jcwalker3andClaude Opus 4.8
a143cd065b
Addresses B1 and B2 from formal review 635 on PR #966. Both are one defect:
the seam conflated two questions that must stay separate.
recognition: "is this an identifier this system knows, and may it be
bound, pinned and recorded?"
execution: "is this entrypoint commissioned to actually serve on it?"
SUPPORTED_TRANSPORTS answered the first and was then used to answer the
second, so registering streamable-http was the same act as executing it.
With mcp.run fed the bound value, GITEA_MCP_TRANSPORT=streamable-http
reached FastMCP.run -> run_streamable_http_async and started a uvicorn
HTTP server over the whole tool surface with auth=None, no TLS and no
per-request principal. That endpoint is owned by #938 and is an explicit
non-goal of #931. B2 is why B1 was reachable: bound_transport was read
only by reporting sites, so no decision anywhere depended on it.
The fix adds an execution-authorization layer rather than removing the
identifier or mapping it to stdio, both of which would have destroyed the
seam #931 exists to create.
mcp_transport_config gains EXECUTABLE_TRANSPORTS, a strict subset of
SUPPORTED_TRANSPORTS containing only the local transport, plus
TRANSPORT_EXECUTION_OWNER recording that #938 commissions the remote
listener. assess_transport_execution returns a structured verdict:
transport, recognized, executable, allowed, blocker_kind, owner_issue,
reasons and exact_next_action.
mcp_daemon_guard gains assess_serve_authorization, which is the decision
that consumes bound_transport and is what stops it being reporting-only
metadata, and authorize_transport_execution, which enforces two ordered
boundaries: assert_transport_bound first, so an unbound runtime keeps its
pre-existing #695 failure and reason code; then execution authorization,
so a registered but uncommissioned transport is refused before any
listener exists and before any tool can dispatch. TransportExecutionError
subclasses UnsanctionedRuntimeError, so every existing fail-closed handler
still catches it while a caller that cares can distinguish the two cases.
native_runtime_status now reports executable_transports, serve_authorized
and the full serve_authorization verdict.
The entrypoint serves through authorize_transport_execution.
Net effect. stdio: unchanged, still binds and still reaches the runner.
streamable-http: still recognized, still validated, still pinned, still
recorded in decision-lock and audit provenance -- and refused at the serve
boundary with blocker transport_listener_not_commissioned naming #938.
Unregistered identifiers still fail earlier, at bind validation. Unbound
execution keeps the #695 contract. Rebind idempotence and conflict
rejection, session isolation, provenance and secret handling are untouched.
Tests: 63 in tests/test_issue_931_transport_bind_seam.py, up from 42. New
coverage proves stdio reaches the real runner; the remote identifier binds
and is recorded yet never reaches run(); no socket is bound during the
refusal, asserted with a socket.bind tripwire; the refusal names the
transport, the unmet requirement and #938; the decision genuinely consumes
bound_transport, proven by flipping only that value; no mutation is
authorized after denial; verdicts do not leak across runtimes; and the
refusal carries no credential material. Per review 635 the two file-list
scans are now globs over the production surface, and a new test asserts
there is exactly one mcp.run site and that it routes through the guard.
#956 anchors re-anchored for the two lines this change shifted,
mcp_daemon_guard.py 178->195 and 519->583. No other anchor moved.
Full suite from the branches/ worktree: 28 failed, 5864 passed, 6 skipped,
1047 subtests. Base 9b80e75c: 28 failed, 5801 passed, 6 skipped, 1047
subtests. Failing test IDs are identical sets in both directions; the +63
passed are this module.
No listener, socket, authentication, TLS or principal code is added. #938,
#957, #958 and #959 remain unimplemented.
Refs #931, #938. Addresses review 635.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
81 lines
5.2 KiB
JSON
81 lines
5.2 KiB
JSON
{
|
|
"_comment": [
|
|
"Machine-checkable anchor table for docs/remote-mcp/threat-model.md (#956).",
|
|
"Every file:line anchor cited in the threat model must appear here, and the",
|
|
"source line at that anchor must contain the 'expect' substring.",
|
|
"tests/test_issue_956_threat_model.py enforces both directions, so a refactor",
|
|
"that shifts a line number fails the suite instead of silently rotting the",
|
|
"document. #930's inventory had no such guard and its gitea_mcp_server.py",
|
|
"anchors drifted between 7bf4f125 and aad5c8b4."
