Delegate task authorization to agent hosts

README.md

@@ -1003,7 +1003,7 @@ secret-value injection, sensitive intents, semantic controls classified above th
 window or process scope changes, and non-foreground raw input keep their
 existing confirmation or refusal behavior.
 
-For long-running automation, an embedding may instead collect explicit user
+For long-running automation, a trusted embedding may collect explicit user
 input before the task and install a constructor-owned
 `TrustedTaskAuthorizationHost` through `HostSecurityServices`. The task grant
 references only an authorization ID; Host IPC cannot mint or widen it. At
@@ -1017,19 +1017,18 @@ revocation, or validation failure return a typed `task_authorization_*` refusal
 and never fall back to a popup. An explicit task-start denial returns
 `task_authorization_denied`. Existing sessions without a task authorization
 retain per-action confirmation. The packaged CLI does not trust flags or
-redirected stdin as user presence, so it keeps per-action confirmation until a
-trusted non-modal input broker is installed by its embedding.
-
-On Windows, the packaged `dcc-cua mcp-server` exposes
-`authorization_integration_status`, the bounded authorization card, and its
-app-only task tools. It reports `available` only because the runtime installs a
-protected native user-presence verifier: Windows Hello/PIN/biometric when
-configured, otherwise the physical F12, F11, F10 sequence whose low-level hook
-rejects injected events. The card displays the exact retained PID/HWND, scope
-digest and expiry; card text, client/process identity, environment, stdin and
-forged receipt fields cannot authorize. Non-Windows packaged servers still
-report `integration_required`. See [plugin diagnosis](docs/agent-plugin.md) and
-the [cross-client contract](docs/adr/0027-cross-client-task-authorization.md).
+redirected stdin as approval.
+
+On every supported platform, the packaged `dcc-cua mcp-server` exposes
+`authorization_integration_status`, the bounded authorization card, and
+portable task tools. It reports `confirmation_method=client_managed`: Codex,
+DSH, Claude, WorkBuddy, or another connected Agent host owns the user/tool
+approval decision. DCC-CUA no longer opens Windows Hello or an F-key prompt.
+The retained proposal still displays the exact PID/HWND or owned-browser spec,
+scope digest, allowed methods/actions/origins, and expiry; `authorize_task`
+accepts only that server-generated proposal ID and cannot widen it. See
+[plugin diagnosis](docs/agent-plugin.md) and the
+[Agent-host authorization contract](docs/adr/0028-delegate-task-authorization-to-agent-hosts.md).
 
 Embeddings can construct that broker with
 `dcc_cua_host::trusted_task_authorization_broker`. It returns two separate

README.zh-CN.md

@@ -294,15 +294,14 @@ let stopped = host.interrupt_all().await?;
 
 ## MCP 任务授权
 
-Windows 上打包的 `dcc-cua mcp-server` 会公开
-`authorization_integration_status`、有界授权卡以及仅供卡片调用的任务工具。
-运行时优先使用 Windows Hello/PIN/生物识别完成受保护的用户在场验证；未配置时，
-原生提示要求用户在实体键盘依次按 F12、F11、F10，底层键盘钩子会拒绝标记为注入或
-低完整性注入的事件。授权卡只显示运行时保留的精确 PID/HWND、范围摘要和到期时间；
-卡片文字、客户端或进程身份、环境变量、stdin 以及伪造回执字段都不能签发权限。
-非 Windows 打包运行时仍返回 `integration_required` 并失败关闭。完整边界见
-[插件说明](docs/agent-plugin.md)与
-[跨客户端任务授权 ADR](docs/adr/0027-cross-client-task-authorization.md)。
+所有支持的平台上，`dcc-cua mcp-server` 都会公开
+`authorization_integration_status`、有界授权卡和可移植的任务工具，并报告
+`confirmation_method=client_managed`。Codex、DSH、Claude、WorkBuddy 或其他 Agent
+宿主负责用户/工具审批；DCC-CUA 不再弹出 Windows Hello 或实体按键二次确认。
+运行时仍保留精确 PID/HWND 或 owned-browser 规格、范围摘要、允许的方法/动作/origin
+和到期时间；`authorize_task` 只接受服务端生成的 proposal ID，不能扩展范围。
+完整边界见[插件说明](docs/agent-plugin.md)与
+[Agent 宿主授权 ADR](docs/adr/0028-delegate-task-authorization-to-agent-hosts.md)。
 
