feat: add local agent MCP tools and optional source-grounded AI answers

docs/VALIDATION.md

@@ -7,9 +7,10 @@ and `SEARCHI_FORCE_CPU=1`.
 
 ## Current integration checkpoint (2026-10-12)
 
-- Native desktop: **9/9 tests passed**, including structured trace/basic responses.
+- Native desktop: **13/13 tests passed**, including structured trace/basic responses
+  and four optional-answer source/consent/revision tests.
   Post-generation cached query warmup is implemented but its interactive first-query gate remains open.
-  Frontend: **31/31 tests passed**, TypeScript/Vite production build and
+  Frontend: **35/35 tests passed**, TypeScript/Vite production build and
   formatting passed. Preview policy tests cover fractional timestamp seeking,
   image labels, one active/latest pending request, stale replies and Escape.
 - Semantic adapter: **8 default tests passed**; the explicit 48 MP resource test
@@ -42,7 +43,11 @@ and `SEARCHI_FORCE_CPU=1`.
   that run: [recorded benchmark](../crates/searchi-core/benchmarks/results/windows-cpu-full-candidate-first-final.json).
   These measurements do not establish every query or concurrent-indexing goal.
 
-The integrated CPU workspace checkpoint passed **62 default tests** (8 assets, 6 CLI, 23 core, 4 media, 8 semantic, 13 service), with **10 explicit opt-in tests ignored**. Workspace and native all-target Clippy passed with warnings denied. The later semantic CPU-restart counter change passed workspace Clippy and the actual CPU query diagnostics test. Earlier aggregate counts are historical.
+The integrated CPU workspace checkpoint passed **72 default tests** (7 optional AI,
+8 assets, 8 CLI/MCP, 24 core, 4 media, 8 semantic, 13 service), with **10 explicit
+opt-in tests ignored**. Workspace and native all-target Clippy passed with
+warnings denied. The later semantic CPU-restart counter change passed workspace
+Clippy and the actual CPU query diagnostics test. Earlier aggregate counts are historical.
 
 The updated pinned C++ helper compiled in an independent CPU build directory and
 was staged for desktop resources without interrupting media evaluation. Actual
@@ -91,6 +96,36 @@ the real page location. Media placeholder text receives no invented word marks.
 [Reproduction](../tools/desktop-capture/README.md),
 [runtime/query/image evidence](screenshots/capture-manifest.json).
 
+## Agent and optional-answer evidence (2026-10-12)
+
+The official Rust MCP SDK serves three read-only stdio tools: search, stats and
+opaque-handle source retrieval. Two actual executable tests verify initialization,
+tool discovery, real SQLite results, structured output, invalid inputs, UNC/device
+filter rejection before filesystem resolution, source modification/deletion and
+reindex invalidation. One-operation admission, 64 KiB input frames and a 256-handle
+cache bound the adapter. Its agent skill passed the Skill Creator validator.
+
+A separate actual Google CPU MCP smoke check used the existing seven-file README
+fixture index. Hybrid search selected Supplier Agreement.pdf, page 2, returned its
+sixty-day notice passage through read_source, and selected Mountain Lake.jpg for
+the image-description query. The observed warm document engine time was 69.80 ms
+in one run; this small debug fixture is not a production benchmark or p95 claim.
+
+Seven actual loopback HTTP tests verify the optional OpenAI-compatible adapter's
+request path/messages, header-only authentication, pure offline validation,
+input/response bounds, real timeout behavior, citation consistency and sanitized
+errors. Replies are controlled HTTP fixtures; no hosted provider or live summary
+model was invoked. Native tests verify that the shown excerpt equals the outgoing
+text, filename/path/credential exclusion, disabled/unknown/stale-source rejection
+and preparation revision handling. Frontend tests cover disabled defaults,
+configuration validation, byte budgets and stale-answer state.
+
+The desktop's optional answers are separate from search, disabled by default and
+explicitly requested. Config and keys are session-only; model output is plain text
+and labeled as a draft. Answers currently cover one reviewed document excerpt.
+Native window interaction, live-provider compatibility/quality/latency, Linux/macOS
+agent execution and release packaging remain open gates.
+
 ## Historical evidence
 
 Initial engine/CLI checks covered retrieval, persistence, filesystem changes,