feat(catalog): truthful availability — available:true ⇒ built + verified-real

The catalog defaulted every cartridge to available:true (router.ex), so all
125 cartridges advertised as working when only feedback-mcp is actually built
and returns real results. This makes the catalogue tell the truth and adds a
CI gate so it cannot silently regress.

- cartridge.json (×125): add explicit `available` (true only for feedback-mcp);
  add `status` where missing ("catalogued"), preserving existing stub/ffi_only
  labels; fix orchestrator-lsp's duplicate `status` key (kept ffi_only).
- router.ex: flip the `available` default true→false so a cartridge must opt in
  to being advertised as working, never by omission.
- tests/truthfulness_check.sh + .github/workflows/truthfulness.yml: a gate that
  builds every available cartridge and invokes its first tool, failing on a
  "status":"stub" reply (or none). Verified to catch a stub flipped to available.
- router_test.exs / contract_test.exs: fix /menu tests that asserted the
  pre-tiering cartridges/count shape (broken since tiered /menu landed) to assert
  the real tier_*/summary shape and the new availability invariant
  (summary.ready == count of available entries).

https://claude.ai/code/session_019tMcRS1Dm1nWjjYP4WvbJa

Author: claude

.github/workflows/truthfulness.yml

@@ -0,0 +1,60 @@
+# SPDX-License-Identifier: MPL-2.0
+# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
+#
+# Truthfulness invariant: the cartridge catalogue must never advertise as
+# `available: true` anything that isn't built and returning real results.
+# This gate builds every available cartridge and invokes its first tool,
+# failing if the reply carries a `"status":"stub"` marker (or no reply at all).
+# See tests/truthfulness_check.sh for the rules.
+
+name: Truthfulness
+
+on:
+  push:
+    branches: [main, master, develop]
+    paths:
+      - 'cartridges/**/cartridge.json'
+      - 'cartridges/**/ffi/**'
+      - 'ffi/**'
+      - 'elixir/lib/boj_rest/router.ex'
+      - 'tests/truthfulness_check.sh'
+      - '.github/workflows/truthfulness.yml'
+  pull_request:
+    branches: [main, master]
+    paths:
+      - 'cartridges/**/cartridge.json'
+      - 'cartridges/**/ffi/**'
+      - 'ffi/**'
+      - 'elixir/lib/boj_rest/router.ex'
+      - 'tests/truthfulness_check.sh'
+      - '.github/workflows/truthfulness.yml'
+  workflow_dispatch:
+
+permissions: read-all
+
+concurrency:
+  group: truthfulness-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  truthfulness:
+    name: Catalogue truthfulness (available ⇒ built + real)
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Install Zig
+        uses: goto-bus-stop/setup-zig@9566bb3e8749893055694249726756f25e099b30  # v2
+        with:
+          version: 0.15.1
+
+      - name: Install jq
+        run: sudo apt-get update && sudo apt-get install -y jq
+
+      # The script builds boj-invoke and (re)builds each available cartridge's
+      # .so itself, so it is the single source of truth for the gate.
+      - name: Run truthfulness check (probe)
+        run: bash tests/truthfulness_check.sh --probe

cartridges/007-mcp/cartridge.json

@@ -51,6 +51,8 @@
     "tag_map_path": "schemas/memory-tag-map.a2ml"
   },
   "name": "007-mcp",
+  "available": false,
+  "status": "catalogued",
   "protocols": [
     "MCP",
     "Agentic"

cartridges/academic-workflow-mcp/cartridge.json

@@ -3,6 +3,8 @@
   "spdx": "MPL-2.0",
   "copyright": "Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>",
   "name": "academic-workflow-mcp",
+  "available": false,
+  "status": "catalogued",
   "version": "1.0.0",
   "description": "Academic workflow — Zotero integration, citations, paper review",
   "domain": "Research",

cartridges/aerie-mcp/cartridge.json

@@ -3,6 +3,8 @@
   "spdx": "MPL-2.0",
   "copyright": "Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>",
   "name": "aerie-mcp",
+  "available": false,
+  "status": "catalogued",
   "version": "0.1.0",
   "description": "Aerie environment lifecycle manager",
   "domain": "infrastructure",

cartridges/affinescript-mcp/cartridge.json

@@ -3,6 +3,8 @@
   "spdx": "MPL-2.0",
   "copyright": "Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath)",
   "name": "affinescript-mcp",
+  "available": false,
+  "status": "catalogued",
   "version": "0.1.0",
   "description": "AffineScript language cartridge -- type checking, parsing, formatting, linting, compiling, hover/goto-def/completion queries, error explanation, stdlib browsing, and syntax reference for the AffineScript language (substructural type system with affine/linear types, algebraic effects)",
   "domain": "Languages",

cartridges/agent-mcp/cartridge.json

@@ -3,6 +3,8 @@
   "spdx": "MPL-2.0",
   "copyright": "Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>",
   "name": "agent-mcp",
+  "available": false,
+  "status": "catalogued",
   "version": "0.1.0",
   "description": "OODA loop agent session enforcer",
   "domain": "ai",

cartridges/airtable-mcp/cartridge.json

@@ -3,6 +3,8 @@
   "spdx": "MPL-2.0",
   "copyright": "Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath)",
   "name": "airtable-mcp",
+  "available": false,
+  "status": "catalogued",
   "version": "0.2.0",
   "description": "Airtable cartridge -- base listing, table schema retrieval, record search, record creation, record update, field listing, view browsing, webhook management, comment access, and revision history via the Airtable REST API",
   "domain": "Productivity",

cartridges/arango-mcp/cartridge.json

@@ -3,6 +3,8 @@
   "spdx": "MPL-2.0",
   "copyright": "Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath)",
   "name": "arango-mcp",
+  "available": false,
+  "status": "catalogued",
   "version": "0.1.0",
   "description": "ArangoDB multi-model database gateway. AQL queries, document operations, graph traversals, and collection management.",
   "domain": "Database",

cartridges/aws-mcp/cartridge.json

@@ -3,6 +3,8 @@
   "spdx": "MPL-2.0",
   "copyright": "Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath)",
   "name": "aws-mcp",
+  "available": false,
+  "status": "catalogued",
   "version": "0.1.0",
   "description": "AWS cloud gateway. Session-based authentication with per-region slots, throttle management, and multi-service action routing.",
   "domain": "Cloud",

cartridges/bofig-mcp/cartridge.json

@@ -3,6 +3,8 @@
   "spdx": "MPL-2.0",
   "copyright": "Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath)",
   "name": "bofig-mcp",
+  "available": false,
+  "status": "catalogued",
   "version": "1.0.0",
   "description": "Bofig Cartridge — Evidence graph query tools for investigative workflows",
   "domain": "Research",