J125: MCP adapter over the shared action route #318

New issue

Open

opened 2026-11-03 05:36:24 +00:00 by kayg · 20 comments

kayg commented 2026-11-03 05:36:24 +00:00

Owner

Copy link

Job J125: MCP adapter over the shared action route.

Scope:

• Add infraternal mcp over stdio with initialize, tools/list generated from the shared action registry, and tools/call dispatched through the existing action route using MCP's own signed-in API-key authority.
• Assess streamable HTTP against the current server and existing dependencies; include it only if it is a small adapter with no unjustified new dependency.
• Preserve the registry's action names, descriptions, JSON schemas, CLI help text, refusal codes, and refusal guidance. Do not define actions or dispatch handlers a second time.
• Add protocol and unauthorized-call coverage, plus a real MCP-client end-to-end case if a compatible client is present in the VM dev shell.
• Measure the static binary before and after and report the delta.

Plan and estimate (4–6 hours of implementation and review, excluding VM queue time):

1. Start from J94's route branch origin/apikey-actions-303 at 067c3e233bcf0235332abf278a74f89c34172bf8, rebase onto current origin/dev 7add126405a9205bb817a154af11fad2c438cd45, and confirm the route contract with #303.
2. Read D318, D299, D303, D304, D314, docs/CLI.md, and the action registry; trace CLI text, authority, errors, and shared dispatch.
3. Implement the narrow MCP transport adapter and authority handoff; avoid a new dependency unless measured and justified.
4. Add protocol, authority, and available real-client coverage; record before/after static sizes.
5. Check both VM build queues, run scripts/verify fast on the less-loaded eligible VM through build-slot, wait for completion, then commit and push this branch and post the final SHA, size table, and gate output verbatim.

Contract constraint: MCP is a thin adapter over the one shared action route. No MCP-only action definitions, second dispatch path, or changes to numbered decisions.

Job J125: MCP adapter over the shared action route. Scope: - Add `infraternal mcp` over stdio with initialize, tools/list generated from the shared action registry, and tools/call dispatched through the existing action route using MCP's own signed-in API-key authority. - Assess streamable HTTP against the current server and existing dependencies; include it only if it is a small adapter with no unjustified new dependency. - Preserve the registry's action names, descriptions, JSON schemas, CLI help text, refusal codes, and refusal guidance. Do not define actions or dispatch handlers a second time. - Add protocol and unauthorized-call coverage, plus a real MCP-client end-to-end case if a compatible client is present in the VM dev shell. - Measure the static binary before and after and report the delta. Plan and estimate (4–6 hours of implementation and review, excluding VM queue time): 1. Start from J94's route branch `origin/apikey-actions-303` at `067c3e233bcf0235332abf278a74f89c34172bf8`, rebase onto current `origin/dev` `7add126405a9205bb817a154af11fad2c438cd45`, and confirm the route contract with #303. 2. Read D318, D299, D303, D304, D314, `docs/CLI.md`, and the action registry; trace CLI text, authority, errors, and shared dispatch. 3. Implement the narrow MCP transport adapter and authority handoff; avoid a new dependency unless measured and justified. 4. Add protocol, authority, and available real-client coverage; record before/after static sizes. 5. Check both VM build queues, run `scripts/verify fast` on the less-loaded eligible VM through `build-slot`, wait for completion, then commit and push this branch and post the final SHA, size table, and gate output verbatim. Contract constraint: MCP is a thin adapter over the one shared action route. No MCP-only action definitions, second dispatch path, or changes to numbered decisions.

kayg commented 2026-11-03 05:36:51 +00:00

Author

Owner

Copy link

Started implementation on branch j125-mcp in /home/kayg/Developer/Worktrees/infraternal-J125. The branch started from the current #303 route head 067c3e233bcf0235332abf278a74f89c34172bf8 and was rebased onto origin/dev base 7add126405a9205bb817a154af11fad2c438cd45. I will keep MCP as a generated thin adapter and use the shared action route. Estimate: 4–6 hours implementation and review, excluding VM queue time.

Started implementation on branch `j125-mcp` in `/home/kayg/Developer/Worktrees/infraternal-J125`. The branch started from the current #303 route head `067c3e233bcf0235332abf278a74f89c34172bf8` and was rebased onto `origin/dev` base `7add126405a9205bb817a154af11fad2c438cd45`. I will keep MCP as a generated thin adapter and use the shared action route. Estimate: 4–6 hours implementation and review, excluding VM queue time.

kayg referenced this issue 2026-11-03 05:36:52 +00:00

CLI: use sign-in API keys for remote actions (D311) #303

kayg commented 2026-11-03 05:41:42 +00:00

Author

Owner

Copy link

Finding: the current CLI registry already carries each hosted ActionDef alongside its CLI description and JsonSchema. CLI execution uses cli/api_actions.rs, which loads the private sign-in credential, enforces the descriptor's explicit api_scope, scrubs bearer material from responses, and dispatches normal calls to POST /v1/actions/{action_id}. The existing SSH bootstrap and host-removal approval flows are special cases within that same hosted adapter. MCP can therefore generate from registered hosted definitions and reuse that adapter instead of adding action definitions or server dispatch.

Finding: the current CLI registry already carries each hosted `ActionDef` alongside its CLI description and `JsonSchema`. CLI execution uses `cli/api_actions.rs`, which loads the private sign-in credential, enforces the descriptor's explicit `api_scope`, scrubs bearer material from responses, and dispatches normal calls to `POST /v1/actions/{action_id}`. The existing SSH bootstrap and host-removal approval flows are special cases within that same hosted adapter. MCP can therefore generate from registered hosted definitions and reuse that adapter instead of adding action definitions or server dispatch.

kayg commented 2026-11-03 05:43:54 +00:00

Author

Owner

Copy link

Streamable HTTP assessment: the CLI crate currently compiles Hyper with its client/http1 features, and its current networking helper is client-only. An HTTP MCP transport would need an inbound listener plus an ingress authentication and lifecycle boundary in addition to stdio. That is not a small adapter over the current action route, so J125 will ship stdio only and add no HTTP dependency or second listener.

Streamable HTTP assessment: the CLI crate currently compiles Hyper with its client/http1 features, and its current networking helper is client-only. An HTTP MCP transport would need an inbound listener plus an ingress authentication and lifecycle boundary in addition to stdio. That is not a small adapter over the current action route, so J125 will ship stdio only and add no HTTP dependency or second listener.

kayg commented 2026-11-03 06:10:12 +00:00

Author

Owner

Copy link

Finding: D28 requires a dry run before a destructive MCP call. The registered remote.host.remove action is destructive and marks dry-run as required, but its registered MCP input schema contains only host_id and has no dry_run field. J125 therefore excludes destructive actions from tools/list unless their shared schema requires a boolean dry_run input, and tools/call rejects calls to excluded actions. This keeps the action registry and route unchanged and does not create a duplicate dry-run action.

Finding: D28 requires a dry run before a destructive MCP call. The registered remote.host.remove action is destructive and marks dry-run as required, but its registered MCP input schema contains only host_id and has no dry_run field. J125 therefore excludes destructive actions from tools/list unless their shared schema requires a boolean dry_run input, and tools/call rejects calls to excluded actions. This keeps the action registry and route unchanged and does not create a duplicate dry-run action.

kayg commented 2026-11-03 06:46:05 +00:00

Author

Owner

Copy link

Progress: MCP stdio, registry-generated tool metadata, shared hosted credential/scope dispatch, protocol errors, and unauthorized-call coverage are committed on j125-mcp at f73d3e6fb. Baseline static sizes from compute01 at the unmodified base 28ffb4bfdf: x86_64 22,762,256 bytes; aarch64 20,735,176 bytes. No dependency added. Next: run scripts/verify fast on the least-loaded VM, measure both final sizes, then amend to the final commit message and post the gate receipt.

Progress: MCP stdio, registry-generated tool metadata, shared hosted credential/scope dispatch, protocol errors, and unauthorized-call coverage are committed on j125-mcp at f73d3e6fb. Baseline static sizes from compute01 at the unmodified base 28ffb4bfdffd1a0ff2c838943f96ddd3114ae39e: x86_64 22,762,256 bytes; aarch64 20,735,176 bytes. No dependency added. Next: run scripts/verify fast on the least-loaded VM, measure both final sizes, then amend to the final commit message and post the gate receipt.

kayg commented 2026-11-03 10:09:46 +00:00

Author

Owner

Copy link

J125c takeover (Claude Sonnet 5.5) of J125 after the previous job stopped on a provider 429 at about 07:00 UTC.

State found:

• Branch j125-mcp head f73d3e6fb (3 WIP commits on base origin/dev 7add12640: two are J94's #303 route commits, one is J125's MCP commit). No uncommitted work in the control-host worktree or in either VM worktree (~/worktrees/J125 on compute01 at f73d3e6fb, on dev-02 at 28ffb4bfd). Current origin/dev is 7c082bddf.
• No J125 process is running on either VM. Leftovers: a 14 GB target/ in compute01 ~/worktrees/J125 and ~/.cache/codex-scratch/J125 (baseline-size.log: x86_64 22,762,256 B, aarch64 20,735,176 B, recorded in the previous progress comment). No gate log exists, so the two unit failures I was told about are not on record and I will reproduce them myself.
• The base is stale: J94c's apikey-actions-303 head 73664b9d5 changed cli/api_actions.rs, command_tree.rs, main.rs and sign_in.rs after J125's base, and J125 rewrote most of api_actions.rs. I rebuilt the stack as origin/dev 7c082bddf + J94's three WIP commits (clean rebase) + J125's commit (one conflict in api_actions.rs, resolved by keeping J125's shared call_action_with_output and J94's clone_into lint fix) on a new branch j125c-mcp. I will not force-push j125-mcp.
• Contract of record on #313 is the J94 comment of 2026-11-02 23:06 UTC (POST /v1/actions/{action_id}, hosted_action CLI hook). J94c has not re-published; I will re-check after its squash and rebase onto it.

Remaining plan:

1. Build and run the infraternal crate tests; reproduce the root help line width and hosts list parser failures on unmodified origin/dev and on the stack without my commit, to separate inherited failures from ones J125 caused (30-60 min).
2. Fix the failures J125 caused, with a failing test first (30 min).
3. Review the MCP adapter against the #313 contract (no duplicated auth, schemas from the registry) and fill protocol gaps (30-60 min).
4. Squash into atomic commits with full messages, rebase onto J94c's published head, measure static sizes, run scripts/verify fast through build-slot on the freer VM, and post the head SHA and output verbatim (gate time plus queue).

Estimate: 3-4 hours plus queue time.

J125c takeover (Claude Sonnet 5.5) of J125 after the previous job stopped on a provider 429 at about 07:00 UTC. State found: - Branch `j125-mcp` head `f73d3e6fb` (3 WIP commits on base `origin/dev` `7add12640`: two are J94's #303 route commits, one is J125's MCP commit). No uncommitted work in the control-host worktree or in either VM worktree (`~/worktrees/J125` on compute01 at f73d3e6fb, on dev-02 at 28ffb4bfd). Current `origin/dev` is `7c082bddf`. - No J125 process is running on either VM. Leftovers: a 14 GB `target/` in compute01 `~/worktrees/J125` and `~/.cache/codex-scratch/J125` (baseline-size.log: x86_64 22,762,256 B, aarch64 20,735,176 B, recorded in the previous progress comment). No gate log exists, so the two unit failures I was told about are not on record and I will reproduce them myself. - The base is stale: J94c's `apikey-actions-303` head `73664b9d5` changed `cli/api_actions.rs`, `command_tree.rs`, `main.rs` and `sign_in.rs` after J125's base, and J125 rewrote most of `api_actions.rs`. I rebuilt the stack as origin/dev `7c082bddf` + J94's three WIP commits (clean rebase) + J125's commit (one conflict in `api_actions.rs`, resolved by keeping J125's shared `call_action_with_output` and J94's `clone_into` lint fix) on a new branch `j125c-mcp`. I will not force-push `j125-mcp`. - Contract of record on #313 is the J94 comment of 2026-11-02 23:06 UTC (POST /v1/actions/{action_id}, hosted_action CLI hook). J94c has not re-published; I will re-check after its squash and rebase onto it. Remaining plan: 1. Build and run the `infraternal` crate tests; reproduce the root help line width and `hosts list` parser failures on unmodified origin/dev and on the stack without my commit, to separate inherited failures from ones J125 caused (30-60 min). 2. Fix the failures J125 caused, with a failing test first (30 min). 3. Review the MCP adapter against the #313 contract (no duplicated auth, schemas from the registry) and fill protocol gaps (30-60 min). 4. Squash into atomic commits with full messages, rebase onto J94c's published head, measure static sizes, run `scripts/verify fast` through build-slot on the freer VM, and post the head SHA and output verbatim (gate time plus queue). Estimate: 3-4 hours plus queue time.

kayg commented 2026-11-03 11:43:28 +00:00

Author

Owner

Copy link

J125c findings (Claude Sonnet 5.5). Branch j125c-mcp, stacked as origin/dev 7c082bddf + J94's three WIP commits (rebased, clean) + one MCP commit. j125-mcp is untouched.

1. Which failures are inherited, and which J125 caused. cargo test -p infraternal --bins on compute01:

• Unmodified origin/dev 67556332b: 128 passed, 0 failed. Nothing is inherited from dev.
• J125's original head f73d3e6fb: 8 failed, 138 passed.
  • J125's own: root_help_lines_fit_80_columns (95 columns: mcp Serve registered server actions to an MCP client over standard input and output.), mcp::an_unauthorized_call_keeps_the_cli_refusal_text_and_code, mcp::initialize_and_tool_list_follow_the_registered_cli_metadata.
  • Inherited from the J94 WIP commits it was built on, and fixed by J94c's 73664b9d5: server_action_commands_use_the_shared_action_definitions (this is the hosts list parser expectation, panic at command_tree.rs:391), every_command_in_the_tree_takes_json, public_help_is_plain_words, removal_and_retention_inputs_keep_the_production_runtime_bindings (clap debug assert at debug_asserts.rs:110) and sign_in::stored_key_selection_requires_one_server_or_an_explicit_origin. They all pass on the rebased stack.
• Stack with my fixes: 147 passed, 0 failed, 1 ignored.

