feat(mcp)!: TDQS pass — rename bootstrap_host→provision_host, get_workbench_info→describe_workbench (v3.0.0)

AGENTS.md

@@ -13,9 +13,9 @@ offloaded to a compute box (`cs run "pnpm test"`) or CI — do not run them loca
 ## Repo structure
 
 - `mcp-server/` — the `opencode-workbench` MCP server + connector (TypeScript).
-  Tools: `get_workbench_info`, `inspect_target`, `plan_clone`, `apply_clone`,
+  Tools: `describe_workbench`, `inspect_target`, `plan_clone`, `apply_clone`,
   `verify_clone`, `install_component`, `remove_component`, `update_component`,
-  `list_required_credentials`, `run_auth_flow`, `bootstrap_host`.
+  `list_required_credentials`, `run_auth_flow`, `provision_host`.
   Local + SSH transports.
   See `mcp-server/README.md` and `docs/architecture/clone-mcp.md`.
 - `connector.json` — connector manifest / registration snippet.

WORKFLOW_STATE.md

@@ -10,7 +10,7 @@
 | Phase #0 — Verify Docs | **COMPLETED** |
 | Phase #1 — Research | **COMPLETED** |
 | Phase #2 — Architecture | **COMPLETED** |
-| Phase #3 — Implementation | **COMPLETED** (clone MCP + bootstrap_host shipped) |
+| Phase #3 — Implementation | **COMPLETED** (clone MCP + provision_host shipped) |
 | VDD chain (Phase 0–8) | **COMPLETED** — `constitution.md` + `vdd/` (gates G1–G7 PASS) |
 | Distribution | In progress — npm published; Vercel live; registry publish prepared |
 
@@ -29,7 +29,7 @@ Timestamp: 2026-10-03
 |------|--------|--------|
 | Clone engine (inspect/plan/apply/verify) | DONE | `mcp-server/src/clone.ts` |
 | Consent gate + value-blind credentials | DONE | `apply_clone`/`install_component` `confirm:true`; `list_required_credentials`, `run_auth_flow` |
-| One-call provisioning | DONE | `bootstrap_host` (platform scan + upgrade plan + OpenCode pin + verify + `help`) |
+| One-call provisioning | DONE | `provision_host` (platform scan + upgrade plan + OpenCode pin + verify + `help`) |
 | Tests + CI | DONE | 49 tests; `mcp-server.yml` |
 
 ### VDD chain — DELIVERED

connector.json

@@ -3,7 +3,7 @@
   "name": "opencode-workbench",
   "title": "OpenCode Workbench",
   "description": "Clones the OpenCode workbench installation onto Linux machines, locally or over SSH.",
-  "version": "2.1.0",
+  "version": "3.0.0",
   "transport": {
     "type": "stdio",
     "command": "npx",

context7.json

@@ -1,15 +1,15 @@
 {
   "$schema": "https://context7.com/schema/context7.json",
   "projectTitle": "OpenCode Workbench (opencode-workbench)",
-  "description": "Provisions and clones the OpenCode workbench onto Linux machines — locally or over SSH — reproducing the config, MCP servers (35), agent skills (45), plugins and Docker tooling. Exposes 11 tools over stdio, including bootstrap_host for one-call provisioning and remove_component/update_component for the lifecycle.",
+  "description": "Provisions and clones the OpenCode workbench onto Linux machines — locally or over SSH — reproducing the config, MCP servers (35), agent skills (45), plugins and Docker tooling. Exposes 11 tools over stdio, including provision_host for one-call provisioning and a full install/update/remove lifecycle.",
   "folders": [
     "mcp-server",
     "docs",
     "configs"
   ],
   "rules": [
     "Run locally with `npx -y @simonmak-ascent/opencode-workbench` (Node stdio MCP server; no API key).",
-    "Drive a clone with the tool order `get_workbench_info` → `inspect_target` → `plan_clone` → `apply_clone` → `verify_clone`; use `install_component` to install a single component by id, and `bootstrap_host` for a one-call end-to-end provision (platform scan + OpenCode + apply + verify; `help:true` documents parameters).",
+    "Drive a clone with the tool order `describe_workbench` → `inspect_target` → `plan_clone` → `apply_clone` → `verify_clone`; use `install_component`/`remove_component`/`update_component` for per-component lifecycle, and `provision_host` for a one-call end-to-end provision (platform scan + OpenCode + apply + verify; `help:true` documents parameters).",
     "`apply_clone` and `install_component` are consent-gated: without `confirm:true` they return a plan and change nothing.",
     "Every tool takes a `target` of `{mode: \"local\"}` or `{mode: \"ssh\", host, user, port?, identityFile?}`.",
     "The connector never reads, transmits or writes secret values; `apply_clone` writes an empty `~/.env.workbench` template (mode 600) listing the `{env:VAR}` names to fill in.",

docs/CHANGELOG_WORKBENCH.md

@@ -3,6 +3,27 @@
 > All notable changes to the workbench configuration.
 > Format: [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
 
