Repository navigation

feat(mcp): propose isolated external tool support - #1732

Draft

JacobWeyer wants to merge 312 commits into

cortexapps:mainfrom

JacobWeyer:codex/external-mcp-final-ci

Draft

feat(mcp): propose isolated external tool support#1732
JacobWeyer wants to merge 312 commits into
cortexapps:mainfrom
JacobWeyer:codex/external-mcp-final-ci

This pull request is big! We're only showing the most recent 250 commits

Commits on Nov 2, 2026
- Run closed namespace test in Firecracker CI
  JacobWeyer
  committed
  77ba160
- Integrate reviewed MCP harness and network acceptance gates
  JacobWeyer
  committed
  91405a9
- Require exact capture authority at the destination boot
  JacobWeyer
  committed
  b346b27
- Require exact capture authority at the destination boot
  JacobWeyer
  committed
  5f0f324
- Pin managed capture artifacts before host I/O
  JacobWeyer
  committed
  6446314
- Pin managed capture artifacts before host I/O
  JacobWeyer
  committed
  f5e3404
- Inherit unknown MCP write restrictions through trusted ancestry
  JacobWeyer
  committed
  c5c41d8
- Distinguish retained retired boot sources from missing owners
  JacobWeyer
  committed
  4e03f85
- Distinguish retained retired boot sources from missing owners
  JacobWeyer
  committed
  ac41b4c
- Integrate reviewed inherited MCP unknown-write restrictions
  JacobWeyer
  committed
  43c8ebf
- Require all three actual helper acceptance targets in CI
  JacobWeyer
  committed
  17353d1
- Persist managed boot, capture, and start authority
  JacobWeyer
  committed
  67144ff
- Merge reviewed MCP helper CI gate
  JacobWeyer
  committed
  eff7cca
- Stage MCP operator publication on coordinator checkpoint
  JacobWeyer
  committed
  f313dd0
- Transfer only closed private allocation policy leases
  JacobWeyer
  committed
  eaa2edd
- Require exact finalized managed attach environment
  JacobWeyer
  committed
  3531c23
- Seal managed attach identity before finalization
  JacobWeyer
  committed
  ef8f487
- Require exact finalized managed attach environment
  JacobWeyer
  committed
  b825d68
- Type managed recovery-required host outcomes
  JacobWeyer
  committed
  96be624
- Release and retire exact managed sandbox owners
  JacobWeyer
  committed
  1ea4117
- Own managed boot, policy retirement and disk capture on the host
  JacobWeyer
  committed
  7614880
- Serialize managed harness events with cold interruption
  JacobWeyer
  committed
  6961ace
- Merge reviewed durable MCP coordinator
  JacobWeyer
  committed
  6d3ec1d
- Fence managed attachment and alternate disks without blocking inventory
  JacobWeyer
  committed
  6b5f29c
- feat: publish operator policy through an authenticated readiness barrier
  JacobWeyer
  committed
  418f19f
- Preserve MCP recovery while dispatch is disabled
  JacobWeyer
  committed
  32639d7
- Give managed boot finalization its own response envelope
  JacobWeyer
  committed
  cd30514
- Merge managed host runtime with disabled recovery
  JacobWeyer
  committed
  bc692ae
- fix: require permanent source proof for operator publication
  JacobWeyer
  committed
  1848290
- Merge coordinator boot and operator publication producers
  JacobWeyer
  committed
  0417b5a
- Merge reviewed operator publication proof correction
  JacobWeyer
  committed
  561dbc7
- Enforce global MCP admission and persist discovery leases
  JacobWeyer
  committed
  fec9f99
- Merge reviewed MCP operator publication and protocol
  JacobWeyer
  committed
  5ee7453
- Define authenticated managed cold asset inspection contract
  JacobWeyer
  committed
  5d07367
- Lock MCP connection before initial admission execution
  JacobWeyer
  committed
  78dd730
- Merge reviewed global MCP and discovery admission
  JacobWeyer
  committed
  49a0725
- Define authenticated managed cold asset inspection contract
  JacobWeyer
  committed
  549f50a
- Add identity-only managed boot bridge contracts
  JacobWeyer
  committed
  83cde7d
- Verify actual managed cold boot assets on the host
  JacobWeyer
  committed
  b400935
- Drive managed creation and recovery from durable pinned intents
