Coordinator tool registry

coordinatorToolDefinitions() lists the Node operations an external coordinator (Claude Code or Codex acting as the brain) may call as MCP tools. Each is a feature descriptor whose projections.coordinator names the tool (D-102), in registry order: node.status, project.list/show, project.guard.show, workspace.list/show, connection.list/show/usage.show, session.list/show/create/start/ observe/events.list/stop/resume, turn.send/show/wait/interrupt, port.lease.acquire/renew/release/list, run.ledger.create/list/task.list/task.show/task.dispatch/task.settle, connection.detect/models.list, discovery.sessions.list, session.history.read/archive/rename/diff, approval.list/show/respond, receipt.get and reference.resolve. COORDINATOR_TOOL_OPERATIONS is the same list as method IDs and the coordinator principal's whole allowlist at the Node.

Each definition carries the tool name (. and - become _, so session.events.list is session_events_list), a description, readOnly and destructive hints, and a draft-07 JSON Schema generated from the request union in local-node/effect-schema.ts. The generator reads every request's parameters member, so a tool's schema cannot drift from the wire contract. Optional fields render as absent-or-valid: the null branch Effect emits for an optional field is removed, because the Node rejects null.

The registry grants nothing. A server built from it calls the Node with the operator's local credential, exactly as the CLI does; the Node still validates, authorizes, checks revisions and writes receipts. approval.respond is listed but refused with role_denied unless the Project's guard grants coordinators the answer (D-199, default none). Human-only operations (accounts, integrations, executable approval, Project and container confirmation, interaction answers) have no tool. turn.send is included even though agent definitions mark it human-only: the coordinator is the operator's own client, not a worker inside a Session.

Adding a tool means setting projections.coordinator (description, readOnly, destructive) on the operation's descriptor and adding its row to the reviewed allowlist test; its schema is derived, and the CLI's call map test fails until the SDK binding exists.

workerToolDefinitions() projects exactly SESSION_ROLE_OPERATIONS.worker, using the same schemas and descriptions plus context_show. Its CLI call map uses SDK operations, and the Node authenticates every call as the worker's Session. Changing that role requires matching tool definitions and bindings; it never expands to the coordinator catalog.