docs(specs): Kan MCP platform-managed v0 prebuild (#131) #345

Closed

claude wants to merge 0 commits from claude/iskra/kan-mcp-platform-managed-v0 into main

claude commented

2026-05-17 21:04:53 +02:00

Collaborator

Summary

Prebuild for #131 — migrate Kan MCP discovery on VPS1000 from temporary systemd user drop-in (kan-mcp.conf) to platform-canonical mcporter + Infisical-resolved configuration.

After cutover: OpenClaw renderer reads Kan config from same canonical path as every other MCP; mcporter list kan --schema works from OpenClaw host; Kan agent token stays server-side on RS2000 bridge (P2).

What's in this PR

6-file Spec Kit + companion execution prompt:

docs/specs/kan-mcp-platform-managed-v0/README.md — index
docs/specs/kan-mcp-platform-managed-v0/00-constitution.md — 8 principles (P1 platform as canonical, P2 token never on OpenClaw, P3 Tailnet-restricted writes, P4 zero regression for live loop, P5 mcporter schema = discovery contract, P6 retire drop-in LAST, P7 Infisical least-privilege, P8 backwards-compatible renderer)
docs/specs/kan-mcp-platform-managed-v0/01-specify.md — problem (live Kan value loop works; migration must not regress), scope, acceptance
docs/specs/kan-mcp-platform-managed-v0/02-plan.md — architecture, 4-slice breakdown, Q1-Q5 (mcporter conventions, machine identity selection, token bridge, fallback timeline, kan-ductor reuse), dependencies, risks
docs/specs/kan-mcp-platform-managed-v0/03-tasks.md — per-slice task list
docs/specs/kan-mcp-platform-managed-v0/04-implement-notes.md — Infisical 403 diagnosis path, mcporter convention inspection, renderer mod sketch, gotchas G1-G6
prompts/codex-kan-mcp-platform-managed.md — execution prompt with Safety / production boundary + per-slice instructions + stop conditions (P4 + P2 violations = automatic STOP)

Slices (forthcoming PRs)

(a) Infisical scope — Full (security-sensitive) — recon + operator-applied least-privilege policy + smoke
(b) mcporter Kan registration — Lite — schema + Infisical URL + mcporter list kan --schema works
(c) Renderer migration — Full — backwards-compatible: mcporter first, legacy fallback only with opt-in flag, fail-closed otherwise
(d) Cutover + drop-in retirement — Lite — 24h clean soak required before drop-in retired (P6)

Operator-protected

P4 (zero regression for live Signal → Iskra → Kan loop) + P6 (drop-in retired LAST after soak) + P8 (renderer backwards-compatible during transition). Live drop-in stays in place throughout migration; retirement is gated on soak.

Per operator hint: pdurlej/kan-ductor likely has its own MCP — v0 registers existing MCP in canonical config, does NOT create new MCP server.

Tier

Trivial per ADR-0007 (docs-only prebuild).

Operator action

Draft for review. After merge: paste prompts/codex-kan-mcp-platform-managed.md to fresh codex session.

Operator-side coordination points:

Slice (a.2) Infisical policy expansion = OPERATOR-RUNNABLE via admin UI
Slice (c.3) renderer deploy on VPS1000 = scheduled maintenance window (Iskra brief disruption)
Slice (d.2) drop-in retirement = explicit operator consent (sacred-adjacent)

Refs #131 (related: #76 Agent Access Plane PR #323, #237 Bws/Infisical close, #135 OpenClaw scheduler obs PR #325)

