[PROPOSAL] governance-mcp: read-only substrate access for the jurist (PENDING-82)

The three-party model asks Claude.app to rule on items it cannot read. Steward
confirmed 2026-07-28 that local MCP servers are exposed to the app's *chat*
surface — and always have been, predating Cowork by about a year. My earlier
framing ("chat, not only Cowork") had the relationship backwards: it is "chat,
always; Cowork, only while its loop still runs locally," and local Cowork is the
mode being phased out as default. The jurist chat is therefore the sturdy target.

Five read-only tools. The one a pasted cache can never provide is
governance_item(id): the verbatim body of any item or ruling, across PENDING.md,
PENDING-archive.md and REVIEWED.md. Four refusals are designed in, each with a
control proving the refusal is detectable — no writes (AST-audited), no path
arguments (keys from a fixed enum, so there is no traversal to defend), no second
parser (item_spans is imported, not reimplemented), and not an agent (tools
return data; an agent would return testimony about the substrate instead).

[FIX] to the shared definition while here: item_spans() is now fence-aware. A
'## ' header inside a fenced block is neither an item nor a boundary. Zero such
headers exist today — 17 open items before and after — but governance drafts are
written as fenced markdown carrying '## REVIEWED-N' headers, which is the
steward's own practice, so the next draft would have created a phantom item and
truncated the item containing it. PENDING-82's own fenced JSON block confirms the
fix within the hour.

Not installed. The mcpServers key edits the steward's desktop-app config; the
snippet is in PENDING-82 and the server is inert until someone loads it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WuMjg3ipEVa3n8CoSzoyvc

scripts/wake-digest.py

@@ -47,16 +47,39 @@ def read(p):
 
 # ---------- extractors (pure functions of text, so --selftest can exercise them) ----------
 
+def item_spans(text):
+    """-> [(header, start, end)] for every item; 1-based start, end exclusive.
+
+    THE single definition of "an item" for every consumer. Two lessons are welded in:
+
+    - **Any `## ` header is an item.** A family-specific regex (`^## PENDING-<digits>`)
+      hid twenty items on 2026-07-28, ten of them open. Never match on family.
+    - **Fenced blocks are not the document's structure.** Governance drafts are
+      written as plain fenced markdown carrying their own `## REVIEWED-N` headers
+      (the steward's copy-paste-clean practice), so a fenced header would otherwise
+      register as a phantom item AND truncate the real item containing it. Zero such
+      headers exist in the substrate today; the trigger is a drafting habit already
+      in use, so this is a defect waiting on the next draft rather than a hypothetical.
+    """
+    lines = text.split("\n")
+    heads, fence = [], False
+    for i, l in enumerate(lines):
+        s = l.lstrip()
+        if s.startswith("```") or s.startswith("~~~"):
+            fence = not fence
+            continue
+        if not fence and l.startswith("## "):
+            heads.append((l[3:].strip(), i + 1))
+    return [(h, s, heads[k + 1][1] if k + 1 < len(heads) else len(lines) + 1)
+            for k, (h, s) in enumerate(heads)]
+
+
 def open_items(text):
-    """-> [(header, line_no)] for every '## ' item lacking closure evidence.
-    Closure evidence = a REVIEWED-N (resolved by the caller) or CLOSED/COMPLETED
-    in the header. Any '## ' line is an item — assuming one naming family missed
-    twenty items on 2026-07-28."""
-    out = []
-    for i, l in enumerate(text.split("\n"), 1):
-        if l.startswith("## ") and "CLOSED" not in l and not l.startswith("## COMPLETED"):
-            out.append((l[3:].strip(), i))
-    return out
+    """-> [(header, line_no)] for every item lacking closure evidence. Closure
+    evidence = a REVIEWED-N (resolved by the caller) or CLOSED/COMPLETED in the
+    header."""
+    return [(h, s) for h, s, _e in item_spans(text)
+            if "CLOSED" not in h and not h.startswith("COMPLETED")]
 
 
 def tag_of(text, header):
@@ -290,6 +313,14 @@ def selftest():
     chk("open_items excludes CLOSED / COMPLETED",
         open_items("## PENDING-1 — x (CLOSED)\n## COMPLETED — y") == [])
     chk("open_items returns empty on empty input", open_items("") == [])
+    FENCED = "## PENDING-9 — real\nbody\n```markdown\n## REVIEWED-9 — a draft\n```\ntail"
+    chk("open_items ignores a header inside a fenced block  [drafting-habit trigger]",
+        [h for h, _ in open_items(FENCED)] == ["PENDING-9 — real"])
+    chk("open_items DOES find that same header unfenced  [positive control for the line above]",
+        [h for h, _ in open_items(FENCED.replace("```markdown\n", "").replace("```\n", ""))]
+        == ["PENDING-9 — real", "REVIEWED-9 — a draft"])
+    chk("item_spans runs a fenced item to the tail, not to the fenced header",
+        item_spans(FENCED)[0][2] == 7)
     chk("tag_of reads a tag",
         tag_of("## PENDING-9 — t\n**Date:** d\n**Tag:** [ESCALATE]\n", "PENDING-9 — t") == "[ESCALATE]")
     chk("tag_of returns '' when absent", tag_of("## PENDING-9 — t\n", "PENDING-9 — t") == "")