E1 · Catalog in order
3 minRun the catalog check.
Done when: node scripts/governanca.mjs; echo "saída: $?" → GOVERNANÇA: 0 problema(s) and saída: 0; the bad one → GOVERNANÇA: 3 problema(s) and saída: 1.
Lesson 7 · 16 min
Production and governance: who approves a new tool, versioning, shutting it off fast
A tool for an agent is an action on your site performed by someone else. It needs an owner, an approval date, an autonomy level, and a way to go offline in minutes without breaking the form. In this lesson the approved catalog becomes a file that the page and the server read, a script checks it, and a state shuts a tool off.
Start the lesson
In this lesson you will
- 1The approved catalog (governanca.json)
- 2Autonomy levels from 0 to 3
- 3The script that checks code × catalog
- 4Shutting off a tool while keeping the form
Goal: put each tool in a catalog with an owner, a date, and an autonomy level, and shut one off without a code deploy and without breaking the form.
01The life of a tool
Click each step.
Click each block in the diagram to see what it does.
02Autonomy levels
From INEMA's agent constitution model, applied to the site's tools.
1. 3
Executes and logs. For what only reads: search, list, view.
In the kit: buscar_oficinas, listar_comentarios, minhas_reservas.
2. 2
Executes and notifies the person in charge.
For small, reversible effects, with a notice to whoever looks after it.
3. 1
Prepares and waits for the person to approve: the page's Confirmar, the MCP's MRTR.
In the kit: reservar_vaga. Every action with consequences stays here or below.
4. 0
Hands off to a person. It cannot be active.
E.g.: canceling someone's enrollment, refunding a payment.
Script rule
consequence and level above 1 = problem; level 0 active = problem
03The approved catalog
The page reads it with fetch (cache: no-store); the server reads it from disk on every request. Without the file, nothing goes out: it fails closed.
File · kit/pagina/governanca.json
{
"versao_catalogo": "2026-10-19.1",
"spec_webmcp": "2026-10-16",
"protocolo_mcp": "2026-07-28",
"niveis": {
"3": "faz sozinho e registra",
"2": "faz e avisa o responsável",
"1": "propõe e espera a pessoa aprovar",
"0": "não toca: encaminha para uma pessoa"
},
"ferramentas": [
{ "nome": "buscar_oficinas", "dono": "time do site", "nivel": 3, "aprovada_em": "2026-10-19", "estado": "ativa", "superficies": ["webmcp", "mcp"] },
{ "nome": "listar_comentarios", "dono": "time do site", "nivel": 3, "aprovada_em": "2026-10-19", "estado": "ativa", "superficies": ["webmcp"] },
{ "nome": "minhas_reservas", "dono": "time do site", "nivel": 3, "aprovada_em": "2026-10-19", "estado": "ativa", "superficies": ["webmcp"] },
{ "nome": "reservar_vaga", "dono": "time do site", "nivel": 1, "aprovada_em": "2026-10-19", "estado": "ativa", "superficies": ["webmcp", "mcp"] }
]
}04Check code × catalog
governanca.mjs reads the tools the code knows about (page and server) and compares them with the catalog.
Terminal · the kit's catalog and a bad catalog
cd ~/projetos/formacao-webmcp-expert-v72/kit
node scripts/governanca.mjs; echo "saída: $?"
node scripts/governanca.mjs governanca/ruim.json | grep -E "PROBLEMA|GOVERN"; echo "saída: ${PIPESTATUS[0]}"Example from the repository
catálogo 2026-10-19.1 · 4 ferramentas (4 ativas) · código: 4 na página, 2 no servidor GOVERNANÇA: 0 problema(s) saída: 0 PROBLEMA reservar_vaga: tem consequência e está no nível 3 (máximo 1: propõe e espera a pessoa) PROBLEMA minhas_reservas: está no código (webmcp) mas não no catálogo aprovado PROBLEMA listar_comentarios: sem data de aprovação (AAAA-MM-DD) GOVERNANÇA: 3 problema(s) saída: 1
The bad catalog puts reservar_vaga at level 3 (it would act alone), forgets minhas_reservas, and doesn't date the approval of listar_comentarios.
