[AI-Assisted] feat(mcp): qualify bounded barrier-register screening

[EvenSol]

Campaign

Advances #3153 under the bounded Phase 0 trust-evidence roadmap.

Capability contract: #3153 (comment)

Engineering question

Can runBarrierRegister accept a bounded caller-supplied register, preserve deterministic source order and traceable evidence, fail closed for malformed or excessive input, exclude impaired or unqualified barriers from quantitative handoffs, and expose only advisory LOPA/SIL/bow-tie/QRA screening through the standard packaged MCP boundary?

Change

• Enforce 65,536 UTF-8 request bytes, 100 items per collection, 256 object members, 4,096 characters per text value, and 12 nested levels.
• Reject wrong collection/item types and non-numeric or non-finite quantitative fields before constructing canonical barrier objects.
• Preserve the existing NeqSim BarrierRegister, SafetyBarrier, PerformanceStandard, SafetyCriticalElement, and DocumentEvidence classes as the only model.
• Add explicit screeningOnly, standards-conformance, and qualified-review boundaries on success and error.
• Extend focused Java evidence and add a seven-scenario packaged-STDIO qualification harness.
• Wire the focused protocol into the read-only MCP qualification workflow and publish the exact evidence boundary.

Frozen scope and accounting

Exact base: 3e6262872d14fa31715e818549ca6473d79a7057
Exact head: fdcab71eff776735cf9268e9bee3385c3d4606ba

Six files are changed. Active autonomous PRs #3700, #3701, #3708, #3710, and #3712 are file-disjoint.

This is qualification only. Phase 0 remains 1.39 / 20 explicit + 39 contract-tested + 12 confirmed gaps, and runBarrierRegister remains CONFIRMED_GAP until this evidence merges and a later atomic promotion re-audits current master.

Safety and advisory boundary

The change does not identify hazards; validate source documents, PFD, effectiveness, availability, independence, common-cause failure, proof testing, or lifecycle evidence; select or verify SIL; decide tolerability; demonstrate NORSOK/IEC/ISO compliance; authorize plant action; certify design; or replace qualified process-safety review and accountable approval. No external data, plant write, control action, or second safety model is introduced.

Exact-head validation

Passing:

• CodeQL, pre-commit, Spotless, PaperLab, and Javadocs
• documentation accounting, agent checks, and benchmark accuracy
• all four Java 21 slow shards
• all MCP qualification steps preceding the new barrier-register protocol

Two test-only blockers remain:

1. The focused packaged barrier-register protocol reaches scenario 3 of 7, then fails because its synthetic “valid” fixture omits the canonical performance-standard safetyFunction and leaves the impaired barrier unlinked to an SCE. Canonical validation correctly returns two warnings and validation.valid=false; the harness incorrectly requires true. Comprehensive MCP is not reached.
2. Windows Java 21 executes 14,097 tests before the added BarrierRegisterRunnerTest.testScreeningBoundaryAndImpairedBarrierExclusion errors. The test reads lopaHandoff.excludedBarriers, but the canonical response key is excluded, producing a null dereference. Ubuntu Java 21 was cancelled after that failure; Java 8 jobs were skipped by fail-fast.

The sole permitted repair was already consumed by the exact hosted Spotless patch for initial head 7ed1eef37a4da858da266a4168e293cad33a3bed; artifact digest sha256:0349942585773986883d2bcc15576f8931022d35e1261e3cbd3c34b7f5c2c369. It changed formatting only and produced current exact head fdcab71eff776735cf9268e9bee3385c3d4606ba.

VALIDATION BLOCKED — SECOND REPAIR DISALLOWED.

No reviews or unresolved review threads.

Workflow policy

Draft only. Preserve exact head fdcab71eff776735cf9268e9bee3385c3d4606ba. Do not merge, auto-merge, mark ready, rebase, synchronize, force-push, close, replace, restart, abandon, or apply a second repair.