feat: provider discovery as a shipped tool - engine, CLI, MCP tools, JSON entries

[MrJ55]

Summary

Makes provider discovery a shipped, triggerable capability of comet-mcp instead of a test artifact, and adds self-healing provider controls (ADR 0003) so the harness is the rare repair, not the routine check.

Two capabilities:

1. Discovery as a shipped tool — when a provider changes its DOM and comet-mcp breaks, re-running discovery is repeatable and on-demand. Provider entries are data (JSON), not code, written directly by the discovery engine — so DOM-drift repair is discover → commit new JSON, no code changes.

2. Self-healing controls (ADR 0003) — inspired by Bladebro's Live Page Model (src/knowledge.rs, src/page/refs.rs). provider_verify is now a learning loop: per-control confidence (success +0.05, failure −0.15 asymmetric, evict <0.3, trust ≥0.7 hot-path resolve, learn-only-from-success). On a selector miss, a structural fingerprint rebind (in-page FNV-1a of ancestor chain + tag + children + identity attrs) absorbs React/Vue re-renders before anything escalates — only a genuine DOM change degrades and suggests provider_discover --diff.

Base note: this branch is stacked on feat/fabric-types-p0-p2 (PR #9) because the engine depends on the P1 canonical types landed there. It is open against main; merge order #8 → #9 → #10 and GitHub auto-shrinks the diff to this PR's delta.

What's included

src/core/discovery.ts — the engine (ported from the discovery harness):

• runDiscovery(provider, {write, deadlineMs}) — inventory → composer/send detection → one varied validation prompt → streaming/completed observation → writes entry JSON + fixtures
• verifyProvider(provider) — cheap selector check, sends NO prompt (the drift gate); now a confidence-learning loop with fingerprint rebind on miss
• diffEntry(provider, next) — selector/heuristic changes vs the committed entry
• pickPrompt — per-run prompt rotation (persisted state) so no provider repeats a probe prompt
• Zero dependencies (Node native WebSocket); own CDP connection per run

src/core/registry.ts — loads + validates src/providers/entries/*.json; confidence model (recordSuccess/recordFailure/resolveWithConfidence/persistControlUpdate); packageRoot() walk-up so paths work from compiled dist/.

src/core/fingerprint.ts — in-page FNV-1a structural fingerprint (ancestor chain ≤10 + tag + first-3 children + type/name/data-testid, per Bladebro perception.rs) + resolveWithRebind: known selector → fingerprint rebind on miss → null escalates to discovery. Resolution order: known → fingerprint-rebind → heuristic → discovery.

src/cli.ts + bin dispatch — the primary on-demand trigger:

comet-mcp discover --provider grok [--diff] [--no-write]
comet-mcp verify   --provider grok        # no prompt sent; reports per-control confidence + rebinds
comet-mcp list

MCP tools (provider_discover, provider_verify) — opt-in operational tools per ADR 0001 (discovery is not a hot-path dependency).

Provider entries as JSON — src/providers/entries/{perplexity,grok,gemini,chatgpt,claude}.json, all HIGH confidence from live verification (2026-08-06/07, ACK/PONG/ALPHA/OK/BRAVO validations). Each control carries confidence/fingerprint fields; conditional controls (send buttons rendered only after typing) are flagged and skipped by idle verify. The hand-written .ts entries are retired.

Docs — ADR 0003 (self-healing provider controls); build plan phase status (P0 done, P1/P2 types+discovery done, runtime pending); generalized discovery runbook; Turn-02 checklist updated.

Fixtures — test/fixtures/{perplexity,gemini,chatgpt,claude}/ state snapshots.

Notes for reviewers

• tsc --noEmit + npm run build pass.
• Verified live: comet-mcp verify --provider perplexity → HEALTHY with confidence climbing (0.70→0.80 across verifies) and fingerprints captured; verify --provider gemini → HEALTHY (conditional sendButton correctly skipped, unconditional controls at 1.00); verify --provider grok gracefully reports "no grok tab found" (exit 1); plain comet-mcp still starts the server.
• Conditional-control fix (caught live): send buttons rendered only after typing were initially counted as verify failures at idle (false negative — Gemini's sendButton drained 0.9→0.6 in two verifies). Fixed: conditional controls are skipped by idle verify (no confidence penalty, not a health failure); their precondition is exercised by provider_discover.
• The discovery engine sends exactly one validation prompt per run, rotated per provider (ACK/ALPHA/OK/BRAVO/PONG pool) — repeated identical probes would look like an injection sweep.
• Legacy test/integration/discover.mjs harness removed (superseded by the engine).
• Rotation state + test/integration/out/ are gitignored as runtime artifacts.

Drift workflow this enables

comet-mcp verify --provider grok              # MISS → confidence drops; re-renders rebind silently
comet-mcp discover --provider grok --diff     # only on genuine DOM change / eviction
git diff src/providers/entries/grok.json      # review selector changes
git commit                                     # repaired — no code changes

Related

• ADR 0001 (transport/relay) · ADR 0002 (fabric types) · ADR 0003 (self-healing controls)
• PR feat: conversation fabric types, P0 CDP spike, and Grok provider discovery #9: P1 fabric types + P0 spike + provider entries (this branch's base)
• Reference: Bladebro (dondai44423/bladebro) — src/knowledge.rs, src/page/refs.rs, src/page/perception.rs