pdurlej/platform

Fork 0

fix(identity): split Forgejo MCP identity per agent and disable admin MCP by default #56

New issue

Closed

opened 2026-05-04 17:36:27 +02:00 by Iskra · 2 comments

Iskra commented

2026-05-04 17:36:27 +02:00

Collaborator

Context

Piotr reported a platform bug on Signal, 2026-05-04:

obecnie mcp używa mojego pdurlej chyba dla Forgejo, a powinno w zależności od modelu glm, codex lub claude. Każdy z agentów powinien widzieć tylko swoje MCP, a moje adminowe MCP powinno być wyłączone by default, ale w systemie.

This matches an existing identity-isolation smell noted in PR #42: Forgejo MCP/API path may still use the operator/admin identity while commits/worktrees were already separated by actor.

Bug

Forgejo MCP / platform MCP access appears to default to Piotr's admin identity (pdurlej) instead of the active agent identity.

Expected agent identities:

GLM runtime → glm Forgejo/MCP identity
Codex runtime → codex Forgejo/MCP identity
Claude runtime → claude Forgejo/MCP identity
Piotr/admin MCP → available only explicitly, disabled by default

Desired model

Each agent should see/use only its own MCP/tool identity by default.

Admin/operator MCP should exist in the system for explicit break-glass/admin work, but should not be exposed or selected by default in ordinary agent sessions.

Why it matters

This is an identity-boundary issue, not just cosmetics:

comments/issues/PR actions can be misattributed to Piotr;
agent accountability gets blurred;
reviewers cannot tell which model/agent performed an action;
admin token exposure surface is larger than needed;
it undermines the identity-isolation work from Order B/C.

Proposed fix direction

Inventory current MCP definitions and Forgejo credentials.
Identify which MCP server/tool path uses pdurlej by default.
Split MCP config by actor/model/session where needed:
- forgejo-glm
- forgejo-codex
- forgejo-claude
- forgejo-admin / forgejo-pdurlej disabled by default.
Ensure runtime model/agent selection resolves the corresponding MCP identity.
Ensure admin MCP requires explicit opt-in / elevated operator path.
Add identity doctor checks for MCP identity, not only git author/askpass.
Add smoke test: each agent comments on a test issue as itself, not as pdurlej.

Acceptance criteria

Current Forgejo MCP identity leak/default is confirmed with evidence.
Actor-specific MCP configs exist or equivalent routing is implemented.
Ordinary GLM/Codex/Claude sessions do not see/use Piotr's admin MCP by default.
Admin MCP remains available only through explicit break-glass/admin path.
Identity doctor reports MCP identity per actor.
Test issue/comment proves attribution:
- GLM action authored by glm;
- Codex action authored by codex;
- Claude action authored by claude;
- no default action authored by pdurlej unless explicitly admin.

PR #8 — GLM comment hook / identity wiring
PR #12 — Codex askpass worktree wiring
PR #42 — STATE_OF_PLATFORM note: Forgejo MCP still using operator PAT for PR-create API
PLATFORM_CHARTER identity isolation rules

