# Phase 165.4-02 Summary

Status: implemented in working tree

## Goal

Open `165.4 / 999.75` by replacing prompt-only "do not edit" expectations for
review and skeptic agents with a mechanical MCP profile boundary.

The boundary should make review-oriented agents physically unable to call
write-capable AITP MCP tools, while still leaving the normal full-control AITP
server available for controller/operator lanes.

## What Landed

- new profile support module:
  - `knowledge_hub/aitp_mcp_profiles.py`
- `knowledge_hub/aitp_mcp_server.py` now:
  - classifies each MCP tool as `read` or `write`
  - builds profile-specific FastMCP servers through `build_mcp_server(...)`
  - honors `AITP_MCP_PROFILE=full|review|skeptic`
  - exposes profile metadata tools:
    - `aitp_describe_mcp_profile`
    - `aitp_list_tool_manifest`
- `review` and `skeptic` MCP profiles now register only the read-only subset:
  - `aitp_describe_mcp_profile`
  - `aitp_get_runtime_state`
  - `aitp_list_tool_manifest`
- all write-capable orchestration / promotion / loop / install tools stay
  available only on the full profile
- agent install surfaces now support role-specific MCP setup via:
  - `aitp install-agent --mcp-profile full|review|skeptic`
- profile-specific MCP installs now materialize distinct server names:
  - `aitp`
  - `aitp-review`
  - `aitp-skeptic`
- OpenCode / Claude Code / Codex / OpenClaw setup payloads now inject
  `AITP_MCP_PROFILE` for non-full installs so the server-side exclusion is
  enforced mechanically, not by prompt text

## Verification

- `python -m pytest research/knowledge-hub/tests/test_aitp_mcp_server.py -q`
- `python -m pytest research/knowledge-hub/tests/test_aitp_cli.py -q`
- `python -m pytest research/knowledge-hub/tests/test_aitp_service.py -q`
- `python -m pytest research/knowledge-hub/tests -q`

## Outcome

`165.4` now has a real schema/tool-surface isolation slice:

- review and skeptic agents can be pointed at a server manifest that does not
  contain write tools at all
- full-control agent installs remain available, but no longer need to share the
  same MCP server identity as read-only reviewer lanes
- the isolation boundary is durable, inspectable, and test-backed

## Remaining Open Work Inside 165.4

- `999.74` context injection with dedup
- `999.76` JSONL metrics for self-evolution
- `999.77` derivation loop detection
- `999.78` manifest-as-truth-source
