Every door reads one surface The sealed data surface at the top; the form, HTTP and OpenAPI, and the tool read it directly; the React page walks through HTTP, and MCP and ECA through the tool. Every door keeps one accepted document, one refusal list, and no schema stricter than the runtime. The sealed data surface
built once, then only read
Form
Draws each key with a widget chosen
from its definition.
A refusal lands under the key that
caused it.
HTTP and OpenAPI
Serves both documents at the
resource's path; the method is the
operation.
An OpenAPI 3.1 document describes
every path.
Tool
One tool per operation, its inputs
the contract's.
A dry run answers the accepted
values.
Read the surface directly
Walk through one of those
React page
Draws the resource from the schema
alone, knowing nothing else of it.
MCP and ECA
MCP lists the tool, input schema
included.
An ECA action runs the tool, so a
model cannot save what the form
refuses.
Settings pages and plugin settings forms are
drawn through it.
Every door keeps, for the same values sent:
One accepted document
One refusal list, by pointer and code
No advertised schema stricter than the runtime Every door reads one surface The sealed data surface; the form, HTTP and OpenAPI, and the tool read it directly; the React page walks through HTTP, and MCP and ECA through the tool. Every door keeps one accepted document, one refusal list, and no schema stricter than the runtime. The sealed data surface
built once, then only read
Read the surface directly
Form
Draws each key with a widget chosen
from its definition.
A refusal lands under the key that
caused it.
Settings pages and plugin settings forms are
drawn through it.
HTTP and OpenAPI
Serves both documents at the
resource's path; the method is the
operation.
An OpenAPI 3.1 document describes
every path.
React page
Draws the resource from the
schema alone, knowing nothing
else of it.
Tool
One tool per operation, its inputs the
contract's.
A dry run answers the accepted values.
MCP and ECA
MCP lists the tool, input schema
included.
An ECA action runs the tool, so a
model cannot save what the form
refuses.
Every door keeps, for the same
values sent:
One accepted document
One refusal list, by pointer and code
No advertised schema stricter than the
runtime
Every door reads the one sealed data surface and nothing else: the form, the tool and through it MCP and ECA, HTTP with its OpenAPI document and through it the React page. The same values sent through any door give one accepted document and one refusal list, by pointer and code, because nothing an operation runs reads the request; and no schema a door advertises is stricter than what the pipeline accepts.
Read more Surface API , No door-specific context , Never stricter than the runtime , Testing a resource . Decisions Nothing an operation runs reads the request , One result at every door , Two documents, never stricter than the runtime .