- Version: 1.3
- Published: 2026-08-27
- Status: recorded-scope client-admission update
- Evidence sources: ADR-0004,
ADR-0010,
dependency policy, and the released
context-enginestructural-language inventory.
This matrix describes shipped capabilities, not aspirations. A language label on an evaluation fixture is not a structural-support claim.
The matching machine-readable release artifact is
compatibility-manifest-v1.json.
| Level | Meaning |
|---|---|
| Discovery | Eligible regular files can be fingerprinted and represented as metadata. |
| Lexical evidence | UTF-8 files can participate in exact path, filename, literal, and lexical retrieval with recoverable evidence. |
| Structural evidence | The isolated project-owned worker and resolver can emit snapshot-bound structural facts with source provenance and explicit unresolved or truncated states. |
| Unsupported or partial | The engine reports an explicit limitation, exclusion, or unsupported state; it does not imply semantic analysis. |
Discovery and lexical evidence remain subject to the workspace policy, encoding, file-size, generated-file, and exclusion rules. Invalid UTF-8 and binary files may be discoverable as metadata but do not receive text evidence.
| Language or file family | Discovery | Lexical evidence when UTF-8 eligible | Structural evidence | Notes |
|---|---|---|---|---|
TypeScript (.ts) |
Yes | Yes | Yes | Pinned TypeScript Tree-sitter grammar and project-owned resolver. |
TSX (.tsx) |
Yes | Yes | Yes | Pinned TSX grammar and project-owned resolver. |
JavaScript (.js, .mjs, .cjs) |
Yes | Yes | Yes | Pinned JavaScript grammar and project-owned resolver. |
JSX (.jsx) |
Yes | Yes | Yes | Pinned JSX grammar and project-owned resolver. |
Python (.py) |
Yes | Yes | Yes | Pinned Python Tree-sitter grammar and project-owned syntax resolver. Python imports, declarations, containment, calls, and references are syntax-derived only; no interpreter, environment, package, or runtime resolution is performed. |
Java (.java) |
Yes | Yes | Yes | Pinned Java Tree-sitter grammar and project-owned syntax resolver. Type and method declarations, non-static non-wildcard imports, direct unqualified method calls, and references are syntax-derived only; no Java compiler, classpath, package, module, build-tool, annotation, dependency, or runtime resolution is performed. |
Kotlin (.kt, .kts) |
Yes | Yes | Yes | Pinned Kotlin Tree-sitter grammar and project-owned syntax resolver. Named classes, objects, functions, and type aliases; non-wildcard/non-aliased imports; direct identifier calls; and references are syntax-derived only. No Kotlin compiler, Gradle, classpath, package, dependency, annotation, coroutine, extension-dispatch, or runtime resolution is performed. |
C# (.cs) |
Yes | Yes | Yes | Pinned C# Tree-sitter grammar and project-owned syntax resolver. Classes, records, structs, delegates, constructors, named methods, non-static/non-aliased using directives, direct identifier calls, and references are syntax-derived only. No .NET compiler, MSBuild, project, package, dependency, attribute, overload, dispatch, or runtime resolution is performed. |
C (.c, .h) |
Yes | Yes | Yes | Pinned C grammar emits named declarations, literal includes, direct calls, references, and containment. No preprocessing, macro expansion, compiler, ABI, build, linker, or runtime semantics are claimed. |
C++ (.cc, .cpp, .cxx, .hh, .hpp, .hxx) |
Yes | Yes | Yes | Pinned C++ grammar emits named declarations, literal includes, direct calls, references, and containment. Ambiguous .h remains C. No preprocessing, templates, overload resolution, compiler, build, linker, or runtime semantics are claimed. |
Ruby (.rb) |
Yes | Yes | Yes | Pinned Ruby grammar emits modules, classes, methods, literal requires, receiver-free direct calls, references, and containment. No interpreter, Bundler, Rails, metaprogram, autoload, monkey-patch, dispatch, or runtime semantics are claimed. |
PHP (.php) |
Yes | Yes | Yes | Pinned PHP grammar emits namespaces, named declarations, literal includes/requires, direct named calls, references, and containment. No interpreter, Composer, framework, autoload, extension, dispatch, or runtime semantics are claimed. |
