Repository navigation
GRAPHOS-MCP-RESOURCES-R002: prove receipts are only constructed by the gate module - #238
Merged
58 commits merged intoOct 10, 2026
Merged
58 commits merged into
58 commits merged into
Conversation
… resolver _probe_protocol_families called _harvest_resource_bodies directly twice; both now go through _resolve_via_local_catalog_or_harvest so admitted children resolve from the resident catalog with no wire read. Spec: GRAPHOS-FLEET-R006.3.1 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Only ingest sync has a real registry operation; every other analyze/ingest legacy action is a gap, so each row is split into add-operation children plus an approve-mappings child. Spec: none (refactor) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
… ports build_identity_ports builds the concrete runtime once and returns it typed as CredentialAuthority/SessionAuthority; fails closed with IdentityUnavailable. Spec: GRAPHOS-OPS-R032.2.1 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Add expires_at and effective_scopes(): intersect with owner scopes at use time, deny revoked/expired keys, never yield approver scopes. Spec: GRAPHOS-IDENTITY-R008.2 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Spec: none (refactor) Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Injection needs run_web_ui and mcp_server.composition startup wiring that cannot be tested in isolation; split into compose_web_application (.1) and run_web_ui/supervisor threading (.2). Spec: none (refactor) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Adds the approved mapping and a bound test that the operation id exists in the ingest registry. Spec: GRAPHOS-HOST-R005.2.3.1 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…ring (.2) The R022/PA-12 publish step is not built in graph-os, so there is no entry point to wire. R003 becomes a rollup with two bite-sized children. Spec: none (refactor) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
admit_tool_subset already refuses closed; add a negative test across varied graph refs and budgets proving no trimmed admission is returned. Spec: GRAPHOS-A2A-002-R005 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Split R020.3.1 into .1 (ingest.packs.list) and .2 (ingest.jobs.status) and deliver .1 through the typed ingest runner port with the ingest:read scope. Spec: GRAPHOS-OPS-R020.3.1.1 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Spec: none (refactor) Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Typed IngestJobRecord and runner port method get_job_status; read op under ingest:read, fails closed with UNAVAILABLE when no runner is composed. Spec: GRAPHOS-OPS-R020.3.1.2 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Adds PublicationRefusedError and require_reconciled_for_swap(), which raises the typed refusal for any reingestion-unreconciled gate result. Spec: GRAPHOS-MCP-RESOURCES-R003.1 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
ingest.operations() gained ingest.packs.list; both functions are still the per-domain declarative OpSpec registries the entry describes. Spec: none (refactor) Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Spec: none (refactor) Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…server No production identity runtime exists (build_identity_ports has only test callers), so the supervisor start call cannot supply real ports yet. Split .2.3.2 into .2.3.2.1 (run_web_ui accepts/binds ports, lands with .2.3.1) and .2.3.2.2 (supply from mcp_server composition, depends on R032.2.2). Spec: none (refactor) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…o children Split R010.2 into .2.1-.2.4 and deliver .2.1: map_groups_to_roles with DN normalization, refusing when no group maps to a role. Spec: GRAPHOS-IDENTITY-R010.2.1 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Split R009.2 into children .2.1-.2.4; deliver pure select_mapping_rule. Spec: GRAPHOS-IDENTITY-R009.2.1 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…ser model R011.2 becomes a rollup of .2.1-.2.4; .2.1 delivers ScimUser with validation/refusal tests. Spec: GRAPHOS-IDENTITY-R011.2.1 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Split R012.2 into .2.1-.2.4; deliver .2.1: ParsedSamlAssertion plus pure audience/recipient/validity-window checks with typed refusal reasons. Spec: GRAPHOS-IDENTITY-R012.2.1 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Split R021.2 into .1 retrieval.search and .2 retrieval.freshness; deliver .1 through a typed retriever port that truncates hits to the context budget and fails closed with UNAVAILABLE. Spec: GRAPHOS-OPS-R021.2.1 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Add docs-consistency tests asserting docs/status.md and docs/fleet.md cite exactly the reingestion-unreconciled code the gate returns. Spec: GRAPHOS-MCP-RESOURCES-R004 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
….jobs.status Spec: none (refactor) Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…status Split R022.2 into children .1-.5; deliver the first read op through a typed evolution runner port, failing closed UNAVAILABLE when not composed. Spec: GRAPHOS-OPS-R022.2.1 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Adds check_id_token_claims (issuer, audience, expiry, nonce over decoded claims) raising OidcTokenRefused with an OidcRefusalReason; no signature handling. Spec: GRAPHOS-IDENTITY-R009.2.2 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
check_scim_credential gates a request on its bearer token via ScimServiceCredential.authorizes, raising ScimCredentialRefused for missing, unknown or wrong-provider tokens. Spec: GRAPHOS-IDENTITY-R011.2.2 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
… escaping Fails closed with IdentityUnavailable on missing port or bind failure. Spec: GRAPHOS-IDENTITY-R010.2.2 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…erifier port Adds SamlSignatureVerifier Protocol and verify_assertion(), which refuses with a typed reason when the verifier is absent or reports an invalid signature, then runs check_assertion_conditions. No crypto or XML in graph-os. Spec: GRAPHOS-IDENTITY-R012.2.2 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Extends the typed Retriever port with freshness(); op reuses memory:read scope and fails closed with UNAVAILABLE when the port is absent. Spec: GRAPHOS-OPS-R021.2.2 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…tering loops:read Reverts the evolution.loops.status op added with a substituted work:read scope; the registry factory accepts only scopes in the engine contract, and loops:read is not registered there yet. Spec: none (refactor) Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…mplexity cap Spec: none (refactor) Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…mplexity cap, regenerate status Spec: none (refactor) Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…eipts AST test asserting no graph_os module other than mcp_resource_reconciliation.py calls ReconciliationReceipt. The receipt has no source field, so a source-rejection test is not applicable. Spec: GRAPHOS-MCP-RESOURCES-R002 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds an AST test that no graph_os module other than fleet/mcp_resource_reconciliation.py calls ReconciliationReceipt.
Based on land/train-1010d.
🤖 Generated with Claude Code