diff --git a/CHANGELOG.md b/CHANGELOG.md index 0b822b2..09d62d1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -57,6 +57,9 @@ when releases begin. ### Changed +- Synchronized PE Version Info `v0.1.0-alpha.2` publication governance and + recorded MCP Doctor's evidence-backed JSONC compatibility increment without + relaxing the static no-execution boundary. - Registered the verified Color Atlas and MD Porter Alpha releases in the bilingual organization profile, settings policy, and release governance. - Documented dependency-update review gates: Dependabot is proposal-only, diff --git a/docs/ACCESS_MODEL.md b/docs/ACCESS_MODEL.md index 8f3dfab..60bb110 100644 --- a/docs/ACCESS_MODEL.md +++ b/docs/ACCESS_MODEL.md @@ -39,7 +39,7 @@ must not be converted into current failures merely because they appear in a | Setting | Current | Target | Apply when | | --- | --- | --- | --- | | Release publishers | Only the organization owner may deliberately create a protected project release tag; no organization-wide or unattended publisher is authorized | Separate build verification from least-privilege release publication | A project reaches its documented release gate, the exact commit and hosted evidence are reviewed, and tag creation is separately authorized | -| High-privilege automation | `cert_viewer`, `color_atlas`, `cron_maker`, `curl_builder`, `developer_primitives`, `diff_viz`, `dmg_background`, `encoding_toolbox`, `favicon_kit`, `image_to_icns`, `json_yaml_swiss`, `jwt_inspector`, `mcp_doctor`, `md_porter`, `qr_forge`, and `tool_call_trace` limit `contents: write` to their final tag-triggered publication jobs; their release Environments have no independent reviewer on GitHub Free | Require a protected Environment or appropriately scoped GitHub App with non-author approval | A second trusted owner is active, credentials and recovery are tested, and the exact automation is explicitly authorized | +| High-privilege automation | `cert_viewer`, `color_atlas`, `cron_maker`, `curl_builder`, `developer_primitives`, `diff_viz`, `dmg_background`, `encoding_toolbox`, `favicon_kit`, `image_to_icns`, `json_yaml_swiss`, `jwt_inspector`, `mcp_doctor`, `md_porter`, `pe_version_info`, `qr_forge`, and `tool_call_trace` limit `contents: write` to their final tag-triggered publication jobs; their release Environments have no independent reviewer on GitHub Free | Require a protected Environment or appropriately scoped GitHub App with non-author approval | A second trusted owner is active, credentials and recovery are tested, and the exact automation is explicitly authorized | During the solo stage, a deliberate protected-tag push is an accountable owner authorization, not independent review. It is permitted only under diff --git a/docs/INCIDENT_RESPONSE.md b/docs/INCIDENT_RESPONSE.md index 25f7f1e..388c954 100644 --- a/docs/INCIDENT_RESPONSE.md +++ b/docs/INCIDENT_RESPONSE.md @@ -20,7 +20,7 @@ public disclosure of sensitive evidence. | Setting | Current | Target | Apply when | | --- | --- | --- | --- | | Emergency access restriction | No standing incident-specific remote rule is claimed | Temporarily revoke or narrow compromised access with least privilege | An authorized owner verifies a credible active risk, identifies exact affected access, records recovery privately, and approves the action | -| Workflow or release pause | Project-specific protected-tag release automation exists for `cert_viewer`, `color_atlas`, `cron_maker`, `curl_builder`, `developer_primitives`, `diff_viz`, `dmg_background`, `encoding_toolbox`, `favicon_kit`, `image_to_icns`, `json_yaml_swiss`, `jwt_inspector`, `mcp_doctor`, `md_porter`, `qr_forge`, and `tool_call_trace`; `data_toolbox` and `pe_version_info` currently produce candidate evidence without an unattended publication job, and organization release evidence remains read-only | Disable affected automation or publication while preserving evidence | A credible compromise could affect builds or releases, the incident lead records scope and rollback, and an authorized owner applies the pause | +| Workflow or release pause | Project-specific protected-tag release automation exists for `cert_viewer`, `color_atlas`, `cron_maker`, `curl_builder`, `developer_primitives`, `diff_viz`, `dmg_background`, `encoding_toolbox`, `favicon_kit`, `image_to_icns`, `json_yaml_swiss`, `jwt_inspector`, `mcp_doctor`, `md_porter`, `pe_version_info`, `qr_forge`, and `tool_call_trace`; `data_toolbox` currently produces candidate evidence without an unattended publication job, and organization release evidence remains read-only | Disable affected automation or publication while preserving evidence | A credible compromise could affect builds or releases, the incident lead records scope and rollback, and an authorized owner applies the pause | | Repository interaction limits | No incident restriction is pre-authorized | Temporarily limit interactions only when abuse or disclosure cannot be contained otherwise | The incident lead documents necessity and duration, an authorized owner approves it, and restoration criteria are defined | | Public advisory | No security advisory channel is claimed ready | Coordinate a minimal, accurate advisory and corrected release when appropriate | A private intake exists, affected scope and mitigation are understood, disclosure risk is reviewed, and publication is explicitly authorized | diff --git a/docs/RELEASE_POLICY.md b/docs/RELEASE_POLICY.md index 95ab1d1..5066c80 100644 --- a/docs/RELEASE_POLICY.md +++ b/docs/RELEASE_POLICY.md @@ -4,8 +4,8 @@ | Setting | Current | Target | Apply when | | --- | --- | --- | --- | -| Release automation | `cert_viewer`, `color_atlas`, `cron_maker`, `csv_sculptor`, `curl_builder`, `developer_primitives`, `diff_viz`, `dmg_background`, `encoding_toolbox`, `favicon_kit`, `image_to_icns`, `json_yaml_swiss`, `jwt_inspector`, `mcp_doctor`, `md_porter`, `qr_forge`, and `tool_call_trace` have project-specific, tag-triggered publication workflows; `data_toolbox` and `pe_version_info` currently build candidates without an unattended publication job, and the organization reusable workflow remains read-only | Build and verify reproducibly, then publish from a protected tag with least privilege and project-owned verification | A project has stable hosted checks, immutable release inputs, a documented artifact contract, and explicit owner authorization | -| Versioning | Published releases are `developer_primitives` and `tool_call_trace` at `v0.2.0`; `cert_viewer`, `json_yaml_swiss`, and `jwt_inspector` at `v0.1.1`; `csv_sculptor` at `v0.1.0-alpha.2`; `color_atlas`, `curl_builder`, `data_toolbox`, `md_porter`, and `pe_version_info` at `v0.1.0-alpha.1`; and `cron_maker`, `diff_viz`, `dmg_background`, `encoding_toolbox`, `favicon_kit`, `image_to_icns`, `mcp_doctor`, and `qr_forge` at `v0.1.0` | Use Semantic Versioning for public versions and document pre-`1.0.0` instability | A project declares a public contract and its first release is authorized | +| Release automation | `cert_viewer`, `color_atlas`, `cron_maker`, `csv_sculptor`, `curl_builder`, `developer_primitives`, `diff_viz`, `dmg_background`, `encoding_toolbox`, `favicon_kit`, `image_to_icns`, `json_yaml_swiss`, `jwt_inspector`, `mcp_doctor`, `md_porter`, `pe_version_info`, `qr_forge`, and `tool_call_trace` have project-specific, tag-triggered publication workflows; `data_toolbox` currently builds candidates without an unattended publication job, and the organization reusable workflow remains read-only | Build and verify reproducibly, then publish from a protected tag with least privilege and project-owned verification | A project has stable hosted checks, immutable release inputs, a documented artifact contract, and explicit owner authorization | +| Versioning | Published releases are `developer_primitives` and `tool_call_trace` at `v0.2.0`; `cert_viewer`, `json_yaml_swiss`, and `jwt_inspector` at `v0.1.1`; `csv_sculptor` and `pe_version_info` at `v0.1.0-alpha.2`; `color_atlas`, `curl_builder`, `data_toolbox`, and `md_porter` at `v0.1.0-alpha.1`; and `cron_maker`, `diff_viz`, `dmg_background`, `encoding_toolbox`, `favicon_kit`, `image_to_icns`, `mcp_doctor`, and `qr_forge` at `v0.1.0` | Use Semantic Versioning for public versions and document pre-`1.0.0` instability | A project declares a public contract and its first release is authorized | | Changelog | This governance repository contains only an `Unreleased` section | Maintain Keep a Changelog categories and move entries to a dated version only during release | A reviewed release candidate is approved; do not create historical entries without release evidence | | Git tags | Every published release above has a `vMAJOR.MINOR.PATCH` tag; repository rules protect current release tags from deletion or mutation | Use protected, immutable `vMAJOR.MINOR.PATCH` tags that point to the reviewed release commit | Tag protection is verified, the release commit and version agree, and tag creation is explicitly authorized | | Artifacts | Release assets and verification material are project-specific; binary projects publish checksums, SBOMs, and attestations defined by their release contract | Publish platform artifacts with cryptographic checksums, an SBOM, and provenance appropriate to the build system | Artifact generation is reproducible, consumer verification instructions exist, and the release is approved | diff --git a/docs/agent-workflow-pain-points-2026-08.md b/docs/agent-workflow-pain-points-2026-08.md index 67fb61d..04dc74f 100644 --- a/docs/agent-workflow-pain-points-2026-08.md +++ b/docs/agent-workflow-pain-points-2026-08.md @@ -15,6 +15,7 @@ verify the result without collecting user secrets. | --- | --- | --- | | [MCP servers #719](https://github.com/modelcontextprotocol/servers/issues/719) | MCP initialization timed out while a local server downloaded dependencies. | Diagnostics must distinguish startup, dependency, PATH, and timeout causes. | | [MCP servers #4199](https://github.com/modelcontextprotocol/servers/issues/4199) | A fetch server silently required Node.js and could block without a timeout. | Runtime prerequisites and subprocess limits must be explicit. | +| [GitHub Copilot CLI #4323](https://github.com/github/copilot-cli/issues/4323) | Comments in a repository `.mcp.json` caused a strict parser to skip every workspace MCP server. | Static diagnosis must accept client-native JSONC while preserving a narrow, non-executing parser boundary. | | [MCP servers #3741](https://github.com/modelcontextprotocol/servers/issues/3741) | Production users requested private-network blocking, size/type limits, redirect validation, and fetch timeouts. | Network-capable tools need a security policy, not only a URL field. | | [OpenAI Agents #4016](https://github.com/openai/openai-agents-python/issues/4016) | MCP credentials and query tokens appeared in errors, traces, and persisted metadata. | Redaction must happen before formatting, export, and persistence. | | [OpenAI Agents #4353](https://github.com/openai/openai-agents-python/issues/4353) | Strict schema conversion silently removed constraints and emitted unsupported keywords. | Schema tooling needs fixture-based accept-set tests and loud failures. | @@ -40,6 +41,11 @@ claim to detect every secret. ### P2: Bounded MCP probing +The evidence-backed static compatibility increment is complete: `mcp_doctor` +accepts JSONC comments and trailing commas, treats VS Code `${input:name}` +references as client-provided values, and still does not execute configured +commands. + Keep `mcp_doctor` static by default. An optional `--probe` may be considered only after three external users reproduce failures that static checks cannot explain. Any probe must execute only an explicitly selected command, enforce a diff --git a/docs/agent-workflow-pain-points-2026-08.zh-CN.md b/docs/agent-workflow-pain-points-2026-08.zh-CN.md index 4aab20c..64b8783 100644 --- a/docs/agent-workflow-pain-points-2026-08.zh-CN.md +++ b/docs/agent-workflow-pain-points-2026-08.zh-CN.md @@ -12,6 +12,7 @@ | --- | --- | --- | | [MCP servers #719](https://github.com/modelcontextprotocol/servers/issues/719) | 本地服务器下载依赖时 MCP 初始化超时。 | 诊断必须区分启动、依赖、PATH 和超时原因。 | | [MCP servers #4199](https://github.com/modelcontextprotocol/servers/issues/4199) | fetch server 静默依赖 Node.js，且可能无超时阻塞。 | 运行时前置条件和子进程限制必须明确。 | +| [GitHub Copilot CLI #4323](https://github.com/github/copilot-cli/issues/4323) | 仓库级 `.mcp.json` 中的注释使严格解析器跳过全部工作区 MCP server。 | 静态诊断需要兼容客户端原生 JSONC，同时保持窄边界且不执行命令。 | | [MCP servers #3741](https://github.com/modelcontextprotocol/servers/issues/3741) | 用户要求阻断内网、限制大小/类型、验证重定向和设置超时。 | 网络型工具需要安全策略，而不只是 URL 字段。 | | [OpenAI Agents #4016](https://github.com/openai/openai-agents-python/issues/4016) | MCP 凭证和 query token 出现在错误、trace 和持久化元数据中。 | 脱敏必须在格式化、导出和持久化之前完成。 | | [OpenAI Agents #4353](https://github.com/openai/openai-agents-python/issues/4353) | 严格 schema 转换静默删除约束并输出不支持的关键字。 | schema 工具需要 fixture 接收集合测试，并在不支持时显式失败。 | @@ -29,6 +30,9 @@ ### P2：有界 MCP 探测 +证据支持的静态兼容增量已经完成：`mcp_doctor` 接受 JSONC 注释和尾逗号，把 VS Code +`${input:name}` 引用视为客户端提供的值，同时仍不执行配置中的命令。 + `mcp_doctor` 继续默认静态检查。只有三位外部用户复现静态检查无法解释的失败，才考虑可选 `--probe`。探测只能执行用户明确选择的命令，必须有硬超时、环境和输出清理，并禁止访问远程 URL。 ### P3：上下文预算检查器