## Context Piotr reported a platform bug on Signal, 2026-05-04: > obecnie mcp używa mojego `pdurlej` chyba dla Forgejo, a powinno w zależności od modelu `glm`, `codex` lub `claude`. Każdy z agentów powinien widzieć tylko swoje MCP, a moje adminowe MCP powinno być wyłączone by default, ale w systemie. This matches an existing identity-isolation smell noted in PR #42: Forgejo MCP/API path may still use the operator/admin identity while commits/worktrees were already separated by actor. ## Bug Forgejo MCP / platform MCP access appears to default to Piotr's admin identity (`pdurlej`) instead of the active agent identity. Expected agent identities: - GLM runtime → `glm` Forgejo/MCP identity - Codex runtime → `codex` Forgejo/MCP identity - Claude runtime → `claude` Forgejo/MCP identity - Piotr/admin MCP → available only explicitly, disabled by default ## Desired model Each agent should see/use only its own MCP/tool identity by default. Admin/operator MCP should exist in the system for explicit break-glass/admin work, but should **not** be exposed or selected by default in ordinary agent sessions. ## Why it matters This is an identity-boundary issue, not just cosmetics: - comments/issues/PR actions can be misattributed to Piotr; - agent accountability gets blurred; - reviewers cannot tell which model/agent performed an action; - admin token exposure surface is larger than needed; - it undermines the identity-isolation work from Order B/C. ## Proposed fix direction 1. Inventory current MCP definitions and Forgejo credentials. 2. Identify which MCP server/tool path uses `pdurlej` by default. 3. Split MCP config by actor/model/session where needed: - `forgejo-glm` - `forgejo-codex` - `forgejo-claude` - `forgejo-admin` / `forgejo-pdurlej` disabled by default. 4. Ensure runtime model/agent selection resolves the corresponding MCP identity. 5. Ensure admin MCP requires explicit opt-in / elevated operator path. 6. Add identity doctor checks for MCP identity, not only git author/askpass. 7. Add smoke test: each agent comments on a test issue as itself, not as `pdurlej`. ## Acceptance criteria - Current Forgejo MCP identity leak/default is confirmed with evidence. - Actor-specific MCP configs exist or equivalent routing is implemented. - Ordinary GLM/Codex/Claude sessions do not see/use Piotr's admin MCP by default. - Admin MCP remains available only through explicit break-glass/admin path. - Identity doctor reports MCP identity per actor. - Test issue/comment proves attribution: - GLM action authored by `glm`; - Codex action authored by `codex`; - Claude action authored by `claude`; - no default action authored by `pdurlej` unless explicitly admin. ## Related - PR #8 — GLM comment hook / identity wiring - PR #12 — Codex askpass worktree wiring - PR #42 — STATE_OF_PLATFORM note: Forgejo MCP still using operator PAT for PR-create API - PLATFORM_CHARTER identity isolation rules

Iskra referenced this issue

2026-05-04 18:04:38 +02:00

feat(agents): Antigravity/Gemini scheduled PR factory for platform issues #57

claude referenced this issue

2026-05-05 00:04:36 +02:00

docs(repo): swarm-fundament — onboarding map + AGENTS amend + issue templates #58

pdurlej referenced this issue

2026-05-05 02:03:47 +02:00

ops(security): Codex SSH key delivery via ssh-agent with TTL — keep key off disk (Phase 1 Lite) #73

pdurlej referenced this issue

2026-05-05 02:08:26 +02:00

arch(governance): kontrakt + granica między pdurlej/platform a pdurlej/iskra-openclaw — co gdzie mieszka #74

codex referenced this issue

2026-05-05 03:17:40 +02:00

arch(agent-access): Agent Access Plane — session-scoped AI credential delivery #76

codex referenced this issue

2026-05-05 03:18:25 +02:00

feat(agent-access): add codex OpenClaw ssh-agent TTL wrapper #77

codex referenced this issue

2026-05-05 03:21:33 +02:00

docs(decisions): define Agent Access Plane #78

codex referenced this issue

2026-05-05 07:37:42 +02:00

fix(agent-access): harden ssh-agent session lifecycle #80

claude referenced this issue

2026-05-10 00:41:03 +02:00

docs(prompts): cutover flight — 5-phase Codex master prompt suite (NIECH GINIE) #141

claude referenced this issue

2026-05-11 01:54:30 +02:00

governance: ADR-0006 cousin role taxonomy + ADR-0007 domain promotion policy #168

glm referenced this issue from a commit

2026-05-17 10:17:25 +02:00

WIP: feat(agent-access): v0 4-slice skeleton — session-scoped credential delivery [#76]

claude referenced this issue

2026-05-17 10:17:51 +02:00

WIP: feat(agent-access): v0 4-slice skeleton — session-scoped credential delivery [#76] #323

claude referenced this issue

2026-05-17 17:25:50 +02:00

WIP: docs(specs): prebuild Spec Kit for #79 session lifecycle hardening #329

claude referenced this issue

2026-05-17 18:36:04 +02:00

WIP: docs(specs): prebuild Spec Kit for #56 Forgejo MCP identity split #343

claude referenced this issue

2026-05-17 21:01:19 +02:00

WIP: docs(specs): prebuild joint Spec Kit for #132 + #181 YubiKey integration #344

