docs(adr): align ADR-0020 (MCP auth hub) with the harness invariants + add AGENTS.md - #31
Merged
Merged
Conversation
…+ add AGENTS.md Review addendum to the user-authored ADR-0020. The auth engineering (PKCE/RFC 8252, GCP WIF via Entra OIDC + STS, safeStorage) is sound; this adds the integration discipline it was missing so it builds as an EXTENSION of omp, not greenfield: - Decision 6 (load-bearing): extend omp, don't fork — omp already accepts mcpServers[] in session/new (acp_backend.ts), so the hub does auth + config assembly only and feeds authenticated server entries to omp; it does not re-implement an MCP client. - safeStorage is Electron-main-only → token seal/unseal routes through main.ts+preload (the ADR-0010 seam), passphrase fallback in dev. - Untrusted MCP output must pass the fail-closed gate + be delimited (invariant #5). - Localhost PKCE catcher: distinct ephemeral port + drain/close (the OAuth bug class). - terraform/mcp_auth scoped as IaC/docs only — doesn't widen the TS+Python boundary. - Added phases P-MCP.1–4 (one increment each), recommended first build, and the frozen-contract impacts (new EventNames, no migration, registry stays git-ignored). - Minor: PQC cross-refs ADR-0015 (ML-KEM already FIPS-203); Entra/Okta are the IdPs, Yubikey/PIV the factors. Also adds AGENTS.md — a mirror of CLAUDE.md (the cross-tool agent-instructions filename). Docs only; no code changed. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Review addendum to ADR-0020: extend-omp framing (feed authenticated configs into omp's mcpServers, not a parallel client), the safeStorage/Electron-main seam, the scan-untrusted-MCP-output guardrail, localhost PKCE coordination, Terraform-as-IaC boundary, phases P-MCP.1–4, and frozen-contract impacts. Adds AGENTS.md (mirror of CLAUDE.md). Docs only.
🤖 Generated with Claude Code