feat(mcp): propose isolated external tool support

.github/scripts/detect-rebake-lanes.py

@@ -178,7 +178,7 @@
 # exactly mirroring `web/`'s treatment. A source-only orchestrator change
 # rebakes the orchestrator (and the other images in the matrix; that's the same
 # coarse behavior `web/` has always had).
-IMAGES_PATHS = ["docker/", "web/", "orchestrator/", "deploy/migrations/"] + BINARY_COMMON
+IMAGES_PATHS = ["docker/", "web/", "orchestrator/", "mcp-worker/", "deploy/migrations/"] + BINARY_COMMON
 # The build INSTRUCTIONS, as opposed to the sources they copy in. Only a change
 # here can break an image in a way a native build does not already catch, so
 # only a change here needs the PR-time `build-images` lane: `tests (linux)`
@@ -249,7 +249,7 @@
 ]
 
 
-# ── PR test-lane gating (ci.yml + ci-macos-vz.yml) ─────────────────────
+# ── PR test-lane gating (ci.yml) ─────────────────────
 # These gate the CI *test* lanes (not the bake lanes above) so a change only
 # runs the lanes it can affect. Protos live in the engram-protocol crate, so a
 # proto change is already in every Rust binary's closure (→ cc, host_binaries,
@@ -263,7 +263,10 @@
                  # touching ci.yml (ci-macos-vz.yml was folded into
                  # ci.yml; its old entry here was a dead path).
                  ".github/actions/",
-                 ".github/scripts/detect-rebake-lanes.py"]
+                 ".github/scripts/detect-rebake-lanes.py",
+                 ".github/scripts/tests/",
+                 ".github/scripts/mcp-acceptance-",
+                 ".github/scripts/mcp-stack-"]
 PROTO_PATHS = ["crates/engram-protocol/proto/", "buf.gen.yaml"]
 WEB_PATHS = ["web/", "orchestrator/packages/spec-document/"]
 # The public docs + landing site (site/, Astro + Starlight). Its content is
@@ -279,10 +282,11 @@
 # version it ships on. They were absent here, so a change to either skipped
 # this lane entirely — which is half of how prod came to run a Bun the tests
 # never saw (the other half was the Dockerfile floating on `oven/bun:1`).
-ORCH_PATHS = ["orchestrator/",
+MCP_STACK_FIXTURE_PATHS = ["tests/fixtures/mcp-stack/"]
+ORCH_PATHS = ["orchestrator/", "mcp-worker/",
               "docker/orchestrator.Dockerfile",
               ".bun-version",
-              "crates/engram-egress-proxy/policy/google-credential-denylist.json"]
+              "crates/engram-egress-proxy/policy/google-credential-denylist.json"] + MCP_STACK_FIXTURE_PATHS
 # A lockfile/manifest/toolchain bump recompiles the whole workspace.
 RUST_COMMON = ["Cargo.lock", "Cargo.toml", "rust-toolchain.toml"]
 
