feat(addie): add dormant direct replay contract

[bokelley]

Summary\n- Extract the existing global/request-local direct tool merge into the client’s private request assembly.\n- Mint a WeakMap-backed, single-use, audit-only opaque contract only from the authenticated public official-docs channel assembly; it is not persisted or connected to fixed-trace/replay dispatch.\n- Add bounded parity and tamper/lifecycle tests.\n\n## Checks\n-

RUN v4.1.11 /home/vercel-sandbox/adcp/server

{"level":30,"time":1788634988377,"processRole":"worker","module":"storyboards","id":"acme_outdoor_live","msg":"Loaded test kit"}
{"level":30,"time":1788634988387,"processRole":"worker","module":"storyboards","id":"acme_outdoor","msg":"Loaded test kit"}
{"level":30,"time":1788634988392,"processRole":"worker","module":"storyboards","id":"bistro_oranje","msg":"Loaded test kit"}
{"level":30,"time":1788634988405,"processRole":"worker","module":"storyboards","id":"nova_motors","msg":"Loaded test kit"}
{"level":30,"time":1788634988410,"processRole":"worker","module":"storyboards","id":"osei_natural","msg":"Loaded test kit"}
{"level":30,"time":1788634988413,"processRole":"worker","module":"storyboards","id":"rate_limit_trip_runner","msg":"Loaded test kit"}
{"level":30,"time":1788634988416,"processRole":"worker","module":"storyboards","id":"signed_requests_runner","msg":"Loaded test kit"}
{"level":30,"time":1788634988430,"processRole":"worker","module":"storyboards","id":"substitution_observer_runner","msg":"Loaded test kit"}
{"level":30,"time":1788634988435,"processRole":"worker","module":"storyboards","id":"summit_foods","msg":"Loaded test kit"}
{"level":30,"time":1788634988440,"processRole":"worker","module":"storyboards","id":"webhook_receiver_runner","msg":"Loaded test kit"}
{"level":30,"time":1788634988440,"processRole":"worker","module":"storyboards","testKits":10,"msg":"Test kits loaded"}

Test Files 1 passed (1)
Tests 14 passed (14)
Start at 19:03:05
Duration 4.51s (transform 1.37s, setup 91ms, import 4.22s, tests 76ms, environment 0ms)\n-

adcontextprotocol@3.2.0-rc.1 test:addie-fixed-traces
vitest run --config server/vitest.config.ts server/tests/unit/addie/fixed-trace-suite.test.ts

RUN v4.1.11 /home/vercel-sandbox/adcp/server

{"level":30,"time":1788634993101,"processRole":"worker","module":"storyboards","id":"acme_outdoor_live","msg":"Loaded test kit"}
{"level":30,"time":1788634993108,"processRole":"worker","module":"storyboards","id":"acme_outdoor","msg":"Loaded test kit"}
{"level":30,"time":1788634993110,"processRole":"worker","module":"storyboards","id":"bistro_oranje","msg":"Loaded test kit"}
{"level":30,"time":1788634993118,"processRole":"worker","module":"storyboards","id":"nova_motors","msg":"Loaded test kit"}
{"level":30,"time":1788634993121,"processRole":"worker","module":"storyboards","id":"osei_natural","msg":"Loaded test kit"}
{"level":30,"time":1788634993123,"processRole":"worker","module":"storyboards","id":"rate_limit_trip_runner","msg":"Loaded test kit"}
{"level":30,"time":1788634993124,"processRole":"worker","module":"storyboards","id":"signed_requests_runner","msg":"Loaded test kit"}
{"level":30,"time":1788634993132,"processRole":"worker","module":"storyboards","id":"substitution_observer_runner","msg":"Loaded test kit"}
{"level":30,"time":1788634993134,"processRole":"worker","module":"storyboards","id":"summit_foods","msg":"Loaded test kit"}
{"level":30,"time":1788634993136,"processRole":"worker","module":"storyboards","id":"webhook_receiver_runner","msg":"Loaded test kit"}
{"level":30,"time":1788634993136,"processRole":"worker","module":"storyboards","testKits":10,"msg":"Test kits loaded"}

Test Files 1 passed (1)
Tests 51 passed (51)
Start at 19:03:10
Duration 5.31s (transform 2.00s, setup 84ms, import 4.94s, tests 165ms, environment 0ms)\n- focused replay/tool-orchestration/direct-selection suites (116 tests)\n-

adcontextprotocol@3.2.0-rc.1 typecheck
tsc --project server/tsconfig.json --noEmit\n- \n\n
adcontextprotocol@3.2.0-rc.1 test:addie-tools
tsx scripts/build-addie-tool-reference.ts --check && tsx scripts/build-addie-tool-surface-inventory.ts --check && node scripts/check-addie-tool-inventory-portability.mjs