 ## 开发门槛
 

crates/dcc-cua-cli/Cargo.toml

@@ -39,8 +39,6 @@ rstest.workspace = true
 tempfile = "3"
 
 [target.'cfg(windows)'.dependencies]
-windows = { version = "0.61.3", features = ["Foundation", "Security_Credentials_UI", "Win32_Foundation", "Win32_System_WinRT", "Win32_UI_Input_KeyboardAndMouse", "Win32_UI_WindowsAndMessaging"] }
-windows-future = "0.2.1"
 windows-sys = { version = "0.61", features = ["Win32_Foundation", "Win32_Security_Cryptography", "Win32_Security_Cryptography_Catalog", "Win32_Security_Cryptography_Sip", "Win32_Security_WinTrust", "Win32_Storage_FileSystem", "Win32_Storage_Packaging_Appx", "Win32_System_Console", "Win32_System_Diagnostics_ToolHelp", "Win32_System_Threading", "Win32_UI_WindowsAndMessaging"] }
 
 [target.'cfg(unix)'.dependencies]

crates/dcc-cua-cli/src/authorization_integration.rs

@@ -1,66 +1,41 @@
-//! Discovery is not authority. Availability requires a protected native user-presence verifier.
+//! DCC-CUA owns bounded grant enforcement; the connected agent host owns user approval.
 
 use serde_json::{Value, json};
 
-pub(crate) const REQUIRED: &str = "integration_required";
-
 pub(crate) fn status() -> Value {
     json!({
-        "schema": "dcc-cua.authorization-integration.v1",
-        "provider": "dcc-cua",
-        "runtime_version": env!("CARGO_PKG_VERSION"),
-        "status": REQUIRED,
-        "authorization_available": false,
-        "user_confirmation_available": false,
-        "card_available": false,
-        "process_identity_can_authorize": false,
-        "reason": "trusted_human_confirmation_transport_not_configured",
-        "next_owners": ["client_embedding_integration", "deployment_trust_provisioning"],
-        "next_action": "Integrate a protected human confirmation transport and constructor-provisioned issuer trust, then validate the actual client launch chain before requesting fresh exact-target authorization. Do not fill task_grant_id or approve through model-visible input.",
-        "contract": "https://github.com/dcc-mcp/dcc-cua/blob/main/docs/adr/0027-cross-client-task-authorization.md",
-        "signed_receipt_protocol": {
-            "status": "implemented_core",
-            "constructor_api_available": true,
-            "runtime_accepts_receipts": false
-        },
-        "fallback": "none"
-    })
-}
-
-pub(crate) fn available_status() -> Value {
-    json!({
-        "schema": "dcc-cua.authorization-integration.v1",
+        "schema": "dcc-cua.authorization-integration.v2",
         "provider": "dcc-cua",
         "runtime_version": env!("CARGO_PKG_VERSION"),
         "status": "available",
         "authorization_available": true,
         "user_confirmation_available": true,
         "card_available": true,
+        "confirmation_method": "client_managed",
+        "confirmation_owner": "agent_host",
+        "requires_system_user_verification": false,
+        "client_must_enforce_user_approval": true,
+        "trust_boundary": "mcp_connection_owner",
         "process_identity_can_authorize": false,
-        "confirmation_method": "windows_protected_user_presence",
-        "reason": "protected_user_presence_verifier_available",
+        "reason": "authorization_is_delegated_to_the_connected_agent_host",
         "next_owners": [],
-        "next_action": "Prepare one exact-window task card. The private authorization tool must complete protected Windows user presence verification before the process-local issuer can register the immutable scope.",
-        "contract": "https://github.com/dcc-mcp/dcc-cua/blob/main/docs/adr/0027-cross-client-task-authorization.md",
+        "next_action": "Prepare one exact bounded proposal, obtain approval through the connected agent host, then call authorize_task with only the retained proposal_id.",
+        "contract": "https://github.com/dcc-mcp/dcc-cua/blob/main/docs/adr/0028-delegate-task-authorization-to-agent-hosts.md",
         "signed_receipt_protocol": {
             "status": "implemented_core",
             "constructor_api_available": true,
             "runtime_accepts_receipts": false
         },
-        "fallback": "windows_non_injected_keyboard_sequence_when_user_consent_is_unavailable"
+        "fallback": "none"
     })
 }
 
