Fix RF3 readiness and native MCP schema and saga acceptance flows

Author: KSemenenko

README.md

@@ -342,8 +342,12 @@ source/test-image identity verification, without skips. Later native codec and
 captured-envelope criteria now close **KL-007**, with all19 mapped cases passing
 in both modes and all33 owned source files bound to the original compiled images.
 The newer cross-process ownership and read-cut regressions pass locally; their
-original Linux results remain pending. RF3, functional coverage, scale and release qualification remain
-open. The [implementation status](docs/implementation/status.json) records each
+original Linux results remain pending. Six focused local Docker RF3 flows now
+pass through the real SDK and official MCP clients, covering native schema
+discovery and autonomous saga timeout/replay. The owned image lifecycle also
+passes prepare, verify, cleanup and repeated cleanup. Full Linux RF3,
+functional coverage, scale and release qualification remain open. The
+[implementation status](docs/implementation/status.json) records each
 source and report boundary.
 
 Functional coverage excludes load/comparison runs and admits complete operation

docs/ADR/ADR-039-official-mcp-agent-api.md

@@ -309,9 +309,14 @@ and additive capture calls in existing `McpDiscoveryTests`,
 joins, builds and executes those unchanged assertion flows through actual Aspire
 Docker RF3 and the official C# MCP client, then retains original GitHub artifacts.
 
-Capture only the three exact tool input schemas before the existing assertions:
+Capture only the three exact tool input schemas and the exact shortest-path and
+partition-query output schemas before the existing assertions:
 at most 64 KiB UTF-8 per object, with at most 1 KiB safe name/context/filename/size/
-SHA-256 sidecar. Use the existing repository-root helper and unique owned files
+SHA-256 sidecar. The current-source R154/R155 output failures require retaining
+the two actual `Tool.OutputSchema` objects before any further oracle correction.
+Use a fixed output filename marker and exact official SDK capture source;
+missing/non-object outputs fail, and all five objects total at most 320 KiB per
+capture set. Use the existing repository-root helper and unique owned files
 under uploaded `artifacts/qualification/mcp-schema-evidence/`; reject unknown
 names, invalid objects, excess size and failed writes. No credential, caller
 payload, private catalog, production logger, alternate schema or synthetic
@@ -325,7 +330,8 @@ REQ-GRAPH-010 / AC-GRAPH-009 using original876c run37546085722 input captures an
 the unchanged JsonDefaults.Web decoder/exporter. Root freezes and joins the
 ClientApi contract; ci_failure_evidence Luna owns only the existing
 IntegrationTests GraphIncomingMcpSchemaAssertions,
-PartitionQueryMcpSchemaAssertions and McpGraphPathInputSchemaAssertions.
+PartitionQueryMcpSchemaAssertions, McpGraphPathInputSchemaAssertions and
+McpGraphPathSchemaAssertions.
 First review exact integer string/integer, Labels array/null and optional
 computed AtomicPartitionId string/null projections against native metadata.
 Then correct exact-set oracles, rejecting duplicates/extra types while retaining
@@ -336,7 +342,28 @@ same native exporter options; source review cannot qualify an uncaptured output
 execution. Root joins full build/quality review and actual Aspire RF3/Linux
 originals. No public API, persistence, topology, dependency or trust change,
 compatibility reader or permissive type fallback is introduced. Rollback restores
-only prior test oracles; original failed outcomes remain historical failures.
+only prior test oracles; original failed outcomes remain historical failures. The original259/884 follow-up
+repairs only the open parameters-dictionary observation (omitted additionalProperties
+is open, an explicit false remains closed; explicit values must be boolean/object)
+and the exact non-nullable string/integer output type set. No labels-input or
+public exporter change accompanies this correction.
+
+The current-source R158/R159 native output captures additionally freeze
+QueryRow.RedactedFields array/null with string items, computed
+PartitionRef.AtomicPartitionId string/null beside four required scalar identity
+strings, and GraphPath.Hops string/integer/null. Correct only the matching output
+oracles with exact sets and no duplicates, extra types or malformed entries.
+Keep all other field, required-member, item, reference-depth, hint and catalog
+checks. Root retains the original captures and failures, rebuilds and verifies
+the same official SDK/RF3 flows and Linux delivery; capture or source review alone
+does not qualify these corrections. No production or dependency change is made.
+The R162 discovery flow also exposes the placement helper's old four-property
+PartitionRef oracle. Its same native McpSchemaFactory projection requires the
+same five-property/four-required-identity contract and exact computed string/null
+set. McpPartitionPlacementSchemaAssertions joins the scoped test-only correction;
+keep exact integer string/integer sets and strict scalar string/boolean fields.
+The actual full discovery case, including placement schemas and all hints, must
+pass before this source inference is qualified. The production path is unchanged.
 