Swift (.swift) |
Yes | Yes | Yes | Pinned Swift grammar emits named declarations, direct imports and receiver-free calls, references, and containment. No SwiftPM, Xcode, macro/plugin, compiler, type, build, signing, bridging, or runtime semantics are claimed. |
Scala (.scala) |
Yes | Yes | Yes | Pinned Scala Tree-sitter grammar and project-owned syntax resolver. Classes, objects, traits, enums, named functions, direct imports, direct calls, and references are syntax-derived only. Wildcard, selector, and aliased imports; compiler, SBT, Mill, classpath, dependency, implicit, macro, extension-dispatch, and runtime semantics are unsupported. |
Elixir (.ex, .exs) |
Yes | Yes | Yes | Pinned Elixir Tree-sitter grammar and project-owned syntax resolver. Literal defmodule, direct function/macro declarations, direct alias/import/require forms, direct identifier calls, and references are syntax-derived only. Mix, Hex, BEAM, macro expansion, protocol dispatch, compile-time code, and runtime semantics are unsupported. |
Clojure (.clj, .cljs, .cljc) |
Yes | Yes | Yes | Pinned Clojure Tree-sitter grammar and project-owned syntax resolver. Direct literal ns, def, defn, defmacro, defmulti, and defonce forms plus direct list-head calls are syntax-derived only. Reader evaluation, syntax quoting, macro expansion, namespace/classpath, dependency, JVM/JS, and runtime semantics are unsupported. |
Haskell (.hs, .lhs) |
Yes | Yes | Yes | Pinned Haskell Tree-sitter grammar and project-owned syntax resolver. Named bindings and direct imports are syntax-derived only. GHC, Cabal, Stack, package, typeclass, type inference, Template Haskell, compiler, and runtime semantics are unsupported. |
Go (.go) |
Yes | Yes | Yes | Pinned Go Tree-sitter grammar and project-owned syntax resolver. Functions, methods, type specifications, imports, direct calls, and references are syntax-derived only; no Go toolchain, module cache, package, or runtime resolution is performed. |
Rust (.rs) |
Yes | Yes | Yes | Pinned Rust Tree-sitter grammar and project-owned syntax resolver. Structs, enums, unions, traits, named functions, use declarations, direct calls, and references are syntax-derived only; no Cargo, compiler, crate graph, macro expansion, build script, feature, package, or runtime resolution is performed. |
Strict JSON configuration (package.json, deno.json, composer.json, manifest.json) |
Yes | Yes | Yes | A strict JSON gate precedes the pinned JSON Tree-sitter grammar and emits static configuration-key and nesting facts only. Comments, arbitrary JSON data, JSON Schema, interpolation, loaders, and runtime configuration semantics are unsupported. |
JSONC configuration (all .jsonc files; tsconfig.json, jsconfig.json, devcontainer.json, and selected .vscode/*.json) |
Yes | Yes | Yes | Pinned JSON grammar emits decoded object-key and nesting facts only. Comments are syntax only; no editor, compiler, container, include, interpolation, runtime, or configuration-to-code semantics are claimed. |
TOML configuration (.toml) |
Yes | Yes | Yes | Pinned TOML grammar emits raw syntax-derived key, table, table-array, and nesting facts only. It does not evaluate values, includes, interpolation, package resolution, toolchains, build scripts, or runtime behavior. Malformed TOML emits no facts. |
YAML configuration (.yaml, .yml) |
Yes | Yes | Yes | Pinned YAML grammar emits only raw direct-scalar mapping keys and syntactic containment. Aliases, anchors, tags, merge behavior, directives, scalar values, sequences, schemas, and consumer/runtime semantics are unsupported. Syntax-malformed YAML emits no facts. |
| Other eligible UTF-8 regular files | Yes | Yes | No | Language labels are filtering hints, not semantic claims. |
| Binary, invalid UTF-8, excluded, generated, or oversized files | Metadata only when safely discoverable | No | No | Reported as explicit partial or unsupported states. |
Structural facts are conservative syntax-derived facts, not compiler, runtime, or language-server semantics. The worker never executes repository code or loads repository configuration.
