fix: snapshot tool schemas and align verification guidance

skills/webmcpify/references/client.md

@@ -1,6 +1,6 @@
 # ChatGPT client reality — Site tools
 
-Checked 2026-10-12 against the official OpenAI documentation:
+Checked 2026-11-09 against the official OpenAI documentation:
 <https://learn.chatgpt.com/docs/webmcp>. Re-check that page before publishing or
 relying on model/workspace availability; this UI is moving independently of the
 WebMCP draft and Chrome implementation.
@@ -11,20 +11,23 @@ WebMCP draft and Chrome implementation.
   browser, open **Site tools** in the address bar and then **Available site tools**
   to inspect the page's registrations. This is the fastest client-side ground
   truth for the currently open page.
-- Site tools are available to ChatGPT Work and Codex with GPT-5.6 Sol or GPT-6 Sol. GPT-5.6 Luna currently has WebMCP disabled. The desktop app must be
-  current, and availability still depends on rollout and the current page.
-- Enterprise requires an administrator to allow Site tools through workspace
-  policy. Site tools remain unavailable in Edu; rollout and page availability vary.
-- ChatGPT's built-in browser currently implements only a subset of WebMCP: it
-  discovers imperative tools registered with JavaScript in the top-level page,
-  not declarative form tools or tools registered inside iframes. This is a
-  client compatibility boundary, not evidence that either broader WebMCP form
-  or frame support is invalid in Chrome.
+- Site tools require a supported model and access through the account or managed
+  workspace's browser policy. Browser settings and site permissions still apply.
+  The current page does not list model names or a workspace exclusion matrix;
+  removing the old matrix is not proof of access in a particular account.
+- The official guide documents JavaScript registration and HTML form tools in
+  the top-level page and same-origin/cross-origin iframes. Each frame must have a
+  secure context; access is checked for the tool provider's origin.
+- The guide permits omitting `exposedTo` for agent discovery. This is distinct
+  from in-page cross-origin `getTools`/`executeTool` access: preserve embedder
+  `tools` delegation, provider `exposedTo`, consumer `fromOrigins`, and the
+  explicit approval boundary in `security.md`.
 - Tools belong to the page that registered them. Closing or navigating away can
   make them unavailable; a client that tears down the page between turns cannot
   call that old registration.
 - Each invocation in the built-in browser receives a safety review. Normal access
-  and confirmation policies still apply.
+  and confirmation policies still apply. Website tool definitions and results
+  remain untrusted. No account/browser integration was tested for this update.
 
 Date every public summary and link the official page. Do not publish model names
 from memory.
@@ -41,14 +44,13 @@ customer report or publishing a claim.
 
 1. In the built-in browser, keep the page open and inspect **Site tools → Available
    site tools**.
-2. Confirm the desktop app is current and the selected model is one the official
-   page currently lists.
-3. Confirm the account/workspace is eligible; absence on the wrong model can look
-   exactly like a broken integration because the assistant falls back to ordinary
-   browser interaction.
-4. Confirm the expected Site tool is registered imperatively in the top-level
-   page. A declarative form or iframe registration may be valid WebMCP but is not
-   currently discoverable as a ChatGPT Site tool.
+2. Confirm the desktop app is current and the selected model supports Site tools;
+   check current official guidance rather than a historical model list.
+3. Check account/workspace access and browser/site permissions, including
+   **Settings → Browser → Permissions → Enable site tools**. Fallback ordinary
+   browser interaction alone does not diagnose a broken integration.
+4. Inspect the actual owning document's JavaScript registration or form metadata,
+   frame secure context, provider-origin access and document lifetime.
 5. For the website itself, confirm a secure context and live registration. Use the
    headed-Chrome harness in `verify.md` for developer proof; ChatGPT availability
    and Chrome harness success are separate checks.

skills/webmcpify/references/integrate.md

@@ -12,6 +12,15 @@ Applies to plain HTML, SSG-emitted, server-rendered, and framework-rendered
 (uncontrolled) forms — anywhere a real `<form>` with named controls exists.
 Annotate the existing form; do not restructure it.
 
