feat(mcp): resolve approved route presets without widening policy #359

Problem

The CLI has route-only presets and an address book, but MCP clients must repeatedly supply destination IDs and target selection inputs. Reusing presets could improve usability, but a stored route must never widen MCP policy authority.

Proposed scope

Design read-only preset lookup and explicit selection within operator-approved MCP destinations. Preset creation/replacement/removal is excluded from this issue. This is an MCP adapter follow-up to completed CLI work #324, not a second preset implementation.

Acceptance criteria

• Enumerate/show only presets explicitly approved for the MCP process; do not expose arbitrary preset file paths, raw homes, SSH identities or private route data by default.
• Intersect every resolved preset route with destination/agent/home/capability policy. Reject mismatches before any discovery, probe or native submission; never treat possession of a preset or revision as authorization.
• Preserve the distinction between saved route inspection and current session discovery. Lookup does not select an arbitrary discovered target or create a session.
• When later used in an explicitly permitted send, require an explicit target and the applicable current preset-revision precondition; resolve the route once and recheck policy before effects.
• Preserve existing revision semantics: name+route deterministic token, restored identical values may reuse a token, and later mutation cannot retroactively cancel an already expanded invocation.
• Revisions are not authenticated caller/recipient identities, target generations, storage attestations or ACKs.
• No management writes, silent fallback, alias-based policy bypass or automatic resend. Unsupported platform/transport combinations remain explicit.
• Preserve current POSIX secure-storage limits and owner/ACL/symlink/mount checks (64 KiB, 128 entries). Missing/unsafe storage must not trigger initialization or permission repair. Metadata lookup performs no native/SSH/version probes or background refresh.
• Read a validated snapshot and preserve its dp1: revision. Do not combine --preset with MCP's existing explicit routing flags, which the CLI rejects; resolve, authorize and expand a single execution plan under a reviewed adapter contract.
• Add real stdio/policy fixtures for mismatched routes, stale revision, changes during resolution, output bounds and no secret reflection.

Dependencies and limits

Depends on the MCP destination contract and preflight model. Keep published CLI preset platform/transport and filesystem/ownership restrictions. Do not broaden Windows, paired-device, handoff or trusted-SSH-config support as a side effect.

Source: v1.3.3 CLI reference and MCP policy.

Planning

Updated 2026-11-02: v1.4.0 candidate, priority P2. The owner authorized sequential implementation and PR preparation with independent CLI review. This supersedes the original Long-term/P3 plan. No release date, merge, publication or operational approval is implied.

Tracking dependencies

Depends on the reviewed destination/policy model in #356 and the preflight execution-plan contract in #357. Included as the separate fourth v1.4.0 candidate slice after the dependency contracts, following the owner's 2026-11-02 instruction.