These are library-level, authority-neutral capabilities on the default branch;
they are not present in the published v0.1.0 artifacts unless a later release
explicitly includes them.
| Capability | Status | Supported scope | Explicit limitation |
|---|---|---|---|
| HRA-1 artifact inventory | Implemented | Bounded, read-only, snapshot-bound static classification with explicit exclusions on all Tier A hosts | Classification is not malware detection; archives and hostile formats are not deeply parsed. |
| HRA-2 execution-surface observations | Implemented | Exact npm lifecycle keys in strict package.json and exact privileged: true in the admitted canonical Compose layout |
Values are not interpreted; unsupported JSON/YAML syntax is explicit; intent and runtime behavior are not inferred. |
| HRA-3 coverage and assessment | Implemented | Deterministic required-analysis planning, ADR-0013-normalized synthetic result intake, and immutable assessment assembly | No analyzer is discovered or run. Missing mandatory analysis remains incomplete; zero findings never means safe. |
| HRA-4 reference policy evaluation | Implemented | Pure deterministic four-state evaluation of exact immutable assessment, coverage, findings, and policy | No filesystem, process, network, model, credential, exception, approval, or ordinary-host authority. Eligibility names only one future quarantine profile. |
| ADR-0074 isolated analyzer runner | IAR-1A application supervisor | Closed protocols/profiles; private content-addressed synthetic staging; pinned short-lived worker; bounded transport/time/output; input rehash; direct-child reap; cleanup | Application-enforced only; IAR-1B remains pending. No OS/VM sandbox, verified network/descendant containment, ClamAV, YARA, reputation provider, analyzer discovery, signature lifecycle, or real analyzer execution. |
| ADR-0089/0095/0096 legacy YARA adapter and supply chain | Superseded engine-specific contracts; evidence retained | Digest-bound synthetic adapter and exact YARA v4.5.8 source metadata remain historical inputs; common build, SBOM, provenance, signing, review, expiry, rollback, and revocation gates carry forward | No source archive, YARA binary, ruleset, parser, process launch, repository analyzer input, network, credential access, live result, detection claim, IAR-2, production admission, safety verdict, or added authority. |
| ADR-0097 first-analyzer engine selection | YARA-X selected; replacement contract implemented by ADR-0098 | Exact official YARA v4.5.8 and YARA-X v1.20.0 upstream metadata, architecture consequences, compatibility differences, and retained common gates are documented | Engine direction only; no source/archive asset downloaded; no build, ruleset, live adapter, analyzer execution, IAR-2, or production admission. |
| ADR-0098 YARA-X contract-only admission | Exact contract implemented; artifacts, ruleset, parser, and execution absent | YARA-X v1.20.0 commit and six official asset metadata identities; separately rebuilt/signed artifact strategy; module-free project ruleset surface; exact single-file yr scan arguments; bounded zero-byte NDJSON; compatibility, expiry, revocation, and non-authority gates |
Official assets are candidates only. No source/archive asset downloaded; no executable, rule, compiled ruleset, live parser, compatibility execution, analyzer execution, IAR-2, platform, production, detection, or safety admission. |
| ADR-0099 YARA-X artifact compatibility | Exact hosted synthetic candidate passed; no artifact admitted | Run 33406541396, job 99535422988, built the exact patched v1.20.0 source with Rust 1.93.0, passed the Linux composite on kernel 6.17.0-1022-azure with Landlock ABI 7, passed five literal/hex/wide synthetic cases, and passed mandatory disposable-root cleanup. The bounded executable and compiled-rules identities are recorded in the verification record. |
Exact-host compatibility evidence only. No source, executable, compiled rules, raw output, or receipt artifact was retained or uploaded. No live parser, repository scan, signature, artifact/ruleset admission, reproducibility, production, IAR-2, detection-quality, or safety claim. |