2. Safety hole in J125's destructive-action filter (D28). Two registrations share the hosted id remote.host.remove: hosts remove and the remote plugin's remove-host. The plugin sets effect=Destructive and dry_run=Required in its contract but leaves the advisory safety notes empty. J125's is_mcp_tool read only the notes, so remove-host (inputs host, server, no dry_run) was listed and callable. Fixed: the filter now reads the contract and the hosted ActionDef. A test covers every registration that shares that id.

3. Refusal text was split across lines. The error text came from the pretty renderer, which clamps at 100 columns, so the 109-character "not signed in" sentence was hard-wrapped for a client reading one string. The text now comes from the unwrapped message, detail and next steps.

4. Real-client coverage. The VM dev shell has no MCP client (claude, codex, inspector and the Python mcp package are all absent; no SDK in the lockfile). I added crates/infraternal/tests/mcp_stdio.rs, which drives the real infraternal mcp binary over stdin/stdout: handshake, tools/list, an unsigned call refused with not_allowed, the removal tool absent, pre-initialized calls refused, clean exit at end of input, and stdout holding only JSON-RPC. I did not add a client library for this.

5. First gate run on 4b8e00030: fmt FAIL, clippy FAIL (9 findings, all in mcp.rs / emit_failure), test FAIL. The test failure was a link error caused by my own probe: a shared target kept a build-script linker path inside a probe worktree I had removed. Everything else passed, including static builds. Fixed in e4baecdd6; the gate is rerunning.

J125c findings (Claude Sonnet 5.5). Branch `j125c-mcp`, stacked as origin/dev `7c082bddf` + J94's three WIP commits (rebased, clean) + one MCP commit. `j125-mcp` is untouched. **1. Which failures are inherited, and which J125 caused.** `cargo test -p infraternal --bins` on compute01: - Unmodified `origin/dev` `67556332b`: 128 passed, 0 failed. Nothing is inherited from dev. - J125's original head `f73d3e6fb`: 8 failed, 138 passed. - J125's own: `root_help_lines_fit_80_columns` (`95 columns: mcp Serve registered server actions to an MCP client over standard input and output.`), `mcp::an_unauthorized_call_keeps_the_cli_refusal_text_and_code`, `mcp::initialize_and_tool_list_follow_the_registered_cli_metadata`. - Inherited from the J94 WIP commits it was built on, and fixed by J94c's `73664b9d5`: `server_action_commands_use_the_shared_action_definitions` (this is the `hosts list` parser expectation, panic at command_tree.rs:391), `every_command_in_the_tree_takes_json`, `public_help_is_plain_words`, `removal_and_retention_inputs_keep_the_production_runtime_bindings` (clap debug assert at debug_asserts.rs:110) and `sign_in::stored_key_selection_requires_one_server_or_an_explicit_origin`. They all pass on the rebased stack. - Stack with my fixes: 147 passed, 0 failed, 1 ignored. **2. Safety hole in J125's destructive-action filter (D28).** Two registrations share the hosted id `remote.host.remove`: `hosts remove` and the remote plugin's `remove-host`. The plugin sets effect=Destructive and dry_run=Required in its contract but leaves the advisory `safety` notes empty. J125's `is_mcp_tool` read only the notes, so `remove-host` (inputs `host`, `server`, no `dry_run`) was listed and callable. Fixed: the filter now reads the contract and the hosted `ActionDef`. A test covers every registration that shares that id. **3. Refusal text was split across lines.** The error text came from the pretty renderer, which clamps at 100 columns, so the 109-character "not signed in" sentence was hard-wrapped for a client reading one string. The text now comes from the unwrapped message, detail and next steps. **4. Real-client coverage.** The VM dev shell has no MCP client (`claude`, `codex`, inspector and the Python `mcp` package are all absent; no SDK in the lockfile). I added `crates/infraternal/tests/mcp_stdio.rs`, which drives the real `infraternal mcp` binary over stdin/stdout: handshake, tools/list, an unsigned call refused with `not_allowed`, the removal tool absent, pre-`initialized` calls refused, clean exit at end of input, and stdout holding only JSON-RPC. I did not add a client library for this. **5. First gate run on `4b8e00030`:** fmt FAIL, clippy FAIL (9 findings, all in `mcp.rs` / `emit_failure`), test FAIL. The test failure was a link error caused by my own probe: a shared target kept a build-script linker path inside a probe worktree I had removed. Everything else passed, including static builds. Fixed in `e4baecdd6`; the gate is rerunning.

kayg commented 2026-11-03 16:15:24 +00:00

Author

Owner

Copy link

J125c finish (Claude Sonnet 5.5). Branch j125c-mcp, head 2636dc9c03b3fd78429ceb8e2bbbf60c1bdde3a3: one commit on J94d's apikey-actions-303 head 842fbf1d7 (which sits on dev bcca3054f). j125-mcp is untouched. When J94 is rebased or squashed again, replay the one MCP commit with git rebase --onto <new J94 head> 842fbf1d7 j125c-mcp.

Contract changes since the first takeover comment. I rebased onto J94d's new head after reading its updated route contract on #313 (comments 76765, 77006). MCP now asks ActionDef::key_callable() instead of api_scope.is_some(), as the contract says. The D28 rule stays on top: a destructive or dry-run-required action is listed only when its registered input requires a boolean dry_run. No auth, dispatch or action definition was added; MCP reuses the hosted adapter, the stored device credential and the POST /v1/actions/{id} route.

Gate: scripts/verify fast on compute01 at 2636dc9c0, not green. Verbatim:

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | FAIL (1)     |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | FAIL (101)   |
| SSH runtime test helper   | PASS         |
| real-binary fixture paths | PASS         |
| test                      | PASS         |
| SSH inode reuse fixture   | PASS         |
| shim process-per-user     | PASS         |
| cargo-deny                | PASS         |
| gate architecture         | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+
VERIFY_EXIT=1

Both failing rows come from J94d's commits, not from the MCP commit:

• fmt: diffs in infraternal-plugin-api/src/lib.rs, infraternal-server/src/api_actions.rs, auth/api_actions_tests.rs, bootstrap_api_tests.rs, infraternal/src/sign_in.rs, and two places in infraternal/src/cli/api_actions.rs (terminal_safe and a test). git blame puts those lines in J94d's 64764d79a; my commit touches none of them.
• clippy: clippy::double_must_use in infraternal-server (lib test). It stops the run at that crate.
• Because that stops the workspace clippy, I linted my crate on its own at this head: cargo clippy -p infraternal --all-targets --locked -- -D warnings passes (rc 0; the one warning is in vendored russh). rustfmt --check is clean on cli/mcp.rs, cli/actions.rs, tests/mcp_stdio.rs.
• The test row passes, so the 10 infraternal-server failures seen on the earlier stack are fixed upstream. It includes the MCP unit tests (new no_destructive_registration_is_listed_without_a_dry_run_input) and tests/mcp_stdio.rs.

Flaky tests in the infraternal bin (not reproduced on this head): on the previous head e4baecdd6, one run failed cli::command_tree::tests::public_help_is_plain_words (I did not capture its message) and a workspace run failed restart::tests::deleted_path_review::relative_recovery_after_atomic_install_keeps_live_install_path ("Text file busy", a fork/exec race). Eight repeated cargo test -p infraternal --bins runs at that head all passed, and the help test passes when run alone. I could not prove the help flake pre-exists; the 24 other failures in that workspace run were identical with and without my commit.

Static size (musl release, compute01), exact before/after:

target	J94d head 842fbf1d7	with MCP 2636dc9c0	delta
x86_64	22,795,408 B	22,864,496 B	+69,088 B
aarch64	20,761,576 B	20,819,080 B	+57,504 B

No dependency added. Streamable HTTP is not included (decided earlier on this issue).

Cleaned up: VM worktree ~/worktrees/j125c and its target removed; nothing of mine is running. ~/worktrees/J125 (the previous job's, now without its target) is left for its owner.

J125c finish (Claude Sonnet 5.5). Branch `j125c-mcp`, head `2636dc9c03b3fd78429ceb8e2bbbf60c1bdde3a3`: one commit on J94d's `apikey-actions-303` head `842fbf1d7` (which sits on dev `bcca3054f`). `j125-mcp` is untouched. When J94 is rebased or squashed again, replay the one MCP commit with `git rebase --onto <new J94 head> 842fbf1d7 j125c-mcp`. **Contract changes since the first takeover comment.** I rebased onto J94d's new head after reading its updated route contract on #313 (comments 76765, 77006). MCP now asks `ActionDef::key_callable()` instead of `api_scope.is_some()`, as the contract says. The D28 rule stays on top: a destructive or dry-run-required action is listed only when its registered input requires a boolean `dry_run`. No auth, dispatch or action definition was added; MCP reuses the hosted adapter, the stored device credential and the `POST /v1/actions/{id}` route. **Gate: `scripts/verify fast` on compute01 at 2636dc9c0, not green. Verbatim:** ``` +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | FAIL (1) | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | FAIL (101) | | SSH runtime test helper | PASS | | real-binary fixture paths | PASS | | test | PASS | | SSH inode reuse fixture | PASS | | shim process-per-user | PASS | | cargo-deny | PASS | | gate architecture | PASS | | static builds | PASS | +---------------------------+--------------+ VERIFY_EXIT=1 ``` Both failing rows come from J94d's commits, not from the MCP commit: - fmt: diffs in `infraternal-plugin-api/src/lib.rs`, `infraternal-server/src/api_actions.rs`, `auth/api_actions_tests.rs`, `bootstrap_api_tests.rs`, `infraternal/src/sign_in.rs`, and two places in `infraternal/src/cli/api_actions.rs` (`terminal_safe` and a test). `git blame` puts those lines in J94d's `64764d79a`; my commit touches none of them. - clippy: `clippy::double_must_use` in `infraternal-server` (lib test). It stops the run at that crate. - Because that stops the workspace clippy, I linted my crate on its own at this head: `cargo clippy -p infraternal --all-targets --locked -- -D warnings` passes (rc 0; the one warning is in vendored russh). `rustfmt --check` is clean on `cli/mcp.rs`, `cli/actions.rs`, `tests/mcp_stdio.rs`. - The `test` row passes, so the 10 `infraternal-server` failures seen on the earlier stack are fixed upstream. It includes the MCP unit tests (new `no_destructive_registration_is_listed_without_a_dry_run_input`) and `tests/mcp_stdio.rs`. Flaky tests in the `infraternal` bin (not reproduced on this head): on the previous head `e4baecdd6`, one run failed `cli::command_tree::tests::public_help_is_plain_words` (I did not capture its message) and a workspace run failed `restart::tests::deleted_path_review::relative_recovery_after_atomic_install_keeps_live_install_path` ("Text file busy", a fork/exec race). Eight repeated `cargo test -p infraternal --bins` runs at that head all passed, and the help test passes when run alone. I could not prove the help flake pre-exists; the 24 other failures in that workspace run were identical with and without my commit. **Static size (musl release, compute01), exact before/after:** | target | J94d head 842fbf1d7 | with MCP 2636dc9c0 | delta | |---|---|---|---| | x86_64 | 22,795,408 B | 22,864,496 B | +69,088 B | | aarch64 | 20,761,576 B | 20,819,080 B | +57,504 B | No dependency added. Streamable HTTP is not included (decided earlier on this issue). **Cleaned up:** VM worktree `~/worktrees/j125c` and its target removed; nothing of mine is running. `~/worktrees/J125` (the previous job's, now without its target) is left for its owner.

kayg commented 2026-11-03 16:24:21 +00:00

Author

Owner

Copy link

J147 (Claude Sonnet 5.5): design for MCP events on the thin adapter. Branch mcp-events-j147 on J125c 2636dc9c0 (J94d 842fbf1d7; origin/apikey-actions-303 is now b0d41158a, I will rebase when it lands). Spec reading done 2026-11-03.

What the spec offers (latest = 2026-07-28; previous 2025-11-25)

• Changelog: https://modelcontextprotocol.io/specification/2026-07-28/changelog
• 2025-11-25 and older ("legacy"): initialize handshake; resources capability {subscribe, listChanged}; resources/subscribe -> notifications/resources/updated {uri}; notifications/resources/list_changed; notifications/tools/list_changed; progress; logging. https://modelcontextprotocol.io/specification/2025-11-25/server/resources
• 2026-07-28 ("modern"): stateless, no initialize, every request carries _meta (io.modelcontextprotocol/protocolVersion, clientCapabilities, clientInfo); mandatory server/discover; UnsupportedProtocolVersionError (-32022, data.supported); subscriptions/listen replaces resources/subscribe and the HTTP GET stream (filter toolsListChanged, resourcesListChanged, resourceSubscriptions: [uri]; first message notifications/subscriptions/acknowledged; every notification tagged _meta."io.modelcontextprotocol/subscriptionId"; client cancels with notifications/cancelled; server ends with a complete result; stdio reconnect = client re-sends listen); results carry resultType; list results carry ttlMs/cacheScope; Logging, Roots, Sampling deprecated; resource-not-found is -32602. https://modelcontextprotocol.io/specification/2026-07-28/basic/patterns/subscriptions , .../server/discover , .../basic/versioning , .../basic/transports/stdio
• There is no separate "events" feature. Server-to-client events are: resource updates (subscriptions), list_changed, request-scoped progress and message. Notifications are invalidations: the client re-reads the resource. That is the same shape as our changed events (contracts/mesh-api.md section 4).
• Compatibility rule (versioning page): a dual-era server picks the era from how the client opens. _meta on the first request -> modern. initialize -> legacy, scoped to the stdio process. Clients probe stdio with server/discover and fall back to initialize on any non-modern error.

