CHAP 0.3.4: review rounds, patch limits and the MCP gate

The protocol packages move together to 0.3.4. Four of the fixes close ways a
member could put a decision on the record that nobody made, take over another
member's object, or exhaust a coordinator. Upgrade every coordinator, and
every generated project that serves /mcp. chap-analytics 0.2.5, on its
own track, reads a revised artefact as a new review pass, and applies the
coordinators' patch limits with a size limit of 64 MiB.

npm install @brightbeamai/chap-coordinator@0.3.4
pip install "chap-coordinator==0.3.4"

These fixes change what the review, whisper, deliberation and handoff
profiles require. They are security fixes, so they ship as a patch release on
the supported 0.3 line, as SECURITY.md sets out. The
security advisories
give the details.

Security

• A revised artefact starts a new review round. A task completed again
  after a revision kept the review's earlier decisions, so under
  all_approve or quorum:<n> an approval of the first artefact counted
  for the second. The completion now opens a new round of the same review,
  with the same reviewers and rule and no decisions. The completer is left
  out of the round's named reviewers, and a completion that would leave none
  is refused with -32011. A copy of a decision sent again is evaluated
  like any accepted call; send approved_artefact_digest with a decision to
  tie it to its artefact.
• A patch cannot grow an artefact without limit. A decide.override
  patch could grow a 64 KiB artefact to about 2 GiB with copy, or nest it
  deep enough to break the coordinator. A patch is now refused with
  -32012 when, after any of its operations, the artefact holds more string
  and key text than max_envelope_bytes allows or nests deeper than 64
  levels, or when its copies, and its moves to a deeper place or onto the
  whole artefact, carry more than three times the value and size limits.
• The MCP gate's connection acts only as the assistant. The mcp-gate
  template served every tool on /mcp, and each call named its own from,
  so the assistant could approve its own work in the human's name. The
  templates' /mcp now makes every call as the agent and offers only the
  tools in AGENT_MCP_TOOLS, and a generated server refuses to start with
  mcp on and no agent.uri. POST /chap still accepts a call in any
  member's name unless signatures are required, as the template's README
  says.
• A supplied id cannot replace an existing whisper, deliberation or
  handoff. An id already in use, one that is not a string, or __proto__,
  constructor or prototype is refused with -32602.

Added

• participant on the MCP servers. makeChapMcpServer and
  make_chap_mcp_server make every call as that participant, and refuse a
  call that names another from.
• A skill filter on the A2A executors. skillFilter in TypeScript and
  skill_filter in Python refuse a skill the Agent Card's filter excludes,
  with -32601.

Fixed

• The patch an override record keeps now matches the one sent and
  recorded on the chain.
• The MCP tool filter refuses what it excludes. Both MCP servers left an
  excluded tool out of tools/list and still ran it when it was called by
  name.
• The MCP package under zod 3, which it accepts, now imports.
• The Python A2A card names its binding JSONRPC, the value a2a-sdk
  clients look for.

Documentation

• A shorter README, with what CHAP is for, the concepts, the install
  lines, the override envelope, the status and the links. The 90-second
  tour has a page of its own, docs/tour.md, with its code in TypeScript and
  Python; what the override envelope's fields point at, and reading the log
  back, are in ABOUT.md.

chap-analytics 0.2.5

• A revised artefact is a new review pass, as in the coordinators.
• The patch limits, with 64 MiB of string and key text, so a chain
  cannot make a rebuild exhaust memory.

A project generated before 0.3.4

It keeps its own server.mjs. Copy the /mcp call and AGENT_MCP_TOOLS
from the template, and move its packages to 0.3.4.

The full entry is in the
changelog.