| ADR-0100 YARA-X NDJSON adapter | Pure original-synthetic parser implemented; runner linkage gated | Profile sha256:e444a5fd2675a01c85370e01c9456db4dfe214e09b5887d237ee06ac30871e7c; one bounded original-synthetic NDJSON record; exact staged-path validation; zero-byte match markers; checked ranges; complete accounting; deterministic path-free normalization; stable source-free errors; provenance-bound fixtures and mutation tests |
No filesystem, process, network, environment, clock, credentials, analyzer execution, runner linkage, repository input, artifact/ruleset admission, production, IAR-2, detection, or safety authority. |
| ADR-0101 YARA-X synthetic envelope | Exact hosted synthetic emitter envelope passed | Run 33419412353, job 99577842304, passed both closed original-synthetic emitter cases, bounded output, exact identity handoff, in-memory parser composition, source-free receipt, and mandatory cleanup on the admitted Ubuntu 24.04 synthetic boundary |
Synthetic-emitter execution is not YARA-X or analyzer execution. No repository input, network, credentials, uploads, artifact/ruleset admission, production, IAR-2, detection, or safety authority. |
| ADR-0102 YARA-X live synthetic composition | Exact hosted candidate revalidated; production and IAR-2 gated | Runs 33432469614 / job 99620875408 and 33439251952 / job 99643176845 source-built YARA-X v1.20.0 and compiled the Impresari-owned rules, passed five generated cases through the one audited launch site, Linux cgroup/Landlock/seccomp confinement, in-memory ADR-0100 parsing, exact result accounting, mandatory cleanup, and zero artifact upload on kernel 6.17.0-1022-azure with Landlock ABI 7. The second executable digest differed under otherwise matching pinned inputs and host identities, so byte reproducibility remains unproven. |
The executable and ruleset were ephemeral, unsigned, unretained, and unadmitted. No repository input, credentials, uploads, reproducibility, production, IAR-2, detection-quality, safety, or malware-free claim. |
| ADR-0103 YARA-X production admission architecture | Source-free v1 evaluator and closed candidate schemas implemented; activation closed | Policy sha256:fbae2b383e843d07dd5e30ad3d33a580e9094878e49c21fec21c8e977ce8891c separates the per-target engine bundle, project-owned ruleset bundle, fresh Linux support receipt, and final release-binding manifest; schema sha256:eda3497fcc6a56a07ded32c5bec3b3f2f922af6d1d4c02792827fb425d2deb54 rejects admission, synthetic production-rule provenance, and activation; deterministic failure states keep the current result at release_pending |
No retained executable, production ruleset, signing identity, upload, publication, production activation, IAR-2, repository scan, detection-quality, safety, or malware-free claim. |
| ADR-0104 YARA-X retained engine candidate | Exact-main retention and same-run verification passed | Run 33460329608, build job 99708941391, and verifier job 99710540087 built the exact Linux x86-64 engine in the digest-pinned Rust 1.93.0 image, retained one authenticated non-release seven-day artifact 9783099367, and verified its twelve closed members without extraction or execution. Archive SHA-256: 8ba47a6ce0b5e84b5356751eb813c9eb35e375bd938f0aa81746d32ae2feffa6; unexecuted yr SHA-256: 92b8abe893588b02e54c4759ff1fe8cd0173de3e6a0eba32d8d1f05923be62f5. |
The public repository makes the artifact downloadable to signed-in repository readers; it is not maintainer-only. It expires 2026-09-08T02:00:07Z. No signing, attestation, release publication, ruleset, execution, admission, repository scan, credentials, production, IAR-2, detection-quality, safety, or malware-free claim. |
| ADR-0105 YARA-X reproducibility diagnostic | Same-job canonical equality passed; broader reproducibility unproven | Run 33443483096 / job 99657000024 performed four independent clean offline builds in one Ubuntu 24.04 x86-64 job. Baseline A/B differed; fixed epoch, locale, incremental state, archive time, and remapped source/target paths produced identical canonical SHA-256 a35ad2ec1354a67cb2465a07fe1576e60bcfdbc18ec0b80546fca2a7faeff09d. Cleanup passed and the artifacts API returned zero. |
