deps.sh ran bare 'uv sync --locked', which only installs the root
dependency graph (root -> cli -> core) and orphans the ngen-weave-mcp
and ngen-weave-server workspace members, so fastapi/uvicorn/mcp never
installed and the CI pytest step failed at collection.

- deps.sh: sync --all-packages --locked so every member installs
- build.sh: build all four package wheels instead of core+cli only
- mcp/server package versions: 0.1 (they were copying the monorepo
  version 0.1.3); uv.lock updated accordingly (version pins only)

@@ -5,6 +5,7 @@ description = "Core library for ngen-weave: durable human-in-the-loop AI workflo
 requires-python = ">=3.12"
 license = "Apache-2.0"
 dependencies = [
+    "jsonschema>=4.21",

@@ -0,0 +1,46 @@
+"""Agent-specific error taxonomy.

@@ -0,0 +1,78 @@
+"""PermissionGate: wraps a ToolRegistry and enforces a PermissionSet per activation."""

@@ -0,0 +13,4 @@
+
+MAX_TURNS = 3  # provider turns before exhaustion; one turn yields exactly one action
+
+_REPAIR_NUDGE = (

@@ -0,0 +9,4 @@
+from ngen_weave.agent.errors import UnknownToolError
+from ngen_weave.errors import ConfigError, DataError
+
+_TOOL_NAME_RE = re.compile(r"^[a-z][a-z0-9_-]*$")

@@ -146,0 +176,4 @@
+        raise ConfigError(f"{source}: unknown run.budget keys: {sorted(unknown)}")
+    cost_usd = raw.get("cost_usd")
+    steps = raw.get("steps")
+    cost_ok = isinstance(cost_usd, (int, float)) and not isinstance(cost_usd, bool) and cost_usd > 0

@@ -1,89 +1,340 @@
-"""Single-writer persistence for run files.
+"""Single-writer persistence for run state in one SQLite database.

@@ -113,0 +386,4 @@
+            records=records,
+        )
+
+    def _import_legacy(self) -> None:

@@ -0,0 +1,321 @@
+"""Budget enforcement and cooperative cancellation.

@@ -0,0 +10,4 @@
+from ngen_weave.errors import ConfigError
+from ngen_weave.workflow import Workflow
+
+MANIFEST_NAME = "ngen-weave.json"

@@ -0,0 +62,4 @@
+        return f"{self.field} {_OP_SYMBOLS[self.op]} {self.value}"
+
+
+def gt(field: str, value: float | int) -> ObserverPredicate:

@@ -0,0 +1,126 @@
+"""RunService protocol plus run-summary types.

@@ -0,0 +22,4 @@
+from ngen_weave.service import RunService
+from ngen_weave.workflow import Workflow
+
+NGEN_WEAVE_DIR = Path(".ngen-weave")

@@ -0,0 +1,23 @@
+[project]
+name = "ngen-weave-mcp"
+version = "0.1.3"

@@ -0,0 +20,4 @@
+from ngen_weave_mcp.stdio import EPILOG, _package_version
+from ngen_weave_mcp.tools import DEFAULT_TOOL_TIMEOUT_S, register_workflow_tools
+
+MCP_HTTP_HOST = "127.0.0.1"  # local-only by design; TLS/auth are out of scope

@@ -0,0 +13,4 @@
+from ngen_weave.workflow import Workflow
+from pydantic import ValidationError
+
+POLL_INTERVAL_S = 0.25  # engine-specified status poll cadence while blocking

@@ -0,0 +16,4 @@
+POLL_INTERVAL_S = 0.25  # engine-specified status poll cadence while blocking
+DEFAULT_TOOL_TIMEOUT_S = 3600.0
+
+_TERMINAL_STATUSES = {"completed", "failed", "cancelled"}

@@ -0,0 +1,19 @@
+[project]
+name = "ngen-weave-server"
+version = "0.1.3"

@@ -0,0 +1,192 @@
+"""FastAPI HTTP translation layer: routes translate to LocalRunService calls.
+
+No business logic per the PRD.