Design

1. Dual-era stdio server. initialize keeps today's behaviour (negotiate down to 2024-11-05 / 2025-03-26 / 2025-06-18 / 2025-11-25). Requests with modern _meta are served statelessly: server/discover, tools/list, tools/call, resources/*, subscriptions/listen. Unknown modern version -> -32022 with supported. Capabilities only advertised to clients that can use them: resources.subscribe and listChanged are only sent in the initialize result (legacy), and honoured in subscriptions/listen (modern) per the client's filter. Old clients see no change in tools.
2. Event -> MCP mapping (resources are views of registered read actions, so reads go through the one action route):

infraternal event source (server, existing)	MCP resource	read via	scope	MCP mechanism
remote.hosts topic (host added, removed, connected, disconnected)	infraternal://hosts	remote.host.list	hosts:read	resources/updated
terminal.sessions topic (session started, ended)	infraternal://sessions	sessions.list	sessions:read	resources/updated
none (no change feed)	infraternal://status	server.status	status:read	readable, not subscribable
key revoked/expired, scopes	tools			stream closes; adapter emits tools/list_changed after re-listing
mesh changes	not exposed: no key-callable mesh read action yet			add a resource when one is registered
approvals pending, inbox items	no server event or read action exists			not invented here; resource is added with the action
long-running action				notifications/progress only for the add-host stream, if a progressToken is sent (follow-up)
Logging is deprecated in 2026-07-28 and is not implemented (diagnostics stay on stderr).
3. One event route (D318). The adapter subscribes on the server's existing GET /v1/ws control stream with Subscribe frames, the same topics the web app uses. contracts/wire.md section 7 already says leg A admits "the session cookie or a device API key", but the code only admits the cookie. So the one server change is: /v1/ws admits a bearer key in a events-only profile (Subscribe/Close only, topic -> scope check before dispatch, key revocation/expiry closes the socket through the existing authority watchdog). No second endpoint, no second authorization path, no terminal or action traffic on a key socket.
4. No new dependency. Wire codec is the workspace's infraternal-protocol; WebSocket client is the tokio-tungstenite the CLI already ships under remote. An MCP SDK crate is not needed: the adapter is ~1k lines and the spec surface is small.
5. Adapter becomes async (stdin reader task + select over requests, event stream, cancellation) so notifications can be pushed between requests. Reconnect: bounded backoff, resubscribe, and on every (re)connect send one updated per subscribed URI (the missed-change case), as our snapshot-on-subscribe semantics allow.

Open items / blockers

• test.ssh.kayg.org runs an older build: POST /v1/actions/remote.host.list answers 405 (the SPA fallback). Without J94d's route there is no key-callable action there, so the action and event scenarios cannot run against it until it is deployed with this stack. I was told not to deploy. Plan: run the scenario suite against a server built from this branch on compute01 (same code, real sign-in flow, real passkey approval via the software authenticator), and run against test.ssh.kayg.org whatever its build supports (sign-in, key issue). I will report this for the owner/orchestrator to decide on a test-server deploy.
• Tool listing per scope: the adapter lists by registry, not by key scope. I will check whether the server exposes the key's scopes.

J147 (Claude Sonnet 5.5): design for MCP events on the thin adapter. Branch `mcp-events-j147` on J125c `2636dc9c0` (J94d `842fbf1d7`; origin/apikey-actions-303 is now `b0d41158a`, I will rebase when it lands). Spec reading done 2026-11-03. ## What the spec offers (latest = 2026-07-28; previous 2025-11-25) - Changelog: https://modelcontextprotocol.io/specification/2026-07-28/changelog - **2025-11-25 and older ("legacy")**: `initialize` handshake; `resources` capability `{subscribe, listChanged}`; `resources/subscribe` -> `notifications/resources/updated {uri}`; `notifications/resources/list_changed`; `notifications/tools/list_changed`; progress; logging. https://modelcontextprotocol.io/specification/2025-11-25/server/resources - **2026-07-28 ("modern")**: stateless, no `initialize`, every request carries `_meta` (`io.modelcontextprotocol/protocolVersion`, `clientCapabilities`, `clientInfo`); mandatory `server/discover`; `UnsupportedProtocolVersionError` (-32022, `data.supported`); **`subscriptions/listen`** replaces `resources/subscribe` and the HTTP GET stream (filter `toolsListChanged`, `resourcesListChanged`, `resourceSubscriptions: [uri]`; first message `notifications/subscriptions/acknowledged`; every notification tagged `_meta."io.modelcontextprotocol/subscriptionId"`; client cancels with `notifications/cancelled`; server ends with a `complete` result; stdio reconnect = client re-sends listen); results carry `resultType`; list results carry `ttlMs`/`cacheScope`; Logging, Roots, Sampling deprecated; resource-not-found is -32602. https://modelcontextprotocol.io/specification/2026-07-28/basic/patterns/subscriptions , .../server/discover , .../basic/versioning , .../basic/transports/stdio - **There is no separate "events" feature.** Server-to-client events are: resource updates (subscriptions), list_changed, request-scoped progress and message. Notifications are *invalidations*: the client re-reads the resource. That is the same shape as our `changed` events (contracts/mesh-api.md section 4). - Compatibility rule (versioning page): a dual-era server picks the era from how the client opens. `_meta` on the first request -> modern. `initialize` -> legacy, scoped to the stdio process. Clients probe stdio with `server/discover` and fall back to `initialize` on any non-modern error. ## Design 1. **Dual-era stdio server.** `initialize` keeps today's behaviour (negotiate down to 2024-11-05 / 2025-03-26 / 2025-06-18 / 2025-11-25). Requests with modern `_meta` are served statelessly: `server/discover`, `tools/list`, `tools/call`, `resources/*`, `subscriptions/listen`. Unknown modern version -> -32022 with `supported`. Capabilities only advertised to clients that can use them: `resources.subscribe` and `listChanged` are only sent in the `initialize` result (legacy), and honoured in `subscriptions/listen` (modern) per the client's filter. Old clients see no change in `tools`. 2. **Event -> MCP mapping** (resources are *views of registered read actions*, so reads go through the one action route): | infraternal event source (server, existing) | MCP resource | read via | scope | MCP mechanism | |---|---|---|---|---| | `remote.hosts` topic (host added, removed, connected, disconnected) | `infraternal://hosts` | `remote.host.list` | `hosts:read` | `resources/updated` | | `terminal.sessions` topic (session started, ended) | `infraternal://sessions` | `sessions.list` | `sessions:read` | `resources/updated` | | none (no change feed) | `infraternal://status` | `server.status` | `status:read` | readable, not subscribable | | key revoked/expired, scopes | tools | | | stream closes; adapter emits `tools/list_changed` after re-listing | | mesh changes | not exposed: no key-callable mesh read action yet | | | add a resource when one is registered | | approvals pending, inbox items | **no server event or read action exists** | | | not invented here; resource is added with the action | | long-running action | | | | `notifications/progress` only for the add-host stream, if a `progressToken` is sent (follow-up) | Logging is deprecated in 2026-07-28 and is not implemented (diagnostics stay on stderr). 3. **One event route (D318).** The adapter subscribes on the server's existing `GET /v1/ws` control stream with `Subscribe` frames, the same topics the web app uses. contracts/wire.md section 7 already says leg A admits "the session cookie or a device API key", but the code only admits the cookie. So the one server change is: `/v1/ws` admits a bearer key in a **events-only profile** (Subscribe/Close only, topic -> scope check before dispatch, key revocation/expiry closes the socket through the existing authority watchdog). No second endpoint, no second authorization path, no terminal or action traffic on a key socket. 4. **No new dependency.** Wire codec is the workspace's `infraternal-protocol`; WebSocket client is the `tokio-tungstenite` the CLI already ships under `remote`. An MCP SDK crate is not needed: the adapter is ~1k lines and the spec surface is small. 5. Adapter becomes async (stdin reader task + select over requests, event stream, cancellation) so notifications can be pushed between requests. Reconnect: bounded backoff, resubscribe, and on every (re)connect send one `updated` per subscribed URI (the missed-change case), as our snapshot-on-subscribe semantics allow. ## Open items / blockers - **test.ssh.kayg.org runs an older build:** `POST /v1/actions/remote.host.list` answers 405 (the SPA fallback). Without J94d's route there is no key-callable action there, so the action and event scenarios cannot run against it until it is deployed with this stack. I was told not to deploy. Plan: run the scenario suite against a server built from this branch on compute01 (same code, real sign-in flow, real passkey approval via the software authenticator), and run against test.ssh.kayg.org whatever its build supports (sign-in, key issue). I will report this for the owner/orchestrator to decide on a test-server deploy. - Tool listing per scope: the adapter lists by registry, not by key scope. I will check whether the server exposes the key's scopes.

kayg commented 2026-11-03 17:58:14 +00:00

Author

Owner

Copy link

J147 progress (Claude Sonnet 5.5), branch mcp-events-j147 at 3fa688f62 (WIP commits; I will regroup them into atomic commits before the final report). Based on J125c 2636dc9c0; J94d's branch has since moved to b0d41158a, I rebase when it lands.

Built

• Server: GET /v1/ws now admits Authorization: Bearer <key> in an events-only profile (the access wire.md section 7 already promised). Hello/Welcome as for the browser (no resume), then only Subscribe/Close. Topics: remote.hosts needs hosts:read, terminal.sessions needs sessions:read; auth.recovery, mesh, canvas.layout are not offered to keys. Key liveness is event-driven (account revocation event + one timer at the key's deadline), same J90 authorizer and per-key limit/audit as the action route. Files: websocket/key_events.rs, small hooks in websocket.rs, api_actions.rs, runtime.rs.
• CLI infraternal mcp: dual-era stdio server. initialize keeps the old eras (2024-11-05..2025-11-25) and adds resources + resources/subscribe. Requests with _meta protocolVersion 2026-07-28 are served statelessly: server/discover, tools/*, resources/*, subscriptions/listen (ack first, tagged notifications, notifications/cancelled, graceful completion at end), resultType, ttlMs/cacheScope, -32022 with the supported list. Tools and resources are listed per the stored key's scopes. Resources: infraternal://hosts, infraternal://sessions (subscribable), infraternal://status. A read is the registered read action through the one action route. Event link mcp/events.rs is a client of the same /v1/ws. No new third-party dependency (the workspace's own infraternal-protocol crate is now a CLI dependency under remote; Cargo.lock edited by hand for that edge).
• stdin is read by a thread so notifications can be pushed between requests; a tool call in flight is cancellable.

Evidence so far (compute01, cargo test, CARGO_TARGET_DIR under codex-scratch/j147)

• cargo test -p infraternal -p infraternal-server -- mcp key_events: 21 CLI protocol tests ok, 5 server real-socket tests ok (admission, scope-limited topics, frame allow-list, revocation closes the socket, deadline closes the socket).
• cargo test -p infraternal --test mcp_stdio: 4 ok (process boundary, both eras, listen ack/completion at EOF).
• cargo check -p infraternal-server -p infraternal --tests --locked: no warnings from my files.

Next: live scenarios. Reminder of the blocker from the design comment: test.ssh.kayg.org runs a build that predates POST /v1/actions (405), so key-callable actions and the event socket do not exist there. I was told not to deploy, so route-dependent scenarios will run against a server built from this branch on compute01; sign-in/approval will run against the real test server.

J147 progress (Claude Sonnet 5.5), branch `mcp-events-j147` at `3fa688f62` (WIP commits; I will regroup them into atomic commits before the final report). Based on J125c `2636dc9c0`; J94d's branch has since moved to `b0d41158a`, I rebase when it lands. **Built** - Server: `GET /v1/ws` now admits `Authorization: Bearer <key>` in an **events-only profile** (the access wire.md section 7 already promised). Hello/Welcome as for the browser (no resume), then only `Subscribe`/`Close`. Topics: `remote.hosts` needs `hosts:read`, `terminal.sessions` needs `sessions:read`; `auth.recovery`, `mesh`, `canvas.layout` are not offered to keys. Key liveness is event-driven (account revocation event + one timer at the key's deadline), same J90 authorizer and per-key limit/audit as the action route. Files: `websocket/key_events.rs`, small hooks in `websocket.rs`, `api_actions.rs`, `runtime.rs`. - CLI `infraternal mcp`: dual-era stdio server. `initialize` keeps the old eras (2024-11-05..2025-11-25) and adds `resources` + `resources/subscribe`. Requests with `_meta` protocolVersion 2026-07-28 are served statelessly: `server/discover`, `tools/*`, `resources/*`, `subscriptions/listen` (ack first, tagged notifications, `notifications/cancelled`, graceful completion at end), `resultType`, `ttlMs`/`cacheScope`, `-32022` with the supported list. Tools and resources are listed per the stored key's scopes. Resources: `infraternal://hosts`, `infraternal://sessions` (subscribable), `infraternal://status`. A read is the registered read action through the one action route. Event link `mcp/events.rs` is a client of the same `/v1/ws`. No new third-party dependency (the workspace's own `infraternal-protocol` crate is now a CLI dependency under `remote`; Cargo.lock edited by hand for that edge). - stdin is read by a thread so notifications can be pushed between requests; a tool call in flight is cancellable. **Evidence so far (compute01, cargo test, `CARGO_TARGET_DIR` under codex-scratch/j147)** - `cargo test -p infraternal -p infraternal-server -- mcp key_events`: 21 CLI protocol tests ok, 5 server real-socket tests ok (admission, scope-limited topics, frame allow-list, revocation closes the socket, deadline closes the socket). - `cargo test -p infraternal --test mcp_stdio`: 4 ok (process boundary, both eras, listen ack/completion at EOF). - `cargo check -p infraternal-server -p infraternal --tests --locked`: no warnings from my files. **Next:** live scenarios. Reminder of the blocker from the design comment: test.ssh.kayg.org runs a build that predates `POST /v1/actions` (405), so key-callable actions and the event socket do not exist there. I was told not to deploy, so route-dependent scenarios will run against a server built from this branch on compute01; sign-in/approval will run against the real test server.

kayg referenced this issue 2026-11-03 18:19:28 +00:00

CLI: use sign-in API keys for remote actions (D311) #303

kayg commented 2026-11-03 20:24:05 +00:00

Author

Owner

Copy link

J147 scenario run (Claude Sonnet 5.5). Server: infraternal server built from branch mcp-events-j147 head 50ca636c7 (J94d d8c8f4a04 + J125c + this work), HTTPS with a throwaway CA, on compute01 (own HOME/runtime dir). Client: the real infraternal mcp process over stdio, plus the official TypeScript SDK 2.4 and 1.32 clients and the official Inspector CLI 2.13 (installed in a temp dir, no repo dependency).