Same-job build-only evidence. No rules, analyzer execution, artifact retention or upload, cross-run/host or production reproducibility claim, signing, publication, admission, repository input, credentials, production, or IAR-2. |
| ADR-0074 macOS IAR-1B candidate | Materially incomplete; IAR-1A remains supported posture | Ad hoc signed App Sandbox/private-XPC prototype plus synthetic supervisor proved bounded IPC; filesystem, credential, pseudo-terminal device, process, and network denials; effective frozen per-process/per-file limits; closed source-free launch preparation; exact-target timeout; crash/relaunch; and source-byte cleanup on macOS 26.5.1 arm64 |
No real analyzer backend or production admission. Tier A probes proved aggregate-disk and cross-job-container isolation failures. Signing and Option C packaging cannot correct those runtime gaps; macOS XPC remains defense-in-depth pending a materially different confinement layer. |
| ADR-0087/0091 macOS local-VM candidate | Current authenticated synthetic guest and release-metadata sealing checkpoints passed; IAR-1A remains supported posture | On macOS 26.5.1 arm64, fresh guests proved exact read-only input, hard scratch capacity, absent guest networking, cross-job cleanliness, reproducible exact guest identity, bounded malformed/output/fault handling, whole-VM descendant stop, Rust-supervised lifecycle recovery, cgroup v2 resource enforcement, and six host-only canary classes. The controller's source-free will-sleep path passed. The denied 6.18.35-0-virt guest was replaced by authenticated current Alpine linux-virt 6.18.48-r0; all synthetic matrices passed under v2 identities, and sixteen active metadata/profile members are now one canonical content-addressed set. |
One-host partial synthetic evidence only. Provider data does not establish complete current 6.18 advisory coverage, so vulnerability_assessment_complete=false. Genuine sleep/wake, reboot, power-loss recovery, multi-host evidence, GitHub publication attestation, Developer ID/notarization, one-cask lifecycle, independent review, sealed distribution, production admission, and real analyzers remain unverified. |
| ADR-0088/0092/0093 Windows native candidate | Exact hosted target unsupported before worker start; IAR-1A remains supported posture | PR 181 proved the no-worker APIs and profile lifecycle on Windows Server 2025 build 26100 x86-64. PR 183 final run 33366224611, job 99407325602, then built the exact 19-scenario LPAC launch boundary from source a402d25cb7d80351f7ff7c875c58849025f5ed8c, but Windows denied the first suspended worker with error 5. The validated receipt records unsupported_host under matrix profile sha256:82ab5c5c0cff76079ae19925b92da23b2d86e3a31e7cfc58626e17cb01c14678; no administrator-level drive-root ACL preparation or weaker AppContainer fallback was used. |
No worker ran. Network/path/resource/descendant denial, multi-host evidence, host-preparation policy, signing, production admission, Windows IAR-1B, and real analyzers remain unverified. |
| ADR-0094 Windows BaseContainer routing candidate | Exact hosted target unsupported by frozen build gate; IAR-1A remains supported posture | PR 184 run 33367923249, job 99412379212, observed Windows 11 Enterprise build 26200 arm64 with processmodel.dll and both exact experimental exports present. The frozen minimum build is 26600, so the receipt returned unsupported_build. The probe did not invoke either export or launch a worker. |
Export presence cannot override the version gate. No profile, ACL/feature mutation, elevation, service, IAR-1B, production support, or analyzer admission. A later supported-build synthetic rehearsal remains separately gated. |
| ADR-0074/0077 Linux IAR-1B candidate | Exact Ubuntu 24.04 x86_64/arm64 candidate evidence maintained; production scope pending | PR 131 job 99197119262 and PR 132 job 99198568879 are exact candidate targets through 2026-09-13. PR 133 jobs 99200027090 and 99200027056 remain held-out kernel-diversity evidence. The source-free ADR-0077 evaluator withdraws the claim on drift, expiry, missing evidence, or unavailability. |
