I3285 — A vendor workspace reads the plan through the authenticated remote MCP surface, and a tunnel never makes it look local

✕BLOKOVÁNO vlna 1 · p3 · profil implementation · bezpečné paralelně

Part of a-workspace-reaches-the-repository — A vendor workspace reads the repository, and proposes to it only where the owner has decided it may.

Cíl

Let a vendor's remote MCP connector — a ChatGPT custom connector, or a claude.ai custom connector, which the Claude in Chrome side panel and claude.ai chat call — call the read capabilities (plan, intents, evidence) over the existing MCP-over-HTTP projection, through a listener of its own whose callers authenticate by the mechanism an ADR amending ADR 0126 defines (ADR 0126 admits reads beyond loopback without authentication), and refuse any deployment where a tunnel terminating on loopback would make vendor requests pass as local.

Proč

ADR 0126 judges a caller by its address. The router already refuses a loopback request whose Host is neither an address nor localhost (rebound()), so only a tunnel that rewrites Host to localhost passes as local; that hole affects every mutation and belongs to runtime-trust. Read-only is what ADR 0126 already allows remotely and what every ChatGPT plan can call. Critique 2026-10-18: ADR 0126 admits every read beyond loopback without authentication, so authenticating a vendor reader is a new mechanism that needs its own ADR; this issue serves the intent's a-vendor-reads-and-never-writes, not a-reference-validates-everywhere, which it does nothing for. The Claude in Chrome side panel is the same case: it is an agent on claude.ai and reaches only a connector Anthropic's cloud can call over the public internet (support.claude.com/en/articles/11175166), so it cannot reach the loopback server either (docs/MCP.md#claude-in-the-browser, 2026-10-21). Sources: chatgpt-majordomus:c239#7, chatgpt-majordomus:c267#2, chatgpt-majordomus:c065#4.

Aktuální stav

MCP over HTTP exists on the shared server; I2123 (runtime-trust) covers remote reads; nothing declares a vendor caller.

Cílový stav

A declared remote listener for vendor callers, separate from the loopback one, serving reads only, with tool schemas derived from the registry.

Rozsah

• apps/majordomus-cli/src/http
• apps/majordomus-cli/src/mcp
• docs/MCP.md
• .ai/repo/adrs/0126-a-caller-beyond-loopback-reads-and-changes-nothing-it-cannot-authenticate.md

Mimo rozsah

• Mutation from a vendor (I3286)
• Hosting a public endpoint
• Serving workspace message text to a vendor caller

Závislosti

• I2123✓HOTOVO Volající mimo loopback čte a nic nemění, co nedokáže ověřit

Co na tom čeká

• I3286✕BLOCKED A proposal from a workspace arrives as intent.propose carrying the workspace reference it came from

Kritéria přijetí

• A request through the vendor listener runs a read capability and is refused a repository_mutation one
• A request arriving on the loopback listener with a forwarding header is refused remote-only reads' privileges, not granted loopback ones
• No credential appears in output or logs
• An ADR amending ADR 0126 defines how a vendor reader authenticates (OAuth for a ChatGPT or a claude.ai connector) before the vendor listener admits any caller

Validace

• cargo test --manifest-path apps/majordomus-cli/Cargo.toml --test remote_callers
• cargo test --manifest-path apps/majordomus-cli/Cargo.toml --test http_host

Požadované důkazy

• case_a_vendor_caller_reads_only

Důkazy

Nic nezaznamenáno. Za každým tokenem výše musí stát příkaz nebo artefakt, než lze tento úkol dokončit; vyprávění se odmítá.

Časová osa

zahájeno

—

ověřeno

—

dokončeno

—

Tato tři pole, důkazy výše a stav závislostí jsou vše, z čeho se stav skládá. Neexistuje žádné pole stavu, které by s nimi mohlo být v rozporu.

Canonical record: .ai/repo/project/issues/I3285.yaml. Read it back with majordomus plan show I3285.