Add versioned task context capsules

docs/MCP_CONTRACT.md

@@ -42,6 +42,7 @@ schema version 1 and does not silently acquire machine-specific process policy.
 - `docforge_dependencies`
 - `docforge_impact`
 - `docforge_get_context`
+- `docforge_get_task_context`
 - `docforge_validate_project`
 - `docforge_render_status`
 - `docforge_visualize`
@@ -72,6 +73,46 @@ oversized entry advances as a hash-identified `response size limit` omission so
 loop; targeted retrieval remains available for that node. The existing three-argument custom
 context-provider contract is unchanged because pagination is applied after provider selection.
 
+`docforge_get_task_context` accepts one closed task kind (`change`, `implementation`, `failure`,
+`ownership`, `test`, `operation`, or `release`), a bounded task description, and optional
+`focus_node_id`, token `budget`, page `limit`, and opaque `cursor`. It derives, rather than accepts,
+a version-1 retrieval plan. The plan contains only exact or lexical focus, bounded outgoing and
+incoming graph traversal, and metadata hydration. It cannot request arbitrary SQL, paths, relation
+names, or Logic extraction. Task context applies fixed internal ceilings of 1,000 evidence items,
+100,000 examined candidate edges, and 10,000 task-query characters even when broader project
+limits are configured. Traversal steps bind the complete project-owned relation vocabulary by hash
+rather than copying an unbounded name list into every response.
+
+The plan and returned context capsule are bound to the effective policy and one immutable index
+generation. Every evidence item identifies its indexed source path, content hash, graph path,
+additional qualifying relationship reasons, and the provenance facts that the current graph
+cannot prove. Required evidence gaps distinguish an undeclared relation category, a completed
+bounded search with no selected evidence, and an incomplete proof caused by a work, result, token,
+or response limit. Unknown project relations remain present with their raw names and an
+`unclassified_relation` limitation; DocForge never infers semantics from spelling outside the
+versioned alias map.
+
+Path relationship direction is relative to the preceding traversal node. Additional
+`relationship_reasons` direction is relative to the evidence item itself: `outgoing` when that
+evidence node is the stored source and `incoming` when it is the stored target.
+
+The exact version-1 aliases are: structure (`contains`, `defined_in`, `defines`, `owns`);
+implementation (`implemented_by`, `implements`, `inherits`, `inherits_from`); dependency
+(`depends_on`, `imports`); execution (`activates`, `calls`, `dispatches_to`, `launches`); data
+(`reads`, `writes`); evidence (`documents`, `governs`, `proves`, `tested_by`, `verifies`); and
+context (`relates_to`). Every other allowed relation is `unclassified`.
+
+Task-context continuation partitions the immutable evidence stream without changing its
+`request_hash`, `plan_hash`, `collection_hash`, or `capsule_hash`. Its cursor additionally binds
+the effective policy and task request. One evidence item that cannot fit advances exactly once as
+a hash-identified `response_limit` omission. A changed generation, policy, plan, or collection
+fails as `stale_cursor`.
+
+The legacy `docforge_get_context` tool and its custom three-argument provider contract remain
+unchanged. A server with a custom context provider does not silently inherit the core task planner;
+version 1 exposes no custom task-planner extension point. `docforge_get_task_context` returns
+`task_context_unavailable` without synchronizing or loading the custom projection.
+
 Version-1 cursors are canonical JSON encoded as base64url with a domain-separated SHA-256
 corruption checksum. They are opaque and fail closed, but are not authenticated authorization
 tokens. Cursors bind the project, adapter, source generation, operation parameters, collection