Candidate compatibility is not broad Linux or production support. No host discovery, automatic repair, real analyzer, or production admission. |
| ADR-0078–0081 Linux C lifecycle candidate | Exact Ubuntu 24.04 x86_64 externally managed candidate; production scope pending | Release-candidate run 33300661271, job 99228064803, composes exact package, topology, interruption, crash/relaunch, cleanup, and post-collection withdrawal evidence from source 8f8f9adb5d99f373fbd6456564dfa6233c37bc34. |
Exact-host synthetic lifecycle candidate only. A remains partial pending genuine login-session reentry. No production admission, broad Linux claim, real analyzer, privileged installation, persistent service, or automatic repair. |
| ADR-0082 Linux C production-support admission | Contract implemented; immutable release pending | Exact GitHub-hosted Ubuntu 24.04 x86_64 target, fresh evidence through 2026-09-13, pinned manifest and lifecycle-composition identities, and deterministic withdrawal states. |
The candidate is newer than published v0.1.0 but still reports 0.1.0, so support cannot activate until a new version/tag/archive is published and reviewed. A, broad Linux, and IAR-2 remain closed. |
| ADR-0075 disposable quarantine runner | Not implemented | None | No VM/container provisioning, repository execution, behavior observation, or destruction proof exists. |
See the Step 1 limitations statement before interpreting any inventory, finding, coverage, assessment, or decision.
| Client or surface | Classification | Supported connection today | Limitation |
|---|---|---|---|
| Any client that can start a configured local stdio MCP child process | Generic local MCP | Launch impresari-context-mcp with fixed workspace, cache, consumer, role, and operation-time arguments. |
No named client conformance or maintained configuration kit is claimed. |
| Codex | First-class L1; recorded-scope L2 guidance; recorded-scope L3 guided delivery; recorded-scope L4 lifecycle maintenance | The L1 user-home MCP kit and L2 AGENTS.md guidance retain their separate records. L3 uses a separately inspected preview plus explicit --apply, a dedicated operator-authenticated Codex home, complete initialization and auth preflight, and an ephemeral read-only/no-network App Server thread. Two independent deliveries completed with immutable source, clean runtimes, and no added authority. L4 adds an explicit source-free health/freshness check for only the exact L2 artifact; see the Phase 1 kit record, L2 guidance record, CI-3b record, and CI-4 record. |
L1/L2/L4 remain limited to Codex CLI 0.149.0-alpha.4.1 on macOS aarch64. L3 is independently limited to App Server 0.150.0-alpha.8 on the recorded macOS arm64 platform and exact authenticated-home/protocol boundary. L4 does not maintain that separate L3 version. No other version, platform, automatic injection, background monitoring, or conversational repeatability is claimed. |
| Claude Code | First-class L1; recorded-scope L2 guidance | An explicit local-scope command and read-only JSON validator preserve the fixed local-stdio contract. Claude Code CLI 2.1.241 on macOS aarch64 rejected malformed strict temporary configuration, completed an isolated temporary-config lifecycle with direct packet equivalence, and completed native claude mcp add/get/remove --scope local against a disposable Claude home. Its owned project skill also completed an isolated L2 packet smoke. See the Phase 1 kit record and L2 guidance record. |
Supported only for Claude Code CLI 2.1.241 on macOS aarch64. The model-directed lifecycles are live smoke evidence, not deterministic prompt-repeatability. The native rehearsals do not mutate a default MCP configuration and remove only their named temporary entries. Revalidate on an upstream client/configuration change. |
| Cursor | First-class L1; recorded-scope L2 guidance | An explicit project .cursor/mcp.json kit and validator preserve the fixed local-stdio contract. Cursor Agent CLI 3.17.8 (2026.08.11-e8db854) on macOS aarch64 rejected malformed configuration, completed native enable/list-tools/disable, and completed a guarded Agent-mode four-tool lifecycle with direct packet equivalence in a disposable project. Its opt-in project rule v2 also completed an isolated native-guidance smoke with exact removal. See the Phase 1 kit record and L2 guidance record. |
