[EPIC] MCP admission, bounded context, and release-readiness trust boundary

[Joncallim]

Execution mode: tracking
VNext programme: #333
Canonical policy: docs/adr/0009-mcp-admission-contract.md
Bounded context: docs/adr/0008-filesystem-mcp-bounded-context-grants.md

Issue Type

Epic - MCP trust/release tracking. Do not dispatch this Epic directly to an implementation agent.

Context

Epic #172 established one fail-closed MCP admission and bounded-context trust model for the coding beta. Its implementation slices S1-S5 are completed and remain critical foundations under VNext; they are not throwaway Project-specific work.

Delivered behavior includes:

• one canonical capability/admission classifier used across planning/preview/approval/handoff;
• planning-only vs bounded read-only vs deferred/blocked live-MCP semantics;
• explicit filesystem grant/denial/revocation/reapproval recovery;
• privacy-preserving bounded context packet/run evidence;
• protected Architect plan/session/evidence boundaries;
• typed operator recovery/presentation surfaces;
• append-only signed release/evidence/transition state and strict lock/lease/fencing contracts;
• no live unrestricted MCP tool handles or credentials granted to workers.

S6 repository-side regression/controller scaffolding is also largely present. The remaining release-grade trust work is now tracked by #181/#357 rather than by reopening the entire Epic.

Desired Outcome

VNext reuses MCP admission/bounded-context/recovery/evidence as a stricter protected subsystem behind generic Resource/Capability/Grant/Operation contracts. No generic layer may bypass or silently weaken these decisions, and future live MCP/tool capabilities require the #336/#342 confinement/adapter security model rather than prompt policy.

Tasks

• S1 / [FEATURE] S1 — Unified MCP admission contract and capability taxonomy #176 — canonical MCP admission contract/capability classification.
• S2 / [FEATURE] S2 — Consolidate MCP admission onto the shared core and enforce it at approval #177 — shared admission core across preview/approval/handoff/filesystem projection.
• Step 0 + S3/S4/S5 / [FEATURE] S3 — Deterministic bounded filesystem context grant/denial recovery #178-[FEATURE] S5 — Unified operator UI copy and recovery-action contract for MCP admission #180 — grant recovery, retention/evidence, bounded context, operator presentation and recovery.
• Repository-side S6 manifest/contract/PostgreSQL/operator/host-boundary scaffolding tracked by [EPIC] MCP S6 release proof and external-controller finalization #181.
• [BUG][P0][SECURITY] Enforce Forge release gates with GitHub main-branch protection/ruleset #348 — enforce external repository rules/check boundary.
• [BUG][P1][SECURITY] Pin GitHub Actions dependencies to immutable commit SHAs #352 — immutable external Action identities for required/privileged workflows.
• [OTHER][RELEASE] Complete S6 external-controller trust binding and live release evidence #357 — complete independently controlled S6 GitHub App/host/signed live release proof.
• [EPIC] MCP S6 release proof and external-controller finalization #181 — close S6 release Epic after [OTHER][RELEASE] Complete S6 external-controller trust binding and live release evidence #357 and final enabled-build receipt consumption.
• [FEATURE][ARCH] VNext Phase 0 — generic runtime contracts and compatibility seam #334/[FEATURE] VNext Phase 2 — secure generic execution envelope and side-effect recovery #336/[FEATURE] VNext Phase 8 — general Resource/Capability adapter ecosystem #342 — prove generic VNext contracts/adapters consume this trust boundary without duplicating or weakening it.

Canonical Invariants

• Planning/prompt context is not permission.
• Live MCP handles/credentials remain unavailable unless a future explicitly reviewed adapter/Capability is implemented through VNext confinement/Grant policy.
• Required bounded project filesystem context is explicit, Resource-bound, recoverable and auditable.
• Unknown/typo/unsafe capability requests fail closed; optional/deferred states remain distinguishable from broken installation.
• Preview/approval/handoff consume one canonical admission decision for a fixed policy/health snapshot.
• Host writes are not MCP filesystem-write grants; mutation authority belongs to the separate confined Operation path.
• Bounded packet selected names/paths/excerpts/contents/prompts/credentials are not normal persisted evidence.
• Signed evidence/transition identity, append-only decisions, lock order, leases and stale-owner fencing remain authoritative.
• Browser/model presentation cannot grant recovery authority; server re-authorizes every mutation.
• Generic VNext Resource/Grant/adapter code may wrap/reuse these contracts but not replace them with weaker editable/package policy.

Acceptance Criteria

• [EPIC] MCP S6 release proof and external-controller finalization #181/[OTHER][RELEASE] Complete S6 external-controller trust binding and live release evidence #357 complete the remaining S6 external release proof against exact reviewed build/App/host identity.
• Generic [FEATURE][ARCH] VNext Phase 0 — generic runtime contracts and compatibility seam #334 contracts can represent the MCP/Resource boundary without a duplicate admission source of truth.
• [FEATURE] VNext Phase 2 — secure generic execution envelope and side-effect recovery #336/[FEATURE] VNext Phase 8 — general Resource/Capability adapter ecosystem #342 future tool/adapter work cannot issue a live MCP Capability that this protected boundary/policy disallows.
• Existing cross-surface admission, grant recovery, bounded-context privacy, lease/fencing and operator-recovery regression suites remain green through VNext migrations.
• No future package/model/role/prose can widen MCP authority or reinterpret unknown/deferred capability as safe.
• Epic can close after S6 live release evidence is complete and VNext has explicit compatibility coverage; closure does not mean unrestricted live MCP execution is enabled.

Out of Scope

• General adapter ecosystem implementation ([FEATURE] VNext Phase 8 — general Resource/Capability adapter ecosystem #342).
• Arbitrary live MCP tools/credentials.
• Rewriting completed S1-S5 merely to rename tables/types for VNext.
• Using model/adversarial prose as an enforcement boundary.

Technical Notes

Physical Epic-172 schema/protocol names may remain behind generic service interfaces until a separately justified migration proves equivalent trust/evidence. Do not perform schema aesthetic rewrites during VNext Phase 0-2.

[github-actions]

FORGE issue validation

This Epic issue now matches the required FORGE template structure.
The validator applied ready-for-agent and removed needs-clarification if it was present.