I3285 — A vendor workspace reads the plan through the authenticated remote MCP surface, and a tunnel never makes it look local

✕BLOCKED wave 1 · p3 · implementation profile · parallel safe

Part of a-workspace-reaches-the-repository — A vendor workspace reads the repository, and proposes to it only where the owner has decided it may.

Objective

Let a vendor's remote MCP connector — a ChatGPT custom connector, or a claude.ai custom connector, which the Claude in Chrome side panel and claude.ai chat call — call the read capabilities (plan, intents, evidence) over the existing MCP-over-HTTP projection, through a listener of its own whose callers authenticate by the mechanism an ADR amending ADR 0126 defines (ADR 0126 admits reads beyond loopback without authentication), and refuse any deployment where a tunnel terminating on loopback would make vendor requests pass as local.

Why

ADR 0126 judges a caller by its address. The router already refuses a loopback request whose Host is neither an address nor localhost (rebound()), so only a tunnel that rewrites Host to localhost passes as local; that hole affects every mutation and belongs to runtime-trust. Read-only is what ADR 0126 already allows remotely and what every ChatGPT plan can call. Critique 2026-10-18: ADR 0126 admits every read beyond loopback without authentication, so authenticating a vendor reader is a new mechanism that needs its own ADR; this issue serves the intent's a-vendor-reads-and-never-writes, not a-reference-validates-everywhere, which it does nothing for. The Claude in Chrome side panel is the same case: it is an agent on claude.ai and reaches only a connector Anthropic's cloud can call over the public internet (support.claude.com/en/articles/11175166), so it cannot reach the loopback server either (docs/MCP.md#claude-in-the-browser, 2026-10-21). Sources: chatgpt-majordomus:c239#7, chatgpt-majordomus:c267#2, chatgpt-majordomus:c065#4.

Current state

MCP over HTTP exists on the shared server; I2123 (runtime-trust) covers remote reads; nothing declares a vendor caller.

Desired state

A declared remote listener for vendor callers, separate from the loopback one, serving reads only, with tool schemas derived from the registry.

Scope

• apps/majordomus-cli/src/http
• apps/majordomus-cli/src/mcp
• docs/MCP.md
• .ai/repo/adrs/0126-a-caller-beyond-loopback-reads-and-changes-nothing-it-cannot-authenticate.md

Out of scope

• Mutation from a vendor (I3286)
• Hosting a public endpoint
• Serving workspace message text to a vendor caller

Dependencies

• I2123✓DONE A caller beyond loopback reads, and changes nothing it cannot authenticate

What waits on this

• I3286✕BLOCKED A proposal from a workspace arrives as intent.propose carrying the workspace reference it came from

Acceptance criteria

• A request through the vendor listener runs a read capability and is refused a repository_mutation one
• A request arriving on the loopback listener with a forwarding header is refused remote-only reads' privileges, not granted loopback ones
• No credential appears in output or logs
• An ADR amending ADR 0126 defines how a vendor reader authenticates (OAuth for a ChatGPT or a claude.ai connector) before the vendor listener admits any caller

Validation

• cargo test --manifest-path apps/majordomus-cli/Cargo.toml --test remote_callers
• cargo test --manifest-path apps/majordomus-cli/Cargo.toml --test http_host

Evidence required

• case_a_vendor_caller_reads_only

Evidence

None recorded. Every token above needs a command or an artifact behind it before this issue can be completed; narrative is refused.

Timeline

started

—

verified

—

completed

—

Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.

Canonical record: .ai/repo/project/issues/I3285.yaml. Read it back with majordomus plan show I3285.