  JacobWeyer
  committed
  b15345e
- Preserve unsupported cold asset inspection on older hosts
  JacobWeyer
  committed
  19b3c36
- Compose trusted MCP admission and managed lifecycle consumers
  JacobWeyer
  committed
  5b56470
- Replace staging MCP adapters with durable cold lifecycle
  JacobWeyer
  committed
  18da1ae
- fix: fence managed placement and retain original launch inputs
  JacobWeyer
  committed
  e18a44d
- Add standalone durable MCP stack fixture
  JacobWeyer
  committed
  80ebdf0
- fix: use held slot reservation for managed placement
  JacobWeyer
  committed
  c6641fe
- Merge reviewed managed coordinator and host producers
  JacobWeyer
  committed
  abb99a1
- Integrate reviewed managed MCP boot and recovery producers
  JacobWeyer
  committed
  9632ab4
- Wire managed MCP runtime into orchestrator startup
  JacobWeyer
  committed
  8562c52
- Merge reviewed deterministic MCP stack fixture
  JacobWeyer
  committed
  1bd250d
- test(mcp): add shared stack runner contract and observations
  JacobWeyer
  committed
  d4e3e98
- Keep managed session listener enrollment idempotent
  JacobWeyer
  committed
  a7e070e
- test(mcp): consume fixed call plans and native proof records
  JacobWeyer
  committed
  313c83d
- Merge reviewed deterministic MCP stack fixture
  JacobWeyer
  committed
  394bf10
- test(mcp): add bounded model fixture call plans and result proof
  JacobWeyer
  committed
  01e545a
- Add bounded OAuth fixture token lifetimes
  JacobWeyer
  committed
  34adead
- Merge shared MCP acceptance runner checkpoint
  JacobWeyer
  committed
  73b0077
- test(mcp): drive held-write recovery through public observations
  JacobWeyer
  committed
  020c48d
- fix(mcp): preserve expected result depth in fixture plans
  JacobWeyer
  committed
  8c29cae
- test: launch stack scenarios through public automations
  JacobWeyer
  committed
  bbcb079
- Merge reviewed MCP runtime for acceptance denial checks
  JacobWeyer
  committed
  fea3165
- test: emit native MCP completion evidence and bounded probes
  JacobWeyer
  committed
  39beaac
- test: observe native barriers and managed recovery
  JacobWeyer
  committed
  f1b8135
- test: allow a fixed same-call rebind denial probe
  JacobWeyer
  committed
  81032e7
- test: add external MCP policy acceptance drivers
  JacobWeyer
  committed
  c2399cc
- fix(mcp): deny automation writes without an explicit grant
  JacobWeyer
  committed
  1f7e749
Commits on Nov 3, 2026
- test: require observed MCP policy and OAuth refusals
  JacobWeyer
  committed
  da87b61
- merge: assemble reviewed MCP source for cold-proof fixture correction
  JacobWeyer
  committed
  b6f7bb0
- merge: assemble reviewed MCP source for cold-proof fixture correction
  JacobWeyer
  committed
  d7f1875
- Use fresh names for native fixture proof files
  JacobWeyer
  committed
  69e55d8
- fix(crypto): place security entropy helper before tests
  JacobWeyer
  committed
  c4cb4d8
- fix(mcp): accept canonical origin issuer identifiers
  JacobWeyer
  committed
  151342a
- test: match task listener insert builder in fixture
  JacobWeyer
  committed
  4eb9057
- Merge reviewed MCP qualification and fixture corrections
  JacobWeyer
  committed
  6bfafcc
- test: drive managed revocation and outbox recovery
  JacobWeyer
  committed
  00b7ec9
- test: observe actual managed cold boot and network denial
  JacobWeyer
  committed
  9dcb329
- test: assemble complete public MCP stack runner
  JacobWeyer
  committed
  b8cb681
- test(mcp): correct native recovery evidence checks
  JacobWeyer
  committed
  d557573
- test: declare managed policy fixture binding writers
  JacobWeyer
  committed
  45a64dc
- ci: require MCP acceptance source tests
  JacobWeyer
  committed
  00ddb80
- Merge reviewed managed MCP binding writer inventory qualification
  JacobWeyer
  committed
  8458bff
- test: add isolated MCP platform substrate library
  JacobWeyer
  committed
  74a55d0
- test: close platform core validation and cleanup gaps
  JacobWeyer
  committed
  ebeb032
- Fix empty persistent Claude test fixture loop
  JacobWeyer
  committed
  535ee69
