feat(runtime): implement P1 runtime workflow proposal MCP lifecycle - #1108
Merged
Conversation
Implements spec 109 FR-001 through FR-011: an untrusted, ephemeral, manifest-bound workflow proposal lifecycle over already-registered capabilities. - traverse-contracts::proposal: wire format, canonical-JSON digesting (SHA-256, independently reproducible), and structural validation (acyclic, within configured limits, deterministic Kahn's-algorithm execution order with lexicographic tie-breaking, no ambiguous multi-writer target). - traverse-runtime::proposal: cross-validation against the loaded application manifest and capability registry (declared capability set, exact artifact digest pinning, mapping schema compatibility, field-level data-classification/egress policy per FR-011); automatic-eligibility reusing is_automatic_eligible from #1091; Ed25519 approval-token verification and an in-memory use-count/revocation store; per-principal/ app/workspace quota tracking; a sequential DAG executor that threads data solely through declared mappings and stops at the first failed node with no retry/compensation; a bounded redacted trace (never raw payloads, secrets, or the token itself). - traverse-mcp::tools::proposals: the public MCP surface (validate, submit, authorization_state, execute, observe, export), following the same plain-tested-function pattern tools::capabilities already established for spec 015 rather than wiring into the separate stdio_server.rs reference host. Every denial is a stable, secret-free structured response, never an exception. Design decisions not fully specified by the spec text (the FR-011 enforcement rules, the approval-token claims shape, the digest scheme) are documented in docs/workflow-proposal-lifecycle.md. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Adds tests and small code simplifications so traverse-contracts and traverse-runtime reach their required 100% line coverage and traverse-mcp stays above its 98% threshold: proposal graph edge cases (dead-code eliminations for provably-unreachable defensive branches, mirroring the topological_order fix), approval-token malformed/missing claim paths, quota rollback and mutex-poisoning fail-closed paths, and initial-input-sourced execution through nested mapping targets. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Implements #1090 per spec
109-runtime-workflow-proposalsFR-001 throughFR-011: the P1 governed runtime workflow proposal MCP lifecycle. An
untrusted, ephemeral, manifest-bound bounded sequential DAG over
already-registered capabilities can now be submitted, validated, authorized
(automatic or approval-token), executed, and observed.
traverse-contracts::proposal: proposal wire format; independentlyreproducible canonical-JSON + SHA-256 digesting (
proposal_digest,proposal_snapshot_digest); structural validation — configurednode/edge/mapping/payload limits, acyclic-graph enforcement, Kahn's
algorithm with lexicographic tie-breaking for a deterministic execution
order, dangling/duplicate edge and mapping rejection, and ambiguous
multi-writer target detection.
traverse-runtime::proposal: cross-validation against the loadedApplicationBundleManifestandCapabilityRegistry(declared-capabilitycheck, exact artifact-digest pinning, bounded mapping-schema compatibility,
and field-level data-classification/egress-policy enforcement per FR-011);
automatic-eligibility reusing
is_automatic_eligiblefrom Implement immutable capability risk metadata and manifest tightening #1091; Ed25519approval-token verification (issuer/audience/workspace/proposal-digest/
snapshot-digest binding, expiry) plus an in-memory use-count/revocation
store; per-principal/app/workspace concurrency quotas with RAII release; a
sequential executor that threads data solely through declared mappings and
stops at the first failed node (no retry/compensation/mutation); a bounded
redacted trace.
traverse-mcp::tools::proposals: the public MCP surface —validate,submit,authorization_state,execute,observe,export— as plain,fully-tested functions, mirroring the precedent
tools::capabilitiesalready set for spec 015 rather than wiring into the separate
stdio_server.rsreference-host transport. Every denial (invalidproposal, missing/invalid token, exhausted quota) is a stable
snake_case-coded structured response, never an exception.docs/workflow-proposal-lifecycle.mddocuments every design choice thespec names but doesn't fully pin down byte-for-byte (FR-011's exact
enforcement rules, the approval-token claims shape, the digest scheme).
Closes #1090
Governing Spec
109-runtime-workflow-proposals070-runtime-event-sink-boundaryProject Item
Project 1 item for #1090:
PVTI_lADOEbiBt84Bbyp1zg3fR44(In Progress).Validation
cargo test --workspace— all suites pass, including 18 new structural/digest tests (
traverse-contracts), 28 new cross-validation/authorization/quota/execution tests (
traverse-runtime), and 13 new end-to-end MCP testscovering accepted, denied (missing token, invalid token, exhausted quota),
invalid, and failed-execution paths (
traverse-mcp).cargo clippy --workspace --all-targets— clean.cargo fmt --check— clean.BASE_SHA=origin/main bash scripts/ci/local_preflight.sh --pr-body <file>bash scripts/ci/pr_body_check.sh <file>bash scripts/ci/spec_alignment_check.sh— clean against this PR body.Non-goals
Matches spec 109's own "Out of scope": parallel execution, cycles, event
waits, durable resume, automatic retries, sagas, direct registry mutation,
and planner implementation. Approval-token issuance is also out of scope —
per ADR-0041 the approving principal/service is external to Traverse; this
PR only verifies tokens.