canon(constraints): MCP tool surface ceiling — three by default, four at most

[git-repo-auth]

Routing: T2 invariant (adopter-neutral), past the T3 bet gate → L1.

Captain ruling 2026-09-02 (CoS door): all klappy MCP servers ship docs / execute / telemetry; 3–4 tools max. This is the abstract constraint; the exact implementation lives in klappy/kitchen health-code/mcp-server-build-convention (sibling PR).

Status: proposed. Authorial voice — captain reviews exact text before merge. First instance: door43-mcp.

---

Note

Low Risk
Documentation-only proposed policy with no mechanical enforcement or runtime changes in this PR.

Overview
Adds a proposed Tier 1 canon constraint that caps klappy/vodka MCP servers at three tools by default (docs, execute, telemetry) and four at most, with a written spec justification for any fourth tool.

The doc reframes large APIs as one execute plus live docs (not one tool per endpoint), defines advisory spec-review enforcement and verification (tools/list ≤ 4, vodka boundaries, docs() cites this policy URI), plus retraction conditions and common failure modes. Implementation detail stays in the sibling kitchen build-convention PR; first adopter called out is door43-mcp.

^{Reviewed by Cursor Bugbot for commit 8309040. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

Canon Quality — Homepage Surfacing ✅

51 essay(s) scanned. Soft report — never blocks; the hard field gate is the Frontmatter Schema job.

All published essays resolve to the homepage feed.

_{Report: scripts/surfacing-report.py · Canon: klappy://canon/constraints/frontmatter-validation-before-merge}

[github-actions]

Canon Quality — P0010 Retrieval-Readiness ⚠️

Soft report for klappy://canon/constraints/retrieval-disclosure-contract. 713 files scanned. Never blocks — informational until the corpus is ready to enforce.

• Blocking-class findings: 17 (structural fields the contract would filter on)
• Warnings: 0 (kind resolves to unknown)
• Informational: 13 (exempt templates/archive/drafts)

Kind distribution: {'essays': 53, 'canon': 249, 'apocrypha': 38, 'docs': 307, 'journals': 60, 'unknown': 6}
Kind source: {'path': 576, 'frontmatter': 131, 'none': 6} (frontmatter-primary, path-secondary)
Default-include visibility: 609 visible, 104 hidden (journals/apocrypha/unknown)

By rule: {'audience-invalid': 3, 'exposure-missing': 6, 'tier-missing': 5, 'tier-invalid': 7, 'fm-missing': 3, 'kind-unresolvable': 6}

These are not schema violations (see the Frontmatter Schema job for those on writings/). They are corpus-readiness signals for the retrieval contract: invalid/missing audience, exposure, tier, and docs whose kind cannot be resolved. Fix in a corpus-cleanup PR before the contract flips to enforcing. See the retrieval-readiness-findings artifact for the full list.

_{Validator: scripts/audit-retrieval-readiness.py · Constraint: klappy://canon/constraints/retrieval-disclosure-contract · Run: #434}

[github-actions]

Canon Quality — Frontmatter Schema ✅

All 51 file(s) in writings/ conform to klappy://canon/meta/frontmatter-schema.

_{Validator: scripts/validate-frontmatter.py · Canon: klappy://canon/constraints/frontmatter-validation-before-merge · Run: #434}

[github-actions]

Canon Quality — oddkit_audit ✅

No dead klappy:// references or legacy link patterns found in writings/. 53 files scanned.

_{Spec: klappy://docs/oddkit/specs/oddkit-audit · Workflow: .github/workflows/canon-quality.yml · Run: #434}