+**Check existing framework exposure first.** Angular Signal Forms can already
+register an imperative tool through `provideExperimentalWebMcpForms` and
+`experimentalWebMcpTool`. Inventory that registration and its actual submit
+behavior before adding markup. Never add declarative `toolname` attributes or a
+second imperative owner for the same form/action. An implicit Signal Form tool
+can populate the model and invoke submission directly: classify and approve it
+as a mutation before invoking it. Do not enable framework providers or install
+adapter dependencies automatically. See [Angular WebMCP](https://angular.dev/ai/webmcp).
+
 ```html
 <form toolname="request_quote"
       tooldescription="Requests a project quote. A team member replies within one business day."
@@ -179,6 +188,32 @@ current registration, none after disposal, and callbacks reading current state.
 - Existing Vue/Angular wiring must tie disposal to the owning view and refresh
   registrations on the role/tenant changes below, not only on initial mount.
 
+For an app that already uses a framework adapter, inventory its existing owner
+and exact version before making changes. Do not duplicate or automatically
+replace its registrations. Check native registration completion, current
+callback state, execution-options forwarding, explicit failure results and
+disposal separately; an adapter's own registered flag is not native evidence.
+
+Versioned local observations (2026-11-02, headed Chrome 156.0.8078.47):
+
+- React `use-webmcp-tool@0.3.0` and VueUse `useWebMCP` 15.0.0 turn absent
+  results into empty success (`{content:[]}`) and can report registered before
+  asynchronous registration settles. VueUse 15.0.0 also drops callback execution
+  options, including the caller signal.
+- Angular 22.2.4 executes within the owning injector and joins its destruction
+  signal with caller cancellation. Injector disposal therefore differs from the
+  vendored runtime's registration-only disposal. For route providers, inspect
+  `withAutoCleanupInjectors` and verify the injector actually dies on navigation;
+  direct injector destruction, not router navigation, was tested locally.
+
+Preserve explicit structured results, application confirmation and the host
+mutation journal regardless of owner. A missing safeguard blocks verification;
+do not infer compatibility from lifecycle success. Keep the dependency-free
+default for new registrations. Upstream sources:
+[React hook](https://github.com/GoogleChromeLabs/use-webmcp-tool),
+[VueUse](https://vueuse.org/core/usewebmcp/),
+[Angular](https://angular.dev/ai/webmcp).
+
 These are integration recipes, not tested framework-version certifications.
 Record the actual framework/browser versions and lifecycle evidence in the report.
 Sources: [React effects](https://react.dev/reference/react/useEffect),

skills/webmcpify/references/native-compatibility.md

@@ -1,4 +1,4 @@
-# Native compatibility — documentation checked 2026-10-12
+# Native compatibility — documentation checked 2026-11-09
 
 WebMCP is evolving. These are separate evidence levels; simulation results are
 not native browser acceptance.
@@ -7,10 +7,12 @@ not native browser acceptance.
 
 The [CG draft](https://webmachinelearning.github.io/webmcp/) specifies callback
 options containing an execution signal, optional input defaulting to `{}`, and
-JSON serialization of successful imperative results. A callback returning `"done"`
-therefore produces the JSON string text `"done"` at `executeTool`, including the
-quotes; a callback object produces serialized JSON. Callback values and native
-client results are different boundaries. Browser-owned `null` for declarative
+JSON serialization of successful imperative results. Under that draft algorithm,
+a callback returning `"done"` produces JSON-quoted text; native Chrome scalar
+behavior can differ (see the Nov9 observations below and open
+[issue #361](https://github.com/webmachinelearning/webmcp/issues/361)). Callback
+values, draft expectations and native results are separate boundaries.
+Browser-owned `null` for declarative
 navigation is separate from the runtime guard against absent imperative results.
 