Totals: 36 pass, 0 fail, 7 blocked (blocked = the environment cannot run it; the reason is in the row).

What this is not: the keys are seeded in the local server's SQLite (owner row + api_keys rows), because the passkey approval ceremony cannot run on a local origin with the orchestrator's software authenticator (bound to test.ssh.kayg.org), and because the real test server cannot complete infraternal sign-in at all (rows R2 to R4). The ceremony itself is J94d's and J79d's.

ID	Scenario	Expected	Observed	Result
S01a	stateless client: server/discover, no handshake	supportedVersions [2026-07-28], resultType complete	{"supportedVersions": ["2026-07-28"], "resultType": "complete"}	PASS
S01b	unknown protocol version in _meta	error -32022 with data.supported	{"code": -32022, "supported": ["2026-07-28"]}	PASS
S01c	no _meta, no initialize	error -32002 not initialized	-32002	PASS
S01d	stateless tools/list carries cache hints	resultType, ttlMs, cacheScope=private	{"resultType": "complete", "ttlMs": 60000, "cacheScope": "private"}	PASS
S02-2025-11-25	handshake-era client asks for 2025-11-25	negotiates 2025-11-25; no 2026-only fields	negotiated 2025-11-25; tools=3; resources=3; leaked=[]	PASS
S02-2025-06-18	handshake-era client asks for 2025-06-18	negotiates 2025-06-18; no 2026-only fields	negotiated 2025-06-18; tools=3; resources=3; leaked=[]	PASS
S02-2025-03-26	handshake-era client asks for 2025-03-26	negotiates 2025-03-26; no 2026-only fields	negotiated 2025-03-26; tools=3; resources=3; leaked=[]	PASS
S02-2024-11-05	handshake-era client asks for 2024-11-05	negotiates 2024-11-05; no 2026-only fields	negotiated 2024-11-05; tools=3; resources=3; leaked=[]	PASS
S02-2099-01-01	handshake-era client asks for 2099-01-01	negotiates 2025-11-25; no 2026-only fields	negotiated 2025-11-25; tools=3; resources=3; leaked=[]	PASS
S03	tools and resources listed per stored key scope	status:read -> server.status only; read -> +sessions.list, remote.host.list; write (hosts:write) -> +ssh.start, +remote.host.remo…	{"status": ["server.status"], "status:resources": ["status"], "read": ["remote.host.list", "server.status", "sessions.list"], "read:resources": ["hosts", "sessions", "status"], "write": ["remote.host.list", "remote.host.remove", …	PASS
S04	read actions through tools/call and resources/read	all six succeed	{"server.status": true, "sessions.list": true, "remote.host.list": true, "read:hosts": true, "read:sessions": true, "read:status": true}	PASS
S05a	write without the scope (client-side, key file lacks hosts:write)	isError with sign-in --scope guidance	This device key does not include hosts:write. Run infraternal sign-in https://localhost:47811 --scope hosts:write and approve with your pa	PASS
S05b	write when the server never granted the scope (file claims hosts:write)	server refuses (403) with the key guidance, nothing started	Signed out: your key expired or was revoked. Run infraternal sign-in <server>.	PASS
S06	write with the scope (add-host to an unreachable address)	accepted by the route (not a scope refusal); fails on the unreachable host	Host setup failed. The SSH host could not be reached.	PASS
S07a	destructive tool is offered with an explicit dry_run	remote.host.remove listed for a hosts:write key; dry_run is required	listed=True required=['host_id', 'dry_run']	PASS
S07b	real removal without a preview	refused by the adapter before any request, with dry_run guidance	This cannot be undone. Call it with dry_run set to true first and review what it reports, then repeat the call with dry_	PASS
S07c	removal call without dry_run	-32602 (required parameter)	-32602	PASS
S07d	dry run of an unknown host fails, so it is no preview	dry run refused by the server; the real run is still refused	preview isError=True ('Signed out: your key expired or was revoked. Run `infraterna'); real isError=True	PASS
S07e	the route itself: scope decides	write key reaches the handler (unknown host -> 403 from the handler); read key -> 403 scope	write key status=403, read key status=403	PASS
S08-bad	refusal: bad key	tool isError + resources/read error -32603, both with infraternal sign-in guidance, no key in text	'Signed out: your key expired or was revoked. Run infraternal sign-in <server>.'; read error=-32603	PASS
S08-revoked	refusal: revoked key	tool isError + resources/read error -32603, both with infraternal sign-in guidance, no key in text	'Signed out: your key expired or was revoked. Run infraternal sign-in <server>.'; read error=-32603	PASS
S08-expired	refusal: expired key	tool isError + resources/read error -32603, both with infraternal sign-in guidance, no key in text	'Signed out: your key expired or was revoked. Run infraternal sign-in <server>.'; read error=-32603	PASS
S08-unsigned	refusal: not signed in	tool isError + resources/read error -32603, both with infraternal sign-in guidance, no key in text	'This device is not signed in to that server. Run infraternal sign-in <server> and approve with your passkey.'; read error=-32603	PASS
S09	per-key rate limit	about 30 succeed, the rest are refused with the wait-and-retry text	ok=30 limited=10 other=0	PASS
S10a	subscriptions/listen acknowledgement	first message, subscriptionId = request id, only hosts + sessions honoured	{"id": {"io.modelcontextprotocol/subscriptionId": 1}, "granted": ["infraternal://hosts", "infraternal://sessions"]}	PASS
S10b	initial notification after the server confirms each subscription	one updated per subscribed URI, tagged with the subscription id	["infraternal://hosts", "infraternal://sessions"] stderr=[]	PASS
S10c	a real terminal session starts -> sessions resource changes	updated for infraternal://sessions, tagged	none within 20 s (open reply: b'\x0091\x07\x00\x00\x00\x00{"error":"terminal unavailable","reason":"invalid"}') [blocked: this host cannot start a terminal for a person login (needs a root-run agent), so no session can start to c…	BLOCKED
S10d	re-reading the resource shows the new session	sessions.list now has one session	{"sessions": []} [blocked: this host cannot start a terminal for a person login (needs a root-run agent), so no session can start to cause the change]	BLOCKED
S10e	client cancels the stream -> no more notifications	none after notifications/cancelled	notes_before=0 silent=True	PASS
S10f	end of input	exit 0, no output after cancel	exit=0	PASS
S11	handshake-era client: resources/subscribe then a real session start	initial + change, untagged uri only	subscribe={}; first={'uri': 'infraternal://sessions'}; change=None [blocked: this host cannot start a terminal for a person login (needs a root-run agent), so no session can start to cause the change]	BLOCKED
S12	server restart while subscribed: reconnect + resubscribe	adapter reconnects on its own and sends updated (resync) without client action; stderr says the link was lost	updated_after_restart=True; link_lost_logged=True	PASS
S13	key revoked from the app while subscribed	revoke accepted (200); no further notifications; reads are refused	revoke_status=200; notifications_after_revoke=0	PASS
S13b	the revoked key's next call	refused with guidance	Signed out: your key expired or was revoked. Run infraternal sign-in <server>.	PASS
S14	subscription the server key may not hold	server refuses in-band; the adapter reports it on stderr and sends no update	ack=True; refused_logged=True; updates=0	PASS
C1	official TypeScript SDK v2 client (2026-07-28): connect with version negotiation auto, li…	modern era detected; tools/resources listed; read and call succeed; listen honours hosts+sessions; an updated arrives when a sess…	{"steps": {"tools": "ok", "resources": "ok", "read_status": "ok", "call_ok": "ok", "honored": "ok", "closed": "ok"}, "era": "modern", "server": "infraternal", "tools": ["remote.host.list", "server.status", "sessions.list"], "reso…	PASS
C2	official TypeScript SDK v1.32 client (initialize handshake): list, read, call, subscribeR…	works unchanged; updated arrives when a session starts	{"server": "infraternal", "capabilities": {"resources": {"subscribe": true}, "tools": {}}, "tools": ["remote.host.list", "server.status", "sessions.list"], "resources": ["infraternal://hosts", "infraternal://sessions", "infratern…	PASS
C3	official MCP Inspector CLI (2.13) against the adapter	tools/list, resources/list, resources/read, tools/call exit 0	{"tools/list": [0, "{ "tools": [ { "name": "server.status", "description"], "resources/list": [0, "{ "resources": [ { "name": "hosts", "title": "Machin"], "resources/read": [0, …	PASS
R1	real test server: health	200	200	PASS
R2	real test server: bearer action route	present (401/403/404/429), not 405	POST /v1/actions/remote.host.list -> 405 [blocked: the deployed build predates POST /v1/actions (J94d, #303); a deploy of the stacked branch is needed]	BLOCKED
R3	real test server: sign-in scopes the CLI requests	sessions:read, status:read, hosts:write accepted (CLI always requests the three read scopes)	{"hosts:read": 200, "sessions:read": 400, "status:read": 400, "hosts:write": 400, "terminal:connect": 200, "actions:dry-run": 200} [blocked: the deployed build accepts only hosts:read, terminal:connect and actions:dry-run, so `in…	BLOCKED
R4	real test server: infraternal sign-in with the stacked CLI	starts an approval and prints the link	exit=1: The server returned a response this command could not use. [blocked: the deployed build rejects the CLI's scope list (R3)]	BLOCKED
R5	real test server: key on the event socket	a bad key is refused before the upgrade (403)	GET /v1/ws with a bearer -> 400 [blocked: the deployed build admits only the browser cookie there]	BLOCKED

BLOCKED rows, in plain words

• S10c, S10d, S11: the test host runs the server as a non-root account; starting a terminal needs a per-person login, which the agent refuses (terminal unavailable, reason invalid). So no real session could start to cause a change on this host. What is covered instead: the first notification after each subscribe on the live server (S10b, C1, C2), the resync after a server restart (S12), and the Rust test a_session_inventory_change_is_pushed_to_a_subscribed_key_socket that bumps the same signal the server bumps when a session starts or ends.
• R2 to R5: test.ssh.kayg.org runs a build that predates J94d's route. POST /v1/actions/... answers 405; /auth/device-start accepts only hosts:read, terminal:connect, actions:dry-run (the CLI always asks for sessions:read and status:read, so it gets 400 and prints "The server returned a response this command could not use"). Sign-in, key-callable actions and the event socket therefore cannot be exercised there until the stacked branch is deployed. I did not deploy (task rule).

Things the run found that are fixed in the branch

1. ssh.start (add-host) through a key could never open its stream: hand-built WebSocket request without the handshake headers (comment 77118 on #303; fixed in commit 6dff335bd).
2. The official v2 client rejected resources/read results without ttlMs/cacheScope (2026-07-28); fixed.
3. A script that wrote requests and closed stdin lost the answers of calls in flight; fixed, with a regression test.
4. Host removal had vanished from MCP under D333; it is back with a required dry_run and a preview-first rule (D28).

Found in J94d's code, not changed here: a remote.host.remove dry run for an unknown host returns 403, which the CLI renders as "Signed out: your key expired or was revoked" (S07d). A valid key gets told it is signed out; the server should answer 404 or 400 for a host it does not know, or the CLI should not map every 403 to the key diagnostic.

Driver and raw results are attached to this comment (j147_scenarios.txt is a Python 3 script, standard library only; run with INFRATERNAL_BIN=<binary> J147_REAL=1 J147_CONF=<dir with the SDK clients> python3 j147_scenarios.txt).

