-
Notifications
You must be signed in to change notification settings - Fork 0
feat(adt-mcp): add delegated assistant read scope #147
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Closed
Closed
Changes from all commits
Commits
Show all changes
2 commits
Select commit
Hold shift + click to select a range
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,26 @@ | ||
| --- | ||
| trigger: always_on | ||
| description: Commit and push authorized feature work without re-prompting. | ||
| --- | ||
|
|
||
| # Autonomous Delivery Rule | ||
|
|
||
| ## Rule | ||
|
|
||
| Once the user authorizes implementation, that authorization includes creating | ||
| and pushing verified atomic commits to the scoped feature branch. Do not pause | ||
| to request a second commit or push confirmation. | ||
|
|
||
| Before committing and pushing: | ||
|
|
||
| 1. Inspect the exact staged files and diff. | ||
| 2. Run the relevant verification gates and record known blockers. | ||
| 3. Use a scoped, public-safe commit message and author identity where required. | ||
| 4. Push only the intended feature branch and report the resulting commit/MR. | ||
|
|
||
| ## Actions that remain gated | ||
|
|
||
| - destructive history rewrites or force-pushes; | ||
| - direct protected-branch updates or merges; | ||
| - releases and package publication; | ||
| - expanding the branch, repository, or delivery scope. |
This file was deleted.
Oops, something went wrong.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
44 changes: 44 additions & 0 deletions
44
openspec/changes/add-delegated-assistant-read-scope/design.md
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,44 @@ | ||
| # Design: delegated-assistant read scope | ||
|
|
||
| ## Decision | ||
|
|
||
| `delegated-assistant` is a product-neutral signed invocation identity for an | ||
| interactive MCP client acting on behalf of one authenticated principal. Its | ||
| credential carries the fixed `server` and `read` classes plus one | ||
| System/Destination binding. The server's catalogue remains the only | ||
| tool-to-class authority. | ||
|
|
||
| The exact constraint is: | ||
|
|
||
| ```ts | ||
| { | ||
| kind: 'delegated-assistant-read-v1'; | ||
| threadId: string; | ||
| executionId: string; | ||
| systemSid: string; | ||
| } | ||
| ``` | ||
|
|
||
| `threadId` and `executionId` are UUIDs. Limits are empty because operational | ||
| rate limits remain server-owned and do not determine tool admission. | ||
|
|
||
| ## Enforcement | ||
|
|
||
| The invocation verifier accepts only the exact claim shape. HTTP session | ||
| identity remains bound to the credential JTI. `tools/list` filters registered | ||
| tools through the operation-class catalogue, and dispatch repeats the same | ||
| class and Destination checks before acquiring a lease. | ||
|
|
||
| The client requests the coarse read envelope by obtaining this credential. It | ||
| does not send tool names, Destination keys, or resource-broadening arguments. | ||
|
|
||
| ## Alternatives rejected | ||
|
|
||
| - Product-specific agent IDs: rejected because the public MCP server must | ||
| remain reusable outside one consumer. | ||
| - Client-maintained tool allowlists: rejected because they drift from the | ||
| server catalogue. | ||
| - Reusing `system-assistant`: rejected because it lacks explicit thread and | ||
| execution binding and is retained only for compatibility. | ||
| - Adding `safe_execute`: rejected because checks require a separate exact, | ||
| single-use grant. |
28 changes: 28 additions & 0 deletions
28
openspec/changes/add-delegated-assistant-read-scope/proposal.md
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,28 @@ | ||
| # Add a delegated-assistant read scope | ||
|
|
||
| ## Why | ||
|
|
||
| An interactive assistant needs to discover and call the read tools permitted | ||
| to its authenticated principal without duplicating the MCP server's tool | ||
| catalogue in every client. | ||
|
|
||
| ## What changes | ||
|
|
||
| - Add one product-neutral `delegated-assistant` signed invocation policy. | ||
| - Bind the policy to the authenticated principal, MCP execution, thread, and | ||
| one System/Destination. | ||
| - Let the server's operation-class catalogue select all permitted `server` | ||