|
|
],
|
|
"generated_against_commit": "c1626081757dff76ea49fcb1869fc0362dea45b1",
|
|
"anchors": [
|
|
{"anchor": "gitea_mcp_server.py:24728", "expect": "mcp_daemon_guard.bind_native_mcp_transport()"},
|
|
{"anchor": "mcp_daemon_guard.py:49", "expect": "_PRODUCTION_TRANSPORTS = mcp_transport_config.SUPPORTED_TRANSPORTS"},
|
|
{"anchor": "mcp_daemon_guard.py:195", "expect": "def bind_native_mcp_transport"},
|
|
{"anchor": "irrecoverable_provenance.py:497", "expect": "def assess_transport_for_auth_mint"},
|
|
{"anchor": "gitea_mcp_server.py:9132", "expect": "assess_transport_for_auth_mint()"},
|
|
{"anchor": "gitea_mcp_server.py:9381", "expect": "assess_transport_for_auth_mint()"},
|
|
{"anchor": "mcp_server.py:4", "expect": "The transport is selected by deployment configuration"},
|
|
|
|
{"anchor": "gitea_mcp_server.py:15415", "expect": "def _is_client_managed_process"},
|
|
{"anchor": "gitea_mcp_server.py:15445", "expect": "def _provenance_mutation_block"},
|
|
{"anchor": "gitea_mcp_server.py:15453", "expect": "unsupported_manual_launch"},
|
|
{"anchor": "gitea_mcp_server.py:19004", "expect": "server_provenance"},
|
|
{"anchor": "gitea_mcp_server.py:21445", "expect": "def _check_mcp_runtimes_diagnostics"},
|
|
{"anchor": "gitea_mcp_server.py:21465", "expect": "\"ps\", \"-o\", \"pid,lstart,command\""},
|
|
{"anchor": "gitea_mcp_server.py:21509", "expect": "\"ps\", \"eww\""},
|
|
{"anchor": "gitea_config.py:1172", "expect": "RECOGNIZED_GITEA_ENV_KEYS"},
|
|
{"anchor": "gitea_config.py:1233", "expect": "GITEA_CLIENT_MANAGED"},
|
|
|
|
{"anchor": "gitea_config.py:54", "expect": "ENV_PROFILE = \"GITEA_MCP_PROFILE\""},
|
|
{"anchor": "gitea_config.py:97", "expect": "_REVIEW_MERGE_OPS"},
|
|
{"anchor": "gitea_config.py:499", "expect": "repository authorization scope"},
|
|
|
|
{"anchor": "gitea_config.py:956", "expect": "def _keychain_token"},
|
|
{"anchor": "gitea_config.py:974", "expect": "def resolve_token"},
|
|
{"anchor": "gitea_config.py:1015", "expect": "def keychain_auth"},
|
|
{"anchor": "gitea_config.py:294", "expect": "def _validate_identity_auth"},
|
|
{"anchor": "mcp_daemon_guard.py:583", "expect": "def assert_keychain_access_allowed"},
|
|
{"anchor": "gitea_mcp_server.py:19261", "expect": "def gitea_list_profiles"},
|
|
{"anchor": "gitea_mcp_server.py:19312", "expect": "gitea_config.resolve_token(p)"},
|
|
{"anchor": "gitea_mcp_server.py:19555", "expect": "def gitea_audit_config"},
|
|
{"anchor": "gitea_mcp_server.py:19577", "expect": "service_summaries(config)"},
|
|
|
|
{"anchor": "gitea_config.py:704", "expect": "def resolve_service"},
|
|
{"anchor": "gitea_config.py:837", "expect": "def service_summaries"},
|
|
{"anchor": "gitea_config.py:851", "expect": "_keychain_token(auth.get(\"id\"))"},
|
|
{"anchor": "gitea_mcp_server.py:17710", "expect": "\"jenkins-mcp\""},
|
|
{"anchor": "gitea_mcp_server.py:17716", "expect": "external-mcp"},
|
|
{"anchor": "gitea_mcp_server.py:17737", "expect": "\"glitchtip-mcp\""},
|
|
{"anchor": "gitea_mcp_server.py:17742", "expect": "external-mcp"},
|
|
{"anchor": "mcp_discoverability.py:9", "expect": "EXPECTED_JENKINS_TOOLS"},
|
|
{"anchor": "mcp_discoverability.py:17", "expect": "EXPECTED_GLITCHTIP_TOOLS"},
|
|
|
|
{"anchor": "sentry_incident_bridge.py:36", "expect": "SENTRY_AUTH_TOKEN"},
|
|
{"anchor": "sentry_incident_bridge.py:190", "expect": "def resolve_token"},
|
|
{"anchor": "sentry_incident_bridge.py:289", "expect": "Authorization"},
|
|
{"anchor": "sentry_observability.py:55", "expect": "SENTRY_DSN"},
|
|
|
|
{"anchor": "master_parity_gate.py:168", "expect": "def capture_startup_parity"},
|
|
{"anchor": "master_parity_gate.py:255", "expect": "mutation_safe"},
|
|
{"anchor": "gitea_mcp_server.py:19105", "expect": "def gitea_assess_master_parity"},
|
|
|
|
{"anchor": "gitea_mcp_server.py:193", "expect": "ACTIVE_WORKTREE_ENV"},
|
|
{"anchor": "gitea_mcp_server.py:194", "expect": "AUTHOR_WORKTREE_ENV"},
|
|
{"anchor": "gitea_mcp_server.py:2351", "expect": "/tmp/gitea_issue_lock.json"},
|
|
{"anchor": "gitea_mcp_server.py:10897", "expect": "def gitea_bootstrap_author_issue_worktree"},
|
|
{"anchor": "mcp_server.py:13", "expect": "/tmp/mcp_server_stderr.log"},
|
|
|
|
{"anchor": "issue_lock_store.py:26", "expect": "DEFAULT_LOCK_DIR"},
|
|
{"anchor": "issue_lock_store.py:83", "expect": "def session_pointer_path"},
|
|
{"anchor": "issue_lock_store.py:98", "expect": "def is_process_alive"},
|
|
{"anchor": "mcp_session_state.py:27", "expect": "DEFAULT_STATE_DIR"},
|
|
{"anchor": "control_plane_db.py:47", "expect": "DEFAULT_DB_PATH"},
|
|
{"anchor": "control_plane_db.py:380", "expect": "mode=0o700"},
|
|
{"anchor": "control_plane_db.py:386", "expect": "sqlite3.connect"},
|
|
{"anchor": "control_plane_db.py:1145", "expect": "os.getpid()"},
|
|
{"anchor": "gitea_mcp_server.py:12804", "expect": "owner_pid_alive"}
|
|
]
|
|
}
|