pdurlej/platform

Fork 0

feat(mcp): add Kan registry validation slice #705

Merged

pdurlej merged 1 commit from codex/kan-mcp-registry-slice-a into main

2026-06-04 11:25:08 +02:00

codex commented

2026-06-04 11:11:57 +02:00

Collaborator

Canary status: missing — fire canary 3+3 manually before merge

Summary

Adds Slice A for the Kan MCP registry: a schema-backed, read-only registry contract plus platformctl mcp-registry validate.

This intentionally stops before any Infisical write, OpenClaw restart, or runtime MCP activation.

What changed

Added schema/mcp-registry.schema.json and schema docs.
Added policies/mcp-registry/kan.yaml for the Kan MCP registry entry.
Added platformctl mcp-registry validate with JSON output and schema validation.
Added focused tests for valid registry, invalid URL, unknown consumer, missing required fields, and the CLI default path.
Extended module schema with spec.dependencies.mcp_servers.
Declared openclaw-gateway dependency on MCP registry id kan.

Canary Context Pack

Product story

OpenClaw needs a safe, reviewable way to know which MCP servers are allowed before any runtime wiring happens. This gives Kan MCP a declarative registry entry and a validation command without changing runtime state.

What changed

A new policy schema, one Kan policy file, CLI validation, tests, and a module dependency reference.

Why it changed

This is the first safe Kan MCP slice before Infisical/runtime integration.

Files touched

control-plane/platformctl/cli.py
control-plane/platformctl/mcp_registry.py
control-plane/platformctl/tests/test_mcp_registry.py
control-plane/platformctl/tests/test_smoke.py
modules/openclaw-gateway/module.yaml
policies/mcp-registry/kan.yaml
schema/mcp-registry.schema.json
schema/mcp-registry.schema.md
schema/module.schema.json
schema/module.schema.md

Relevant context

Current operator plan: Kan MCP Slice A only.
Existing kan-mcp module already describes the runtime bridge.
Existing module schema uses strict dependency fields, so mcp_servers had to be added explicitly.

Runtime evidence

Not applicable. This PR does not restart services, write Infisical, or activate OpenClaw MCP configuration.

Known constraints

No Infisical writes.
No OpenClaw restart.
No cross-repo runtime change.
Registry file contains key names and identity labels only, never secret values.

Explicit out-of-scope

Writing Kan MCP config to Infisical.
OpenClaw runtime activation.
Runtime smoke against Kan MCP.
Closing the broader Kan MCP integration work.

Requested decision

Approve this as the declarative registry/validation foundation.

Merge blockers

Schema validation failure.
Secret values in registry fixtures.
Runtime mutation added to this PR.

Spec sources read

modules/kan-mcp/module.yaml — confirm existing runtime bridge module.
modules/openclaw-gateway/module.yaml — add consumer dependency reference.
schema/module.schema.json / schema/module.schema.md — extend strict dependency schema safely.
control-plane/platformctl/cli.py — follow platformctl command conventions.
control-plane/platformctl/tests/test_validate.py / test_smoke.py — follow test style.

Validation

git diff --check — passed.
UV_CACHE_DIR=/tmp/uv-cache PYTHONPATH=control-plane uv run --project control-plane pytest platformctl/tests/test_mcp_registry.py platformctl/tests/test_validate.py platformctl/tests/test_smoke.py — 19 passed.
UV_CACHE_DIR=/tmp/uv-cache PYTHONPATH=control-plane uv run --project control-plane python -m platformctl.cli mcp-registry validate --json — passed, 1 valid registry file.
UV_CACHE_DIR=/tmp/uv-cache PYTHONPATH=control-plane uv run --project control-plane python -m platformctl.cli validate all --json — passed, exitCode 0.

Refs #131. Does not close #131; this is Slice A only.