+## [2026-10-03] — v3.0.0
+
+### Breaking
+- Renamed the MCP tool `bootstrap_host` → **`provision_host`** for a clearer
+  standard provisioning verb (TDQS naming). Clients that call `bootstrap_host`
+  must update.
+- Renamed the MCP tool `get_workbench_info` → **`describe_workbench`** (the tool
+  describes the server; "describe" reads as its verb). Clients that call
+  `get_workbench_info` must update.
+
+### Added
+- (none)
+
+### Changed
+- TDQS description pass: behavioral transparency (what is overwritten/destroyed,
+  auth prerequisites, duration) and parameter semantics across the tool set;
+  boundary phrasing replaces "do not combine" prohibitions (disambiguation).
+- `get_component_status` was prototyped and removed as redundant with
+  `verify_clone`/`describe_workbench` (it lowered TDQS coherence). Tool count
+  remains 11.
+
 ## [2026-10-03] — v2.1.0
 
 ### Added

docs/architecture/clone-mcp.md

@@ -37,7 +37,7 @@ mcp-server/src/
 
 | Tool | Purpose |
 |------|---------|
-| `get_workbench_info` | Repo, components by tier, optional MCP add-ons. |
+| `describe_workbench` | Repo, components by tier, optional MCP add-ons. |
 | `inspect_target` | OS/arch/pkg-manager/Node/Docker/OpenCode and the *names* of credentials present. |
 | `plan_clone` | Diff the target against the profile → steps (with privileged-command previews). |
 | `apply_clone` | Consent-gated: without `confirm:true` returns the plan; with it, clones + installs. |
@@ -47,7 +47,7 @@ mcp-server/src/
 | `verify_clone` | Re-check config, env template, and every component. |
 | `list_required_credentials` | Value-blind: which keys are missing and how to acquire each. |
 | `run_auth_flow` | Emit-and-verify acquisition guidance for one credential. |
-| `bootstrap_host` | One-call provisioning: kernel-up platform scan + dry-run upgrade plan, latest-stable OpenCode with recorded version, apply + verify; `help:true` documents every parameter without touching the target. Consent-gated. |
+| `provision_host` | One-call provisioning: kernel-up platform scan + dry-run upgrade plan, latest-stable OpenCode with recorded version, apply + verify; `help:true` documents every parameter without touching the target. Consent-gated. |
 
 ### Connector model
 

docs/architecture/opencode-runtime-snapshot.md

@@ -35,9 +35,9 @@ Notes:
 
 ## MCP Tool Surface
 
-The server exposes **11 tools**: `get_workbench_info`, `inspect_target`, `plan_clone`,
+The server exposes **11 tools**: `describe_workbench`, `inspect_target`, `plan_clone`,
 `apply_clone`, `verify_clone`, `install_component`, `remove_component`,
-`update_component`, `list_required_credentials`, `run_auth_flow`, `bootstrap_host`.
+`update_component`, `list_required_credentials`, `run_auth_flow`, `provision_host`.
 
 ## Agent Configuration
 

docs/recovery/recovery-gap-analysis.md

@@ -68,7 +68,7 @@
 - Agent skills: **45** (was 28).
 - Clone MCP hardened and extended: consent gate (`confirm:true` on
   `apply_clone`/`install_component`), value-blind credential tools
-  (`list_required_credentials`, `run_auth_flow`), and `bootstrap_host` (one-call
+  (`list_required_credentials`, `run_auth_flow`), and `provision_host` (one-call
   provisioning with a kernel-up scan and a recorded OpenCode version pin).
 - Distribution: npm `@simonmak-ascent/[email protected]` published; hosted
   connector live at `https://opencode-workbench.simonmak.com/mcp`; `server.json`