Supported only for the recorded Cursor CLI/macOS aarch64 scope. Ask mode blocks dynamic MCP calls; the recorded Agent-mode smoke used a test-only project permission file allowing only the four named Impresari MCP tools and denying shell/file/web actions. Conversational rule selection remains non-deterministic. Revalidate on an upstream client/configuration/approval/stream change. |
| Gemini CLI | Generic local MCP | A project .gemini/settings.json guide and read-only validator require an absolute local binary, fixed arguments, trust: false, and the minimal four-tool session/packet allowlist. Gemini CLI 0.56.0 was authenticated on macOS aarch64. |
Its normal client startup was rejected by the current free-tier service as unsupported; no lifecycle, packet, removal, or platform/version evidence exists. |
| GitHub Copilot CLI | First-class L1; recorded-scope L2 guidance, L3 guided delivery, and L4 health | The existing L1/L2/L4 records remain separate. CI-3c additionally completed two explicit preview/apply deliveries through Copilot CLI 1.0.80 with exact packet binding, isolated authentication, zero tool requests or executions, immutable source, clean disposable runtimes, and no added authority. See the Phase 2 kit record, L2 guidance record, CI-3c record, and CI-4 record. |
Supported only for Copilot CLI 1.0.80 on macOS aarch64 within each recorded boundary. Copilot 1.0.81 is not admitted for L3 because its model request retained built-in tool schemas despite exclusion flags. Revalidate every scope on an upstream client, configuration, authentication, permission, or protocol change. |
| VS Code Copilot extension host | First-class L1; recorded-scope L2 guidance | A workspace .vscode/mcp.json kit and validator require the fixed local stdio contract, reject sandbox and authority-expanding fields, and support preview, explicit install, inspection, and exact owned removal. VS Code 1.134.0 on macOS arm64 visibly discovered the server, started it under operator-controlled trust, and invoked bounded session open/close in a disposable workspace for L1. Its owned v3 instruction then separately completed an Impresari-only open/build/resolve/close lifecycle with one complete exact-source packet, zero omissions, source immutability, and exact-owned cleanup; see the CI-1 record and CI-2 record. |
Supported only for VS Code 1.134.0 on macOS arm64. The L2 result is live conversational evidence, not deterministic prompt-repeatability or L3 delivery. The portable Agent Host root .mcp.json surface remains generic and unadmitted. Revalidate on an upstream VS Code, Copilot, MCP schema, approval, configuration, or platform change. |
| HTTP, remote MCP, daemon, or multi-client service consumers | Unsupported | None. | Impresari Context provides no network listener or remote transport. |
Classification meanings:
- First-class requires a maintained versioned connection kit and client-specific end-to-end conformance evidence.
- Generic local MCP means a client may be technically capable of launching the local stdio process; it is not a promise of a maintained integration.
- Experimental is a named, opt-in capability with a documented version/ platform boundary and no stability or promotion promise. Codex CI-3b is the only published experimental client-delivery path.
- Unsupported means no approved connection path safely preserves the required authority contract.
The client must provide fixed launch-time values for --workspace, --cache,
--consumer-id, and --role. MCP tool input and repository content cannot
change them. The local process records its startup time when --occurred-at is
omitted; the optional flag is for deterministic rehearsals. The workspace and
cache must be separate; the transport is local stdio only; and the process
neither executes repository code nor gains network, source-write, approval, or
orchestration authority.
See the local MCP interface reference for the command and protocol contract, and ADR-0018 for the admission requirements for a first-class kit.