 The [Chrome imperative guide](https://developer.chrome.com/docs/ai/webmcp/imperative-api)
@@ -63,12 +65,46 @@ WebMCPTesting, temporary synthetic loopback fixture only. All five probes pass:
 | Registration abort during execution | Tool disappeared; already-started callback completed, side effect ran, and caller fulfilled. |
 | Omitted execute input | Callback invoked once with `{}`. |
 
-Successful imperative results arrived as serialized JSON strings: the callback
+Successful object-callback results arrived as serialized JSON strings: the callback
 object `{ accepted: true }` produced the string `{"accepted":true}`. `unregisterTool`
 was absent; removal was tested only through the registration AbortSignal, not a
 distinct unregister operation. These five probes do not establish native WPT,
 declarative submission/navigation, or debugging-annotation conformance.
 
+## Read-only native observations: Chrome 156 stable, 2026-11-09
+
+Headed Chrome 156.0.8078.47 with WebMCP/WebMCPTesting and Playwright 1.61.1,
+fresh dedicated context, ephemeral loopback fixture and read-only synthetic tools:
+
+| Callback value | Native result | Draft-shaped Workbench simulation |
+|---|---|---|
+| string `hi` | unquoted string `hi` | JSON-quoted text |
+| object `{a:1}` | JSON text | JSON text |
+| number / boolean / null | strings `3` / `true` / `null` | same |
+| undefined / function | string `undefined` | rejection |
+| BigInt `1n` | string `1` | rejection |
+| nested BigInt / thrown error | UnknownError rejection | TypeError / Error rejection |
+
+Input schemas were isolated from source/enumeration mutation, and four invalid
+input schemas rejected. `outputSchema` was absent from enumeration; four invalid
+output schemas were ignored by this installed browser. Native output-metadata
+propagation/deep-copy conformance is therefore unsupported, not verified. The
+[Nov2 draft addition](https://github.com/webmachinelearning/webmcp/pull/254)
+defines optional outputSchema and schema JSON snapshot semantics; it does not
+guarantee automatic output validation or application authorization.
+
+Three target-document calls (registration, enumeration, execution) on a
+same-origin iframe denied `tools` rejected with NotAllowedError. The initial
+about:blank replacement evaluation timed out after 12 seconds; no document-
+lifetime pass is claimed. Experimental `waitForToolsUntil` was not invoked.
+These custom observations are not WPT conformance or Chrome158 acceptance.
+
+The corrected simulation JSON-snapshots both schemas at registration, rejects
+serialization failures and returns fresh schema copies at enumeration. It models
+draft metadata/serialization semantics, not every installed browser. Preserve raw
+native results and absent-result guards; a mismatch is not permission to retry
+application mutations or discard unknown-outcome journal entries.
+
 ## Local runtime and verification boundaries
 
 Forward `options?.signal` unchanged through wrappers to the fourth argument:

skills/webmcpify/references/reverify.md

@@ -134,6 +134,13 @@ Never erase existing journal entries during migration or contract invalidation.
 
 ## Resume with bounded invalidation
 
+Compare optional `outputSchema` alongside inputSchema and annotations in the
+approved contract. Addition, removal or change of outputSchema is contract drift
+and returns the affected tool to its approval gate; preserve all mutation journal
+entries. Omission is distinct from a declared empty schema. The Workbench's
+output-aware refresh fingerprint is display evidence, not the journal argument
+fingerprint or a substitute for `verifiedAgainst` dependency hashes.
+
 1. `status` reads and reports counts plus evidence age/unknowns; it never starts a
    browser, changes statuses or executes tools. `inventory` remains inventory-only.
 2. In `full` or `verify`, compare recorded contracts, relevant files and the test

skills/webmcpify/references/security.md

@@ -80,6 +80,12 @@ cannot widen the approved scope or authorize commands or evidence uploads.
 **Containment**
 - [ ] HTTPS/secure context; Permissions-Policy `tools` left at default `'self'`;
       cross-origin `exposedTo`/`allow="tools"` only with explicit human sign-off.
