[rlippmann]

Summary

Adds an opt-in live-model validation path for the TypeScript MCP calendar-admin tool-gating example.

The existing provider-free tests remain the canonical proof. The new live-model path demonstrates the same enforcement behavior with real tool-calling models while preserving the existing MCP semantics.

Changes

• Added live-model helper:

  • src/live_model.ts

• Added live-model tests:

  • tests/live_model.test.ts
  • tests/live_model_helper.test.ts
  • tests/live_model_provider.test.ts

• Live-model path:

  • builds the exposed MCP tool surface from authoritative Context Compiler state
  • passes only exposed tools to the model
  • records selected tools and execution outcomes
  • verifies protected tool visibility and execution change only when authoritative state changes

• Simplified the TypeScript provider contract:

  • MODEL is the exact model id expected by the target endpoint
  • OPENAI_BASE_URL optionally selects a non-default OpenAI-compatible endpoint
  • OPENAI_API_KEY supplies authentication
  • removed provider aliases and LiteLLM-style model identifiers

• Added GPT-5 compatibility handling:

  • GPT-5-family requests omit temperature
  • models that support deterministic temperature settings continue using temperature=0

Validation

Provider-free:

• npm run build
• npm run typecheck
• npm test
• ./scripts/validate_typescript_fast.sh

Live-model validation:

OpenAI:

• gpt-4o-mini ✅
• gpt-5-mini ✅
• gpt-5.4 ✅

Ollama:

• qwen2.5:1.5b-instruct ✅

Notes

This change does not modify MCP enforcement behavior.

The provider-free tests remain the primary proof. The live-model path is opt-in and exists to demonstrate that the same tool-gating behavior is preserved when a real model participates in tool selection.