@@ -499,6 +503,7 @@ def main():
     e2e_core = (
         bool(cc & e2e_closure)
         or any_path(changed, E2E_PATHS)
+        or any_path(changed, ["sandbox-netstack/"])
         or any_path(changed, HARNESS_PATHS)
     )
     e2e_orchestrator = e2e_core or any_path(changed, ORCH_PATHS)
@@ -550,14 +555,27 @@ def main():
     # lint + tests(linux) + the two macOS lanes build/test the whole workspace:
     # any workspace crate (cc — protos included via engram-protocol), a
     # lockfile/toolchain bump, or a CI-definition change.
+    fixture_changed = any_path(changed, ["tests/fixtures/mcp-model-cli/"])
     test_rust = (
-        ci_self
+        fixture_changed
+        or ci_self
         or bool(cc)
         or any_path(changed, RUST_COMMON)
         or any_path(changed, HARNESS_PATHS)
+        or any_path(changed, ["mcp-worker/", "sandbox-netstack/"])
+    )
+    test_mcp_worker = ci_self or proto or any_path(changed, ["mcp-worker/", "docker/mcp-worker.Dockerfile"] + MCP_STACK_FIXTURE_PATHS)
+    # Self-contained producers use one selector: no skipped artifact dependency.
+    test_mcp_physical = (
+        ci_self or proto or test_rust or any_path(changed, ORCH_PATHS + [
+            "crates/", ".sqlx/", "deploy/migrations/", "docker/", "deploy/bundles/",
+            "deploy/demo/", "deploy/kernel/", "third_party/firecracker",
+            "sandbox-netstack/", ".bun-version", ".dockerignore", ".cargo/config.toml",
+        ])
     )
+    test_netstack = test_rust
     # musl cross-compile of the FC host binaries — same closure as host_binaries.
-    test_cross = ci_self or host_binaries
+    test_cross = ci_self or host_binaries or fixture_changed or harness_changed
     # Firecracker integration lane. Gated on the e2e binary CLOSURE (the FC
     # backend + host-agent + their deps — the Rust the FC integration tests
     # exercise; engram-sandbox-firecracker is in host-agent's closure, and the
@@ -567,7 +585,8 @@ def main():
     # fixtures and mount bundles via the sandbox crates already in the closure;
     # tripping FC on a bundle-payload edit was a needless ~KVM lane. The
     # e2e-STACK lane still gates on `e2e`, so bundle staging is validated there.
-    test_fc = ci_self or bool(cc & e2e_closure) or fc_fork or any_path(changed, FC_POOL_PATHS)
+    test_fc = ci_self or bool(cc & e2e_closure) or fc_fork or any_path(
+        changed, FC_POOL_PATHS + ["sandbox-netstack/"])
     # web / orchestrator: their own sources or the protos they codegen from.
     # (The `engrams` CLI is a workspace crate: test_rust covers it.)
     test_web = ci_self or proto or any_path(changed, WEB_PATHS)
@@ -576,9 +595,9 @@ def main():
     test_buf = ci_self or proto
     test_integrations_cli = ci_self or any_path(changed, INTEGRATIONS_CLI_PATHS)
     # ADR 0122: the deploy-config lane (helm lint/template + terraform
-    # fmt/validate). Same path set as the bake-side tf_or_helm flag,
-    # plus ci_self like every test lane.
-    test_deploy = ci_self or tf_or_helm
+    # fmt/validate + actual nginx callback canary). The web runtime image
+    # also changes the effective nginx behavior, without changing the chart.
+    test_deploy = ci_self or tf_or_helm or any_path(changed, ["docker/web.Dockerfile"])
     # The site lane: leak lint + astro build, build-only (no deploy on PRs).
     test_site = ci_self or any_path(changed, SITE_PATHS)
     # ADR 0098 R-CoSim: the coordinator↔host boundary sim — its own (spanning)
@@ -634,14 +653,17 @@ def image_flag(name):
             ])
         if name == "orchestrator":
             return bake_all_l or proto_l or any_path(
-                cs, ["orchestrator/", "docker/orchestrator.Dockerfile"])
+                cs, ["orchestrator/", "mcp-worker/src/", "mcp-worker/package.json",
+                     "mcp-worker/package-lock.json", "docker/orchestrator.Dockerfile"])
+        if name == "mcp-worker":
+            return bake_all_l or any_path(cs, ["mcp-worker/", "docker/mcp-worker.Dockerfile"])
         raise ValueError(name)
 
     image_flags = {name: image_flag(name) for name in
-                   ["coordinator", "host-agent", "host-operator", "web", "orchestrator"]}
+                   ["coordinator", "host-agent", "host-operator", "web", "orchestrator", "mcp-worker"]}
     # Stable matrix order; the bake job consumes this as `fromJSON`.
     images_matrix = [name for name in
-                     ["coordinator", "host-agent", "host-operator", "web", "orchestrator"]
+                     ["coordinator", "host-agent", "host-operator", "web", "orchestrator", "mcp-worker"]
                      if image_flags[name]]
     # The deploy-dispatch gate must fire whenever ANY container lane trips —
     # level-triggered lanes can trip when the push range alone would not
@@ -687,8 +709,11 @@ def b(v):
             f.write(f"e2e={b(e2e)}\n")
             f.write(f"e2e_matrix={json.dumps({'include': e2e_matrix})}\n")
             f.write(f"e2e_full_matrix={json.dumps({'include': e2e_full_matrix})}\n")
-            # PR test lanes (ci.yml + ci-macos-vz.yml gate on these).
+            # PR test lanes (ci.yml gates on these).
             f.write(f"test_rust={b(test_rust)}\n")
+            f.write(f"test_mcp_worker={b(test_mcp_worker)}\n")
+            f.write(f"test_mcp_physical={b(test_mcp_physical)}\n")
+            f.write(f"test_netstack={b(test_netstack)}\n")
             f.write(f"test_cross={b(test_cross)}\n")
             f.write(f"test_fc={b(test_fc)}\n")
             f.write(f"test_web={b(test_web)}\n")

