Extension tools discovered after hosted MCP bind are not callable in managed sessions #371

Summary

Extension-host tools can be visible and callable in the daemon registry while remaining unavailable to the managed provider that owns the session. The hosted MCP bind excludes the extension provider from its initial bootstrap projection, then publishes those tools asynchronously. A managed session can discover the canonical descriptor through compozy__tool_search and compozy__tool_info, but the harness never exposes an invocable tool reference.

This affects any installed and active extension that publishes extension_host tools. It is not specific to one extension, agent, or workflow.

Reproduction

1. Install and activate any extension that publishes an extension_host tool.
2. Start a fresh managed agent session in a workspace where that extension is active.
3. Inspect the published tool through compozy__tool_search and compozy__tool_info.
4. Attempt to invoke the tool reference from the managed provider.

Actual behavior

• The daemon registry reports the extension tool as registered, available, authorized, executable, and callable.
• The hosted MCP initial bind omits extension tools because daemonExtensionToolProvider.DeferInitialDiscovery() returns true.
• The asynchronous projection later adds the descriptor to the MCP server, but the managed provider may not receive an invocable tool reference during that session.
• Any workflow that requires the extension tool must stop even though the canonical registry says the tool is callable.

Expected behavior

Every tool published by any installed and active extension that is available and callable when a managed session starts must be included in the provider's invocable hosted MCP projection before the provider begins work. Registry discovery and provider invocation must agree. Dynamic updates may still handle later extension lifecycle changes without weakening workspace, policy, or approval fences.

Impact

Any extension-backed managed workflow can pass registry preflight and still be unable to execute its required tools. This breaks the documented tool_search → tool_info → invoke flow for arbitrary installed extensions.

Evidence

A production canary with an installed extension loaded the extension skill catalog successfully and resolved one of its extension_host tools as callable, but the managed provider exposed no invocable reference. No extension tool invocation occurred.

A focused registry regression test reproduces the underlying contract directly: an available and executable extension tool produces an empty hosted bootstrap projection.

Constraints

• Fix the hosted MCP projection contract at its source; do not add extension-specific workflow fallbacks.
• Preserve workspace scoping, policy and approval evaluation, and lazy discovery for truly external vendor MCP providers.
• Add provider-boundary regression coverage proving a tool from an arbitrary installed extension is invocable in a fresh managed session.