J147 scenario run (Claude Sonnet 5.5). Server: `infraternal server` built from branch `mcp-events-j147` head `50ca636c7` (J94d `d8c8f4a04` + J125c + this work), HTTPS with a throwaway CA, on compute01 (own HOME/runtime dir). Client: the real `infraternal mcp` process over stdio, plus the official TypeScript SDK 2.4 and 1.32 clients and the official Inspector CLI 2.13 (installed in a temp dir, no repo dependency). **Totals: 36 pass, 0 fail, 7 blocked** (blocked = the environment cannot run it; the reason is in the row). **What this is not:** the keys are seeded in the local server's SQLite (owner row + `api_keys` rows), because the passkey approval ceremony cannot run on a local origin with the orchestrator's software authenticator (bound to test.ssh.kayg.org), and because the real test server cannot complete `infraternal sign-in` at all (rows R2 to R4). The ceremony itself is J94d's and J79d's. | ID | Scenario | Expected | Observed | Result | |---|---|---|---|---| | S01a | stateless client: server/discover, no handshake | supportedVersions [2026-07-28], resultType complete | {"supportedVersions": ["2026-07-28"], "resultType": "complete"} | PASS | | S01b | unknown protocol version in _meta | error -32022 with data.supported | {"code": -32022, "supported": ["2026-07-28"]} | PASS | | S01c | no _meta, no initialize | error -32002 not initialized | -32002 | PASS | | S01d | stateless tools/list carries cache hints | resultType, ttlMs, cacheScope=private | {"resultType": "complete", "ttlMs": 60000, "cacheScope": "private"} | PASS | | S02-2025-11-25 | handshake-era client asks for 2025-11-25 | negotiates 2025-11-25; no 2026-only fields | negotiated 2025-11-25; tools=3; resources=3; leaked=[] | PASS | | S02-2025-06-18 | handshake-era client asks for 2025-06-18 | negotiates 2025-06-18; no 2026-only fields | negotiated 2025-06-18; tools=3; resources=3; leaked=[] | PASS | | S02-2025-03-26 | handshake-era client asks for 2025-03-26 | negotiates 2025-03-26; no 2026-only fields | negotiated 2025-03-26; tools=3; resources=3; leaked=[] | PASS | | S02-2024-11-05 | handshake-era client asks for 2024-11-05 | negotiates 2024-11-05; no 2026-only fields | negotiated 2024-11-05; tools=3; resources=3; leaked=[] | PASS | | S02-2099-01-01 | handshake-era client asks for 2099-01-01 | negotiates 2025-11-25; no 2026-only fields | negotiated 2025-11-25; tools=3; resources=3; leaked=[] | PASS | | S03 | tools and resources listed per stored key scope | status:read -> server.status only; read -> +sessions.list, remote.host.list; write (hosts:write) -> +ssh.start, +remote.host.remo… | {"status": ["server.status"], "status:resources": ["status"], "read": ["remote.host.list", "server.status", "sessions.list"], "read:resources": ["hosts", "sessions", "status"], "write": ["remote.host.list", "remote.host.remove", … | PASS | | S04 | read actions through tools/call and resources/read | all six succeed | {"server.status": true, "sessions.list": true, "remote.host.list": true, "read:hosts": true, "read:sessions": true, "read:status": true} | PASS | | S05a | write without the scope (client-side, key file lacks hosts:write) | isError with sign-in --scope guidance | This device key does not include hosts:write. Run `infraternal sign-in https://localhost:47811 --scope hosts:write` and approve with your pa | PASS | | S05b | write when the server never granted the scope (file claims hosts:write) | server refuses (403) with the key guidance, nothing started | Signed out: your key expired or was revoked. Run `infraternal sign-in <server>`. | PASS | | S06 | write with the scope (add-host to an unreachable address) | accepted by the route (not a scope refusal); fails on the unreachable host | Host setup failed. The SSH host could not be reached. | PASS | | S07a | destructive tool is offered with an explicit dry_run | remote.host.remove listed for a hosts:write key; dry_run is required | listed=True required=['host_id', 'dry_run'] | PASS | | S07b | real removal without a preview | refused by the adapter before any request, with dry_run guidance | This cannot be undone. Call it with dry_run set to true first and review what it reports, then repeat the call with dry_ | PASS | | S07c | removal call without dry_run | -32602 (required parameter) | -32602 | PASS | | S07d | dry run of an unknown host fails, so it is no preview | dry run refused by the server; the real run is still refused | preview isError=True ('Signed out: your key expired or was revoked. Run `infraterna'); real isError=True | PASS | | S07e | the route itself: scope decides | write key reaches the handler (unknown host -> 403 from the handler); read key -> 403 scope | write key status=403, read key status=403 | PASS | | S08-bad | refusal: bad key | tool isError + resources/read error -32603, both with `infraternal sign-in` guidance, no key in text | 'Signed out: your key expired or was revoked. Run `infraternal sign-in <server>`.'; read error=-32603 | PASS | | S08-revoked | refusal: revoked key | tool isError + resources/read error -32603, both with `infraternal sign-in` guidance, no key in text | 'Signed out: your key expired or was revoked. Run `infraternal sign-in <server>`.'; read error=-32603 | PASS | | S08-expired | refusal: expired key | tool isError + resources/read error -32603, both with `infraternal sign-in` guidance, no key in text | 'Signed out: your key expired or was revoked. Run `infraternal sign-in <server>`.'; read error=-32603 | PASS | | S08-unsigned | refusal: not signed in | tool isError + resources/read error -32603, both with `infraternal sign-in` guidance, no key in text | 'This device is not signed in to that server. Run `infraternal sign-in <server>` and approve with your passkey.'; read error=-32603 | PASS | | S09 | per-key rate limit | about 30 succeed, the rest are refused with the wait-and-retry text | ok=30 limited=10 other=0 | PASS | | S10a | subscriptions/listen acknowledgement | first message, subscriptionId = request id, only hosts + sessions honoured | {"id": {"io.modelcontextprotocol/subscriptionId": 1}, "granted": ["infraternal://hosts", "infraternal://sessions"]} | PASS | | S10b | initial notification after the server confirms each subscription | one updated per subscribed URI, tagged with the subscription id | ["infraternal://hosts", "infraternal://sessions"] stderr=[] | PASS | | S10c | a real terminal session starts -> sessions resource changes | updated for infraternal://sessions, tagged | none within 20 s (open reply: b'\x0091\x07\x00\x00\x00\x00{"error":"terminal unavailable","reason":"invalid"}') [blocked: this host cannot start a terminal for a person login (needs a root-run agent), so no session can start to c… | BLOCKED | | S10d | re-reading the resource shows the new session | sessions.list now has one session | {"sessions": []} [blocked: this host cannot start a terminal for a person login (needs a root-run agent), so no session can start to cause the change] | BLOCKED | | S10e | client cancels the stream -> no more notifications | none after notifications/cancelled | notes_before=0 silent=True | PASS | | S10f | end of input | exit 0, no output after cancel | exit=0 | PASS | | S11 | handshake-era client: resources/subscribe then a real session start | initial + change, untagged `uri` only | subscribe={}; first={'uri': 'infraternal://sessions'}; change=None [blocked: this host cannot start a terminal for a person login (needs a root-run agent), so no session can start to cause the change] | BLOCKED | | S12 | server restart while subscribed: reconnect + resubscribe | adapter reconnects on its own and sends updated (resync) without client action; stderr says the link was lost | updated_after_restart=True; link_lost_logged=True | PASS | | S13 | key revoked from the app while subscribed | revoke accepted (200); no further notifications; reads are refused | revoke_status=200; notifications_after_revoke=0 | PASS | | S13b | the revoked key's next call | refused with guidance | Signed out: your key expired or was revoked. Run `infraternal sign-in <server>`. | PASS | | S14 | subscription the server key may not hold | server refuses in-band; the adapter reports it on stderr and sends no update | ack=True; refused_logged=True; updates=0 | PASS | | C1 | official TypeScript SDK v2 client (2026-07-28): connect with version negotiation auto, li… | modern era detected; tools/resources listed; read and call succeed; listen honours hosts+sessions; an updated arrives when a sess… | {"steps": {"tools": "ok", "resources": "ok", "read_status": "ok", "call_ok": "ok", "honored": "ok", "closed": "ok"}, "era": "modern", "server": "infraternal", "tools": ["remote.host.list", "server.status", "sessions.list"], "reso… | PASS | | C2 | official TypeScript SDK v1.32 client (initialize handshake): list, read, call, subscribeR… | works unchanged; updated arrives when a session starts | {"server": "infraternal", "capabilities": {"resources": {"subscribe": true}, "tools": {}}, "tools": ["remote.host.list", "server.status", "sessions.list"], "resources": ["infraternal://hosts", "infraternal://sessions", "infratern… | PASS | | C3 | official MCP Inspector CLI (2.13) against the adapter | tools/list, resources/list, resources/read, tools/call exit 0 | {"tools/list": [0, "{ \"tools\": [ { \"name\": \"server.status\", \"description"], "resources/list": [0, "{ \"resources\": [ { \"name\": \"hosts\", \"title\": \"Machin"], "resources/read": [0, … | PASS | | R1 | real test server: health | 200 | 200 | PASS | | R2 | real test server: bearer action route | present (401/403/404/429), not 405 | POST /v1/actions/remote.host.list -> 405 [blocked: the deployed build predates POST /v1/actions (J94d, #303); a deploy of the stacked branch is needed] | BLOCKED | | R3 | real test server: sign-in scopes the CLI requests | sessions:read, status:read, hosts:write accepted (CLI always requests the three read scopes) | {"hosts:read": 200, "sessions:read": 400, "status:read": 400, "hosts:write": 400, "terminal:connect": 200, "actions:dry-run": 200} [blocked: the deployed build accepts only hosts:read, terminal:connect and actions:dry-run, so `in… | BLOCKED | | R4 | real test server: `infraternal sign-in` with the stacked CLI | starts an approval and prints the link | exit=1: The server returned a response this command could not use. [blocked: the deployed build rejects the CLI's scope list (R3)] | BLOCKED | | R5 | real test server: key on the event socket | a bad key is refused before the upgrade (403) | GET /v1/ws with a bearer -> 400 [blocked: the deployed build admits only the browser cookie there] | BLOCKED | **BLOCKED rows, in plain words** - S10c, S10d, S11: the test host runs the server as a non-root account; starting a terminal needs a per-person login, which the agent refuses (`terminal unavailable`, reason `invalid`). So no real session could start to cause a *change* on this host. What is covered instead: the first notification after each subscribe on the live server (S10b, C1, C2), the resync after a server restart (S12), and the Rust test `a_session_inventory_change_is_pushed_to_a_subscribed_key_socket` that bumps the same signal the server bumps when a session starts or ends. - R2 to R5: **test.ssh.kayg.org runs a build that predates J94d's route.** `POST /v1/actions/...` answers 405; `/auth/device-start` accepts only `hosts:read`, `terminal:connect`, `actions:dry-run` (the CLI always asks for `sessions:read` and `status:read`, so it gets 400 and prints "The server returned a response this command could not use"). Sign-in, key-callable actions and the event socket therefore cannot be exercised there until the stacked branch is deployed. I did not deploy (task rule). **Things the run found that are fixed in the branch** 1. `ssh.start` (add-host) through a key could never open its stream: hand-built WebSocket request without the handshake headers (comment 77118 on #303; fixed in commit `6dff335bd`). 2. The official v2 client rejected `resources/read` results without `ttlMs`/`cacheScope` (2026-07-28); fixed. 3. A script that wrote requests and closed stdin lost the answers of calls in flight; fixed, with a regression test. 4. Host removal had vanished from MCP under D333; it is back with a required `dry_run` and a preview-first rule (D28). **Found in J94d's code, not changed here:** a `remote.host.remove` dry run for an unknown host returns 403, which the CLI renders as "Signed out: your key expired or was revoked" (S07d). A valid key gets told it is signed out; the server should answer 404 or 400 for a host it does not know, or the CLI should not map every 403 to the key diagnostic. Driver and raw results are attached to this comment (`j147_scenarios.txt` is a Python 3 script, standard library only; run with `INFRATERNAL_BIN=<binary> J147_REAL=1 J147_CONF=<dir with the SDK clients> python3 j147_scenarios.txt`).

j147_scenarios.txt

39 KiB

j147-results.json

14 KiB

kayg referenced this issue 2026-11-03 20:24:19 +00:00

CLI: use sign-in API keys for remote actions (D311) #303

kayg commented 2026-11-03 23:24:42 +00:00

Author

Owner

Copy link

J147 finish (Claude Sonnet 5.5). Branch mcp-events-j147, head 6b37672ae (docs only on top of 9ae746aeb, which is the gate-tested head). Stacked on J94d's final apikey-actions-303 d8c8f4a04 (rebased with git rebase --onto d8c8f4a04 842fbf1d7). Not merged, not deployed. J125c's commit is unchanged except for the conflict resolution in cli/api_actions.rs with D333 (the removal-approval flow is gone upstream).

Commits on top of d8c8f4a04

1. 9fe533787 J125c: serve registered actions over MCP stdio (conflict-resolved only)
2. 6dff335bd cli: complete the WebSocket handshake request for key streams (#303 finding 77118; droppable if J94d fixes add_host_stream themselves)
3. 3d9219d5e server: events-only profile of /v1/ws for API keys (D318)
4. 0133562ea cli: MCP resources, both protocol generations, event link
5. 50ca636c7 cli: destructive MCP tools require dry_run and a preview of the same target (D28, D333)
6. J154 review fixes, one commit each: b87937c95 P2-3 (removal maps to exactly {host_id, dry_run}, dry_run required, no default, route-shape test), 48257aa54 P3-4 (remote output under untrusted_remote_output, outside the text block), 1142e7d7e P3-5 (root kept out of MCP entirely: absent from the schema, refused if sent), abb383d36 P3-6 (additionalProperties)
7. 6ddf86d30, 92e417c82, 9ae746aeb: fmt/clippy/test-build cleanups of my own code (the first gate on this stack was red in those rows because of my code, not J94d's), 6b37672ae docs.
   Still open from the review for J94e's change: the single-use review token (#313); the mapping and the adapter's session-local preview rule change when that contract lands.

scripts/verify fast on compute01, head 9ae746aeb, verbatim

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| SSH runtime test helper   | PASS         |
| real-binary fixture paths | PASS         |
| test                      | PASS         |
| SSH inode reuse fixture   | PASS         |
| shim process-per-user     | PASS         |
| cargo-deny                | PASS         |
| gate architecture         | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+
VERIFY_EXIT=0

Scenario run on the final binary: 36 pass, 0 fail, 7 blocked (same 7 rows as in comment 77177: S10c, S10d, S11 need a real terminal session, which a non-root host cannot start; R2 to R5 are the real test server, whose deployed build predates J94d's route and scope list). Official clients: TypeScript SDK 2.4 (2026-07-28), TypeScript SDK 1.32 (handshake) and Inspector CLI 2.13 all pass.

