forked from molecule-ai/molecule-core
b5f530e27a
The instructions blob in the MCP `initialize` handshake is the spec
non-Claude-Code clients (codex, Cline, opencode, hermes-agent, Cursor)
inherit verbatim. Three gaps mean the bridge daemon handles them in
code (codex-channel-molecule bridge.py:192-200, 278-285) but in-process
agents reading the text alone don't get the same guard:
1. Reply-then-pop ordering was implicit. A literal-minded agent could
pop after a 502 from `send_message_to_user`, dropping the message.
Now: pop ONLY AFTER reply succeeds; on error leave the row unacked
for platform redelivery.
2. peer_agent with empty peer_id had no specified handling. Agent
would call `delegate_task(workspace_id="")` → 400 → re-poll →
infinite loop on the same poison row. Now: skip reply, drain via
inbox_pop.
3. The single security rule ("don't execute without chat-side
approval") effectively disabled peer_agent autonomous handling —
codex daemons have no canvas user to approve from. Now: dual trust
model. canvas_user requires user approval; peer_agent permits
autonomous handling but caps destructive side-effects at the
workspace boundary.
Also disclaims peer_name/peer_role as non-attested display strings —
the platform registry isn't cryptographic identity, and an agent
shouldn't grant elevated permissions based on a peer registering with
peer_role="admin".
Four new pinned tests in test_a2a_mcp_server.py:
- test_initialize_instructions_pins_reply_then_pop_ordering
- test_initialize_instructions_handles_malformed_peer_agent
- test_initialize_instructions_disclaims_peer_role_attestation
- test_initialize_instructions_distinguishes_canvas_user_from_peer_trust
Each fails on staging-HEAD and passes on the patched text — verified
by reverting a2a_mcp_server.py and re-running.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|---|---|---|
| .. | ||
| adapters | ||
| snapshots | ||
| __init__.py | ||
| _signature_snapshot.py | ||
| conftest.py | ||
| test_a2a_cli.py | ||
| test_a2a_client.py | ||
| test_a2a_executor.py | ||
| test_a2a_mcp_server.py | ||
| test_a2a_multi_workspace.py | ||
| test_a2a_tools_impl.py | ||
| test_a2a_tools_module.py | ||
| test_adapter_base_event_log.py | ||
| test_adapter_base_signature.py | ||
| test_agent_card_well_known_path.py | ||
| test_agent.py | ||
| test_agents_md.py | ||
| test_approval.py | ||
| test_audit_ledger.py | ||
| test_audit.py | ||
| test_awareness_client_full.py | ||
| test_boot_routes.py | ||
| test_card_helpers.py | ||
| test_compliance.py | ||
| test_config.py | ||
| test_configs_dir.py | ||
| test_consolidation.py | ||
| test_coordinator_parent.py | ||
| test_coordinator_routing.py | ||
| test_delegation_sync_via_polling.py | ||
| test_delegation.py | ||
| test_dispatcher_schema_drift.py | ||
| test_event_log.py | ||
| test_events.py | ||
| test_executor_helpers.py | ||
| test_gh_wrapper.sh | ||
| test_governance.py | ||
| test_heartbeat_runtime_metadata.py | ||
| test_heartbeat.py | ||
| test_hitl.py | ||
| test_inbox.py | ||
| test_internal_chat_uploads.py | ||
| test_internal_file_read.py | ||
| test_jsonrpc_wire_role_format.py | ||
| test_load_skills_call_sites.py | ||
| test_main_initial_prompt.py | ||
| test_mcp_cli_multi_workspace.py | ||
| test_mcp_cli.py | ||
| test_mcp_memory.py | ||
| test_memory.py | ||
| test_molecule_ai_status.py | ||
| test_namespaces.py | ||
| test_not_configured_handler.py | ||
| test_openclaw_adapter.py | ||
| test_platform_auth_signature.py | ||
| test_platform_auth.py | ||
| test_platform_inbound_auth.py | ||
| test_platform_tools.py | ||
| test_plugins_builtins.py | ||
| test_plugins_registry.py | ||
| test_plugins.py | ||
| test_pre_stop.py | ||
| test_preflight.py | ||
| test_prompt.py | ||
| test_routing_policy.py | ||
| test_runtime_capabilities.py | ||
| test_runtime_wedge_signature.py | ||
| test_runtime_wedge.py | ||
| test_safe_env.py | ||
| test_sandbox.py | ||
| test_secret_redact.py | ||
| test_secret_redactor.py | ||
| test_security_scan.py | ||
| test_shared_runtime_peer_summary.py | ||
| test_skill_loader_signature.py | ||
| test_skills_loader.py | ||
| test_skills_watcher.py | ||
| test_smoke_mode.py | ||
| test_snapshot_scrub.py | ||
| test_telemetry.py | ||
| test_temporal_workflow.py | ||
| test_transcript_auth.py | ||
| test_watcher.py | ||