Repository navigation
Add bounded MCP authorization assessment fixture - #297
Merged
Merged
Conversation
Bind immutable fixture cases and source hashes to existing signed authorization, consume one batch approval atomically, and observe peer forwarding plus two-tenant target effects independently. Return explicit failure, inconclusive, unsupported and partial results with bounded cleanup. Validation: focused approval, portable-runtime and BDD tests pass; make check passed in this checkout with Python 3.14. Native Windows and live providers are not claimed. Preserve this checkpoint for review and upstream integration.
Preserve MCP assessment, offline execution and model advice documentation. Resolve duplicate threat identifiers introduced during integration.
Preserve completed case results when a later authorized case fails unexpectedly; stop admission and require reconciliation of uncertain effects. Validate package contracts and coverage without importing approval-bound assessment sources. Validation: 84 focused tests passed, capability coverage audit passed, and make check passed with the Unix socket fixture enabled. The sandbox-only make check attempt was blocked by socket permissions. A trusted missing-tenant counterexample confirms the prior review observation was not a defect.
…-mcp-authorization
The signed MCP assessment plan now calls its canary ledger separate-process, matching the documented shared-host trust boundary. Add a contract regression. The focused 185-test suite, Ruff, and diff checks passed. Documentation already states the same-host limitation. Revert this commit to restore the prior label. Refs #236.
15 tasks
sodejm
marked this pull request as ready for review
October 15, 2026 03:12
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem and result
The Foundry Agent Harness needed a reproducible operator path that checks authorization decisions and observed effects across tenant boundaries. This change adds a signed, bounded two-tenant agent/MCP fixture and a public CLI demo. The 22-case matrix records runner approval separately from target authorization, distinguishes denial from inconclusive results, verifies observed effects, consumes approval evidence once, and removes private approval material.
The local observer now runs as a child process that owns an Ed25519 private key. The runner receives only the public verification key. Readiness and effect records are signed, session-bound, challenge-bound, and monotonically sequenced; missing, forged, and stale records fail closed.
Reproduce the assessment
From a checkout with the repository virtual environment:
At signed commit
6baf52c2a1254397596d2cfe316b85b02ea7a59d, the demo completed 22/22 unique cases with zero expectation, cleanup, redaction, or provenance failures. It observed eight authorized effects, verified the signed receipt, consumed it once, and removed the private approval directory. The publicauth-planand firstauth-labinvocations exited 0. Reusing the identical approval was denied with exit 2 andalready_consumed_or_revoked.Focused authorization tests: 43 passed.
PATH="$PWD/.venv/bin:$PATH" make checkpassed on the host. Independent exact-commit review repeated the public demo and focused demo test without finding a must-fix issue. The full pre-push gate passed on the signed exact head: 1,984 tests passed, 20 skipped, 251 subtests passed, dependency audit found no known vulnerabilities, and the gate recordedstatus: passedunder policy SHA-2569e0083b6f771516604fa2a91c4e05ee890b24723364acf9af06b75c06ada4d7b.All 18 hosted checks passed on exact head
6baf52c2a1254397596d2cfe316b85b02ea7a59d, including Python 3.11 and 3.13 validation, Windows operator and SOC smoke tests, Linux bubblewrap isolation, CodeQL, issue coverage, secret scans, linting, and dependency scans.Scope and limits
This fulfills issue #236's first-release local agent/MCP scenario pack, provider-neutral observation contract, allowed/denied matrix, end-to-end fixture, cleanup, and operator documentation. Live provider integration remains a later increment under #150.
The observer key is isolated from the runner process, but the runner still launches the observer and both processes share one host and storage trust boundary. This evidence establishes the local fixture's process-level integrity contract; it does not establish independently administered external attestation. This PR does not claim native provider authority, OS-enforced egress containment, or durable recovery after physical host loss. Those modes need their own provider, platform, or cross-host evidence before support is claimed.
Closes #236.
Delivery authorization
The repository owner authorized review, finding remediation, and merge of the named finished open PRs batch on October 14, 2026, including PR #297. Exact-head independent review, signature verification, required checks, and mergeability govern the merge.