Static size (musl release, compute01), exact, versus J94d d8c8f4a04

target	J94d d8c8f4a04	this branch	delta
x86_64	22,719,024 B	22,991,664 B	+272,640 B (+1.2%)
aarch64	20,701,320 B	20,927,672 B	+226,352 B (+1.1%)
This includes J125c's MCP adapter (about +69 KB x86 on its own base); no third-party dependency was added (infraternal-protocol is the workspace's own crate).

Cleaned up: target dirs, scenario run dirs, SDK node_modules, the VM base worktree and all test servers are gone. Kept: ~/worktrees/j147 (no target), logs under ~/.cache/codex-scratch/j147/, the driver script (attached to comment 77177).

J147 finish (Claude Sonnet 5.5). Branch `mcp-events-j147`, head `6b37672ae` (docs only on top of `9ae746aeb`, which is the gate-tested head). Stacked on J94d's final `apikey-actions-303` `d8c8f4a04` (rebased with `git rebase --onto d8c8f4a04 842fbf1d7`). Not merged, not deployed. J125c's commit is unchanged except for the conflict resolution in `cli/api_actions.rs` with D333 (the removal-approval flow is gone upstream). **Commits on top of d8c8f4a04** 1. `9fe533787` J125c: serve registered actions over MCP stdio (conflict-resolved only) 2. `6dff335bd` cli: complete the WebSocket handshake request for key streams (#303 finding 77118; droppable if J94d fixes `add_host_stream` themselves) 3. `3d9219d5e` server: events-only profile of `/v1/ws` for API keys (D318) 4. `0133562ea` cli: MCP resources, both protocol generations, event link 5. `50ca636c7` cli: destructive MCP tools require `dry_run` and a preview of the same target (D28, D333) 6. J154 review fixes, one commit each: `b87937c95` P2-3 (removal maps to exactly `{host_id, dry_run}`, `dry_run` required, no default, route-shape test), `48257aa54` P3-4 (remote output under `untrusted_remote_output`, outside the text block), `1142e7d7e` P3-5 (`root` kept out of MCP entirely: absent from the schema, refused if sent), `abb383d36` P3-6 (`additionalProperties`) 7. `6ddf86d30`, `92e417c82`, `9ae746aeb`: fmt/clippy/test-build cleanups of my own code (the first gate on this stack was red in those rows because of my code, not J94d's), `6b37672ae` docs. Still open from the review for J94e's change: the single-use review token (#313); the mapping and the adapter's session-local preview rule change when that contract lands. **`scripts/verify fast` on compute01, head `9ae746aeb`, verbatim** ``` +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | SSH runtime test helper | PASS | | real-binary fixture paths | PASS | | test | PASS | | SSH inode reuse fixture | PASS | | shim process-per-user | PASS | | cargo-deny | PASS | | gate architecture | PASS | | static builds | PASS | +---------------------------+--------------+ VERIFY_EXIT=0 ``` **Scenario run on the final binary:** 36 pass, 0 fail, 7 blocked (same 7 rows as in comment 77177: S10c, S10d, S11 need a real terminal session, which a non-root host cannot start; R2 to R5 are the real test server, whose deployed build predates J94d's route and scope list). Official clients: TypeScript SDK 2.4 (2026-07-28), TypeScript SDK 1.32 (handshake) and Inspector CLI 2.13 all pass. **Static size (musl release, compute01), exact, versus J94d `d8c8f4a04`** | target | J94d d8c8f4a04 | this branch | delta | |---|---|---|---| | x86_64 | 22,719,024 B | 22,991,664 B | +272,640 B (+1.2%) | | aarch64 | 20,701,320 B | 20,927,672 B | +226,352 B (+1.1%) | This includes J125c's MCP adapter (about +69 KB x86 on its own base); no third-party dependency was added (`infraternal-protocol` is the workspace's own crate). **Cleaned up:** target dirs, scenario run dirs, SDK `node_modules`, the VM base worktree and all test servers are gone. Kept: `~/worktrees/j147` (no target), logs under `~/.cache/codex-scratch/j147/`, the driver script (attached to comment 77177).

kayg referenced this issue 2026-11-04 03:40:30 +00:00

CLI: use sign-in API keys for remote actions (D311) #303

kayg commented 2026-11-04 04:19:41 +00:00

Author

Owner

Copy link

J94f (#303, D336) → J147: apikey-actions-303 moved past 3900a11c5. Head is now 7b781b33a, and more commits may follow (fmt/clippy folds, then the gate). I will post the final gated head here and on #303. Please rebase the MCP stack onto that one.

What changed (auth only, no MCP files touched): a per-action passkey tap is now bound to one action (login-start {action} → sessions.tap_action, migration 0048, spent once within 120 s). Files: crates/infraternal-server/src/auth/{action_tap,devices,security_settings,recovery_rotation,sessions,webauthn,http,mod}.rs, tests, contracts/{keywrap,plugin}.md, apps/tracer/src/{auth,device-approval.on-demand,recovery-auth}.ts. remote_migration_tests.rs now expects 0043..0048. If your branch adds a migration, it needs 0049+. The key-callable action set, /v1/actions and the API key paths are unchanged.

J94f (#303, D336) → J147: `apikey-actions-303` moved past `3900a11c5`. Head is now `7b781b33a`, and more commits may follow (fmt/clippy folds, then the gate). I will post the final gated head here and on #303. Please rebase the MCP stack onto that one. What changed (auth only, no MCP files touched): a per-action passkey tap is now bound to one action (`login-start {action}` → `sessions.tap_action`, migration **0048**, spent once within 120 s). Files: `crates/infraternal-server/src/auth/{action_tap,devices,security_settings,recovery_rotation,sessions,webauthn,http,mod}.rs`, tests, `contracts/{keywrap,plugin}.md`, `apps/tracer/src/{auth,device-approval.on-demand,recovery-auth}.ts`. `remote_migration_tests.rs` now expects 0043..0048. If your branch adds a migration, it needs 0049+. The key-callable action set, `/v1/actions` and the API key paths are unchanged.

kayg commented 2026-11-04 04:27:43 +00:00

Author

Owner

Copy link

J147: request to deploy the rebased stack to test.ssh.kayg.org. Branch mcp-events-j147, head b9f970e89d1c655316fd27592022616fa6f0b356 = J94e's 3900a11c5 + J125c's MCP commit + my commits (events-only key socket on /v1/ws, MCP resources and both protocol generations, the J154 fixes, and the server's review token carried by the MCP removal tool in place of my session-local rule). Not merged. Please deploy this head; I then run the blocked scenarios R2 to R5 and S10c, S10d, S11 against it with keys approved through infraternal sign-in and the software passkey, and post the table here. I am watching the server (POST /v1/actions/... stops answering 405) and will start on my own when it changes.

Rebase: git rebase --onto 3900a11c5 d8c8f4a04. Conflicts were only in cli/api_actions.rs (J125c's commit against J94e's CLI removal flow). Result there: a person's hosts remove keeps J94e's review, confirm, remove flow; MCP calls the route's two steps directly (dry_run true returns review_token and review_expires_in in structuredContent; the real call passes the token back; the server's review_required / review_invalid text is the tool error). yes and root are not offered to an AI client. My session-local "preview first" code is deleted. A test checks the token passes through unchanged and that nothing in the adapter holds a real call back.

scripts/verify fast on compute01 at this head, verbatim

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| SSH runtime test helper   | PASS         |
| real-binary fixture paths | PASS         |
| test                      | PASS         |
| SSH inode reuse fixture   | PASS         |
| shim process-per-user     | PASS         |
| cargo-deny                | PASS         |
| gate architecture         | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+
VERIFY_EXIT=0

Notes on the gate: (1) The first full run at this head failed test on ten_concurrent_streams_deliver_their_first_keyframe_through_the_server_relay (desktop plugin, code this stack does not touch); it passed 5 of 5 alone with its features, host load average was 26 to 36, and the second full run is the green one above, so I treat it as a load flake. (2) scripts/verify quick does not finish on this stack. Because the stack changes Cargo.lock, quick picks --workspace scope, and cargo test --workspace --lib --bins then runs the fuzz crate's binaries as unit tests: the libFuzzer binary auth_cookie ran unbounded for 50 minutes until I stopped it. fmt and clippy (the first two quick stages) passed in that run. A bounded run (-runs=N) or leaving the fuzz crate out of quick's test scope fixes it; I did not touch scripts/verify.d/quick.sh.

Static size at this head (musl release, compute01): x86_64 23,020,976 B, aarch64 20,951,224 B. Against J94d's d8c8f4a04 (22,719,024 and 20,701,320 B) that is +301,952 B and +249,904 B; J94e's own part of the change is included in both numbers, so the MCP and event part is the smaller share.

**J147: request to deploy the rebased stack to test.ssh.kayg.org.** Branch `mcp-events-j147`, head **`b9f970e89d1c655316fd27592022616fa6f0b356`** = J94e's `3900a11c5` + J125c's MCP commit + my commits (events-only key socket on `/v1/ws`, MCP resources and both protocol generations, the J154 fixes, and the server's review token carried by the MCP removal tool in place of my session-local rule). Not merged. Please deploy this head; I then run the blocked scenarios R2 to R5 and S10c, S10d, S11 against it with keys approved through `infraternal sign-in` and the software passkey, and post the table here. I am watching the server (`POST /v1/actions/...` stops answering 405) and will start on my own when it changes. **Rebase:** `git rebase --onto 3900a11c5 d8c8f4a04`. Conflicts were only in `cli/api_actions.rs` (J125c's commit against J94e's CLI removal flow). Result there: a person's `hosts remove` keeps J94e's review, confirm, remove flow; MCP calls the route's two steps directly (`dry_run` true returns `review_token` and `review_expires_in` in `structuredContent`; the real call passes the token back; the server's `review_required` / `review_invalid` text is the tool error). `yes` and `root` are not offered to an AI client. My session-local "preview first" code is deleted. A test checks the token passes through unchanged and that nothing in the adapter holds a real call back. **`scripts/verify fast` on compute01 at this head, verbatim** ``` +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | SSH runtime test helper | PASS | | real-binary fixture paths | PASS | | test | PASS | | SSH inode reuse fixture | PASS | | shim process-per-user | PASS | | cargo-deny | PASS | | gate architecture | PASS | | static builds | PASS | +---------------------------+--------------+ VERIFY_EXIT=0 ``` Notes on the gate: (1) The first full run at this head failed `test` on `ten_concurrent_streams_deliver_their_first_keyframe_through_the_server_relay` (desktop plugin, code this stack does not touch); it passed 5 of 5 alone with its features, host load average was 26 to 36, and the second full run is the green one above, so I treat it as a load flake. (2) **`scripts/verify quick` does not finish on this stack.** Because the stack changes `Cargo.lock`, quick picks `--workspace` scope, and `cargo test --workspace --lib --bins` then runs the `fuzz` crate's binaries as unit tests: the libFuzzer binary `auth_cookie` ran unbounded for 50 minutes until I stopped it. fmt and clippy (the first two quick stages) passed in that run. A bounded run (`-runs=N`) or leaving the fuzz crate out of quick's test scope fixes it; I did not touch `scripts/verify.d/quick.sh`. Static size at this head (musl release, compute01): x86_64 23,020,976 B, aarch64 20,951,224 B. Against J94d's `d8c8f4a04` (22,719,024 and 20,701,320 B) that is +301,952 B and +249,904 B; J94e's own part of the change is included in both numbers, so the MCP and event part is the smaller share.

kayg commented 2026-11-04 04:43:31 +00:00

Author

Owner

Copy link

J147: first run against the deployed test server (keys approved through infraternal sign-in and the software passkey). CLI at b9f970e89. Totals: 11 pass, 9 fail, 2 blocked.

What the run shows about the deployed build: it is not the stack I asked for. A valid key on GET /v1/ws answers 403 Forbidden (R5: my events-only key profile is absent), and a dry run of an unknown host still answers 'Signed out: your key expired or was revoked' (J94e's 404 fix 3900a11c5 is absent). Everything that depends only on J94's route and scopes works, with real keys: sign-in with the 24 h approval page (E1a, E1b), tool listing per scope (E2), reads (E3), write with and without scope (E4), a key revoked from the app (E6b), the rate limit (E7), and the official Inspector (E10-C3). The subscription tests fail because the server side of the one event route is not there: the adapter's subscriptions/listen is acknowledged, but no event ever arrives (E9a, E10-C1, E10-C2).

Two things I need:

1. Deploy my head, not an older J94 build. mcp-events-j147 @ b9f970e89d1c655316fd27592022616fa6f0b356 (it contains J94e's 3900a11c5). J94f says apikey-actions-303 has moved to 7b781b33a and will move again; when J94f posts the final gated head I rebase and give you the new SHA. If you would rather deploy now, b9f970e89 is gated and green.
2. Enrol one throwaway host into test.ssh.kayg.org (for example infraternal-dev-02-std). The test server runs without root and has no account matching orchestrator, so opening a terminal answers no_login (E9b: This server runs without root and has no user account matching your name). No session can start there, which keeps S10c, S10d, S11 (a real session start causing a sessions change) blocked, and there is no host to dry-run a removal against (E5b). With one enrolled host I can run all of them, and the removal dry run only previews: I will not remove a host unless you say so.

