mindspace: version runtime contracts and audit packages

mindspace-service/mindspace-rpc-server.mjs

@@ -151,8 +151,9 @@ export async function createMindSpaceRpcRequestHandler({
   serviceMeta = {},
 } = {}) {
   const {
+    createMindSpaceServerAdapterContractPayload,
     MINDSPACE_SERVER_ADAPTER_BINDINGS,
-    MINDSPACE_SERVER_ADAPTER_BINDING_KEYS,
+    MINDSPACE_SERVER_ADAPTER_CONTRACT_VERSION,
   } = await loadContract(env);
   const operationBasePath = String(
     serviceMeta.operationBasePath ?? env.MINDSPACE_REMOTE_OPERATION_BASE_PATH ?? '/mindspace/v1/adapter',
@@ -199,6 +200,16 @@ export async function createMindSpaceRpcRequestHandler({
           service: 'mindspace-service',
           adapterKind: adapter.kind,
           implementationStatus: adapter.implementationStatus,
+          contractVersion:
+            MINDSPACE_SERVER_ADAPTER_CONTRACT_VERSION,
+          buildId:
+            serviceMeta.buildId ??
+            env.MINDSPACE_SERVICE_BUILD_ID ??
+            null,
+          gitSha:
+            serviceMeta.gitSha ??
+            env.MINDSPACE_SERVICE_GIT_SHA ??
+            null,
           operationBasePath,
           mcpOperationBasePath,
           mcpScopedToolsEnabled:
@@ -207,10 +218,15 @@ export async function createMindSpaceRpcRequestHandler({
         });
       }
       if (req.method === 'GET' && url.pathname === '/mindspace/v1/contract') {
-        return json(res, 200, {
-          bindings: MINDSPACE_SERVER_ADAPTER_BINDINGS,
-          bindingKeys: MINDSPACE_SERVER_ADAPTER_BINDING_KEYS,
-        });
+        return json(
+          res,
+          200,
+          createMindSpaceServerAdapterContractPayload({
+            adapter,
+            serviceMeta,
+            env,
+          }),
+        );
       }
       if (
         req.method === 'POST' &&

mindspace-service/mindspace-rpc-server.test.mjs

@@ -320,6 +320,11 @@ test('health and contract endpoints are exposed without auth', async () => {
     env: {
       MINDSPACE_MEMIND_ROOT: '..',
     },
+    serviceMeta: {
+      buildId: 'mindspace-test-build',
+      gitSha: 'abc123',
+      builtAt: '2026-07-27T00:00:00.000Z',
+    },
   });
 
   const health = await runRequest(handler, { path: '/health' });
@@ -327,7 +332,23 @@ test('health and contract endpoints are exposed without auth', async () => {
 
   assert.equal(health.statusCode, 200);
   assert.equal(health.body.ok, true);
+  assert.equal(health.body.contractVersion, 2);
+  assert.equal(health.body.buildId, 'mindspace-test-build');
   assert.equal(contract.statusCode, 200);
+  assert.equal(contract.body.contractVersion, 2);
+  assert.equal(contract.body.service, 'mindspace-service');
+  assert.equal(contract.body.buildId, 'mindspace-test-build');
+  assert.equal(contract.body.gitSha, 'abc123');
+  assert.ok(
+    contract.body.requiredCapabilities.includes(
+      'workspace-publication-delivery-authority',
+    ),
+  );
+  assert.ok(
+    contract.body.requiredBindings.workspaceToolService.includes(
+      'publishPage',
+    ),
+  );
   assert.ok(contract.body.bindings.assetService.includes('renderAssetPreview'));
   assert.ok(
     contract.body.bindings.chatSaveService.includes(

mindspace-service/server.mjs

@@ -1,9 +1,27 @@
 import { bootstrapMindSpaceService } from './mindspace-service-bootstrap.mjs';
 import { startMindSpaceRpcServer } from './mindspace-rpc-server.mjs';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
 
 const logger = console;
 
+async function readBuildInfo() {
+  try {
+    const raw = await fs.readFile(
+      path.join(__dirname, 'build-info.json'),
+      'utf8',
+    );
+    return JSON.parse(raw);
+  } catch {
+    return {};
+  }
+}
+
 async function main() {
+  const buildInfo = await readBuildInfo();
   const service = await bootstrapMindSpaceService({ env: process.env, logger });
   const rpc = await startMindSpaceRpcServer({
     adapter: service.adapter,
@@ -11,6 +29,9 @@ async function main() {
     logger,
     serviceMeta: {
       operationBasePath: service.runtime.remote.operationBasePath,
+      buildId: buildInfo.buildId,
+      gitSha: buildInfo.gitSha,
+      builtAt: buildInfo.builtAt,
     },
   });