stack: MCP submit-Tool mit Upload Review Gate und Quarantäne-Schreibpfad (schliesst #32)

Files changed:
- .gitignore
- AGENTS.md
- CHANGES.md
- INSTALL-MCP.md
- README.md
- VERSION
- docs/why-gates-are-code.md
- instructions/gates.md
- instructions/ingest-queue.md
- instructions/mcp-read-server.md
- instructions/wiki-ingest/SKILL.md
- raw/CONTRACT.md
- tools/CONTRACT.md
- tools/chemenu/cli.py
- tools/chemenu/commands/docs_verify.py
- tools/chemenu/commands/doctor.py
- tools/chemenu/commands/upload_cmd.py
- tools/chemenu/config.py
- tools/chemenu/mcp/server.py
- tools/chemenu/tests/test_doctor.py
- tools/chemenu/tests/test_mcp_server.py
- tools/chemenu/tests/test_upload.py
- tools/chemenu/tests/test_upload_cmd.py
- tools/chemenu/upload.py

instructions/mcp-read-server.md

@@ -8,7 +8,10 @@ description: Run and keep current the MCP read server that serves this wiki to a
 
 Chemenu has a second consumer. `search`, `types`, `describe_type`, `lint` and `status` are
 served over MCP to callers that are not this terminal - the CLI and the server are two adapters
-over one core (`chemenu.api.Corpus`), not a CLI with a network interface bolted on.
+over one core (`chemenu.api.Corpus`), not a CLI with a network interface bolted on. A sixth
+tool, `submit`, is opt-in: a checkout that creates `.wikitool-upload.json` also
+offers a quarantined write path for documents pushed from outside - see
+[instructions/ingest-queue.md](ingest-queue.md) for reviewing what lands there.
 
 This document is about *operating* it: how to start it, what has to be true of the checkout it
 serves, and how that checkout stays current. What it exposes and why is in
@@ -90,6 +93,11 @@ everything an operator needs that is *true of the software* rather than of one i
    drifted answers correctly but reparses on every request - and every answer it gives is
    stamped `"commit": null`, because a dirty tree corresponds to no revision.
 
+   **Never add `git clean` to this sync.** `reset --hard` leaves every gitignored path alone by
+   design, which is exactly what keeps `mcp-upload/` (the `submit` tool's own quarantine) and
+   `reports/telemetry/` intact across a sync - a `git clean -xd` bolted on "to tidy up" would
+   delete a submission nobody has reviewed yet, silently, on the next poll.
+
 ## Decision points
 
 - **An answer looks stale?** Read `commit` in the response. If it names an old revision, the
@@ -99,10 +107,15 @@ everything an operator needs that is *true of the software* rather than of one i
   configuration difference: the two go through the same functions and a golden test holds their
   output together (`tools/chemenu/tests/test_mcp_server.py`). Check first that both are pointed
   at the same root - `CHEMENU_ROOT` is easy to set for one and not the other.
-- **Asked to expose a write tool?** There is none, and the way to add one is not a flag. The
-  server imports nothing under `chemenu.commands`, so `new`, `touch`, `xref`, `cite`, `publish`
-  and `migrate` are unreachable from it rather than filtered out of a list. Submitting documents
-  from outside is a different design, with a quarantine in it - not a tool added here.
+- **Asked to expose a write tool?** Five of the six tools have none, structurally: the server
+  imports nothing under `chemenu.commands`, so `new`, `touch`, `xref`, `cite`, `publish` and
+  `migrate` are unreachable from it rather than filtered out of a list. The one exception is
+  `submit` (opt-in via `.wikitool-upload.json`): it may write, but only into
+  `mcp-upload/`, a quarantine no other command reads - a **positive list** enforced in code
+  (`chemenu.upload._write_atomic_within`), not an absence. The commands that move a submission
+  *out* of that quarantine (`upload accept`/`upload reject`) still have the absence property:
+  they live under `chemenu.commands` and stay unreachable from the server. Reviewing what
+  `submit` receives is [instructions/ingest-queue.md](ingest-queue.md), not this file.
 - **Asked to rate-limit inside the server?** Rate limiting belongs in the middleware in front of
   the process, next to authentication. Not the Iteration Budget Gate: that exists to stop an
   agent *session* from iterating unnoticed over the wiki's state, which is why retrieval is