Description
Vault-Content and DBOM Result Channels separate untrusted retrieved text from trusted operating context so agents can consume Dots records without confusing data for instructions. Every model-facing success and API error text is wrapped in <vault-content> after embedded boundary tags are neutralized. Row tools share the CLI record envelope, while the daemon's DBOM rides only structuredContent.dbom with option and identity label maps.
The workflow is designed for MCP hosts and safety-conscious agent builders. It uses the same authenticated, company-scoped service contracts as the rest of Dots, so terminal or protocol convenience never creates a second source of truth. Inputs are validated before or at the route boundary, and outputs preserve identifiers and structured details needed for a reliable next step.
Selling Points
- Reduces prompt-injection risk from stored row bodies, snippets, and code text.
- Preserves trusted operating-manual guidance outside the untrusted text fence.
- Gives programmatic hosts typed rows, totals, errors, and DBOM metadata.
- Keeps CLI and MCP record rendering aligned through one shared envelope.
- Resolves opaque option and identity ids into useful labels without changing stored data.
User Story
An agent opens a row containing text that imitates instructions. The host receives that body inside a neutralized vault boundary, while the authoritative operating purpose and judgment arrive separately in structured content for policy-aware handling. The result is a concrete, inspectable outcome that another person or automation can continue from without reconstructing hidden state.
Extension Surface
This is fixed_core: packages/mcp/src/render.ts owns the mandatory boundary and packages/mcp/src/tools.ts controls DBOM relay and envelope rendering. Callers consume the channels but cannot disable the safety floor. The rating reflects the most-open supported seam that is true for this capability, not a transitive implementation detail. The cited path is the operational proof: consumers can use the documented seam, while unsupported changes still require a core release.
Capabilities & Limits
- Capability: Always-on vault-content wrapping for success and error text.
- Capability: Boundary-tag neutralization against fence breakout.
- Capability: Trusted tiered DBOM, label maps, and typed result structures.
- Limit: The boundary establishes instruction hierarchy but cannot guarantee that every external host will interpret structured and text channels correctly.
The limit is intentional product truth rather than missing documentation. Calls also remain subject to authentication, tenant selection, schema validation, and the permissions enforced by the authoritative service.
Implementation Map
packages/mcp/src/render.tspackages/mcp/src/tools.tsdocs/mcp/result-rendering.md