 TASK-MCP-NATIVE-FAILURE-CODE maps REQ/AC-CLIENT-006 and AC-MCP-003/005/007 to
 the existing official-client success/error flows. Root owns the ClientApi

docs/ADR/ADR-074-aspire-owned-test-entry.md

@@ -252,3 +252,22 @@ flowchart LR
     Runner --> Outcome[Original exit and MTP artifacts]
     Outcome --> Cleanup[Stop and dispose every owned AppHost]
 ```
+
+TASK-TEST-LOCAL-STARTED-IMAGE-ORDER refines REQ/AC-TEST-015 without a new
+resource or deadline. Root moves the existing native three-node healthy wait
+inside ClusterFixture.StartApplicationAsync after App.StartAsync and before
+local-image/native-coverage Docker config-ID inspection. Host startup return does
+not establish resource creation. Keep the same two-minute startup token, all
+image/receipt checks, private profile, public clients and joined partial-start
+cleanup. The actual local RF3 SDK/MCP operation is the regression; no source-text
+or getter test substitutes for it. Original R151 no-such-container failure remains
+a failed startup receipt. Local pass does not qualify Linux delivery.
+
+TASK-TEST-LOCAL-CLEANUP-COMMAND repairs the existing local owned-image container
+query under REQ/AC-TEST-015: runDocker owns the executable, so pass only `ps` and
+the existing bounded flags. Root owns the one-line local-server-image.mjs fix and
+the actual native prepare/verify/cleanup/repeated-absence operation. Preserve all
+image/receipt/label/config-ID gates and refusal of any referencing container;
+no force/prune or unrelated resource changes. Keep original failed cleanup and
+owned diagnostic removal receipts distinct from the corrected canonical flow.
+This command repair adds no resource, deadline, dependency or product contract.

docs/ADR/ADR-106-partition-owner-movement.md

@@ -250,3 +250,9 @@ the existing genuine six-container Linux test remains required. No image/provide
 change, bound increase or omitted assertion is required. Rollback changes only
 the test expectation and regression; actual Linux RF3 evidence remains required
 and unqualified. Root owns strict integration checks and original evidence.
+
+The added controlled BuildAsync model regression is validation evidence only.
+Aspire testing resumes the normal AppHost entry point; absence of an explicit
+StartAsync call is not a guarantee that resources never start. Joined application
+disposal and owned-root cleanup remain mandatory. The real homogeneous image,
+six-silo startup, membership and public fail-closed cases still qualify runtime.

docs/Features/ClientApi.md

@@ -224,15 +224,21 @@ SetDispatch are explicit parity work, not completed methods.
 
 Canonical map: Client/Server `Features/ClientApi/` transport/adapters та matching IntegrationTests/UnitTests helpers; business operations/tests зберігають owning slice name. CLI — operator/worker entry point; окремий frontend N/A. Shared contracts і host composition мають одного integration owner. Freeze protocol → real parity tests → adapters → rollout/version contract → exact GitHub TUnit/recovery/Docker RF3 evidence. Existing source/test names не виконують planned MCP/agent AC; timeout не означає rollback.
 
-TASK-MCP-NATIVE-SCHEMA-EVIDENCE retains the original official-client input schemas
+TASK-MCP-NATIVE-SCHEMA-EVIDENCE retains the original official-client schemas
 needed to diagnose AC-MCP-001 / REQ/AC-CLIENT-006. The existing discovery,
 incoming-graph and partition-query RF3 cases capture only their exact shortest-path,
 incoming-graph and partition-query `Tool.InputSchema` objects before assertions.
+The original current-source R154/R155 output assertions also require the exact
+shortest-path and partition-query `Tool.OutputSchema` objects. Capture these two
+outputs in the same existing helper and call sites before assertions, with a
+fixed output filename marker and the exact official SDK output capture source.
 Keep every strict type/nullability/required-member/item/hint assertion unchanged.
 Each UTF-8 schema is at most 64 KiB; its sidecar is at most 1 KiB and contains
 only canonical tool name, official SDK capture source, actual Aspire RF3/node1
-context, owned filename, byte count and SHA-256. Three schema payloads total at
-most 192 KiB. Unknown tool names, non-object schemas, excess bounds and failed
+context, owned filename, byte count and SHA-256. The three inputs and two outputs
+total at most 320 KiB per capture set; each object and sidecar retains the existing
+independent bound. A missing output fails capture. Unknown tool names, non-object