Notes: the browser helper hits the server's sign-in rate limit when two passkey sign-ins run within a minute ('Too many attempts. Wait a minute'), so my runs space them 75 s apart. My helper scripts and the results file are attached.

ID	Scenario	Expected	Observed	Result
E1a	infraternal sign-in on the real test server, default scopes, approved with th…	completes; credential stored	approve rc=0; cli rc=0; PAGE_FACTS ["Valid for","24 hours","hosts:read","sessions:read","status:read"]	PASS
E1b	sign-in with hosts:write (+ actions:dry-run)	completes; credential stored	approve rc=0; cli rc=0; PAGE_FACTS ["Valid for","24 hours","hosts:read","sessions:read","status:read","hosts:write","actions:dry-run"]	PASS
R5	real test server: a key on the event socket	101 Switching Protocols	HTTP/1.1 403 Forbidden	FAIL
R2	real test server: a key calls an action through POST /v1/actions	server.status succeeds	{"schema_version":1,"command":"status","ok":true,"state":"ready","message":"The server status was re	PASS
E2	tool listing per key scope (real keys)	read key: no ssh.start, no remote.host.remove; write key: both	{"read": ["remote.host.list", "server.status", "sessions.list"], "write": ["remote.host.list", "remote.host.remove", "server.status", "sessions.list", "ssh.start"]}	PASS
E3	read actions and resources with a real key	all succeed	{"server.status": true, "sessions.list": true, "remote.host.list": true, "read:hosts": true, "read:sessions": true, "read:status": true}	PASS
E4a	write without hosts:write	refused with sign-in --scope guidance	This device key does not include hosts:write. Run infraternal sign-in https://test.ssh.kayg.org --scope hosts:write and approve with your	PASS
E4b	write with hosts:write (add-host to an unreachable address; nothing is installe…	route accepted; setup fails on the unreachable host	Host setup failed.	PASS
E5a	dry run of an unknown host	a plain not-found, not a 'signed out' message (J94e 404)	Signed out: your key expired or was revoked. Run infraternal sign-in <server>.	FAIL
E5b	dry run of a real host	needs a host in the inventory	the test server has no hosts to review [blocked: no enrolled host on the test server; the token flow is covered by J94e's route tests and the adapter test]	BLOCKED
E6a	refusal: bad key	isError with sign-in guidance	Signed out: your key expired or was revoked. Run infraternal sign-in <server>.	PASS
E6b	refusal: a key revoked from the app (fresh passkey sign-in)	worked before; after revoke 'Signed out' guidance	before ok=True; REVOKE_STATUS 200; after: Signed out: your key expired or was revoked. Run infraternal sign-in <server>.	PASS
E6c	refusal: expired key	needs a key whose lifetime ended; the shortest approved lifetime is 1 h	not run on the test server [blocked: keys cannot be made to expire quickly on a real server; covered locally (S08-expired)]	BLOCKED
E7	per-key rate limit on the real server	about 30 succeed, the rest are refused	ok=30 limited=10 other=0	PASS
E8	older client protocol versions calling a real server	each negotiates its version and calls succeed	{"2025-11-25": ["2025-11-25", false], "2025-03-26": ["2025-03-26", false], "2024-11-05": ["2024-11-05", false]}	FAIL
E9a	event subscription on the real server: acknowledgement + initial notifications	ack, then one updated per resource	{"ack": true, "initial": []}	FAIL
E9b	a real terminal session starts -> sessions notification (was S10c)	updated for infraternal://sessions	none (session helper said b'SESSION refused: :1{"error":"terminal unavailable","reason":"no_login"}\n')	FAIL
E9c	re-reading the sessions resource afterwards (was S10d)	shows the new session	"{"sessions":[]}"	FAIL
E9d	handshake-era client: subscribe then a real session start (was S11)	initial + change, untagged	subscribe={}; first=False; change=False	FAIL
E10-C1	official TypeScript SDK v2 client (2026-07-28): connect with version negotiatio…	modern era detected; tools/resources listed; read and call succeed; listen honours hosts+sessions; …	{"steps": {"tools": "ok", "resources": "ok", "read_status": "ok", "call_ok": "ok", "honored": "ok", "closed": "ok"}, "era": "modern", "server": "infraternal", "tools": […	FAIL
E10-C2	official TypeScript SDK v1.32 client (initialize handshake): list, read, call, …	works unchanged; updated arrives when a session starts	{"server": "infraternal", "capabilities": {"resources": {"subscribe": true}, "tools": {}}, "tools": ["remote.host.list", "server.status", "sessions.list"], "resources": …	FAIL
E10-C3	official MCP Inspector CLI (2.13) against the adapter	tools/list, resources/list, resources/read, tools/call exit 0	{"tools/list": [0, "{ "tools": [ { "name": "server.status", "description"], "resources/list": [0, "{ "resources": [ { "name": "…	PASS

**J147: first run against the deployed test server (keys approved through `infraternal sign-in` and the software passkey).** CLI at `b9f970e89`. Totals: 11 pass, 9 fail, 2 blocked. **What the run shows about the deployed build:** it is **not** the stack I asked for. A valid key on `GET /v1/ws` answers `403 Forbidden` (R5: my events-only key profile is absent), and a dry run of an unknown host still answers 'Signed out: your key expired or was revoked' (J94e's 404 fix `3900a11c5` is absent). Everything that depends only on J94's route and scopes works, with real keys: sign-in with the 24 h approval page (E1a, E1b), tool listing per scope (E2), reads (E3), write with and without scope (E4), a key revoked from the app (E6b), the rate limit (E7), and the official Inspector (E10-C3). The subscription tests fail because the server side of the one event route is not there: the adapter's `subscriptions/listen` is acknowledged, but no event ever arrives (E9a, E10-C1, E10-C2). **Two things I need:** 1. **Deploy my head, not an older J94 build.** `mcp-events-j147` @ `b9f970e89d1c655316fd27592022616fa6f0b356` (it contains J94e's `3900a11c5`). J94f says `apikey-actions-303` has moved to `7b781b33a` and will move again; when J94f posts the final gated head I rebase and give you the new SHA. If you would rather deploy now, `b9f970e89` is gated and green. 2. **Enrol one throwaway host into test.ssh.kayg.org** (for example `infraternal-dev-02-std`). The test server runs without root and has no account matching `orchestrator`, so opening a terminal answers `no_login` (E9b: `This server runs without root and has no user account matching your name`). No session can start there, which keeps S10c, S10d, S11 (a real session start causing a `sessions` change) blocked, and there is no host to dry-run a removal against (E5b). With one enrolled host I can run all of them, and the removal dry run only previews: I will not remove a host unless you say so. Notes: the browser helper hits the server's sign-in rate limit when two passkey sign-ins run within a minute ('Too many attempts. Wait a minute'), so my runs space them 75 s apart. My helper scripts and the results file are attached. | ID | Scenario | Expected | Observed | Result | |---|---|---|---|---| | E1a | `infraternal sign-in` on the real test server, default scopes, approved with th… | completes; credential stored | approve rc=0; cli rc=0; PAGE_FACTS ["Valid for","24 hours","hosts:read","sessions:read","status:read"] | PASS | | E1b | sign-in with hosts:write (+ actions:dry-run) | completes; credential stored | approve rc=0; cli rc=0; PAGE_FACTS ["Valid for","24 hours","hosts:read","sessions:read","status:read","hosts:write","actions:dry-run"] | PASS | | R5 | real test server: a key on the event socket | 101 Switching Protocols | HTTP/1.1 403 Forbidden | FAIL | | R2 | real test server: a key calls an action through POST /v1/actions | server.status succeeds | {"schema_version":1,"command":"status","ok":true,"state":"ready","message":"The server status was re | PASS | | E2 | tool listing per key scope (real keys) | read key: no ssh.start, no remote.host.remove; write key: both | {"read": ["remote.host.list", "server.status", "sessions.list"], "write": ["remote.host.list", "remote.host.remove", "server.status", "sessions.list", "ssh.start"]} | PASS | | E3 | read actions and resources with a real key | all succeed | {"server.status": true, "sessions.list": true, "remote.host.list": true, "read:hosts": true, "read:sessions": true, "read:status": true} | PASS | | E4a | write without hosts:write | refused with sign-in --scope guidance | This device key does not include hosts:write. Run `infraternal sign-in https://test.ssh.kayg.org --scope hosts:write` and approve with your | PASS | | E4b | write with hosts:write (add-host to an unreachable address; nothing is installe… | route accepted; setup fails on the unreachable host | Host setup failed. | PASS | | E5a | dry run of an unknown host | a plain not-found, not a 'signed out' message (J94e 404) | Signed out: your key expired or was revoked. Run `infraternal sign-in <server>`. | FAIL | | E5b | dry run of a real host | needs a host in the inventory | the test server has no hosts to review [blocked: no enrolled host on the test server; the token flow is covered by J94e's route tests and the adapter test] | BLOCKED | | E6a | refusal: bad key | isError with sign-in guidance | Signed out: your key expired or was revoked. Run `infraternal sign-in <server>`. | PASS | | E6b | refusal: a key revoked from the app (fresh passkey sign-in) | worked before; after revoke 'Signed out' guidance | before ok=True; REVOKE_STATUS 200; after: Signed out: your key expired or was revoked. Run `infraternal sign-in <server>`. | PASS | | E6c | refusal: expired key | needs a key whose lifetime ended; the shortest approved lifetime is 1 h | not run on the test server [blocked: keys cannot be made to expire quickly on a real server; covered locally (S08-expired)] | BLOCKED | | E7 | per-key rate limit on the real server | about 30 succeed, the rest are refused | ok=30 limited=10 other=0 | PASS | | E8 | older client protocol versions calling a real server | each negotiates its version and calls succeed | {"2025-11-25": ["2025-11-25", false], "2025-03-26": ["2025-03-26", false], "2024-11-05": ["2024-11-05", false]} | FAIL | | E9a | event subscription on the real server: acknowledgement + initial notifications | ack, then one updated per resource | {"ack": true, "initial": []} | FAIL | | E9b | a real terminal session starts -> sessions notification (was S10c) | updated for infraternal://sessions | none (session helper said b'SESSION refused: :1{"error":"terminal unavailable","reason":"no_login"}\n') | FAIL | | E9c | re-reading the sessions resource afterwards (was S10d) | shows the new session | "{\"sessions\":[]}" | FAIL | | E9d | handshake-era client: subscribe then a real session start (was S11) | initial + change, untagged | subscribe={}; first=False; change=False | FAIL | | E10-C1 | official TypeScript SDK v2 client (2026-07-28): connect with version negotiatio… | modern era detected; tools/resources listed; read and call succeed; listen honours hosts+sessions; … | {"steps": {"tools": "ok", "resources": "ok", "read_status": "ok", "call_ok": "ok", "honored": "ok", "closed": "ok"}, "era": "modern", "server": "infraternal", "tools": [… | FAIL | | E10-C2 | official TypeScript SDK v1.32 client (initialize handshake): list, read, call, … | works unchanged; updated arrives when a session starts | {"server": "infraternal", "capabilities": {"resources": {"subscribe": true}, "tools": {}}, "tools": ["remote.host.list", "server.status", "sessions.list"], "resources": … | FAIL | | E10-C3 | official MCP Inspector CLI (2.13) against the adapter | tools/list, resources/list, resources/read, tools/call exit 0 | {"tools/list": [0, "{ \"tools\": [ { \"name\": \"server.status\", \"description"], "resources/list": [0, "{ \"resources\": [ { \"name\": \"… | PASS |

j147_real_e2e.txt

16 KiB

j147-real2.json

7.3 KiB

approve-write.png

198 KiB

kayg referenced this issue 2026-11-04 07:29:45 +00:00

CLI: use sign-in API keys for remote actions (D311) #303

kayg commented 2026-11-04 07:29:46 +00:00

Author

Owner

Copy link

J94f → J147: final gated head of apikey-actions-303 is 21d4f71c9 (verify fast VERIFY_EXIT=0 on compute01, #303). Please rebase the MCP stack onto it. Still no MCP files touched; migration 0048 is taken.

J94f → J147: final gated head of `apikey-actions-303` is **`21d4f71c9`** (`verify fast` VERIFY_EXIT=0 on compute01, #303). Please rebase the MCP stack onto it. Still no MCP files touched; migration 0048 is taken.

kayg commented 2026-11-04 12:21:42 +00:00

Author

Owner

Copy link

J94f → J147: apikey-actions-303 head moved to e2dfbe62a, gated green on compute01 (#303). It adds one CLI-only fix (crates/infraternal/src/host_remove.rs: the removal client uses the shared remote::outbound_tls_connector). Still no MCP files touched. Please rebase onto e2dfbe62a.

J94f → J147: `apikey-actions-303` head moved to **`e2dfbe62a`**, gated green on compute01 (#303). It adds one CLI-only fix (`crates/infraternal/src/host_remove.rs`: the removal client uses the shared `remote::outbound_tls_connector`). Still no MCP files touched. Please rebase onto `e2dfbe62a`.

kayg commented 2026-11-04 12:52:47 +00:00

Author

Owner

Copy link

J94f → J147: heads-up, apikey-actions-303 will move to a merge of origin/dev 1633ffeea (merge commit 3e3e37ce8, then 00756cabf; on scratch ref j94f-merge-wip until its gate passes). Key approval is now #263's device-approve-start/finish ceremony; login-start no longer accepts {"kind":"device.approve"}. No MCP files touched. I will post the gated head here.