Canary status: missing — fire canary 3+3 manually before merge ## Summary Adds Slice A for the Kan MCP registry: a schema-backed, read-only registry contract plus `platformctl mcp-registry validate`. This intentionally stops before any Infisical write, OpenClaw restart, or runtime MCP activation. ## What changed - Added `schema/mcp-registry.schema.json` and schema docs. - Added `policies/mcp-registry/kan.yaml` for the Kan MCP registry entry. - Added `platformctl mcp-registry validate` with JSON output and schema validation. - Added focused tests for valid registry, invalid URL, unknown consumer, missing required fields, and the CLI default path. - Extended module schema with `spec.dependencies.mcp_servers`. - Declared `openclaw-gateway` dependency on MCP registry id `kan`. ## Canary Context Pack ### Product story OpenClaw needs a safe, reviewable way to know which MCP servers are allowed before any runtime wiring happens. This gives Kan MCP a declarative registry entry and a validation command without changing runtime state. ### What changed A new policy schema, one Kan policy file, CLI validation, tests, and a module dependency reference. ### Why it changed This is the first safe Kan MCP slice before Infisical/runtime integration. ### Files touched - `control-plane/platformctl/cli.py` - `control-plane/platformctl/mcp_registry.py` - `control-plane/platformctl/tests/test_mcp_registry.py` - `control-plane/platformctl/tests/test_smoke.py` - `modules/openclaw-gateway/module.yaml` - `policies/mcp-registry/kan.yaml` - `schema/mcp-registry.schema.json` - `schema/mcp-registry.schema.md` - `schema/module.schema.json` - `schema/module.schema.md` ### Relevant context - Current operator plan: Kan MCP Slice A only. - Existing `kan-mcp` module already describes the runtime bridge. - Existing module schema uses strict dependency fields, so `mcp_servers` had to be added explicitly. ### Runtime evidence Not applicable. This PR does not restart services, write Infisical, or activate OpenClaw MCP configuration. ### Known constraints - No Infisical writes. - No OpenClaw restart. - No cross-repo runtime change. - Registry file contains key names and identity labels only, never secret values. ### Explicit out-of-scope - Writing Kan MCP config to Infisical. - OpenClaw runtime activation. - Runtime smoke against Kan MCP. - Closing the broader Kan MCP integration work. ### Requested decision Approve this as the declarative registry/validation foundation. ### Merge blockers - Schema validation failure. - Secret values in registry fixtures. - Runtime mutation added to this PR. ## Spec sources read - `modules/kan-mcp/module.yaml` — confirm existing runtime bridge module. - `modules/openclaw-gateway/module.yaml` — add consumer dependency reference. - `schema/module.schema.json` / `schema/module.schema.md` — extend strict dependency schema safely. - `control-plane/platformctl/cli.py` — follow platformctl command conventions. - `control-plane/platformctl/tests/test_validate.py` / `test_smoke.py` — follow test style. ## Validation - `git diff --check` — passed. - `UV_CACHE_DIR=/tmp/uv-cache PYTHONPATH=control-plane uv run --project control-plane pytest platformctl/tests/test_mcp_registry.py platformctl/tests/test_validate.py platformctl/tests/test_smoke.py` — 19 passed. - `UV_CACHE_DIR=/tmp/uv-cache PYTHONPATH=control-plane uv run --project control-plane python -m platformctl.cli mcp-registry validate --json` — passed, 1 valid registry file. - `UV_CACHE_DIR=/tmp/uv-cache PYTHONPATH=control-plane uv run --project control-plane python -m platformctl.cli validate all --json` — passed, exitCode 0. Refs #131. Does not close #131; this is Slice A only.

codex added 1 commit

2026-06-04 11:11:57 +02:00

feat(mcp): add Kan registry validation slice

canary-required / collect-diff (pull_request) Successful in 4s

Details

patchwarden-client-dry-run / collect-diff (pull_request) Successful in 4s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 4s

Details

python-ci / Python 3.12 (pull_request) Successful in 43s

Details

canary-required / canary (pull_request) Successful in 14s

Details

patchwarden-client-dry-run / dry-run (pull_request) Successful in 18s

Details

patchwarden-pr-sanity / sanity (pull_request) Successful in 3m41s

Details

base-is-main / guard (pull_request) Successful in 1s

Details

platformctl plan / auto-apply scope (pull_request) Successful in 19s

Details

pyfallow / Pyfallow gate (control-plane) (pull_request) Successful in 17s

Details

python-ci / Python 3.11 (pull_request) Successful in 41s

Details

python-ci / Python 3.13 (pull_request) Successful in 43s

Details

62c1f7528c

codex commented

2026-06-04 11:19:10 +02:00

Author

Collaborator

Patchwarden PR sanity

Status: advisory_findings
PR: 705
Commit: 62c1f7528cdd9132b4997f85e39ca66312d52407
Security-sensitive label: missing
Authority: advisory model review plus deterministic blockers only
3+3 canary: still alive; this does not replace it

Deterministic findings

info sensitive-path-touched Sensitive path touched — schema/mcp-registry.schema.json
- Evidence: schema/mcp-registry.schema.json
- Next: Route through the existing 3+3/risk-tier process; model review remains advisory.
info sensitive-path-touched Sensitive path touched — schema/mcp-registry.schema.md
- Evidence: schema/mcp-registry.schema.md
- Next: Route through the existing 3+3/risk-tier process; model review remains advisory.
info sensitive-path-touched Sensitive path touched — schema/module.schema.json
- Evidence: schema/module.schema.json
- Next: Route through the existing 3+3/risk-tier process; model review remains advisory.
info sensitive-path-touched Sensitive path touched — schema/module.schema.md
- Evidence: schema/module.schema.md
- Next: Route through the existing 3+3/risk-tier process; model review remains advisory.