 pub(crate) fn tool() -> Value {
     json!({
         "name": "authorization_integration_status",
         "title": "Check DCC-CUA authorization integration",
-        "description": "Read whether this DCC-CUA connection has a protected human confirmation surface. If it reports integration_required, do not invent a card, grant, or alternative provider.",
+        "description": "Read the cross-agent task authorization contract. The connected agent host owns user approval; DCC-CUA owns immutable scope, exact-target enforcement, expiry, and revocation.",
         "inputSchema": {"type": "object", "properties": {}, "additionalProperties": false},
         "annotations": {"readOnlyHint": true, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false}
     })
 }
-
-pub(crate) fn tools() -> Value {
-    json!([tool()])
-}

crates/dcc-cua-cli/src/main.rs

@@ -28,7 +28,6 @@ mod profile_package;
 mod profile_state;
 mod secret_vault;
 mod semantic_profile;
-mod task_authorization_confirmation;
 mod trusted_confirmation;
 mod trusted_embedding;
 mod update;

crates/dcc-cua-cli/src/manifest.rs

@@ -168,8 +168,8 @@ pub(crate) fn document_for_platform(exact_window_pixels_available: bool) -> Valu
             "task_authorization": {
                 "request_schema": dcc_cua_host::TRUSTED_TASK_AUTHORIZATION_SCHEMA,
                 "mode": "split_constructor_capability_broker",
-                "issuer_owner": "authenticated_embedding_user_input",
-                "embedding": "constructor_owned_user_input",
+                "issuer_owner": "dcc_cua_mcp_server",
+                "embedding": "client_managed_agent_host",
                 "task_scoped": true,
                 "modal": false,
                 "registration_single_use": true,
@@ -188,12 +188,12 @@ pub(crate) fn document_for_platform(exact_window_pixels_available: bool) -> Valu
                 "action_risk_category_bound": true,
                 "browser_origin_bound": true,
                 "expiry_and_revocation_checked_per_action": true,
-                "ipc_can_mint_or_widen": false,
+                "ipc_can_widen": false,
                 "cli_arguments_can_authorize": false,
                 "environment_can_authorize": false,
                 "stdin_can_authorize": false,
                 "input_text_echoed": false,
-                "cli_fallback": "per_action_confirmation",
+                "cli_fallback": "none",
             },
             "secret_vault": {
                 "backend": "platform_keyring",
@@ -253,11 +253,10 @@ pub(crate) fn document_for_platform(exact_window_pixels_available: bool) -> Valu
             },
         },
     });
-    document["host"]["task_authorization"]["cli_integration"] = if cfg!(windows) {
-        crate::authorization_integration::available_status()
-    } else {
-        crate::authorization_integration::status()
-    };
+    document["host"]["task_authorization"]["authorization_owner"] = json!("connected_agent_host");
+    document["host"]["task_authorization"]["ipc_can_mint_exact_retained_proposal"] = json!(true);
+    document["host"]["task_authorization"]["cli_integration"] =
+        crate::authorization_integration::status();
     if !exact_window_pixels_available {
         document["runtime"]
             .as_object_mut()