feat(mcp): instant resume detection, scoped confirm, and a slim read-only tool subset #394

Affected component

MCP server

What problem does this solve?

Every resume pays three taxes that compound across weeks of restarts: the agent must discover and call continuum resume --json itself, mutating-tool confirmation is all-or-nothing (a single self-certified component forces full human review even when everything else is trusted), and the full tool surface sits in context whether or not the run needs it. Cold-start latency and token floor both suffer.

Proposed solution

Three coordinated pieces:

1. Instant detection: write .continuum/resume.json on every checkpoint; SessionStart hook reads it out of band and injects an interrupted-run banner only when one exists. Silent otherwise. Target: cold-start banner latency well under a second.
2. Scoped confirm: confirm --scope <component> clears self-certified REQUIRES_REVIEW for the named components only (goal, progress), leaving any other uncertainty intact. REVIEW_CONFIRMED gains an optional scope payload; validator clears only what was confirmed. Full confirm remains available.
3. Token floor: continuum_resume_check slim tool subset (validate/resume/list_actions) exposed via a minimal registration for contexts that should not carry the mutating surface at all.

COORDINATION CONSTRAINT: this issue touches the confirm flow, which is also the subject of open contributor PR #377. Work MUST build on main's current post-revert behaviour, must not preempt or reproduce #377's diff, and the branch rebasing discipline on the board applies doubly. If #377 merges mid-flight, integrate rather than override.

Acceptance criteria:

• Banner appears only when an interrupted run exists; latency measured and reported in PR.
• Scoped confirm leaves unrelated uncertainty untouched (test: goal confirmed, uncertain side effect still blocks).
• Slim subset lists exactly the read-only trio; mutating calls refuse identically to today.
• Default flows unchanged when features are unused.

Alternatives considered: doing nothing (taxes stay); auto-confirming trusted subsets without an explicit event (rejected: breaks the provenance contract).

Is this a breaking change?

No

Would you like to work on this?

No