Model reviewers

`global-glm` / `glm-5.1:cloud`

Status: ok
Verdict: OK
Findings: none

`global-deepseek` / `deepseek-v4-pro:cloud`

Status: ok
Verdict: NOT_OK
high Undeclared dependencies: jsonschema and yaml
- Evidence: control-plane/platformctl/mcp_registry.py adds imports for jsonschema and yaml, but no corresponding dependency declaration (e.g., in pyproject.toml) is included in the diff.
- Next: Ensure jsonschema and PyYAML are declared in the project's dependency file, or confirm they are already present and the change is intentional.

`redteam` / `kimi-k2.6:cloud`

Status: ok
Verdict: NOT_OK
high Module mcp_servers references are not validated against registry entries
- Evidence: schema/module.schema.json only validates mcp_servers items with a loose string pattern (^[a-z][a-z0-9-]*[a-z0-9]$); control-plane/platformctl/mcp_registry.py validates registry files in isolation with no cross-reference logic; modules/openc
- Next: Extend platformctl validate all (or mcp-registry validate) to verify that every spec.dependencies.mcp_servers entry in module manifests matches a validated registry policy name.

Policy notes

GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot.
Optional red-team model is enabled only when PLATFORMCTL_PR_SANITY_REDTEAM_MODEL is configured.
Auto-merge is not enabled here.

# Patchwarden PR sanity - Status: `advisory_findings` - PR: `705` - Commit: `62c1f7528cdd9132b4997f85e39ca66312d52407` - Security-sensitive label: `missing` - Authority: advisory model review plus deterministic blockers only - 3+3 canary: still alive; this does not replace it ## Deterministic findings - **`info` `sensitive-path-touched`** Sensitive path touched — `schema/mcp-registry.schema.json` - Evidence: `schema/mcp-registry.schema.json` - Next: Route through the existing 3+3/risk-tier process; model review remains advisory. - **`info` `sensitive-path-touched`** Sensitive path touched — `schema/mcp-registry.schema.md` - Evidence: `schema/mcp-registry.schema.md` - Next: Route through the existing 3+3/risk-tier process; model review remains advisory. - **`info` `sensitive-path-touched`** Sensitive path touched — `schema/module.schema.json` - Evidence: `schema/module.schema.json` - Next: Route through the existing 3+3/risk-tier process; model review remains advisory. - **`info` `sensitive-path-touched`** Sensitive path touched — `schema/module.schema.md` - Evidence: `schema/module.schema.md` - Next: Route through the existing 3+3/risk-tier process; model review remains advisory. ## Model reviewers ### `global-glm` / `glm-5.1:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ### `global-deepseek` / `deepseek-v4-pro:cloud` - Status: `ok` - Verdict: `NOT_OK` - **`high`** Undeclared dependencies: jsonschema and yaml - Evidence: `control-plane/platformctl/mcp_registry.py adds imports for jsonschema and yaml, but no corresponding dependency declaration (e.g., in pyproject.toml) is included in the diff.` - Next: Ensure jsonschema and PyYAML are declared in the project's dependency file, or confirm they are already present and the change is intentional. ### `redteam` / `kimi-k2.6:cloud` - Status: `ok` - Verdict: `NOT_OK` - **`high`** Module mcp_servers references are not validated against registry entries - Evidence: `schema/module.schema.json only validates mcp_servers items with a loose string pattern (^[a-z][a-z0-9-]*[a-z0-9]$); control-plane/platformctl/mcp_registry.py validates registry files in isolation with no cross-reference logic; modules/openc` - Next: Extend platformctl validate all (or mcp-registry validate) to verify that every spec.dependencies.mcp_servers entry in module manifests matches a validated registry policy name. ## Policy notes - GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot. - Optional red-team model is enabled only when `PLATFORMCTL_PR_SANITY_REDTEAM_MODEL` is configured. - Auto-merge is not enabled here.