owns WEBCODEX_MCP_TOOL_EXPOSURE. Optional workflow surfaces
remain independently configurable on Adaptive, including bounded authenticated
OAuth-client overrides. CLI is execution-only even if legacy CLI exposure flags
are enabled. Configuration never changes canonical authority. Discovery,
manifests, suggested calls, resources and dispatch must agree on admission.
See client configuration.
X-WebCodex-MCP-Surface: cli selects canonical execution tools and text projection.
Use one default command entry (run_shell), observe_jobs for bounded wait/read,
and stop_job for cancellation; specialized execution and navigation remain
available by manifest/gateway. Workflow, communication, Skills, Memory and Apps
are excluded on both dispatch routes. _wc is absent and rejected. The kernel's
request-local execution-only capability skips optional workflow/collaboration
collection before it happens; it never suppresses execution evidence or audit.
The client reads repository instructions and owns its planning/context. The
optional default Project supplies only omitted required selectors, with normal
reauthorization and source fencing. Render text after canonical audit/Job
correlation so presentation cannot change execution success or retry evidence.
Third-party passthrough retains provider semantics. Adaptive behavior is unchanged.
/healthz is a public deployment/readiness probe. /api/runtime/status is an
authenticated operational API. /api/projects/resolve-or-register is the narrow
operator workflow for exact-path convergence; ordinary project lifecycle uses
canonical tools. Account, enrollment, token-management and Runner-transport routes
keep their existing authentication boundaries and are not model tools.
The retired /openapi.json, /api/actions/{tool_name}, and Action-only
/api/artifacts/import routes are not mounted and have no route metadata admission.
Do not replace them with dummy documents, redirects, or compatibility switches.
Removing those entrypoints does not remove ActionAudit history, credential kinds,
MCP OAuth, generic Runtime HTTP or Runner wire protocols.
The old /api/shell/run, /api/shell/file, /api/shell/job, and
/api/shell/jobs/{status,log,stop,list} execution routes are also unmounted. Use
canonical tools through MCP or /api/tools/call; no deprecated endpoint or
forwarding adapter is maintained for these unused internal APIs. This does not
retire /api/shell/agent/*, whose registration, polling, result and Job-update
handlers remain part of the Runner transport. Shared Registry primitives, existing
Job recovery/cancellation and negotiated mixed-version capabilities are unchanged.
See compatibility policy.
Attachment import requires adapter-derived trusted MCP host-file provenance. Business JSON cannot assert trust. The supported paths remain a configured trusted MCP host and the authenticated OpenAI host-file path with bounded HTTPS download, DNS/IP validation and pinned resolution. Raw API calls cannot impersonate a Host. Keep streaming size bounds, content validation, partial failure, cleanup and source/destination authorization tests. Test-only download fixtures never mount an alternate public import adapter.
Test canonical parser/catalog/schema consistency, generated follow-ups, Direct and Gateway dispatch, App-only admission, OAuth/Project/permission boundaries, file-provenance rejection and authenticated operational routes. Verify retired routes and tool names fail closed in every build configuration. Test description and serialized schema budgets against the maintained MCP surface, not a retired 300-character/30-operation importer limit.