.github/scripts/mcp-acceptance-fc-closed.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# Run the installed CLOSED namespace check on the isolated Linux CI worker.
+set -euo pipefail
+[[ $(uname -s) == Linux ]] || { echo 'CLOSED namespace gate requires Linux' >&2; exit 1; }
+for tool in cargo python3 sudo ip sysctl nft; do
+  command -v "$tool" >/dev/null || { echo "Missing required tool: $tool" >&2; exit 1; }
+done
+name=managed::network::linux::tests::actual_closed_namespace_readback_detects_route_tampering
+state=$(mktemp -d)
+trap 'rm -rf "$state"' EXIT
+# Cargo builds as the runner; only its current libtest executable runs as root.
+export CARGO_TARGET_DIR="$PWD/target"
+cargo test --locked -p engram-sandbox-firecracker --lib --no-run --message-format=json > "$state/artifacts.jsonl"
+artifact=$(ARTIFACT_LIST="$state/artifacts.jsonl" python3 - "$PWD" "${CARGO_TARGET_DIR:-$PWD/target}" < /dev/null <<'PY'
+import json, os, pathlib, stat, sys
+workspace, target = map(pathlib.Path, sys.argv[1:])
+workspace = workspace.resolve()
+target = (workspace / target).resolve()
+assert target.is_relative_to(workspace), 'target must be inside this checkout'
+with open(os.environ['ARTIFACT_LIST']) as stream:
+    paths = [m['executable'] for line in stream if (m := json.loads(line)).get('reason') == 'compiler-artifact'
+             and m.get('executable') and m['target']['name'] == 'engram_sandbox_firecracker'
+             and pathlib.Path(m['target']['src_path']).resolve() == workspace / 'crates/engram-sandbox-firecracker/src/lib.rs'
+             and m['profile']['test']]
+assert len(paths) == 1, 'one current Firecracker libtest artifact is required'
+p = pathlib.Path(paths[0]).resolve(strict=True)
+s = p.stat()
+assert p.is_relative_to(target) and stat.S_ISREG(s.st_mode) and s.st_uid == os.getuid()
+assert not s.st_mode & 0o022 and os.access(p, os.X_OK), 'unsafe test artifact'
+print(p)
+PY
+)
+# Check selection before sudo, then require a positive result from the same artifact.
+"$artifact" --ignored --exact "$name" --list > "$state/selected"
+grep -Fxq "$name: test" "$state/selected"
+grep -Fxq '1 test, 0 benchmarks' "$state/selected"
+[[ $(grep -c ': test$' "$state/selected") == 1 ]] || { echo 'Expected exactly one CLOSED namespace test' >&2; exit 1; }
+sudo env PATH=/usr/sbin:/usr/bin:/sbin:/bin "$artifact" --ignored --exact "$name" --nocapture 2>&1 | tee "$state/result"
+grep -Fxq 'running 1 test' "$state/result"
+grep -Fxq "test $name ... ok" "$state/result"
+grep -Eq '^test result: ok\. 1 passed; 0 failed; 0 ignored; 0 measured; [0-9]+ filtered out;' "$state/result"

.github/scripts/mcp-acceptance-helper.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+set -euo pipefail
+root="$PWD"
+artifact="$root/var/mcp-netstack-artifact"
+(cd "$artifact" && test -s engram-sandbox-netstack && shasum -a 256 -c SHA256SUMS)
+export ENGRAM_SANDBOX_NETSTACK_TEST_BIN="$artifact/engram-sandbox-netstack"
+test -x "$ENGRAM_SANDBOX_NETSTACK_TEST_BIN"
+mkdir -p var/mcp-acceptance-ci
+log=$(mktemp "$root/var/mcp-acceptance-ci/helper.XXXXXXXX")
+trap 'rm -f "$log"' EXIT
+cargo nextest run -p engram-sandbox-vz --lib --run-ignored ignored-only \
+  -E 'test(=managed::helper::tests::actual_helper_closed_lifetime_and_descriptor_isolation) or test(=managed::helper::tests::actual_helper_release_ack_and_active_dns_cleanup) or test(=managed::helper::tests::actual_helper_rejects_wrong_epoch_and_canceled_release)' \
+  --no-tests fail --test-threads 1 2>&1 | tee "$log"
+grep -Eq "(^|[[:space:]])3 tests run: 3 passed, [0-9]+ skipped([[:space:]]|$)" "$log"

