Expose and verify the gateway-safe MCP workflow

[yia-mw-agent]

Parent

• PRD: Dedicated FAVA Data Repo MCP Tunnel for ChatGPT #67

What to build

Expose a conservative MCP tool workflow for the dedicated ChatGPT gateway and verify it end to end through MCP behavior. ChatGPT should be able to discover scopes, recall promoted thoughts, retrieve a thought, save a draft, propose truth through the Trust Gate, and sync shared truth. Admin or destructive tools should not be available by default in this gateway profile.

This slice should preserve one shared semantic tool registry across normal stdio and gateway mode so tool schemas and behavior do not drift. Any gateway-specific filtering should be explicit, tested, and visible through MCP list-tools behavior.

Acceptance criteria

• Gateway list-tools exposes the ChatGPT-safe workflow needed for scope discovery, recall, thought retrieval, draft save, truth proposal, and sync.
• Existing stdio list-tools behavior remains unchanged outside gateway mode.
• Gateway mode blocks admin/destructive operations such as rollback-style or forget-style actions unless separately enabled by explicit configuration.
• Gateway calls require explicit trail_name where scoped tools need it, and error clearly when it is missing.
• End-to-end MCP tests cover list-tools, recall, save draft, propose truth, and sync through the gateway runtime or profile.
• Tests cover missing or invalid startup configuration and blocked admin/destructive tool access.

Blocked by

• Add a dedicated ChatGPT gateway runtime #64

Delivery verification — 2026-09-07

All criteria are satisfied by the existing governed shared MCP registry plus merged PR #96 (6c5278a40a86246014901a88417f3455a46cdfcc). Four committed HTTP integration tests exercise real server initialization, list-tools, discovery, explicit-scope validation, draft save and ownership, denied history/identity spoof/rollback/forget, normal proposal persistence, actual local Git sync, governed readback, and dirty-repository sync refusal. Only the external LLM evaluator result is substituted in these tests. Three legacy protocol versions are covered. Existing startup/configuration and installed-stdio tests remain intact.

Independent review accepted the original patch and exact integrated head 8c334d60e619ce73ae945ebd4fa4f2627c917786; the four HTTP tests passed independently again, the851-test combined suite passed, and all GitHub checks were green. The deployed ordinary private gateway separately passed real configured Trust Gate approval and ordinary sync, then approved readback through the actual connected FAVA tool after a gateway-only restart. Destructive/admin operations remain unavailable to its ordinary principal; no operator grant was added for sync.