- test: declare managed driver simulation exclusions
  JacobWeyer
  committed
  2ca90d4
- Merge reviewed Claude empty-event fixture correction
  JacobWeyer
  committed
  a417345
- fix: align platform fixture with strict context
  JacobWeyer
  committed
  9926c5b
- ci: require MCP platform source tests
  JacobWeyer
  committed
  ba29097
- test(mcp): add fixed guard and fixture image recipes
  JacobWeyer
  committed
  cf79576
- Materialize strict platform input manifests
  JacobWeyer
  committed
  1e3ac56
- fix(firecracker): accept enabled read-only network sysctls
  JacobWeyer
  committed
  7f6d4fc
- Add native route and mutual TLS probe tools to test guard
  JacobWeyer
  committed
  4dbdbb1
- Build and require both physical MCP CI matrices
  JacobWeyer
  committed
  0031504
- Fix physical CI checkout ownership and child cleanup
  JacobWeyer
  committed
  2c6ec97
- test(mcp): compose isolated platform acceptance stack
  JacobWeyer
  committed
  5302cb1
- test(mcp): qualify native routes and production FC lifecycle
  JacobWeyer
  committed
  d9e8e9b
- test(mcp): retain fatal physical evidence write failures
  JacobWeyer
  committed
  b30db89
- fix(ci): prepare MCP source test scratch and select TAP
  JacobWeyer
  committed
  6cd5775
- test(ci): align platform lane contract with root bootstrap
  JacobWeyer
  committed
  01160d9
- fix: execute managed guest commands through the live boot owner
  JacobWeyer
  committed
  a565b99
- fix(mcp): allow the pinned fixture DNS capability
  JacobWeyer
  committed
  83d3d03
- fix(ci): exclude legacy runtime files from MCP source export
  JacobWeyer
  committed
  11ac5e2
- fix(mcp): export source images through the classic store
  JacobWeyer
  committed
  ca8f3e1
- fix(mcp): preserve config linkage across archive conversion
  JacobWeyer
  committed
  e38afe0
- Consolidate feature-only Drizzle schema snapshots
  JacobWeyer
  committed
  f5b3c34
- fix(netstack): preserve TCP half-close in both directions
  JacobWeyer
  committed
  cf505a5
- test(mcp): close effect workers after setup failures
  JacobWeyer
  committed
  00b6905
- fix(web): refresh connection state after MCP publication
  JacobWeyer
  committed
  3fce41e
- fix(mcp): reject lossy numeric arguments before acceptance
  JacobWeyer
  committed
  9ba2a44
- refactor(web): infer MCP grant type from profile form schema
  JacobWeyer
  committed
  d0c9039
- fix(mcp): trim numeric coefficients in linear time
  JacobWeyer
  committed
  abf6a88
- fix(sandbox): bind managed child to host lifetime
  JacobWeyer
  committed
  8be45ed
- fix(sandbox): reclaim closed addresses and disposable staging
  JacobWeyer
  committed
  c7e3434
- perf(mcp): batch live binding catalog reads
  JacobWeyer
  committed
  e7c8492
- Integrate reviewed MCP numeric integrity and fixture ownership fixes
  JacobWeyer
  committed
  ec45515
- fix(mcp): reject lossy numeric schema input
  JacobWeyer
  committed
  bf837b8
- fix(sandbox): fence delayed managed network retirement
  JacobWeyer
  committed
  65f0096
- test(proxy): use valid retirement policy digest
  JacobWeyer
  committed
  1b50dc4
- Preserve administrator MCP schema numeric intent
  JacobWeyer
  committed
  08993d1
- test: set loose file permissions independent of umask
  JacobWeyer
  committed
  dcaa317
- Merge reviewed sandbox lifecycle and incarnation cleanup fixes
  JacobWeyer
  committed
  1efdb94
- Merge reviewed umask-independent permission fixture
  JacobWeyer
  committed
  5b54a58
- Fix native macOS SDK discovery in MCP asset producer
  JacobWeyer
  committed
  6bf299d
- Fix VZ entitlement format validation
  JacobWeyer
  committed
  5f7bda7
- Fix native DNS startup order in MCP platform
  JacobWeyer
  committed
  dff53ab
- test(vz): preserve parked exec submission failures
  JacobWeyer
  committed
  fb7b557
- vz: supply boot entropy and gate saved configurations
  JacobWeyer
  committed
  005c4bc
- Accept exact defaults from pinned MCP platform images
  JacobWeyer
  committed
  a4a897b
- Use bounded temporary storage for archive inspection
  JacobWeyer
  committed
  3235ac5