+schemas, excess bounds and failed
 writes fail; no credentials, caller data or private inventory is recorded.
 
 ADR-039 freezes the test-only helper
@@ -254,19 +260,46 @@ projection cannot supply authority or replace the four required constructor
 identity fields. Their required set and the computed output value remain fixed.
 
 Root owns the contract and joins. ci_failure_evidence Luna owns only
-GraphIncomingMcpSchemaAssertions, PartitionQueryMcpSchemaAssertions and
-McpGraphPathInputSchemaAssertions in their current IntegrationTests slices.
+GraphIncomingMcpSchemaAssertions, PartitionQueryMcpSchemaAssertions,
+McpGraphPathInputSchemaAssertions and McpGraphPathSchemaAssertions in their
+current IntegrationTests slices.
 Compare exact allowed sets, rejecting duplicates and extra types; distinguish
 the optional computed metadata field from required identity strings. Preserve
 all property/required-member/item/effect-hint/catalog checks and native official
 client flows. Native output uses the same unchanged exporter options; review its
 current source shape and retain output execution as unqualified until the actual
-RF3 flow passes. No production schema, decoder, public contract, dependency or
+RF3 flow passes. For the parameters dictionary, omitted
+additionalProperties is open under Draft2020-12; explicit false remains rejected.
+An explicit value must be a boolean or object schema. The original259/884
+output-version stack proves array-versus-scalar disagreement; retain the frozen
+exact string/integer output set, with no duplicate, extra or null type. Labels
+input remains unchanged. No production schema, decoder, public contract, dependency or
 trust change is authorized by this test repair. Root builds, reviews, executes
 the real Aspire RF3 SDK flows and retains exact-source Linux original reports.
 Rollback removes only the oracle corrections, preserving captured failure
 evidence and every mandatory suite. UI/storage changes are N/A.
 
+The current-source R158/R159 official SDK output captures establish the remaining
+exact output sets: QueryRow.RedactedFields is array/null with string items;
+PartitionRef.AtomicPartitionId is string/null, while its four required identity
+strings remain scalar strings; GraphPath.Hops is exactly string/integer/null.
+Use those exact sets in the same existing output assertions, rejecting duplicates,
+extra types and malformed entries. Keep every field, required-member, item,
+reference-depth, catalog and effect-hint assertion. The captured output hashes
+are respectively `248fd97e9a3105df3d6376640b9eb82350fffa8fd829de5e55e04bec85970eb2`
+and `39c7b94a0a86777a5fb007407da7aa576d4b54f3164f5dce6bf05caf76075cf9`.
+Captured failed flows remain failed; actual passing SDK/RF3 and delivered Linux
+qualification are required after these precise oracle corrections.
+R162 subsequently reached the placement tools and failed their common
+PartitionRef property-set oracle. McpSchemaFactory exports their same canonical
+PartitionRef through the same native projection and input/output transforms as
+the captured graph/query tools. McpPartitionPlacementSchemaAssertions must also
+require the exact five properties, keep only the four constructor identities
+required, and check computed AtomicPartitionId's exact string/null set. Keep
+integer string/integer sets exact and scalar string/boolean fields strict. This
+source-bound inference still requires the actual full discovery flow to pass;
+no placement operation, schema exporter or authority rule changes.
+
 TASK-MCP-NATIVE-FAILURE-CODE supports REQ/AC-CLIENT-006 and AC-MCP-003/005/007
 after the original876c saga-timeout RF3 invocation returned IsError without its
 safe classification in the failed assertion. Root freezes and joins; a Luna

docs/Features/ClusterRouting/PartitionTransfer.md

@@ -385,6 +385,9 @@ packet; root owns the final join and gates. The added actual KeyLoad AppHost
 BuildAsync-only flow rejects one test-owned altered digest without changing any
 of the six image annotations, restores that input and verifies the healthy model.
 Its controlled immutable model reference is validation input, not registry or
-runtime evidence; it never starts containers or fabricates an image receipt.
+runtime evidence; it does not explicitly call StartAsync or fabricate an image
+receipt. The native testing builder resumes the AppHost entry point, so absence
+of that explicit call does not establish that resources never started. The owned