glama.json

@@ -2,7 +2,7 @@
   "$schema": "https://glama.ai/mcp/schemas/server.json",
   "maintainers": ["simonmak-ascent"],
   "name": "opencode-workbench",
-  "description": "One-command reproducibility for your AI-agent workstation. Eleven tools let an agent inspect, plan, apply, verify, update, and remove an idempotent, consent-gated clone of the full OpenCode stack — the OpenCode CLI, 35 MCP servers, agent skills, plugins, and Docker infrastructure — onto any Linux machine, over SSH or locally, with zero secrets ever written. bootstrap_host does it end-to-end, including a kernel-up platform scan and a recorded OpenCode version pin.",
+  "description": "One-command reproducibility for your AI-agent workstation. Eleven tools let an agent inspect, plan, apply, verify, and manage an idempotent, consent-gated clone of the full OpenCode stack — the OpenCode CLI, 35 MCP servers, agent skills, plugins, and Docker infrastructure — onto any Linux machine, over SSH or locally, with zero secrets ever written. provision_host does it end-to-end, including a kernel-up platform scan and a recorded OpenCode version pin.",
   "repository": "https://github.com/simonmak-ascent/opencode-workbench",
   "license": "MIT",
   "runtime": "node",

llms.txt

@@ -16,7 +16,7 @@
 
 ## MCP tools (11)
 
-- `get_workbench_info` — describe this server: repo, components by tier, optional MCP add-ons
+- `describe_workbench` — describe this server: repo, components by tier, optional MCP add-ons
 - `inspect_target` — probe a machine: OS, arch, package manager, Node, Docker, OpenCode, home and npm-global paths
 - `plan_clone` — diff the target against the profile → install / present / manual steps (with command previews)
 - `apply_clone` — consent-gated: without `confirm:true` returns the plan; with it, clones + installs the profile (idempotent)
@@ -26,7 +26,7 @@
 - `update_component` — update/upgrade a single component in place (`confirm`-gated)
 - `list_required_credentials` — value-blind: which credentials are missing and how to acquire each
 - `run_auth_flow` — emit-and-verify acquisition guidance for one credential
-- `bootstrap_host` — one-call provisioning: kernel-up platform scan + dry-run upgrade plan, latest-stable OpenCode with recorded version, apply + verify; `help:true` documents every parameter without touching the target
+- `provision_host` — one-call provisioning: kernel-up platform scan + dry-run upgrade plan, latest-stable OpenCode with recorded version, apply + verify; `help:true` documents every parameter without touching the target
 
 Every tool takes a `target`:
 
@@ -35,7 +35,7 @@ Every tool takes a `target`:
 ```
 
 `apply_clone` options: `components[]`, `workspace`, `profileUrl`, `skipRepo`, `dryRun`, `confirm`.
-`bootstrap_host` options: `help`, `confirm`, `upgrade`, `assumeYes`, `opencodeVersion`, `dryRun`.
+`provision_host` options: `help`, `confirm`, `upgrade`, `assumeYes`, `opencodeVersion`, `dryRun`.
 
 ## Docs
 

mcp-server/README.md

@@ -34,15 +34,15 @@ From a checkout, use the local build instead:
 
 | Tool | Purpose |
 |------|---------|
-| `get_workbench_info` | Repo, components by tier, optional MCP add-ons. |
+| `describe_workbench` | Repo, components by tier, optional MCP add-ons. |
 | `inspect_target` | OS/arch/pkg-manager/Node/Docker/OpenCode/home/npm paths. |
 | `plan_clone` | Diff the target against the profile → steps to install / present / manual. |
 | `apply_clone` | Clone the profile + install missing components + write rendered config. Idempotent. |
 | `install_component` | Install a single component by id (consent-gated). |
 | `remove_component` | Uninstall a single component by id (bounded subset; consent-gated). |
 | `update_component` | Update/upgrade a single component in place (consent-gated). |
 | `verify_clone` | Re-check config, env template, and every component. |
-| `bootstrap_host` | One-call provisioning: kernel-up platform scan + dry-run upgrade plan, latest-stable OpenCode + version pin, apply, verify; `help:true` documents parameters without touching the target. |
+| `provision_host` | One-call provisioning: kernel-up platform scan + dry-run upgrade plan, latest-stable OpenCode + version pin, apply, verify; `help:true` documents parameters without touching the target. |
 | `list_required_credentials` | Value-blind: which credentials are missing and how to acquire each. |
 | `run_auth_flow` | Emit-and-verify acquisition guidance for one credential. |
 

mcp-server/src/bootstrap.ts

@@ -1,5 +1,5 @@
 /**
- * `bootstrap_host` orchestration: take a bare Linux target (local or SSH) to a
+ * `provision_host` orchestration: take a bare Linux target (local or SSH) to a
  * VDD-configured OpenCode workstation in one call.
  *
  * Order: inspect → platform plan (dry-run unless `upgrade`) → apply the profile

mcp-server/src/platform.ts

@@ -1,5 +1,5 @@
 /**
- * Pure, side-effect-free platform logic for `bootstrap_host`.
+ * Pure, side-effect-free platform logic for `provision_host`.
  *
  * Nothing here touches the network, the filesystem or a target: every function
  * takes plain input and returns plain output, so the whole cross-distro mapping