.github/scripts/mcp-acceptance-linux.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# Real Linux wrappers and SDK transport. No VM, provider, or upstream server.
+set -euo pipefail
+[[ $(uname -s) == Linux ]] || { echo 'Linux wrapper gate requires Linux' >&2; exit 1; }
+: "${CARGO_TARGET_DIR:?Set an owned absolute target directory}"
+[[ "$CARGO_TARGET_DIR" == /* ]] || exit 1
+cargo build --locked --manifest-path tests/fixtures/mcp-model-cli/Cargo.toml --bin engram-mcp-model-fixture
+cargo build --locked -p engram-harness-claude -p engram-harness-codex --bins
+export ENGRAM_FIXTURE_BIN="$CARGO_TARGET_DIR/debug/engram-mcp-model-fixture"
+export ENGRAM_TEST_CLAUDE_BIN="$CARGO_TARGET_DIR/debug/engram-harness-claude"
+export ENGRAM_TEST_CODEX_BIN="$CARGO_TARGET_DIR/debug/engram-harness-codex"
+for artifact in "$ENGRAM_FIXTURE_BIN" "$ENGRAM_TEST_CLAUDE_BIN" "$ENGRAM_TEST_CODEX_BIN"; do
+  test -x "$artifact"
+  file "$artifact" | grep -Fq 'ELF 64-bit'
+done
+test "$("$ENGRAM_FIXTURE_BIN" --fixture-version)" = 'engram-mcp-model-fixture 1'
+# An example is an explicitly built test utility, never a production binary
+# or a harness=false target that breaks workspace nextest discovery.
+cargo build --locked -p engram-harness-claude --example linux_mcp_supervisor
+# Keep generated Unix socket paths below Linux's sockaddr_un limit.
+state=$(mktemp -d /tmp/mcp-linux.XXXXXXXX)
+trap 'if [[ -f "$state/cleanup-complete" ]]; then rm -rf "$state"; else echo "Cleanup unconfirmed; retained owned state: $state" >&2; fi' EXIT
+export ENGRAM_TEST_STATE_ROOT="$state"
+cargo test --locked -p engram-harness-claude --test linux_mcp_entrypoint \
+  --no-run --message-format=json > "$state/artifacts.jsonl"
+export ENGRAM_TEST_DRIVER_BIN
+ENGRAM_TEST_DRIVER_BIN=$(python3 -c '
+import json, sys
+paths = [m["executable"] for line in sys.stdin if (m := json.loads(line)).get("reason") == "compiler-artifact" and m.get("executable") and m["target"]["name"] == "linux_mcp_entrypoint"]
+assert len(paths) == 1, "one current Linux test driver is required"
+print(paths[0])
+' < "$state/artifacts.jsonl")
+test -x "$ENGRAM_TEST_DRIVER_BIN"
+# The supervisor has an earlier bounded deadline and reaps all descendants.
+# This hard outer kill is only a final bound if the supervisor itself fails.
+timeout --signal=KILL 240s "$CARGO_TARGET_DIR/debug/examples/linux_mcp_supervisor" \
+  --check-cleanup-and-run 2>&1 | tee "$state/entrypoint.log"
+grep -Fq 'forced deadline cleanup: passed; all descendants reaped before state removal' "$state/entrypoint.log"
+grep -Fq 'running 9 tests' "$state/entrypoint.log"
+grep -Fq 'test result: ok. 9 passed; 0 failed; 0 ignored; 0 measured; 1 filtered out' "$state/entrypoint.log"
+test "$(cat "$state/cleanup-complete")" = complete

.github/scripts/mcp-acceptance-native.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+set -euo pipefail
+: "${CARGO_TARGET_DIR:?Set an owned target directory}"
+root="$PWD"
+mkdir -p var/mcp-acceptance-ci
+state=$(mktemp -d "$root/var/mcp-acceptance-ci/native.XXXXXXXX")
+trap 'rm -rf "$state"' EXIT
+unset ENGRAM_FIXTURE_BARRIER
+cargo test --locked --manifest-path tests/fixtures/mcp-model-cli/Cargo.toml --bins --test protocol 2>&1 | tee "$state/protocol.log"
+# Binary unit results cannot satisfy the protocol suite's positive-count guard.
+awk '
+  /Running tests\/protocol.rs / { protocol = 1; next }
+  protocol && /^test result: ok\. [1-9][0-9]* passed; 0 failed; 0 ignored/ { passed = 1 }
+  END { exit !passed }
+' "$state/protocol.log"
+grep -Fxq 'test evidence::tests::expired_deadline_cannot_consume_a_release ... ok' "$state/protocol.log"
+cargo build --locked --manifest-path tests/fixtures/mcp-model-cli/Cargo.toml --bin engram-mcp-model-fixture
+export ENGRAM_FIXTURE_BIN="$CARGO_TARGET_DIR/debug/engram-mcp-model-fixture"
+test -x "$ENGRAM_FIXTURE_BIN"
+test "$("$ENGRAM_FIXTURE_BIN" --fixture-version)" = 'engram-mcp-model-fixture 1'
+export ENGRAM_FIXTURE_TOOL=remote_inventory
+for mode in read held-call; do
+  export ENGRAM_FIXTURE_MODE="$mode"
+  export ENGRAM_FIXTURE_STATE_DIR="$state/$mode"
+  mkdir -m 700 "$ENGRAM_FIXTURE_STATE_DIR"
+  export ENGRAM_FIXTURE_PROOF="$ENGRAM_FIXTURE_STATE_DIR/proof"
+  cargo test --locked -p engram-harness-codex --bin engram-harness-codex \
+    tests::external_mcp_static_fixture_adapter_gate -- --ignored --exact 2>&1 | tee "$state/$mode.log"
+  grep -Fq 'test result: ok. 1 passed; 0 failed; 0 ignored' "$state/$mode.log"
+done