Governed MCP retrieval and release-flow guide

Synthetic worked example

Retrieve only an exact active released revision

Why is a record identifier alone insufficient for licensed retrieval?

The execution binds the selector to an active release, its target digest, release digest, and canonical path before returning evidence.

Starting inputs

An authorized grant

One release ID or canonical path

An exact active release

Remaining quota

Ordered execution

Work the example

  1. 1

    Parse exactly one selector.

  2. 2

    Resolve an active release at that selector.

  3. 3

    Reserve one replay-safe execution.

  4. 4

    Project only the released record fields and boundaries.

  5. 5

    Digest the projection and execution evidence.

Expected outputs

  • Exact release and target identities
  • Source-bound claims and limitations
  • A deterministic projection digest

Verification checks

  • The canonical path matches the release.
  • The target digest matches the projected record.
  • The license boundary remains in the output.

Fail closed

Refusal conditions

  • The release is superseded or withdrawn.
  • The record revision differs from the active target.
  • Entitlement is used to upgrade evidence state.

Digest-bound public fixture

Check the expected state

This fixture contains synthetic operational fields only. Its digest establishes fixture integrity, not scientific truth or a completed commercial transaction.

{
  "artifactKind": "licensed-delivery",
  "schemaVersion": "maha-licensed-evidence/1.0",
  "input": {
    "selector": "one-release-id",
    "releaseStatus": "active",
    "entitlement": "valid"
  },
  "expected": {
    "projection": "exact-active-release-only",
    "evidenceQualityChanged": false
  },
  "artifactSha256": "sha256:ff2090844855c24b1172dff8a4f7c8001b5e15655c35b4711555807345bbee62"
}