## Summary Prebuild for #131 — migrate Kan MCP discovery on VPS1000 from temporary systemd user drop-in (`kan-mcp.conf`) to platform-canonical mcporter + Infisical-resolved configuration. After cutover: OpenClaw renderer reads Kan config from same canonical path as every other MCP; `mcporter list kan --schema` works from OpenClaw host; Kan agent token stays server-side on RS2000 bridge (P2). ## What's in this PR 6-file Spec Kit + companion execution prompt: - `docs/specs/kan-mcp-platform-managed-v0/README.md` — index - `docs/specs/kan-mcp-platform-managed-v0/00-constitution.md` — 8 principles (P1 platform as canonical, P2 token never on OpenClaw, P3 Tailnet-restricted writes, **P4 zero regression for live loop**, P5 mcporter schema = discovery contract, P6 retire drop-in LAST, P7 Infisical least-privilege, P8 backwards-compatible renderer) - `docs/specs/kan-mcp-platform-managed-v0/01-specify.md` — problem (live Kan value loop works; migration must not regress), scope, acceptance - `docs/specs/kan-mcp-platform-managed-v0/02-plan.md` — architecture, 4-slice breakdown, Q1-Q5 (mcporter conventions, machine identity selection, token bridge, fallback timeline, kan-ductor reuse), dependencies, risks - `docs/specs/kan-mcp-platform-managed-v0/03-tasks.md` — per-slice task list - `docs/specs/kan-mcp-platform-managed-v0/04-implement-notes.md` — Infisical 403 diagnosis path, mcporter convention inspection, renderer mod sketch, gotchas G1-G6 - `prompts/codex-kan-mcp-platform-managed.md` — execution prompt with Safety / production boundary + per-slice instructions + stop conditions (P4 + P2 violations = automatic STOP) ## Slices (forthcoming PRs) - **(a) Infisical scope** — Full (security-sensitive) — recon + operator-applied least-privilege policy + smoke - **(b) mcporter Kan registration** — Lite — schema + Infisical URL + `mcporter list kan --schema` works - **(c) Renderer migration** — Full — backwards-compatible: mcporter first, legacy fallback only with opt-in flag, fail-closed otherwise - **(d) Cutover + drop-in retirement** — Lite — 24h clean soak required before drop-in retired (P6) ## Operator-protected P4 (zero regression for live Signal → Iskra → Kan loop) + P6 (drop-in retired LAST after soak) + P8 (renderer backwards-compatible during transition). Live drop-in stays in place throughout migration; retirement is gated on soak. Per operator hint: `pdurlej/kan-ductor` likely has its own MCP — v0 registers existing MCP in canonical config, does NOT create new MCP server. ## Tier Trivial per ADR-0007 (docs-only prebuild). ## Operator action Draft for review. After merge: paste `prompts/codex-kan-mcp-platform-managed.md` to fresh codex session. **Operator-side coordination points**: - Slice (a.2) Infisical policy expansion = OPERATOR-RUNNABLE via admin UI - Slice (c.3) renderer deploy on VPS1000 = scheduled maintenance window (Iskra brief disruption) - Slice (d.2) drop-in retirement = explicit operator consent (sacred-adjacent) Refs #131 (related: #76 Agent Access Plane PR #323, #237 Bws/Infisical close, #135 OpenClaw scheduler obs PR #325)

claude commented

2026-05-17 22:42:30 +02:00

Author

Collaborator

Closing empty PR — fork-anchor 2026-05-17 coordination loss

This PR's branch has zero commits unique vs main — the parallel-fork-claude session that owned this branch wrote spec files locally but those commits never landed on this branch (likely due to shared-checkout collision: forks alternated .git/HEAD between each other's checkout -b, leaving some forks' work uncommitted or on wrong branches).

The untracked spec files were lost during subsequent branch switches by other forks. The PR description above describes intent + scope but no implementation artifact exists on this branch.

Lesson learned: parallel forks on shared local checkout need git worktree add per fork. Next dispatch should use /Users/pd/Developer/iskra-platform-2026-04-30-fork-<letter>/ per fork with own .git/HEAD.

To retry: open a fresh fork session in dedicated worktree, recreate the prebuild from the issue description + this PR's scope description.

Closing as cleanup; not a fail of the underlying spec idea.

## Closing empty PR — fork-anchor 2026-05-17 coordination loss This PR's branch has **zero commits unique vs `main`** — the parallel-fork-claude session that owned this branch wrote spec files locally but those commits never landed on this branch (likely due to shared-checkout collision: forks alternated `.git/HEAD` between each other's `checkout -b`, leaving some forks' work uncommitted or on wrong branches). The untracked spec files were lost during subsequent branch switches by other forks. The PR description above describes intent + scope but no implementation artifact exists on this branch. **Lesson learned:** parallel forks on shared local checkout need `git worktree add` per fork. Next dispatch should use `/Users/pd/Developer/iskra-platform-2026-04-30-fork-<letter>/` per fork with own `.git/HEAD`. **To retry:** open a fresh fork session in dedicated worktree, recreate the prebuild from the issue description + this PR's scope description. Closing as cleanup; not a fail of the underlying spec idea.

claude closed this pull request

2026-05-17 22:42:30 +02:00