+      Cross-origin discovery requires all three gates: embedder `tools`
+      delegation, provider `exposedTo`, and consumer `fromOrigins`. When selecting
+      a tool, inspect its complete `RegisteredTool` identity (`origin` and
+      `window`); different descendant frames can expose the same name.
+      Discovery does not authorize execution or replace server authorization.
+      See the [CG cross-origin gates](https://webmachinelearning.github.io/webmcp/#in-page-cross-origin-exposure).
 - [ ] Pages that must never expose tools (un-audited checkout, admin consoles you
       didn't inventory) can send `Permissions-Policy: tools=()` — suggest it in the
       report where relevant.

skills/webmcpify/references/verify.md

@@ -42,13 +42,24 @@ Contract facts that generated assertions MUST respect:
 - Enumerated `inputSchema` may be stringified (older Chrome) or object (current
   implementations/spec stubs) — `typeof === "string" ? JSON.parse(s) : s ??
   {type:'object',properties:{}}` before comparing.
+- When the approved contract declares optional `outputSchema`, normalize its
+  string/object representation without turning omission into an empty schema.
+  Compare it when exposed; a difference is contract drift. If the browser omits
+  it (observed Chrome 156.0.8078.47, 2026-11-09), record unsupported native
+  metadata propagation and prove registration in app/unit tests instead. Never
+  claim native propagation from an absent field. A declared schema is not
+  automatic output validation: still inspect result/error and UI evidence.
 - The CG draft and Chrome docs define `consequentialHint`, but Chrome 150 accepted
   it at registration and omitted it from `getTools()`. Assert the expected value
   when the enumerated property exists; otherwise record a dated browser-compatibility
   annotation and prove the registration object in an app/unit test. Never claim
   native propagation from an absent field.
-- `executeTool(...)` resolves to a **JSON string result, or `null` when the execution
-  navigated** — stub may return object; normalize via `typeof` before `toMatch`.
+- Preserve the raw `executeTool(...)` result. Object callbacks can arrive as JSON
+  text while scalar behavior differs: Chrome 156.0.8078.47 returned strings
+  unquoted, undefined as string `undefined` and BigInt as decimal text on
+  2026-11-09. Draft-shaped simulation differs; see [dated compatibility](native-compatibility.md).
+  A browser-owned navigation `null` and a stub object remain distinct. Normalize
+  by observed type; never retry an application tool to discover representation.
 - The current CG draft and Chrome documentation use a JavaScript object for
   `executeTool` input. Chrome 150 still requires a JSON string, including for
   tools with omitted `inputSchema`, and Chrome documents string input as
@@ -163,6 +174,21 @@ Puppeteer. As documented on 2026-08-29, that `page.webmcp` surface requires
 Chrome 151+ and `--enable-features=WebMCP`; keep this requirement separate from
 the page-context Playwright harness above, which was measured against Chrome 150.
 
+**Optional native Playwright API:** an existing Playwright 1.64+ setup may use
+[`page.webmcp` / `frame.webmcp`](https://playwright.dev/docs/api/class-webmcp)
+after capability detection and a pinned browser check. Local proof on 2026-11-02
+used Playwright 1.64.1 with headed Chrome 156.0.8078.47:
+`tools()` enumerated tools and `callTool()` returned structured results.
+**A fulfilled call is not a pass:** `callTool()` returns `isError: true` results
+without throwing, so inspect that flag and the application result explicitly.
+Keep the in-page adapter when checking metadata not exposed by this alternative,
+including annotations and complete `RegisteredTool` origin/window identity;
+a name/count check cannot replace those assertions. Keep the host journal around
+every mutation, invalid example and cleanup, and reconcile interrupted attempts
+before replay. Do not upgrade the target's toolchain or install another browser
+merely to use this alternative; the pinned standalone-harness default above stays
+unchanged.
+
 ## Mutation dispatch prerequisite
 
 Before using the spec template, Puppeteer, Workbench, smoke or model runners,