- Compare equivalent inspected capability names exactly
  JacobWeyer
  committed
  93d6fc8
- Fix local VZ DNS fixture TTL
  JacobWeyer
  committed
  ecac850
- fix: let fixture hosts answer DNS queries
  JacobWeyer
  committed
  4f71c75
- fix: request complete native link address metadata
  JacobWeyer
  committed
  d7f47b3
- fix: retain private fixture container stderr
  JacobWeyer
  committed
  dc1030b
- fix: keep edge module temporary files in bounded tmpfs
  JacobWeyer
  committed
  e72cb41
- fix(mcp): preserve source export permissions
  JacobWeyer
  committed
  5b1aec0
- fix: include worker dependencies in orchestrator image
  JacobWeyer
  committed
  44c1ddb
- fix: rebake orchestrator on worker dependency changes
  JacobWeyer
  committed
  b5f91c0
- fix(mcp): use bounded writable scratch for guest publication
  JacobWeyer
  committed
  e9e61ca
Commits on Nov 4, 2026
- fix(mcp): accept queued image jobs before digest observation
  JacobWeyer
  committed
  6b62407
- fix: prepare private state in the MCP guest fixture image
  JacobWeyer
  committed
  e567bc1
- fix(mcp): accept ready jobs without informational digest
  JacobWeyer
  committed
  761f560
- fix: read MCP guest proof through authenticated download route
  JacobWeyer
  committed
  0b6f766
- fix: encode MCP credential lease request digests
  JacobWeyer
  committed
  f5f6cef
- fix: retain public RPC methods in fixture failure diagnostics
  JacobWeyer
  committed
  66a11a5
- fix: enable fixture MCP connection after catalog publication
  JacobWeyer
  committed
  98b5584
- fix: match host observer drive IDs to production slots
  JacobWeyer
  committed
  b37cc8e
- Bound managed host calls by the restore RPC budget
  JacobWeyer
  committed
  6cab6bd
- Log safe managed reconciliation failure reasons
  JacobWeyer
  committed
  33fea9f
- fix: use prepared guest identity for managed policy
  JacobWeyer
  committed
  a85f5da
- fix: verify managed policy against prepared network receipt
  JacobWeyer
  committed
  7af9daa
- fix: stop fixture host before cleaning proxy processes
  JacobWeyer
  committed
  ce6b675
- fix: retry guard package fetches and reject incomplete indexes
  JacobWeyer
  committed
  0eacac6
- fix: bound guard package retries outside apt
  JacobWeyer
  committed
  8107e1c
- fix(mcp): preserve bounded file-download error codes
  JacobWeyer
  committed
  a26f8c0
- Merge upstream main into external MCP development
  JacobWeyer
  committed
  ea7ec77
- fix(sandbox): route managed file transfers through their boot owner
  JacobWeyer
  committed
  0f1d682
- test(mcp): stage acceptance and verify owner file transfers
  JacobWeyer
  committed
  28f389e
- fix(mcp): keep asset input generation dependency-free
  JacobWeyer
  committed
  c7e64aa
Commits on Nov 5, 2026
Commits on Nov 6, 2026
- test(mcp): resume deferred write fixtures
  JacobWeyer
  committed
  db776d1
- test(mcp): handle fresh prompts on resumed fixtures
  JacobWeyer
  committed
  cccdefe
- test(mcp): confirm session teardown before deleting ownership
  JacobWeyer
  committed
  4f8c422
- test(mcp): match native plan approval results
  JacobWeyer
  committed
  3c47e2e
- test(mcp): verify trusted native plan denials
  JacobWeyer
  committed
  124ec88
- Merge upstream main into external MCP development
  JacobWeyer
  committed
  9305f6f
- Fix MCP child compilation from effective parent grants
  JacobWeyer
  committed
  f64af04
Commits on Nov 7, 2026
- test(mcp): wait for child session activation
  JacobWeyer
  committed
  ec87828
- fix(mcp): retry requests during managed start publication
  JacobWeyer
  committed
  005ef3c
- fix(mcp): identify staged harnesses in guest probes
  JacobWeyer
  committed
  43c4308
- fix(mcp): keep platform source checks read-only
  JacobWeyer
  committed
  6b4d419
- test(mcp): separate managed DNS and TLS denial probes
  JacobWeyer
  committed
  520769d
- test(mcp): validate every duplicate unknown-write receipt
  JacobWeyer
  committed
  4e53a05
- test(mcp): keep managed authority proof independent of guest DNS
  JacobWeyer
  committed
  731265d
- test(mcp): probe worker authentication from the trusted runner