J94f → J147: heads-up, `apikey-actions-303` will move to a **merge of origin/dev `1633ffeea`** (merge commit `3e3e37ce8`, then `00756cabf`; on scratch ref `j94f-merge-wip` until its gate passes). Key approval is now #263's `device-approve-start/finish` ceremony; `login-start` no longer accepts `{"kind":"device.approve"}`. No MCP files touched. I will post the gated head here.

kayg commented 2026-11-04 20:54:06 +00:00

Author

Owner

Copy link

J94f → J147: apikey-actions-303 final head is 6ce528383 (dev 1633ffeea and e9f2b3ef4 merged in; verify fast VERIFY_EXIT=0 on compute01, #303). No MCP files touched. Please rebase onto 6ce528383.

J94f → J147: `apikey-actions-303` final head is **`6ce528383`** (dev `1633ffeea` and `e9f2b3ef4` merged in; `verify fast` VERIFY_EXIT=0 on compute01, #303). No MCP files touched. Please rebase onto `6ce528383`.

kayg commented 2026-11-05 10:06:21 +00:00

Author

Owner

Copy link

J94f → J147: apikey-actions-303 head is now e6d04f6ba (origin/dev a8b4ee720 merged in; verify fast VERIFY_EXIT=0 on compute01, #303 79756). No MCP files touched. Please rebase onto e6d04f6ba when you next move.

J94f → J147: `apikey-actions-303` head is now **`e6d04f6ba`** (origin/dev `a8b4ee720` merged in; `verify fast` VERIFY_EXIT=0 on compute01, #303 79756). No MCP files touched. Please rebase onto `e6d04f6ba` when you next move.

Sign in to join this conversation.

No Branch/Tag specified

Branches Tags

main

j470b-server-mesh-rejoin

mesh-compat-382

j444b-d381-key-wins-flood

j461b-macos-utun-reader-thread

j475b-remove-host-motion

fix-reconnect-new-link

j481-d380

dev

j479-mesh-soak

fix/j476-host-facts

j475-motion-pill-split

j470-mac-node-join

root-upgrade-d376

j474-review-merge

latency-targets-120hz

nightly-suite-shards

gotatun-pin-j469

macos-utun-reader-thread

fix-flood-echo-stall

wip/j416

motion-fast-ease-out

mesh-addhost-j259

takeover-close-terminals-d368

kbd-instant-followups

fix-trust-key-double-click

nightly-suite-partial-report

appwin-icons-j207

rusqlite-slice1

swipe-content-first-d374

mesh-mtu-381

addhost-instant-open

glass-contrast-d365-mock

glass-contrast-d365

signout-followups-442

fix-startup-toast-red

research-gotatun-matrix-j317

themes-sync-j304

fix-load-flakes

fix-nix-zig-patch

fix-compute01-browser-baseline

ratchet-size-baseline-419

predict-auto-d130

revoke-coverage-d367

nightly-suite-queue-timeout

nightly-browser-suite

fix-rustsec-2026-0459

fonts-ioskeley-obel

log-retention-d375

fix-kbd-no-anim-427

fix-dev-red-specs-2

takeover-proof-305-j205

wip/j410-server-pump

ui-consistency-d372

fix-osc52-clipboard

libghostty-vt-1.0

forget-retired-host-d369

j404-merge-426

fix-setup-lock-race

fix-touch-select-426

revoke-access-report-ui

fix-predictive-echo-specs

fix-selinux-agent-exec

wip/j395-checkpoint2

wip/j395

j391-review-scratch

ui-consistency-j195-deferred-rebased

fix-rustc-paths-421

decisions-wording-341

fix-install-suite-red

fix-dev-rtt-specs

fix-pending-removal-align

fix-privileged-skip

fix-install-suite-404

review-j368

mesh-dns-j254

revoke-access-report-d356b

revoke-privilege-round5

fix-removal-confirm

review-j360

gotatun-rotation-367

deps-refresh-340

review-j354

review-J351

review-j350

addhost-takeover-d359

revoke-report-items-347

revoke-end-sessions-d362

review-j348

size-mesh-ssh-346

size-trim-337

revoke-access-diff-d356

j259-pre-rebase-b06c5a6

j305-ended-at-start-spec

addhost-sudo-consent

fix-layout-real-specs-411

fix-shell-open-411

fix-console-hosts-373

fix-shell-exit

fuzz-host-name-353

fix-host-details-410

macos-filter-j197

research-gotatun-tricks

revoke-p3-j216l

stale-state-pill

revoke-followups-j216k

revoke-progress-j216e

backup/macos01-20261106/lume/j197

backup/macos01-20261106/lume/appwin-icons-j207-stash0

backup/macos01-20261106/claude/stash-0

backup/macos01-20261106/claude/stash-1

backup/macos01-20261106/claude/J80-macos-s1

backup/macos01-20261106/claude/J80

backup/macos01-20261106/claude/J80-slice1-20261102

backup/macos01-20261106/claude/J16b-appwin-on-dev

backup/macos01-20261106/claude/appwin-launch-idle-146

backup/macos01-20261106/claude/J80-s1-run

wip/j259

trust-285-p3c

runtime-lock-j216f

mesh-ssh-p3-j175

tun-proof-p3b

trust-285-p3

terminal-polish-j271

tun-proof-p3

ssh-install-flakes-j216i

fuzz-fixes-j264

trust-285-a

trust-285-b

restart-oversized-fixture-j198

backup/macos01-20261106/lume/appwin-icons-j207

restart-bound-j216h

up-preflight-p3-j198

backup/macos01-20261106/lume/j251

up-preflight-j198

wip/up-preflight-j198-j245-p2

wip/up-preflight-j198-j245-p1

agent-fsync-offloop-j196

wip/up-preflight-j198-j245

settings-offscreen-j231

wip/up-preflight-j198-j226-inspection

wip/j103f

themes-j206

wip/up-preflight-j198-j226

flakes-j216c

backup/macos01-20261106/claude/j197

flakes-j216b

backup/macos01-20261106/claude/j197-red

wip/up-preflight-j198-review

flakes-j216

backup/macos01-20261106/claude/appwin-icons-j207

engineering-j208b

appwin-mock-j209

toast-stack-j165

engineering-j208

decisions-d351

decisions-d350

decisions-d349

appearance-presets-mock-j129

decisions-d348

docs-audit-spec

doc-coverage-baseline-raise

decisions-d347

decisions-d346b

decisions-d346

j88h-profile

ui-consistency-j195-deferred

ui-consistency-j195

engineering-practices-j194

preferred-login-ui-j166

signin-pools-263-j174

macos-node-265-s1

decisions-d345

decisions-d344

proxy-cgroup-j164

verify-quick-fuzz-329

proxy-start-io-j168

timing-flakes-j163

up-263-s1

mcp-events-j147

verify-quick-fuzz-j158

proxy-p3-j159

agent-resource-j157-detect

wip/j103d-final

remote-cancel-hang-j155

proxy-traefik-281-j62d

j149-verify-quick

proxy-traefik-281-j62b

j150-drop-unnamed

wip/j79d-red-r4

wip/j103d-d332

rootless-toast-j142

wip/j103d-head

wip/j103d

j125c-mcp

macos-build-j136

backup/macos01-20261106/claude/j136

wip/j79d-red-cli

wip/j79d-red-server

j121-link-liveness

j118c-tracer-failures

wip/j79c-head

release-desktop-j131

j124c-signed-macos

wip/j79c-red-p3

wip/j79c-red-p23

wip/j79c-red-p22

merge-j128-check

perf-deferred-j128

sidebar-toggle-260

j127-shortcut-changed-dot

j125-mcp

j118-tracer-failures

j126-account-summary

settings-sections-mock-j92

j120-pinch-lock

sidebar-292

backup/macos01-20261106/claude/j120

taste-2026-11-03

row-actions-242-215

backup/macos01-20261106/claude/stash-0-untracked

backup/macos01-20261106/claude/J80-265-s1-run

backup/macos01-20261106/claude/J80-macos-s1-20261102

j112-canvas-commands

ui-no-overshoot-scroll

fix-recovery-restart

backup/macos01-20261106/claude/stash-1-untracked

taste-2026-11-02

size-baseline-ratchet

machine-cards-structure-j108

j109-boot-copy-mockups

fix-dev-red

wip/up-263-s1

j95b-settings-rows

proxy-traefik-281

j95-option-rows

docs-human-j91

docs-keys-palette

fix-flood-1013-270-j38d

mesh-ssh-s1

mesh-ssh-s0

addhost-d291-tunnel

test-stability-load

mesh-relay-220

repro-296

shim-thp-off-24

mesh-pins-258-v2

mesh-dns

signin-d311-merged

docs-pages

ui-size-283

fix-ui-batch-specs

wip/j12b-edge-update

gate-on-arm

fix-rename-sync-293

trust-285-j60b

fix-focus-ring-clip

integ-ui-1101

edge-update-v2

signin-d311

taste-2026-11-01

layout-per-tab-250

ui-approved-splitopt-224

ui-approved-splitopt-224-on-dev

icon-text-centre-282

ui-approved-189-212-216

research-reverse-proxy

transfer-budget-320

review-mesh-pins-258-r2

sidebar-pill-259

review-mesh-relay-220

wip/j12-edge-update-v2

nix-package

status-crash-loop-237

fix-dev-test-failures

fix-fixture-socket-path

wip/mesh-relay-220-pre-dev-advance-rebase

fix-canvas-side-clip

research-head-to-head

frosted-real-256

review-mesh-pins-258

wip/mesh-relay-220-pre-final-rebase

review-layout-per-tab-250-r2

broad-suite-triage

nix-devshell

review-status-crash-loop-237-r3

wip/nix-devshell-pre-p3

taste-frosted-real

wip/code-serve-demo-2026-10-30

wip/code-serve-glass-2026-10-30

wip/code-serve-clusters-2026-10-30

wip/code-merge-release94-dev-2026-10-30

wip/rproxy-delta-scratch-2026-10-30

wip/stale-note-257-staged-2026-10-30

wip/d241-size-staged-2026-10-30

review-broad-suite-207

wip/mesh-pins-258-pre-split

wip/mesh-relay-220-pre-rebase

mesh-measure-220

plan-211-update

review-edge-autoupdate-r3

perf24-reconnect

review-stale-note-r2

release-prod-live

d241-shell-marker

review-mesh-pins-server-258

review-revocation-r3

review-setup-token-r2

review-sync-journal-r3

wip/review-mesh-pins-258-prune-review-1995fee46

frosted-scroll-256

sync-journal-r3

revocation-per-account-wip

review-tokio-asyncfd-0386

review-sync-p3s

wip/stash-8by64-stash0-2026-10-30

mesh-drag-r2

setup-token-data-wip

release-9-4

auth-busy-1013

mesh-view-overlap

sync-p3s

review-auth-busy-wake

review-readd-r8-wip

mesh-drag-bounds

audit-auth-93

app-windows-stream-start

review-authority-cap-r3

app-windows-r7-measure

readd-minimal-r6

readd-minimal-r5

app-windows-r7-soak

readd-minimal-r4

app-windows-r7

app-windows-r6

readd-minimal-r3

readd-minimal-r2

readd-minimal

merge-release8-dev

review-busy-page-liveness-r2

review-busy-page-liveness

mesh-view-trim

review-authority-read-retry-r2

review-remove-uninstall-r2

release-retry-reattach

release-retry

review-remove-uninstall

review-authority-read-retry

app-windows-ship

mesh-autoswitch-p2

mesh-ssh

mesh-relay

mesh-macos-node

screen-and-control

session-labels

review-real-logins-r5

review-real-logins-r4

review-real-logins-r3

shim-memory-r2

review-real-logins-r2

shim-memory

shadow-addhost-instant

shadow-real-logins

shadow-same-session-flood

shadow-prod-perf-fix

hosts-from-server

app-windows-real

app-windows-transport

release-prod-6w

mesh-policy-verify

quiet-close-toast

dev-merge-r4

review-mesh-agent-transport

review-app-windows-transport

settings-roundtrip

review-release-pipeline-r4

mesh-agent-transport

ended-strip-fix

review-audit-ca-update-d244

settings-rows

phone-width

signout-clear

fix-restart-tests

dev-merge-rp

signer-hardening

review-audit-ca-update

terminal-fidelity

review-audit-ca-update-wip

mesh-integrate

review-mesh-agent-transport-515d3712

review-mesh-dataplane-feec1988

mesh-dataplane

signout

research-canvas-node

wip/review-renderer-cost

wip/review-terminal-fidelity

padlock-glyph

review-release-pipeline-2e95b689

phone-polish

sidebar-polish

inbox-generic

review-mesh-dataplane-378d4055

prod-batch

ui-inbox

ui-ca-unlock

ui-machine-sections

review-mesh-dataplane-a5f744fb

tls-session-prod

session-bounds-prod

fix-dead-session

session-bounds

tls-session

palette-polish

shortcuts-d222

research-appmeta

phone-gutter

ui-centre-button

wip/ui-centre-button

wip/tls-session

review-addhost-breakit

ui-platform

renderer-cost

remote-agents

mesh-api

ssh-bootstrap

prod-hotfix2

prod-fixes

review-remote-agents

review-mesh-dataplane

session-life

research-browser

review-mesh-api

research-capture

review-mesh-api-round3

review-mesh-api-round1

gate-stability

review-gate-stability

review-relay-direct

review-mesh-api-findings

proto-sessions

font-picker

proto-addhost

proto-windows

mesh-core

latency-gate

research-bsd

research-discovery

keytray-mods

mock-core

ui-tweaks

fix-motion-sel

fix-motion

integrate2

fix-robust

t-web

t-server

vt-ghostty

fix-snap-echo

t-web-auth

review-vt2

t-agent

lane-protocol

lane-shim

lane-auth

s1-base

s1-contracts

s1-workspace

No results found.

Labels

Clear labels   

launch-qa

Findings from launch QA.

No labels

launch-qa

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

kayg/infraternal#318

No description provided.