Add gated changeset application and graph controls

docs/CONTRACT.md

@@ -1,4 +1,4 @@
-# DocForge 0.12 contract
+# DocForge 0.13 contract
 
 ## Authority boundary
 
@@ -6,15 +6,11 @@ DocForge is bound to one explicit project root. Canonical project files own docu
 Indexes, query results, context packs, changesets, previews, and renders are derived artifacts.
 
 The generic core validates and retrieves canonical nodes. A project-bound proposal service writes
-only isolated changesets. Canonical application, project builds, Git mutation, deployment, and
-publication remain external integration actions. Passive revision detection may read the current Git
+isolated changesets. A separately gated canonical application service may apply one exact,
+hash-approved changeset through a generic or project-owned serializer. Project builds, Git mutation,
+deployment, and publication remain external. Passive revision detection may read the current Git
 commit when Git is available; it cannot change repository state.
 
-DFG-9 made manual canonical integration the permanent DocForge 0.x policy. The library, CLI, and
-MCP server do not apply changesets to canonical files. Reconsidering that boundary requires a new
-approved contract and measured cross-project evidence; it is not an unimplemented 0.x feature. See
-`APPLICATION_DECISION.md`.
-
 ## Versioned contracts
 
 - Project descriptor schema: `schemas/project.schema.json`, version 1.
@@ -23,7 +19,7 @@ approved contract and measured cross-project evidence; it is not an unimplemente
 - Result envelope: `schemas/result.schema.json`, version 1.
 - Changeset schema: `schemas/changeset.schema.json`, version 1.
 - Index schema: version 1, disposable and reproducible.
-- Core, CLI, and MCP server: version 0.12.0.
+- Core, CLI, and MCP server: version 0.13.0.
 
 Schema files describe the generic interchange contract. Runtime validation remains responsible for
 path confinement, source hashing, relationship resolution, dependency cycles, project limits, stale
@@ -49,8 +45,8 @@ if canonical source no longer matches the derived index.
 
 Create, update, move, and delete are ordered node operations inside an isolated changeset. Every
 operation names its expected base hash. A move preserves the stable node ID. A delete must resolve
-every incident relationship. Proposal validation and storage are atomic. Canonical application
-remains external, and prose is never auto-merged.
+every incident relationship. Proposal validation and storage are atomic. Application requires the
+exact final changeset hash; prose is never auto-merged.
 
 The MCP process binds to one configured writer identity at startup. The project descriptor grants
 that writer explicit families and operation types. A changeset records its creator, project root
@@ -80,9 +76,10 @@ changeset only to its isolated preview path. Status recomputes expected output w
 reports `current`, `stale`, `missing`, `unsafe`, or `oversized`. Input changes detected before atomic
 replacement fail without replacing the prior output.
 
-Normal MCP access does not expose canonical application, declared project-output rendering,
-arbitrary renderer execution, arbitrary file writes, shell commands, Git mutation, build commands,
-deployment, or publication.
+Normal MCP access does not expose canonical application. An explicitly configured canonical
+applier registers one hash-bound application tool. No MCP mode exposes arbitrary renderer
+execution, arbitrary file writes, shell commands, Git mutation, build commands, deployment, or
+publication.
 
 ## Project-bound graph visualization
 
@@ -102,11 +99,12 @@ random token is part of every accepted URL path. Only `GET` and `HEAD` are suppo
 no-store caching, a restrictive content-security policy, frame denial, MIME sniffing protection,
 and no-referrer policy. The built-in template uses only same-origin JSON endpoints for graph
 overview, bounded search, exact descriptor-category filtering, exact node content, bounded
-incoming-and-outgoing neighborhoods. Descriptor filtering accepts only
+incoming-and-outgoing neighborhoods, and one node's bounded project-confined source file.
+Descriptor filtering accepts only
 family, authority, status, or tag plus one exact value. There is no write endpoint, arbitrary query
 endpoint, static filesystem handler, external asset, or project-selection control.
 
-The `graph-browser@11` template provides mouse-wheel zoom centered on the pointer, left-button drag
+The `graph-browser@12` template provides mouse-wheel zoom centered on the pointer, left-button drag
 pan, explicit zoom-in and zoom-out buttons, a reset-view button, and a live zoom percentage. A
 four-pixel drag threshold defers pointer capture and preserves node activation for ordinary clicks.
 Loading another root node fits the viewport to the returned neighborhood, including a useful
@@ -123,8 +121,11 @@ status, and tag pills are buttons that replace the left result list with exact m
 Right-clicking or pressing Shift+Enter opens the complete inspector. Inspection does not replace
 the current neighborhood or reset the viewport. Both dialogs support Escape, explicit close
 controls, and backdrop dismissal. Loading the inspected node as the new root requires the separate
-Explore neighborhood action. Both side panels support pointer and keyboard resizing. The unblurred
-full inspector supports native resizing and constrained title-bar dragging.
+Explore neighborhood action. Non-focus nodes may be hidden from the presentation and restored
+without mutating graph state. Source actions open the project-confined source and navigate to
+supported line, TOML, heading, or text anchors. Both side panels support pointer and keyboard
+resizing. The unblurred full inspector supports native resizing, constrained title-bar dragging,
+and a fixed header/footer surrounding a scrollable body.
 
 The header exposes a Nodes/Flow segmented selector. Nodes displays the complete bounded
 neighborhood. Flow displays an upstream lineage ending at the current root. Calls, dispatches,
@@ -185,5 +186,6 @@ project semantics that the generic core cannot infer. Generic projects retain th
 and TOML source-layout validator.
 
 An explicit integration may construct the full fixed MCP surface for a configured adapter project
-and one startup-bound writer. This does not add adapter discovery or canonical application. An
-adapter without proposal settings or validation remains read-only.
+and one startup-bound writer. Canonical application is registered only when the integration also
+supplies a startup-bound applier identity and project-owned `CanonicalApplier`. An adapter without
+proposal settings or validation remains read-only.