| and `read` tools at discovery and dispatch. | ||
|
|
||
| ## Non-goals | ||
|
|
||
| - This change adds no product-specific agent name or workflow. | ||
| - This change adds no `safe_execute` or `write` authority. | ||
| - This change adds no client-provided tool-name allowlist or call-count limit. | ||
| - This change does not alter ordinary OAuth, bearer, proxy, or stdio modes. | ||
|
|
||
| ## Validation | ||
|
|
||
| - Invocation tests prove only the exact delegated read policy is accepted. | ||
| - HTTP integration proves multiple read tools are advertised. | ||
| - Scope tests prove write and `safe_execute` tools remain absent and denied. |
40 changes: 40 additions & 0 deletions
40
openspec/changes/add-delegated-assistant-read-scope/specs/adt-mcp/spec.md
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,40 @@ | ||
| ## ADDED Requirements | ||
|
|
||
| ### Requirement: Delegated assistants receive a server-owned read catalogue | ||
|
|
||
| The server SHALL accept an exact signed delegated-assistant policy bound to | ||
| one principal, thread, execution, System, and Destination. The resulting MCP | ||
| catalogue SHALL contain every registered tool whose server-owned operation | ||
| class is `server` or `read`. | ||
|
|
||
| #### Scenario: Delegated assistant lists tools | ||
|
|
||
| - **GIVEN** a valid delegated-assistant credential requests the read envelope | ||
| - **WHEN** the client calls `tools/list` | ||
| - **THEN** the server advertises multiple permitted read tools without a | ||
| client-provided tool-name allowlist | ||
|
|
||
| #### Scenario: A new read tool is registered | ||
|
|
||
| - **GIVEN** a new tool has a complete `read` catalogue classification | ||
| - **WHEN** a delegated assistant refreshes `tools/list` | ||
| - **THEN** the new tool is admitted without changing the client credential | ||
| contract | ||
|
|
||
| ### Requirement: Delegated read authority cannot widen | ||
|
|
||
| The server SHALL reject malformed delegated-assistant policies and SHALL deny | ||
| `safe_execute`, `write`, unknown, and out-of-Destination operations at both | ||
| catalogue and dispatch. | ||
|
|
||
| #### Scenario: Delegated assistant attempts a write | ||
|
|
||
| - **WHEN** the client requests or directly calls a write-class tool | ||
| - **THEN** the tool is absent from discovery and dispatch returns | ||
| `mcp_scope_denied` before a Destination lease or SAP operation | ||
|
|
||
| #### Scenario: Delegated policy carries additional authority | ||
|
|
||
| - **WHEN** the signed claim adds a tool list, resource override, non-empty | ||
| limits, another operation class, or an additional Destination | ||
| - **THEN** the invocation exposes no MCP tools |
13 changes: 13 additions & 0 deletions
13
openspec/changes/add-delegated-assistant-read-scope/tasks.md
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,13 @@ | ||
| # Tasks | ||
|
|
||
| - [x] Define the product-neutral delegated-assistant read policy. | ||
| - [x] Add failing policy-parser and HTTP catalogue tests. | ||
| - [x] Implement exact invocation verification. | ||
| - [x] Prove catalogue and dispatch remain server-owned and read-only. | ||
| - [ ] Run adt-mcp build, typecheck, tests, lint, and full-tree formatting. | ||
| - Focused policy, catalogue, and signed-JWT tests pass. | ||
| - Scoped ESLint and Prettier checks pass; strict OpenSpec validation passes. | ||
| - Full build/typecheck and server-construction tests remain blocked by the | ||
| pre-existing dependency-tree mismatch (Zod 4 versus | ||
| `zod-to-json-schema`, stale generated declarations). A clean frozen | ||
| install is unavailable under the current registry policy. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
📝 Info: no-auto-commit references fully removed
The PR deletes
.agents/rules/git/no-auto-commit.mdand replaces it with.agents/rules/git/autonomous-delivery.md, updating the rules index and all epicDevin promptblocks. I grepped the entire repo forno-auto-commitand found zero remaining references, so no dangling links to the removed rule file exist. The.agents/repo-guide.mdindex row anddocs/roadmap/README.mdconventions were both updated consistently.Was this helpful? React with 👍 or 👎 to provide feedback.