  JacobWeyer
  committed
  1310277
- test(mcp): observe denials from the proxy daemon log
  JacobWeyer
  committed
  4d7bcbe
- test(mcp): type guest probes by their exec dependency
  JacobWeyer
  committed
  a048f30
- test(mcp): use finalized hashes for managed rebind
  JacobWeyer
  committed
  c53604e
- test(mcp): select revocation proof by denied exposure
  JacobWeyer
  committed
  3c73128
- Record supervisor control failure phases
  JacobWeyer
  committed
  3d3fb7e
- Avoid shutdown grace for disposable TLS probes
  JacobWeyer
  committed
  36a79cd
- Validate settled unknown MCP recovery
  JacobWeyer
  committed
  fa2da42
- Align MCP OAuth acceptance fixture configuration
  JacobWeyer
  committed
  ed915d8
- Fix OAuth authority recovery fixture
  JacobWeyer
  committed
  6d482e8
- Enable connection before OAuth rebind
  JacobWeyer
  committed
  69097b4
Commits on Nov 8, 2026
- Accept recovery delivery run acknowledgements
  JacobWeyer
  committed
  50f9b24
- Report rebind precondition category
  JacobWeyer
  committed
  f97fa87
- Classify upstream rebind preconditions
  JacobWeyer
  committed
  b75b0d7
- Merge upstream main into external MCP development
  JacobWeyer
  committed
  99fe207
- Match OAuth fixture connection revision types
  JacobWeyer
  committed
  ca46d63
- Record bounded MCP rebind failure context
  JacobWeyer
  committed
  1d7a827
- Use session disks for managed Firecracker boots
  JacobWeyer
  committed
  45fe754
- Keep MCP connection deletion behind credential authority
  JacobWeyer
  committed
  1574d10
- Qualify MCP Firecracker acceptance on dm-thin
  JacobWeyer
  committed
  c815409
- Keep the ordinary host wire on version 38
  JacobWeyer
  committed
  bdb3591
- Preserve ordinary Claude tool events
  JacobWeyer
  committed
  fe4bf78
- Cover predecessor proxy discovery frames
  JacobWeyer
  committed
  b5a505a
- Keep CPU limits in placement previews with unmeasured RAM
  JacobWeyer
  committed
  5662b09
- Record the current orchestrator validation baseline
  JacobWeyer
  committed
  9cdb411
Commits on Nov 9, 2026
- Fix thin-pool inventory reinspection
  JacobWeyer
  committed
  1e54c3e
- Wait for fixture HTTPS listeners during startup
  JacobWeyer
  committed
  85bf93a
- Validate Docker host PID security options
  JacobWeyer
  committed
  434fac0
- Validate Docker local DNS firewall rules
  JacobWeyer
  committed
  faaba28
- Map the Firecracker fixture host to its service namespace
  JacobWeyer
  committed
  08af5cf
- Fix Firecracker fixture backing allocation checks
  JacobWeyer
  committed
  f51ce45
- Allow native namespace mounts in the Firecracker test host
  JacobWeyer
  committed
  abf0162
- Install managed network commands in the host image
  JacobWeyer
  committed
  f57bb75
- Use a valid name for the managed NAT chain
  JacobWeyer
  committed
  7dca6ec
- Qualify the Firecracker host for private namespace control
  JacobWeyer
  committed
  e2c0692
- fix(firecracker): drain the managed cold-boot ready signal
  JacobWeyer
  committed
  f9b139f
- test(mcp): wait for native teardown before checking disk release
  JacobWeyer
  committed
  a51cec9
- fix(firecracker): compare managed drives by stable identity
  JacobWeyer
  committed
  dcd1571
- test(mcp): retain safe Firecracker failure diagnostics
  JacobWeyer
  committed
  532080c
- test(mcp): confirm restored VM disk reads before release
  JacobWeyer
  committed
  0b168c1
- test(mcp): run independent status checks concurrently
  JacobWeyer
  committed
  1507f1f
- fix(firecracker): create private managed disk captures
  JacobWeyer
  committed
  755b17b
- test(mcp): continue safe cases after assertion failures
  JacobWeyer
  committed
  5d57160
- test(mcp): keep probe credentials valid through reconnect
  JacobWeyer
  committed
  87f430c
- test(mcp): batch fidelity calls in the full matrix
  JacobWeyer
  committed
  fff3527
- fix(mcp): let the scanner drive rebind recovery
  JacobWeyer
  committed
  c5dc8e7
Commits on Nov 10, 2026

Commits

Commits on Nov 2, 2026

Commits on Nov 3, 2026

Commits on Nov 4, 2026