aaronrene / knowtation public
BREAKING feat/sec-kn-3-mcp-access-role-cap #1 / 1
aaronrene · 42 days ago · Jul 26, 2026 · Diff

SEC-KN-3: cap mcp_access role by scopes; block agent self-apply.

Pass 2 P6 — agent tokens never inherit admin via HUB_ADMIN_USER_IDS; roleEligibleForPersonalSelfApply rejects mcp_access/agent actors. Seven-tier regression vs pre-fix allowlist inheritance; ROADMAP/handover synced.

sha256:5954c433e02f1be6e102da24f6ccf23649373a50feb9cb819a306969ab621e0d sha
sha256:6ea1888c302f36c9c793f550c3e1fe75ae96f69c5912f4194296768a8b82bfca parent
+15 ~14 −5 symbols
sha256:5fc34bcece74db97f403e49a6297b7179dfdfc9556887db6e89e6f0a130a93d9 snapshot
+15
symbols added
~14
symbols modified
−5
symbols removed
0
dead code introduced
Semantic Changes 34 symbols
~ test/sec-kn-3-mcp-access-role-cap.test.mjs .mjs 5 symbols added
+ matchingProposal function function matchingProposal L85–94
+ resolveHostedActorRoleFixed function function resolveHostedActorRoleFixed L68–83
+ resolveHostedActorRoleLegacy function function resolveHostedActorRoleLegacy L55–60
+ roleEligibleLegacy function function roleEligibleLegacy L353–356
+ roleForSubAllowlist function function roleForSubAllowlist L43–45
~ docs/OVERSEER-HANDOVER.md .md 5 symbols added, 5 symbols removed, 5 symbols modified
− NEXT SESSION — SEC-KN-3 mcp_access role cap (PRIMARY) section NEXT SESSION — SEC-KN-3 mcp_access role cap (PRIMARY) L20–97
− Governance gates checklist section Governance gates checklist L82–97
− Knowtation-owned findings (from Pass 2) section Knowtation-owned findings (from Pass 2) L62–82
− table section table L64–74
− code[text] variable variable code[text] L30–61
+ NEXT SESSION — SEC-KN-4 delegation principal_ref binding (PRIMARY) section NEXT SESSION — SEC-KN-4 delegation principal_ref binding (PRIMARY) L20–96
+ Governance gates checklist section Governance gates checklist L81–96
+ Knowtation-owned findings (from Pass 2) section Knowtation-owned findings (from Pass 2) L61–81
+ table section table L63–73
+ code[text] variable variable code[text] L29–60
~ Overseer Handover — Knowtation
~ Change log
~ table
~ Verified snapshot (what exists now)
~ table
~ docs/ROADMAP.md .md 5 symbols modified
~ Roadmap — knowtation
~ Build queue
~ table
~ Current status (2026-07-26)
~ table
~ hub/gateway/access-token-authz.mjs .mjs 5 symbols added
+ applyAdminAllowlistOverrideLegacy function function applyAdminAllowlistOverrideLegacy L88–94
+ isMcpAccessPayload function function isMcpAccessPayload L28–30
+ mayApplyAdminAllowlistOverride function function mayApplyAdminAllowlistOverride L75–77
+ roleFromMcpAccessScopes function function roleFromMcpAccessScopes L39–43
+ roleFromVerifiedAccessPayload function function roleFromVerifiedAccessPayload L55–66
~ hub/gateway/server.mjs .mjs 2 symbols modified
~ assertHostedProposalApproveDiscard
~ resolveHostedActorRole
~ lib/hub-proposal-personal-self-apply.mjs .mjs 2 symbols modified
~ isPersonalSelfApplyClass
~ roleEligibleForPersonalSelfApply
← Older Oldest on feat/sec-kn-3-mcp-access-role-cap
All commits
Newer → Latest on feat/sec-kn-3-mcp-access-role-cap

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:5954c433e02f1be6e102da24f6ccf23649373a50feb9cb819a306969ab621e0d --body "your comment"