Harden declarative MCP execution policy (#52) #72

Merged

lost-rob0t merged 14 commits from agent/mcp-declaration-security into main

2026-08-17 07:35:42 +00:00

lost-rob0t commented

2026-08-17 07:20:37 +00:00

(Migrated from github.com)

Closes #52.

Finishes the declarative MCP execution-security boundary left after #66:

first-class env_ref/1 and config_ref/1 configuration references;
closed host-controlled installer and stdio execution profiles;
package/profile/version declarations instead of arbitrary executable/argv recipes;
package/version/profile/config/cwd preflight before authority and before process spawn;
secret resolution only inside the exact authority-permitted trusted lifecycle continuation;
policy errors redact malformed declaration/profile payloads so raw values cannot leak through model-facing inspection;
exact normalized working directory participates in authority effect identity;
sanitized loader-facing reference/profile/package metadata without resolved values, concrete cwd, trusted profile argv/executables, or HTTP endpoint text;
deterministic stdio/non-stdio declaration-security fixtures, including dangerous-mode non-bypass, package/version injection rejection, raw-model-environment rejection, legacy direct-process/direct-stdio rejection, capability separation, and owned stdio lifecycle.

The loader/category boundary from #66 remains inert. Concrete standard tool-pack work (#49/#50), #67 registry cleanup, and #68-#71 compiler/workflow work remain intentionally out of scope.

Exact-head validation

Head: 8e9ce1a053409f82deffe26f9f4c93e868725935

Deterministic matrix: green

supported SWI-Prolog runtime;
static production-module load;
static live-integration-definition load;
full canonical PlUnit, including MCP declaration/config + loader/category + tool/MCP async coverage;
benchmark/conformance;
deterministic deep recursion;
CLI/trace smoke;
fresh-process graph resume;
durable artifact handoff;
whitespace.

REAL OpenRouter matrix: green on unchanged-head rerun after one transient free-model core failure

core;
structured repair;
benchmark;
depth 0/1/2;
CLI smoke.

The successful REAL run requested the repository-configured openrouter/free; observed selected models were :free variants and returned HTTP 200 evidence. No paid-model override was introduced.

#67 was inspected and remains open intentionally: no generic registry-destroy cleanup hook currently exists, so closing it here would require a separate registry lifecycle callback contract rather than a tiny dependency-safe MCP change.

Closes #52. Finishes the declarative MCP execution-security boundary left after #66: - first-class `env_ref/1` and `config_ref/1` configuration references; - closed host-controlled installer and stdio execution profiles; - package/profile/version declarations instead of arbitrary executable/argv recipes; - package/version/profile/config/cwd preflight before authority and before process spawn; - secret resolution only inside the exact authority-permitted trusted lifecycle continuation; - policy errors redact malformed declaration/profile payloads so raw values cannot leak through model-facing inspection; - exact normalized working directory participates in authority effect identity; - sanitized loader-facing reference/profile/package metadata without resolved values, concrete cwd, trusted profile argv/executables, or HTTP endpoint text; - deterministic stdio/non-stdio declaration-security fixtures, including dangerous-mode non-bypass, package/version injection rejection, raw-model-environment rejection, legacy direct-process/direct-stdio rejection, capability separation, and owned stdio lifecycle. The loader/category boundary from #66 remains inert. Concrete standard tool-pack work (#49/#50), #67 registry cleanup, and #68-#71 compiler/workflow work remain intentionally out of scope. ## Exact-head validation Head: `8e9ce1a053409f82deffe26f9f4c93e868725935` Deterministic matrix: green - supported SWI-Prolog runtime; - static production-module load; - static live-integration-definition load; - full canonical PlUnit, including MCP declaration/config + loader/category + tool/MCP async coverage; - benchmark/conformance; - deterministic deep recursion; - CLI/trace smoke; - fresh-process graph resume; - durable artifact handoff; - whitespace. REAL OpenRouter matrix: green on unchanged-head rerun after one transient free-model core failure - core; - structured repair; - benchmark; - depth 0/1/2; - CLI smoke. The successful REAL run requested the repository-configured `openrouter/free`; observed selected models were `:free` variants and returned HTTP 200 evidence. No paid-model override was introduced. #67 was inspected and remains open intentionally: no generic registry-destroy cleanup hook currently exists, so closing it here would require a separate registry lifecycle callback contract rather than a tiny dependency-safe MCP change.