AI companion: expand the MCP tool provider beyond the pilot 5

[rubenvdlinde]

Goal

decidesk already ships DecideskToolProvider with 5 tools (listOpenActionItems, listRecentMeetings, getMeetingDetails, startMeeting, addActionItem) — the fleet's reference implementation. Per ADR-035, broaden coverage to the rest of decidesk's user-actionable surface.

Suggested additions

Tool id	Purpose
decidesk.listDecisions	List decisions, filterable by meeting/status
decidesk.getDecisionDetails	Get one decision with its rationale + votes
decidesk.recordVote	Record the caller's vote on an open decision
decidesk.listDelegations	List active vote delegations involving the caller
decidesk.getMeetingMinutes	Render/return the minutes for a closed meeting
decidesk.completeActionItem	Mark an action item done
decidesk.closeMeeting	Close a meeting (chair/admin only)

Same auth design as the existing tools (per-object auth before business logic; helpers return real bools).

Background

ADR-034 defines the cross-app AI Chat Companion: a floating widget shipped from @conduction/nextcloud-vue (auto-mounts via CnAppRoot) that talks to OpenRegister's orchestrator at runtime. Apps expose their own capabilities to the in-app AI by implementing OCA\OpenRegister\Mcp\IMcpToolProvider (3 methods: getAppId(), getTools(), invokeTool($toolId, $arguments)), registered in lib/AppInfo/Application.php under the DI alias OCA\OpenRegister\Mcp\IMcpToolProvider::{appId}.

ADR-035 makes a per-app provider the fleet expectation: every app with a user-actionable surface ships a provider or records an opt-out in openspec/project.md.

Reference implementation: decidesk/lib/Mcp/DecideskToolProvider.php (5 tools, full auth design) + decidesk/tests/Stubs/Mcp/IMcpToolProvider.php (stub used until openregister PR #1466 ships the real interface).

Dependency

The real IMcpToolProvider interface ships in openregister PR #1466 (ai-chat-companion-orchestrator). Until that merges, apps implement the stub (see decidesk's tests/Stubs/Mcp/IMcpToolProvider.php); the stub no-ops when the real OR interface is present.

Definition of done (MVP)

• lib/Mcp/{AppName}ToolProvider.php implements IMcpToolProvider with the tool set below
• Each tool: validates arguments, runs per-object authorisation before business logic (OWASP A01:2021 / ADR-005 — no unconditional return true, no catch(\Throwable) swallowing the verdict), delegates to the app's existing services
• Tool ids namespaced {appId}.{toolName}
• Registered in lib/AppInfo/Application.php under alias OCA\OpenRegister\Mcp\IMcpToolProvider::{appId}
• tests/Stubs/Mcp/IMcpToolProvider.php present (copy decidesk's, adjust namespace/package)
• Unit test asserting the tool catalogue (ids, descriptions, inputSchema)
• Widget mounted: app consumes @conduction/nextcloud-vue with CnAppRoot (FAB auto-renders when OR is reachable, no-renders otherwise — no install-time OR dep)
• ### MCP coverage section added to the proposal that lands this (per ADR-035)