+application is disposed and joined before removing its private root.
 Retain the existing six-node real-image startup and client flow for Linux
 qualification. Rollback removes only this oracle correction and model regression.

docs/Features/Messaging/RecurringSaga.md

@@ -181,11 +181,18 @@ For creator/caller policy tests, create future work, revoke the creator before
 the real due instant, and prove unchanged state after it. Check caller rejection
 while creator remains revoked; restore the caller and then creator before the
 positive transition and full projected SDK/MCP inspection. Use a long interval
-so the one accepted due occurrence remains exact. For saga expiry, independently
-derive the frozen S2 command ID, use the same creator and exact ExpireSaga payload,
-and require complete SDK/MCP receipt convergence whether service or public call
-commits first. Retain real early Validation, Waiting before deadline, TimedOut
-revision2, one timeout ID/message, ACK replay and no second transition.
+so the one accepted due occurrence remains exact. For saga expiry, leave the
+native service active and do not derive or expose its private command ID. After
+the autonomous transition reaches TimedOut revision2, replay the exact previously
+admitted Waiting-create command through the other public client and require the
+original complete receipt. Then submit an ExpireSaga with a fresh command ID and
+the stale expected revision through both SDK and MCP; both must report
+RevisionConflict while state remains terminal and the single timeout message
+remains unchanged. The coordinator creates a fresh private command ID for each
+new dispatch and reuses it only for that dispatch's single uncertainty retry;
+lost-ACK remains a separate acceptance case. Retain real early Validation,
+Waiting before deadline, TimedOut revision2, one timeout ID/message, ACK replay
+and no second transition.
 The service is always active; no fake clock, private expiry call, weakened
 terminal assertion or expected-response race may stand in for these proofs.
 Luna cluster_wave owns only the three existing Messaging RF3 cases and their

docs/Features/TestInfrastructure.md

@@ -80,7 +80,13 @@ receipt. A dirty working tree is identified by these inputs, never a fabricated
 GitHub revision. The config ID is not a registry manifest digest. Before startup,
 the child verifies receipt schema/bounds, current input fingerprint, actual image
 ID/label and all three modeled tags. After startup it verifies each owned container's
-actual image config ID. Missing, oversized or malformed receipts, changed inputs,
+actual image config ID. StartAsync schedules resources asynchronously; await the
+existing native three-resource healthy readiness within the unchanged two-minute
+fixture startup token before inspecting their actual config IDs. Both local-image
+and native coverage started-image verification follow that readiness, and all
+public SDK/MCP operations remain after verification. Do not treat host StartAsync
+return as proof that Docker has created containers or add a separate retry/deadline.
+Missing, oversized or malformed receipts, changed inputs,
 wrong tags/labels/IDs and conflicting proof selectors fail before database effects.
 
 Build failure prevents runner execution. Every failure/cancellation joins the
@@ -99,6 +105,16 @@ Retain the original development receipt and native test reports. Local results c
 qualify delivered-source Linux CI, registry image provenance or website metrics;
 the existing GitHub image producer and verifiers remain mandatory and unchanged.
 
+TASK-TEST-LOCAL-CLEANUP-COMMAND refines the same REQ/AC-TEST-015 owner contract.
+`local-image-process.mjs` already selects the Docker executable; the owned-image
+container query in `local-server-image.mjs` must pass only `ps` and its bounded
+arguments, never a second executable token. Root repairs that command after the
+actual R149 image's canonical cleanup failed. Verify the full native owned-image
+prepare, identity verification, cleanup and repeated-absence cleanup operation.
+Keep receipt/label/config-ID checks, zero running or stopped referencing
+containers, non-force removal and all original process/reader joins. This local
+tooling operation does not qualify database RF3, Linux delivery or coverage.
+
 TASK-TEST-LOCAL-CONTEXT-REALIZATION implements this existing REQ/AC-TEST-015
 snapshot and cleanup contract. Root freezes and owns the joins; unpack_atomicity
 Luna owns only `scripts/Features/TestInfrastructure/local-image-context.mjs`,