✓ Addie tool reference up to date (249 tools, 67 sets).
[19:03:28] ^[[33mWARN^[[39m: ^[[36mDEV MODE ENABLED - Auth bypass active. DO NOT use in production!^[[39m
^[[35mprocessRole^[[39m: "worker"
^[[35mmodule^[[39m: "auth-middleware"
^[[35mavailableUsers^[[39m: [
"admin",
"member",
"personal",
"nonmember",
"leader",
"learner1",
"learner2",
"learner3",
"builder"
]
^[[35mnodeEnv^[[39m: "test"
^[[35moverrideAllowed^[[39m: false
[19:03:28] ^[[32mINFO^[[39m: ^[[36mVisit /auth/login to select a test user^[[39m
^[[35mprocessRole^[[39m: "worker"
^[[35mmodule^[[39m: "auth-middleware"
[19:03:28] ^[[32mINFO^[[39m: ^[[36mAdmin API key configured for programmatic access^[[39m
^[[35mprocessRole^[[39m: "worker"
^[[35mmodule^[[39m: "auth-middleware"
[19:03:28] ^[[32mINFO^[[39m: ^[[36mLoaded test kit^[[39m
^[[35mprocessRole^[[39m: "worker"
^[[35mmodule^[[39m: "storyboards"
^[[35mid^[[39m: "acme_outdoor_live"
[19:03:28] ^[[32mINFO^[[39m: ^[[36mLoaded test kit^[[39m
^[[35mprocessRole^[[39m: "worker"
^[[35mmodule^[[39m: "storyboards"
^[[35mid^[[39m: "acme_outdoor"
[19:03:28] ^[[32mINFO^[[39m: ^[[36mLoaded test kit^[[39m
^[[35mprocessRole^[[39m: "worker"
^[[35mmodule^[[39m: "storyboards"
^[[35mid^[[39m: "bistro_oranje"
[19:03:28] ^[[32mINFO^[[39m: ^[[36mLoaded test kit^[[39m
^[[35mprocessRole^[[39m: "worker"
^[[35mmodule^[[39m: "storyboards"
^[[35mid^[[39m: "nova_motors"
[19:03:28] ^[[32mINFO^[[39m: ^[[36mLoaded test kit^[[39m
^[[35mprocessRole^[[39m: "worker"
^[[35mmodule^[[39m: "storyboards"
^[[35mid^[[39m: "osei_natural"
[19:03:28] ^[[32mINFO^[[39m: ^[[36mLoaded test kit^[[39m
^[[35mprocessRole^[[39m: "worker"
^[[35mmodule^[[39m: "storyboards"
^[[35mid^[[39m: "rate_limit_trip_runner"
[19:03:28] ^[[32mINFO^[[39m: ^[[36mLoaded test kit^[[39m
^[[35mprocessRole^[[39m: "worker"
^[[35mmodule^[[39m: "storyboards"
^[[35mid^[[39m: "signed_requests_runner"
[19:03:28] ^[[32mINFO^[[39m: ^[[36mLoaded test kit^[[39m
^[[35mprocessRole^[[39m: "worker"
^[[35mmodule^[[39m: "storyboards"
^[[35mid^[[39m: "substitution_observer_runner"
[19:03:28] ^[[32mINFO^[[39m: ^[[36mLoaded test kit^[[39m
^[[35mprocessRole^[[39m: "worker"
^[[35mmodule^[[39m: "storyboards"
^[[35mid^[[39m: "summit_foods"
[19:03:28] ^[[32mINFO^[[39m: ^[[36mLoaded test kit^[[39m
^[[35mprocessRole^[[39m: "worker"
^[[35mmodule^[[39m: "storyboards"
^[[35mid^[[39m: "webhook_receiver_runner"
[19:03:28] ^[[32mINFO^[[39m: ^[[36mTest kits loaded^[[39m
^[[35mprocessRole^[[39m: "worker"
^[[35mmodule^[[39m: "storyboards"
^[[35mtestKits^[[39m: 10 is currently blocked by a pre-existing stale generated tool-surface inventory; this change does not modify tool registries. The full pre-commit server-unit umbrella suite reached its configured 600-second timeout, while focused checks passed.\n\n## Safety\nNo provider, tool, budget, credential, output, routing, rollout, or evaluation-dispatch path consumes the capability in this PR.

---

Open workspace in Conductor

[aao-secretariat]

Ladon verdict: Approve

Approve — clean Addie/server-only change with no blocking or medium findings.

Scope reviewed: PR #7297 adds a dormant, WeakMap-backed, single-use, audit-only direct-replay contract for Addie. Changes are confined to server/src/addie/** plus a new test file — no schema (static/schemas/source/**), no dist/** artifacts, no docs, no changeset-eligible protocol surface.

Why no gates fire:

• Row 1: No critical/high findings.
• Row 2: gated_paths is false, so the review_decision (REVIEW_REQUIRED) gate does not apply.
• Row 3: No (deleted) high-risk reasons — all three high-risk matches are (modified).
• Rows 4–5: No medium findings, so the modified-high-risk-file escalation does not trigger.
• Row 6: No prior decision.
• Row 7: No no-auto-approve team match.
• Row 8: Fewer than three medium findings (zero).
• Falls through to Row 9 → approve.

The high_risk: true flag is a heuristic on server/src/addie/** modifications; the reviewer confirmed the refactor is behavior-preserving, minting/consumption fail closed, and it ships with 261 lines of parity/tamper/lifecycle tests. No repo-specific governance gate (schema↔docs, changeset, oneOf, immutable artifacts, breaking-class) applies to this Addie-only diff.