05Switch off fast
On a copy of the page, the state of reservar_vaga becomes desligada. No code changes.
Terminal · switch off reservar_vaga
cd ~/projetos/formacao-webmcp-expert-v72/kit node scripts/desligar.mjs reservar_vaga nativo; echo "saída: $?"
Example from the repository
== Chromium 156.0.8078.4 (Playwright) · modo: nativo antes: WebMCP 4 ferramentas · MCP 2 ferramentas desligada: reservar_vaga (estado "desligada" no governanca.json, nenhum código mudou) depois: WebMCP 3 ferramentas · MCP 1 ferramentas formulário: a pessoa reservou of-301 normalmente DESLIGAR: ok · reservar_vaga fora do WebMCP e do MCP, formulário funcionando saída: 0
In production, the same applies when you publish the new governanca.json: the page reads it without cache on the next load, the server on the next call. An agent with the page already open still sees the tool until it reloads.
06Practice
Check, switch off, and write your site's catalog. Each exercise ends in a done when.
E2 · Switch off without a deploy
5 minRun the drill that switches off reservar_vaga.
Done when: node scripts/desligar.mjs reservar_vaga nativo; echo "saída: $?" → depois: WebMCP 3 ferramentas · MCP 1 ferramentas, DESLIGAR: ok and saída: 0.
E3 · Your site's catalog
20 minWrite the governanca.json for your site's tools: owner, date, level, and surfaces. Agree with your team on who can change the state to desligada and how fast.
Done when: In your copy of the kit with your tools, node scripts/governanca.mjs; echo "saída: $?" → 0 problema(s) and saída: 0.
07Lesson quiz
The explanation appears after the answer.
Question 1 of 4
reservar_vaga has consequences. What level can it be at?
Correct
An action with consequences waits for the person (level 1) or goes to a person (0). The annotation is a warning to the agent, not the confirmation; validating input does not replace the yes.Not this one
An action with consequences waits for the person (level 1) or goes to a person (0). The annotation is a warning to the agent, not the confirmation; validating input does not replace the yes.Review: Autonomy levelsQuestion 2 of 4
The governanca.json failed to load (network error). What does the kit's page do?
Correct
Fails closed: without an approved catalog, no tool goes out. The person's path doesn't depend on the catalog.Not this one
Fails closed: without an approved catalog, no tool goes out. The person's path doesn't depend on the catalog.Review: The approved catalogQuestion 3 of 4
You switched off reservar_vaga in the catalog. An agent with the page open for 10 minutes:
Correct
The page reads the catalog on load. Switching off takes effect on the next load (and, on the MCP server, on the next call). For an immediate cutoff on the page, you would need to abort the registration in real time: decide whether your case calls for that.Not this one
The page reads the catalog on load. Switching off takes effect on the next load (and, on the MCP server, on the next call). For an immediate cutoff on the page, you would need to abort the registration in real time: decide whether your case calls for that.Review: The approved catalogQuestion 4 of 4
governanca.mjs flagged "está no código mas não no catálogo aprovado" (in the code but not in the approved catalog). What does that prevent?
Correct
It's the approval gate: writing code is not enough to expose a tool to an agent. The other checks (name, description) belong to the catalog validator from course 2.Not this one
It's the approval gate: writing code is not enough to expose a tool to an agent. The other checks (name, description) belong to the catalog validator from course 2.Review: The approved catalogQuiz complete
You got {a} of {n} right. If you get them all right, the lesson is marked as completed.Choose an option. The explanation appears after your attempt.
08In three sentences
CatalogEvery exposed tool has an owner, a date, a level, and surfaces in a single file.
LevelAnything with consequences stays at 1 (proposes and waits) or 0 (does not touch).
Turn offThe desligada state removes the tool from both doors without a deploy; the form stays.