feat(mcp): mountable generic delegate() via MCP_ENABLE_DELEGATE on the mcp bin

[drewstone]

What

Teaches the agent-runtime-mcp bin to serve the ONE generic delegate verb — so a consumer app can mount delegate() over the SAME stdio invocation it already uses, by flipping one env var.

The gap this closes

delegate is wired into createMcpServer via McpServerOptions.delegateSupervisor, and createDelegateHandler + the DELEGATE_* constants are exported from /mcp. But the published agent-runtime mcp bin only wired coderDelegate / researcherDelegate — it never wired delegateSupervisor. So npx @tangle-network/agent-runtime mcp (the invocation @tangle-network/agent-app's buildDelegationMcpServer mounts as a sandbox stdio child) could not serve delegate at all, and there was no standalone buildDelegateMcpServer. An app had no clean way to mount the generic verb.

Change

• New src/mcp/delegate-supervisor-provisioning.ts: resolve the delegate supervisor substrate (router brain + worker backend) from env.
  • Opt-in via MCP_ENABLE_DELEGATE=1 (default off — additive, existing consumers unaffected).
  • Brain router: TANGLE_API_KEY + the repo's resolveRouterBaseUrl convention, normalized to /v1; model from MCP_SUPERVISOR_MODEL → MCP_WORKER_MODEL → WORKER_MODEL → default.
  • Worker backend: sandbox — authored workers run as sub-sandboxes via the same SandboxClient the bin already loads (the delegate_code deployment shape). Harness from MCP_DELEGATE_WORKER_HARNESS (default opencode).
  • Fail-closed: no key / not opted in → undefined, matching the coder/researcher posture.
• bin.ts wires it into createMcpServer({ delegateSupervisor }) and adds delegate to the sandbox-client gate.
• Tests for the resolver (6) + the env-var doc block + the canonical-api decision-table row.

Why this shape

Mirrors how coderDelegate is already env-gated. Every consumer app then swaps delegate_code → delegate by flipping env on the SAME bin mount it already has — no app-specific entrypoint, no new sandbox image. (Pilot: the legal-agent swap that proved this — tangle-network/legal-agent#211.)

Verify

• pnpm run build — green.
• pnpm run typecheck — clean.
• pnpm exec vitest run tests/mcp/ — 294 pass (incl. the 6 new resolver tests).
• pnpm run lint — clean.
• pnpm run docs:check — OK (version pin + decision-table row updated).

Version bump 0.71.0 → 0.71.1 (additive).

[tangletools]

✅ Auto-approved PR — 3fd84879

Blanket team auto-approval is enabled for this reviewer service.
The full PR reviewer audit still runs separately and will publish findings if it detects issues.

_{tangletools · auto-approval · reason: blanket_auto_approve · 2026-06-22T09:11:30Z}