ReadonlyContractOptional structural contract fingerprint emitted by CodeGen (or set by a hand-authored
operation). Automatically forwarded on Execute when the caller didn't override
options.contractFingerprint, allowing the server resolver to detect stale client bundles.
ReadonlyExecutionWhether this operation is a plain Sync request/response or a LongRunning run.
Optional ReadonlyExposeWhen true, exposes this operation for automatic discovery by MJ AI Agent tool adapters.
Optional ReadonlyExposeWhen true, exposes this operation for automatic discovery by MJ MCP server tool adapters.
ReadonlyOperationStable registry key and wire token for this operation (e.g. RecordProcess.RunNow).
ReadonlyRequiredOptional API-key scope string (e.g. recordprocess:execute) enforced for API-key / MCP
callers by the server resolver. undefined means no scope gate; interactive users remain
bounded by their entity permissions. Informational here — the server applies it.
ReadonlyRequiresWhen true, the server only permits the system user to invoke this operation.
Optional ReadonlyToolHuman/LLM-readable description when exposed as an Agent or MCP tool.
Optional ReadonlyToolOptional JSON-Schema object describing TInput when exposed as an Agent or MCP tool.
ProtectedAuthorizePer-operation authorization hook, composed with (and applied after) the framework gates that
the server resolver runs. Returns true by default. Override to enforce operation-specific
rules against the input, acting user, and server transport context (e.g. context.requestOrigin).
The typed input payload.
The acting user.
Optional_context: RemoteOpServerContextOptional server execution context (always supplied by ExecuteServer).
True if the operation may proceed.
The universal entry point — identical on client and server. Routes the operation through the active (or explicitly supplied) provider's IRemoteOperationProvider.RouteOperation.
The typed input payload.
Optionaloptions: RemoteOpInvokeOptionsOptional invocation options (mode, progress callback, explicit provider/user).
The result; never throws for logical failures — inspect Success / ErrorMessage.
Server-side execution entry point, invoked in-process by a server provider / resolver after it has resolved this operation by key and applied the framework authorization gates (scope / system-user / entity permissions). It runs the per-operation Authorize hook and then InternalExecute, wrapping the outcome in a RemoteOpResult.
The typed input payload.
The server execution context (provider, acting user, progress emitter, HTTP metadata).
The wrapped result; logical failures are returned, not thrown.
ProtectedInternalThe operation's server-side work. The default throws — a routable operation must supply a
body (CodeGen-emitted AI/default plumbing, or a hand-authored override). Implementations must
use context.provider / context.user for data access (never new Metadata()), per the
multi-provider rule.
The typed input payload.
The owning provider for data access.
The acting user.
The typed output payload.
StaticGetDiscovers all ClassFactory-registered BaseRemotableOperation subclasses that opt into
AI Agent (ExposeAsAgentTool) and/or MCP (ExposeAsMCPTool) tool exposure.
Optionalfilter: { agentOnly?: boolean; mcpOnly?: boolean }
TaskGraph.Submit— validate and durably persist a graph, returning immediately.Returning before execution is the point: the caller is freed the moment the work is safe, and the dispatcher owns it from there. That is what lets an agent submit a graph over MCP without holding anything open.
REMAINING LIMITATION (C5/D1): a remote submission does not bind to an agent run.
TaskGraphSubmitContextcarriesAgentRunID, and this input deliberately has no field for it — whether a remote caller's graph should BIND to an agent run (cost rollup,reinvokerouting) is the D1 execution-identity design question, to be decided rather than defaulted. Until then a remote submission recordssubmittedByAgentRunID: null: no cost rollup, andreinvokedegrades to a message. The other two fields the in-process path carries DO ride this operation now —reinvokeDepth(clamped; see below) so the runaway-loop cap counts remote hops, and the R3-3invocationenvelope sodata.*/context.*conditions evaluate against the invocation instead of nothing.