Governed execution layer for AI agents — MCP server with Y*gov runtime enforcement
This server has significant definition quality gaps. While tool names follow verb_noun patterns (gov_article11_pass, gov_rapid_assign), descriptions are domain-specific but lack clarity for LLM selection. Most critically, parameter descriptions are minimal or absent, e.g., gov_article11_pass layers lack guidance on what 'Gemma reflection' or 'self-audit check' mean in practice. Input schemas are present but sparse: no enums, no min/max constraints, no format specifications. Output schemas are undocumented, tools return JSON strings but the structure is not formally declared. Error handling is minimal; most tools return {'ok': false, 'error': str(e)} without recovery guidance. The domain (governance/audit) is niche and the tool set appears internally coherent, but the definitions would confuse an LLM about when to invoke each tool and what valid inputs look like.
Validate 6-pager brief structure (AMENDMENT-010 §2.1). Checks for 8 required section headings (flexible matching): Problem, Customer, Solution, Strategy, Tenets, FAQ, Scope-Adjacent, Appendix.
Record a 7-layer Article 11 pre-response check (AMENDMENT-009 §2.5). Each layer must be ≥20 chars. This creates a CIEU audit trail that article11_compliance.py can verify before allowing substantive CEO responses.
Run a single boot contract gate check (AMENDMENT-009 §3). Reads .ystar_session.json.boot_contract.mandatory_gates_order, runs the specified gate, returns pass/fail/warn.
Install governance contracts for a project directory.
Scan for missing governance checks in recent actions.
Verify file path access is within allowed scopes.
Parameter descriptions are vague or missing context. E.g., 'layer_5_gemma' is described as 'Gemma reflection (≥20 chars)' but does not explain what 'Gemma reflection' means in the governance context. LLMs cannot infer domain-specific semantics.
No input validation constraints (enums, min/max, regex patterns) in schemas. E.g., gov_rapid_assign accepts R, A, P, I, D as free-form strings with no guidance on valid role names. LLMs will hallucinate invalid role values.
Output schemas are not documented. Tools return JSON strings (e.g., {'ok': True, 'ts': ts, 'latency_ms': ...}) but the response structure is not formally declared. LLMs cannot plan downstream tool calls without knowing what fields to expect.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 46 | 2026-07-28+ | v2 |
Query CIEU audit log (Contextual, Intervention, Execution, Update records).
Assign RAPID roles for a decision (AMENDMENT-009 §4). R = Recommend, A = Agree, P = Perform, I = Input, D = Decide. All role fields must be non-empty strings.
Trigger secretary curation workflow (AMENDMENT-009 §5). Initiates a structured review process for content curation.
Register a new skill with 4 required sections (AMENDMENT-010 §3). Creates a skill record with structured metadata.
Mark content as deprecated via sidecar ledger (AMENDMENT-010 §4). Records deprecation metadata for content lifecycle management.
Error handling lacks recovery guidance. Errors return {'ok': False, 'error': str(e)} with no actionable next steps. E.g., 'CIEU write failed: ...' tells the LLM nothing about whether to retry, call a different tool, or ask the user.
Tool descriptions lack WHEN/WHY context. E.g., 'Assign RAPID roles for a decision' does not explain when to call this vs other governance tools, or what a 'decision' is in this system. LLMs cannot disambiguate tool selection.