claude referenced this issue from a commit

2026-05-17 21:01:21 +02:00

docs(specs): prebuild joint Spec Kit for #132 + #181 YubiKey integration (WIP)

claude referenced this issue from a commit

2026-05-17 23:02:43 +02:00

prompts(forks): v0.1 dispatch template with worktree isolation (8 retry prebuilds)

claude referenced this issue

2026-05-17 23:03:11 +02:00

prompts(forks): v0.1 dispatch template with worktree isolation (8 retry prebuilds) #356

claude referenced this issue from a commit

2026-05-18 08:16:41 +02:00

docs(specs): #79 Agent Access session lifecycle hardening v0 prebuild

claude referenced this issue

2026-05-18 08:17:08 +02:00

docs(specs): #79 Agent Access session lifecycle hardening v0 prebuild #365

claude referenced this issue from a commit

2026-05-18 08:17:28 +02:00

docs(specs): prebuild for #56 Forgejo MCP identity split per agent v0

claude referenced this issue

2026-05-18 08:17:56 +02:00

docs(specs): prebuild for #56 Forgejo MCP identity split per agent v0 #367

codex added this to the 03 - Secrets and access hardening milestone

2026-05-19 08:36:21 +02:00

pdurlej referenced this issue from a commit

2026-05-23 09:19:33 +02:00

Merge pull request 'docs(specs): prebuild for #56 Forgejo MCP identity split per agent v0' (#367) from claude/fork-A2-forgejo-mcp-identity-split into main

codex referenced this issue

2026-05-24 18:32:58 +02:00

docs(secrets): start W4 access hardening #435

codex referenced this issue

2026-05-24 19:46:52 +02:00

docs(identity): document W4b Forgejo MCP reality #439

codex commented

2026-05-24 19:47:08 +02:00

Collaborator

W4b reality check — PR opened — 2026-05-24

Role: executor
Intent: checkpoint
Needs owner: yes, via PR merge decision

Opened #439: docs(identity): document W4b Forgejo MCP reality.

Recommendation

Do not treat full MCP router implementation as a W4 blocker.

Current W4-safe standard is already documented and operational:

direct curl for Forgejo writes;
actor PAT from macOS Keychain;
verify /api/v1/user before writes;
inspect response user.login after writes;
do not use Forgejo MCP write tools when they authenticate as pdurlej.

How to interpret #56 after #439

W4 blocker: resolved by current standard + reality-check doc if #439 merges.
Future work: keep #56 open as Milestone 06 / agent-governance router work, or split it into smaller router/identity-doctor issues.
Do not close as fully fixed yet; the router itself is deferred, not implemented.

Runtime

None. Docs/spec only. No token movement, no MCP implementation, no runtime service.

## W4b reality check — PR opened — 2026-05-24 **Role:** executor **Intent:** checkpoint **Needs owner:** yes, via PR merge decision Opened #439: `docs(identity): document W4b Forgejo MCP reality`. ### Recommendation Do not treat full MCP router implementation as a W4 blocker. Current W4-safe standard is already documented and operational: - direct `curl` for Forgejo writes; - actor PAT from macOS Keychain; - verify `/api/v1/user` before writes; - inspect response `user.login` after writes; - do not use Forgejo MCP write tools when they authenticate as `pdurlej`. ### How to interpret #56 after #439 - W4 blocker: resolved by current standard + reality-check doc if #439 merges. - Future work: keep #56 open as Milestone 06 / agent-governance router work, or split it into smaller router/identity-doctor issues. - Do not close as fully fixed yet; the router itself is deferred, not implemented. ### Runtime None. Docs/spec only. No token movement, no MCP implementation, no runtime service.

codex referenced this issue

2026-05-24 19:56:49 +02:00

fix(security): finish Bws/Infisical secrets injection — close 3-thread gap #237

codex referenced this issue

2026-05-24 20:19:05 +02:00

docs(secrets): integrate W4 closeout forks #443

codex commented

2026-05-24 20:19:55 +02:00

Collaborator

W4b identity/MCP reality check has been consolidated into #443. If #443 merges, #56 is no longer a W4 blocker; remaining MCP router implementation should move/defer to Milestone 06 unless operator pulls it forward.