The v2 MCP Chat Battery, Explained

The Desktop connector’s “Always allow” permissions walkthrough — a UI flow with no headless equivalent. Automated runs resolve it with an ungraded session preamble; this card is verified by hand.

The answer must be in user-action terms with example phrases to try (“try saying: ‘I want to write…’”) covering starting, pitches, continuing, and length. A bare list of internal tool names, or a flow diagram, fails.

Code asserts start_story returned exactly 3 candidates. The judge asserts all three writers were listed by name and style before any pilot was written, and that the actor went straight into the audition instead of brainstorming natively — the product’s “always show the lineup, never filter for the user” directive.

A real pilot episode in the first writer’s voice — prose, not a synopsis — saved silently, followed by exactly one two-option question: lock this writer, or hear another? A brief “your draft is saved” is fine; asking permission to save, or narrating save mechanics, is not. Choreography checks run over the whole transcript because a good actor often pre-fetches Pitch 1 during the start turn.

Pitches 2 and 3 must read in voices clearly distinct from Pitch 1 and from each other — the entire thesis of the product is that the writers aren’t interchangeable. Claiming an earlier draft was lost also fails.

A two-turn destructive-op test. The first message must produce a warning that rerolling clears the saved drafts (the tool returns needs_confirmation when drafts exist); only the explicit go-ahead triggers the reroll. The fresh trio must not overlap the original three, presented as a lineup of names + styles — reading only the first new pitch in full is the expected choreography.

A roster relay with a filter the roster can’t satisfy. Full credit for an honest no-match plus nearest-adjacent voices (dark, mystery, crime-adjacent); the failure modes are ignoring the ask entirely or showing internal persona IDs.

Code asserts commit_persona returned status: active; the judge asserts plain-language confirmation that the pilot is now Episode 1. The commit is idempotent per slot — if a network retry re-sends it, the tool replays success instead of erroring, which once broke a smoke run.

The arc must be laid out — central arc, season shape, setups/payoffs or character arcs — and saved as the plan. Internal tool names or YAML field dumps fail.

The first reply must fog everything past the user’s reading position; the second, on explicit request, reveals the full plan. A future beat leaking into the no-spoilers view is the fail.

Episode 2 must continue in the committed writer’s voice with continuity from Episode 1 — consistent names, no contradicted facts, no drift into generic narration — and be saved without error.

Graded on direction, not precision: an episode that undershoots (~500 words) still passes. The failure mode being tested is the next episode staying as long as before after the change was acknowledged.

“Off” must be understood as a distinct state, not just another number — confirmed in any plain-language form, with some signal that it’s reversible.

Deliberately phrased as a change to an unusual number: the actor’s own story map routinely plans ~10 episodes, and asking for the value already on the plan let it answer “that’s already the plan” without calling the tool. Claiming past episodes get rewritten also fails.

The note must be captured for the next episode without announcing capture mechanics. “Logging your feedback signal” is an instant fail.

A clean, ordered number/title/one-line-summary table. The server renders the table itself and hands it over as display_text for verbatim relay — adopted after three straight runs proved prompt nudges couldn’t make an actor build a table reliably.

The full text, verbatim, with title and hook — never a re-paraphrase or summary.

A readable bundle of every episode plus characters and threads, with a mention that it can also be read on the web. Partial exports or raw JSON fail.

Runs in a brand-new session to prove statelessness. Stories listed by premise (never raw IDs); naming one resumes it with context. Volunteering other stories unprompted violates the “one story at a time” directive.

The judge requires the plan explained in plain language — free tier, unlimited writing, how to upgrade. The exact payload (tier, limits masked to null) is pinned by the contract suite; any numeric cap presented as the plan’s limit is a red flag here, because no tier advertises one.

Ordered last so every earlier test still has a live story. Confirmation must correctly describe the semantics: recoverable via support, not permanently deleted.

Deliberately provokes a wrong-status error on a brand-new story. The decline must be plain-language (“you need to pick a writer first”); a raw wrong_status / ep_num_skip code or stack trace shown to the user is the fail.

Costs are explained as informational — what the platform spent serving the account, plus a ballpark token estimate — never framed as a bill, an invoice, or an amount owed, and never conflated with plan pricing.

Three fronts. (1) No internal leakage — a deterministic regex scan over everything Claude showed the user: no tool names, field names, or rejected=false. Pure code; the judge is not consulted. (2) No IP contamination — no living authors, named published works, franchises, or copyrighted characters in any pitch or episode prose (the platform’s own writer-roster blurbs are carved out as platform copy). (3) No tell-don’t-show crutches — the constructions that mark AI slop: “moved with the practiced precision of someone who…”, “it was the kind of X that…”, “smiled the smile of someone who…”, “the particular quality of X that Y”, “the instinct of X operating…”. This craft half is the only genuinely content-variable grading left in the battery.

The smoke-mode canary that subscriber auth and tier resolution work. The judge requires the plan presented as paid with unlimited writing; the exact payload (tier, limits masked to null) is pinned by the contract suite. The internal daily safety stop is masked by the server and must never be surfaced to the user.

Once the pricing flip is fully live, a free-tier story is created public and the server’s response opens with a loud disclosure. Claude must relay it prominently — before or alongside the three pitches: readable by anyone in Rooms, may help improve the writers, private writing is the paid plan. Skipping it, burying it after the pilot prose, or vague-ing it into “some sharing settings apply” fails; so does refusing to start the story instead of disclosing.

Fixture exhausts the account’s daily safety stop and seeds a real continuable story (committed writer + Episode 1), named in the message — both scars from runs where a bare synthetic story or an unnamed “my story” dead-ended the actor into clarifying questions. next_episode must block with tier_blocked, no episode gets written — and the relay must stay generic. The stop is a silent abuse valve on every plan, so tier framing, numbers, or an upgrade pitch in the relay is the actor inventing policy, and each is a scanned failure.

Fixture: four active stories and heavy same-day episode usage on the subscriber account. The full pitch→commit→episode flow must proceed with zero limit, quota, or upgrade language anywhere — volume is not a sales trigger.

The tool correctly refuses (admin_only); Claude must relay “audiobooks are in a limited admin preview” gracefully — without dumping the error, apologizing in loops, retrying the same call hoping for a different outcome, or improvising a workaround like offering to read the story aloud itself.

Voice audition → generate → listen, run by hand with an admin account and a real ElevenLabs key. Battery accounts are deliberately non-admin.