Interactive plan review

The normal reviewed-write path starts with the workflow's execute tool and omits planDigest. The adapter prepares a fresh plan, binds the exact request into signed MCP request state, and returns conditional input containing the identities, target, permissions, intended change, warnings, risks, operation-key evidence, and digest. Approval resumes that same tool, which validates the signed request, rebuilds the plan, and passes the matching digest to the service. The service performs its own final fresh replan immediately before durable coordination and mutation. A cancellation, declined confirmation, altered request, restart, stale target, changed permission, or mismatched digest sends no write.

Canonical plan tools remain useful for detached review, automation that deliberately separates duties, a display-only plan App, and debugging blocked evidence. A caller may pass the resulting digest to the executor, but manual digest transfer is not required for the ordinary interactive flow. Throughout this reference, any numbered sequence that explicitly says to call a plan tool and then pass its digest documents this detached variant; a compatible host may instead begin with the companion executor and review the equivalent internally prepared evidence.

The server implements the stable MCP Apps extension as an optional progressive enhancement. It advertises io.modelcontextprotocol/ui with text/html;profile=mcp-app, links every configured canonical plan_* tool to ui://guildcontrol/plan-review through nested _meta.ui.resourceUri, and explicitly limits tool visibility to model. It does not emit the deprecated flat ui/resourceUri metadata.

An MCP Apps host can load the one self-contained resource, complete the ui/initialize lifecycle, and deliver exact tool input plus the ordinary CallToolResult. The view highlights status, exact identifier fields, review digests, authority, freshness, permissions, blockers, warnings, risks, limitations, and other evidence. Search, keyboard-accessible tabs, disclosure groups, exact input, and full JSON keep unknown future plan fields inspectable rather than dropping them. A host without MCP Apps support receives the same complete text and structured plan result and can ignore the optional metadata.

The view is deliberately display-only. It advertises no app tool capability, has no server-tool or resource-read call path, and cannot approve, execute, modify, retry, open a link, send a message, update model context, or persist state. Resource metadata requests no network domains, dedicated origin, camera, microphone, geolocation, or clipboard access. The document adds its own restrictive CSP, uses no external assets, and renders every caller or Discord-derived value with DOM text nodes rather than an HTML or CSS sink. Incoming lifecycle messages are accepted only from the parent frame. The app still does not replace any signed elicitation, host write approval, fresh-plan check, confirmation, reservation, pending record, Discord permission proof, or readback gate.

Credential-free catalog inspection verifies the exact extension capability, resource declaration and response, canonical plan-tool linkage, model-only visibility, empty network and permission sets, absence of server-tool authority, and deterministic HTML bytes. The app resource response is part of the overall contract digest; separate HTML and resource digests make source and envelope changes independently visible. catalog --html includes this evidence and an escaped copy of the complete source for offline review.

Canonical source: docs/reference.md