Repository navigation
🦫 feat: Enforce Scheduled MCP Read-Only Authority - #16681
Conversation
|
Head |
|
Head |
|
Head |
|
Verification for
Current-head CI Static checks and Lighthouse passed. Remaining CI is still running. Local Lighthouse is blocked by missing Chromium. Live-provider and DocumentDB certification were not run. Independent review of this head is unavailable: the reviewer failed to start with Parent audit: two P1 findings (expiry during admission; malformed-consent legacy fallback) and one P2 finding (ordinary startup timing) are fixed. No finding was rejected. No merge, deployment or provider activation. |
|
@codex review the latest head, final review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1e18bee981
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Head |
|
Verification for |
|
Head |
|
Verification for |
|
Head |
|
Verification for |
|
Head |
|
Verification for |
|
Head |
|
Verification for |
|
Head |
|
Verification for |
|
Lighthouse CI failed. The last 80 log lines contain the measured budgets and assertion failures. |
|
Verification for |
|
Head |
|
Verification for |
|
Independent review completed for |
|
@codex review the latest head, final review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 35ea38c4db
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Review target: |
|
Verification at |
|
CI update for |
|
MCP Apps trace at |
|
Exact-head independent review completed for |
|
Browser investigation at reviewed head |
|
Updated head: Merged current Focused verification, fresh GitHub CI and independent exact-head review are running. The prior head's MCP Apps failure remains unresolved until this head's CI establishes its result. |
|
Updated head: Merged Seven focused boundary cases and package builds passed. Full focused verification, fresh CI and independent review are running for this head. The predecessor's clean review and CI results do not clear this head. Upgrade-first activation remains separate. |
|
Lighthouse CI failed. The last 80 log lines contain the measured budgets and assertion failures. |
|
Verification for
The reviewer read the full 77-file diff and approval integration, checked JavaScript syntax and diff whitespace, but did not independently run behavioral tests or typechecks. The existing ledger remains 9 P1 + 13 P2 fixed and one accepted upgrade-first operational prerequisite, not fleet certification. All six existing review threads are resolved. CI snapshot: {"success":35,"skipped":2,"in_progress":6,"failure":1}. MCP Apps passed. Lighthouse failed while recording its third audit with Local Lighthouse was attempted at the predecessor and could not start Chrome. It was not rerun at this head; real Redis, live-provider, DocumentDB and fleet/upgrade/drain/activation certification were not run locally. No feature merge, deployment or activation occurred. Review checkout removal completed, but Git's busy review metadata could not be pruned. |
codegraph-librechat
Bot
added
the
🗺️ Agent Execution
|
Updated head: Merged The predecessor's Lighthouse artifact shows |
|
Verification for
All three Lighthouse audits completed without retry. Runner, budgets and assertions are unchanged. The predecessor's second audit failed with Independent review read the full diff, passed syntax/whitespace checks and 34 source-module probes with dependency stand-ins, not SDK/database integrations. Six existing review threads are resolved. Ledger: 9 P1 + 13 P2 fixed; one P1 remains an accepted upgrade-first operational prerequisite, not fleet certification. CI snapshot: {"success":35,"in_progress":7,"skipped":2}. No failed checks. Remaining runtime smoke and memory e2e jobs are running; CI clearance is not yet claimed. MCP Apps passed. Local Lighthouse setup remains blocked by absent Chrome. Real Redis, live-provider, DocumentDB and fleet/upgrade/drain/activation certification were not run locally. No feature merge, deployment or activation. Review checkout removed; Git metadata remains busy after a permitted prune. |
|
Updated head: Merged The predecessor failed the queued-message “Start in a new chat” scenario in all three attempts. Its trace shows navigation to Focused URL-prompt and A3 verification, the unchanged browser scenario, fresh CI and independent exact-head review are running. Upgrade-first activation remains separate. |
|
Verification for
The predecessor’s failure was the URL-prompt handoff, reproduced in all three CI attempts. This head incorporates #16647; no assertion, timeout, performance budget or authority safeguard changed. Existing ledger: 9 P1 + 13 P2 fixed; A3-18 remains an accepted upgrade-first prerequisite, not fleet certification. No feature merge, deployment, activation or live-provider/DocumentDB/fleet validation. Full local Lighthouse and local real Redis integration were not rerun; CI covers those lanes. Review checkout removed; busy Git metadata could not be pruned. |
2 participants
Summary
A2 (#16652) persists schedule consent but does not install execution authority. This PR enforces delegated read-only MCP policy at readiness and immediately before
tools/call. Current consent, owner/tenant/root binding, reachable selections, RBAC, resource routing and pinned tool definitions must match. Denied calls never dispatch.Unenrolled schedules retain legacy behavior only while enrollment remains absent. Revocation, expiry, missing policy and unsupported stored versions never permit a legacy fallback.
Related to #16157. Consumes #16645 and #16652.
How it works
interface.schedules.mcpConsent.readOnlyPolicydeclares exact upstream operations witheffect: read_onlyanddefinitionSha256. Names, annotations, scope previews, remembered conversation approvals and model choices confer no authority. Consent offers reject missing, invalid or principal-overridden policy. Mixed read/write query tools need a separate service policy.Testing
Focused SDK, MCP/HTTP, continuation, consent, schedule and storage regressions. Real Mongo settlement and owner/tenant checks. Real Redis UPDATE/CAS severity and epoch checks. Changed-workspace typechecks, declaration builds and touched-file static checks.
Exact results and CI are recorded in the head-specific verification comment.
Risk / compatibility
Enrollment is default-off. Activation requires the maintainer-approved upgrade-first sequence:
interface.schedules.mcpConsent.enabled: falsethroughout the upgrade. Do not create enrollments on a mixed fleet.Active enrollment during a mixed-version upgrade is unsupported. A rollback to pre-A3 code requires disabling enrollment and draining affected work first. This PR does not certify fleet readiness or authorize a merge, deployment, activation or live-provider certification.
Checklist