Validate Git SSH and public MCP target contracts

ClaudiuSchuster commented

2026-10-15 21:07:13 +00:00

Owner

The access-validation suite now exercises Git over SSH and public MCP with explicit direct-gateway and public-edge contracts. It verifies canary push/readback/cleanup and server-side SSH refusals, paginated MCP file assembly with Git blob integrity, snapshot expiry, method handling, and rejected target mismatches. Reports keep credentials and session data out.

The final candidate passed the isolated full e2e gate, 502 contract tests, independent native review, and both actual PR checks (ci / ci and access-validation-contract / contract). The final assertion correction also has a mutation proof: an edge OPTIONS response carrying an unexpected Allow header passes the predecessor and fails the corrected evaluator.

Configured fixture runs for both edge and direct gateway reported 32 passed, 0 failed and 3 explicitly not run on predecessor 5a2f8ee; those receipts remain bound to that source. Production Stage3 has not run, and this source change makes no live client acceptance or gateway/Caddy rollout claim.

The access-validation suite now exercises Git over SSH and public MCP with explicit direct-gateway and public-edge contracts. It verifies canary push/readback/cleanup and server-side SSH refusals, paginated MCP file assembly with Git blob integrity, snapshot expiry, method handling, and rejected target mismatches. Reports keep credentials and session data out. The final candidate passed the isolated full e2e gate, 502 contract tests, independent native review, and both actual PR checks (`ci / ci` and `access-validation-contract / contract`). The final assertion correction also has a mutation proof: an edge OPTIONS response carrying an unexpected Allow header passes the predecessor and fails the corrected evaluator. Configured fixture runs for both edge and direct gateway reported 32 passed, 0 failed and 3 explicitly not run on predecessor `5a2f8ee`; those receipts remain bound to that source. Production Stage3 has not run, and this source change makes no live client acceptance or gateway/Caddy rollout claim.

ClaudiuSchuster added 3 commits

2026-10-15 21:07:13 +00:00

feat(access): integrate the accepted public MCP contract 64c979e97d

Integrate the deployed, Root-accepted anonymous public catalog
(POST /mcp/public, merged ad99aae, live acceptance 2026-10-15) into
the existing three-stage access-validation lane as optional checks —
no new framework, no SSE/sessions/auth on the public surface, every
existing authenticated /mcp check unchanged.

- av_common/clients/mcp.py: anonymous public_* helpers (no token
  parameter exists on the seam) plus public_read_file/public_list_tree
  cursor walkers that verify offset continuity, echo stability, exact
  has_more/next_cursor termination, the git blob digest, and total
  length — a truncated or digest-mismatched transfer raises and can
  never pass; the per-check Deadline is the only bound (no caps added).
- av_common/clients/http.py: header_facts (Allow, Retry-After, and the
  header-NAME set, which proves absence of Access-Control-Allow-*)
  surfaced into rest_request/mcp_raw_post meta.
- stage 1: FakePublicMcp (exact four tools, HMAC cursors, uniform
  refusal, budget-before-upstream, POST-only surface, hostile
  truncate/corrupt knobs) + 13 public-mcp/* rows + 35 tests; report
  grows 24 -> 37 rows.
- stage 2: optional public_mcp config section (fixture names only, no
  credential envs) driving 7 read-only rows against the configured
  stack's edge; inert without the section (inert report 28 -> 35).
- stage 3: optional per-environment public_mcp section driving the
  same 7 rows against a real named route; inert without target+section
  (inert report 19 -> 26).
- docs: ROUTES inventory replaces the stale "planned, NOT deployed"
  placeholder with the accepted contract + lane rows; IMPLEMENTATION
  stage tables/coverage map/CI counts and a round section;
  ACCESS-VALIDATION access-matrix row; lane README contract notes.

Offline suite: 18 files / 477 cases all green (stage1 166, stage2 119,
stage3 192; was 402/17). VM gate on release1005 against this exact
staged tree (818ff91d): scripts/e2e-local.sh exit 0 (E2E PASS, public
MCP edge ok), full access suite 477/477, verified teardown; the only
operator flag is the same conservative __pycache__ delta the accepted
accessint r2 run carried (tracked bytes provably unchanged).

fix(access): bind the public MCP method contract to a declared target 5a2f8ee509

Root's acceptance review of 64c979e confirmed a real defect: the stage-2/3
method-surface evaluators unconditionally required the direct-gateway shape
(OPTIONS 204 + Allow: POST), but the deployed public edge answers every
non-POST 405 with no Allow header (live observation 2026-10-15). A stage-3
run at the real edge would have failed against accepted behavior.

The stage-2 public_mcp section and the stage-3 environment section now
carry a REQUIRED target key (direct-gateway | public-edge; anything else
or missing refuses with exit 2, inertness without the section unchanged).
The evaluator binds statuses, the Allow-header expectation, and the
receipt wording to the declared target and accepts neither arbitrary
204/405 nor a relabeled surface; the no-CORS assertion now covers all
three probes. Stage 1 pins BOTH surfaces: a new edge_mode fake knob
mirrors the caddy edge (every non-POST 405 text/plain, no Allow, POST
and healthz pass through) with a runner row, plus mis-pairing negatives
in both directions through the stage-2/3 rigs.

Review findings folded in: the fake now mirrors the service's
snapshot-expiry cursor semantics (distinct bounded refusals for
list_tree/get_file continuations, hostile expire_snapshot knob, runner
row proving the walk fails with the distinct text); the stale
multi-chunk fixture comment corrected (160 bytes / 3 chunks); the
unused json-as-_json import removed.

Hermetic suite 18 files / 502 cases green; stage-1 runner 39/39; inert
stage-2 35 notrun / stage-3 26 notrun, exit 0. Full e2e gate green on
the exact staged tree 444c16b on release1005 (operator_exit 0, zero
errors, foreign runner untouched).

fix(access): assert the public-edge OPTIONS Allow-absence

access-validation-contract / contract (pull_request) Successful in 3m23s

Details Explain this check

ci / ci (pull_request) Successful in 2m29s

Details Explain this check

4f32f63fcc

Review-2 F1 (trivial): the edge receipt claims "no Allow header" for
every non-POST, but only GET/DELETE were held to it — an OPTIONS 405
carrying an Allow header passed. The Allow loop now includes the
OPTIONS probe for the public-edge target in both evaluators
(stage2 checks.py, stage3 checks_public.py); direct-gateway keeps its
exact semantics (OPTIONS 204, Allow: POST asserted on the 405s). The
review's adversarial counterexample is pinned as a regression test in
both unit suites; correct edge shape and gateway pairing unchanged.

ClaudiuSchuster changed title from ~~WIP: Validate Git SSH and public MCP target contracts~~ to Validate Git SSH and public MCP target contracts

2026-10-15 21:39:13 +00:00

ClaudiuSchuster merged commit b23fc26fd3 into main

2026-10-15 21:39:44 +00:00

ClaudiuSchuster deleted branch oss-oo/access-public-and-ssh-20261015

2026-10-15 21:39:44 +00:00

ClaudiuSchuster referenced this pull request from a commit

2026-10-15 21:39:46 +00:00

Validate Git SSH and public MCP target contracts (#134)

Rows
Columns

Validate Git SSH and public MCP target contracts #134