#1212 — Directory-bound V1 MCP capability/config primitive

Completed scope: node-local loopback HTTP MCP capability, independent full saved
network/node/Host-instance/canonical-directory/exact-session binding, fresh admitted
Host authority and actual native exact-session/directory before each forward.
Hub credential stays in bridge memory; wrong network refuses and outbound sender
uses original node alias. Unique directory lease/private config and recovery files
preserve provider/model/other MCP. Close revokes connections/capability, restores
only unchanged owned inode/bytes; edited files remain with private recovery records.

Host default remains deny-all. Explicit --scoped-commhub-mcp permits commhub_*
only with all pinned built-ins denied, and persists the policy choice. Retained
Host roots cannot silently switch that policy. Versioned entry, config/secret
handling, startup/ports/upgrade/rollback and recovery boundaries are in
agent-node/src/runtime/opencode-copresence/v1-scoped-mcp.ts and
deploy/node/opencode-v1-host/{start.ts,README.md,supervisor.service.template}.

Source PR: https://github.com/sleep2agi/agent-network/pull/2733
Exact final head: 8482ae2edef96ce799ac118448ff127e03c2065b
Ordinary main merge: f430ddf29b21dbc1a15de5b1a82ac104cddf6ab3
Merged: 2026-10-14T06:00:52Z. Fresh main ancestry verified.
10 protected required checks, mutation pin check and all EIGHT focused Docker
jobs SUCCESS before ordinary merge. CI checkout/test merge:
be697e9b1ab30ebaf546fbdf43b06f1ff48e204f (artifact source label, not a release).

All eight artifacts downloaded and independently read, two exact versions
1.18.1 / 1.18.34, non-root/network-none Docker, synthetic local MCP/model/auth:
- Scoped MCP run 38519434926: jobs 115705510624 / 115705510348 SUCCESS,
  artifacts 11873116753 / 11873650801. Each nine native PASS checkpoints:
  explicit Host policy; private config preserves provider/model/other MCP and
  directory POST /mcp connects without dispose; same-directory identity refuses;
  actual two exact sessions call their original node identities with built-ins
  absent; wrong capability/network/all five binding fields/Host incarnation refuse
  before Hub and outbound sender remains original node; native foreign-session
  200 fails proxy scope; edited config survives cleanup with revoked capability;
  concurrent close A restores exact bytes and B's MCP/session/shared Host still
  works; retained Host cannot silently switch policy.
- Host launcher run 38519434990: jobs 115705511198 / 115705510945 SUCCESS,
  artifacts 11873496215 / 11872549827. Each seven native lifecycle PASS points,
  including startup SIGTERM/no lingering listener, conflict refusal, new incarnation
  and persistent histories. Existing default/owned Host regression, not Node opt-in.
- Host input admission run 38519434918: jobs 115705510306 / 115705510061 SUCCESS,
  artifacts 11873151651 / 11873281611. Each 29 refusals plus valid descriptor ->
  native exact session PASS; input admission remains distinct from live authority.
- Owned checkpoint run 38519434996: jobs 115705511212 / 115705511369 SUCCESS,
  artifacts 11873520975 / 11872973979. Each six unit tests/zero failures and
  seven native PASS points; owned regression, not shared-aware migration/rollback.

Measured config behavior in BOTH pinned native versions: initial project load
adds $schema. Tests prove that annotation changes no other project inputs, then
capture actual pre-proxy bytes. After writing scoped proxy project configuration,
GET /config still reports cached state without the proxy in both directories.
Directory POST /mcp registers it live and actual synthetic model tool calls work.
File installation or GET /config alone therefore cannot publish Node readiness.
Proxy close revokes its connection; native client/cache reconciliation and exact
own-MCP disconnect are consumer work, not implemented Node lifecycle completion.

Failure history is retained: initial head 4808981859902dae22b3ac58862fdef6acf43aeb
run 38519119041 and intermediate head 67c1b359aafcf3c56682706e093c38f072996eb6
run 38519203969 failed both versions on the fixture's restoration-byte baseline:
V1 had added $schema before the proxy captured its original bytes, while the
fixture compared against pre-load bytes. First five native checkpoints already
passed, but these failed runs are not final qualification or guard negative controls.
Only the fixture baseline was corrected to post-native/pre-proxy bytes, with
annotation-only equality asserted. Production proxy/guard was not weakened.
Initial mutation-pin run 38519119058 also failed because a dynamic token assertion
was classified as an unchecked mutation. An equivalent literal synthetic-token
assertion passed the unchanged ratchet; no baseline increase or bypass.
Own broad QA 38519119050 / 38519203845 were superseded/cancelled; final broad
QA 38519435148 cancellation requested after focused/required qualification.
No full broad QA pass is claimed. Facts-only follow-up records existing evidence,
not another healthy native sweep.

Rebuild: tests/test1212-v1-scoped-mcp/Dockerfile plus
.github/workflows/v1-scoped-mcp-core.yml pin Bun 1.3.14 image digest/source and
exact wrapper/platform integrity from test1194. Packages install inside disposable
Docker only. Real Hub tokens, vendor credentials, histories and identities are not
in Git; actual encrypted-backup location/retention/authority remains Owner work.
Edited recovery records/stale directory leases require explicit Owner inspection,
never automatic takeover or secret/config dumps.

Limits: these are two node-local MCP proxies and native sessions on one Host,
not two complete borrowed Node runtimes. MCP has no trusted initiating session or
human/network turn identity; the uniquely leased directory/full saved binding is
a cooperative accidental-crosswire guard, not malicious-peer tenant security.
Ready/turn/FIFO/timeout/unknown-write/abort/TUI integration and exact own native
MCP reconciliation/disconnect remain #1195 (next #1214); shared migration/final
checkpoint/rollback and original Owner canary remain #1196. No global/directory
dispose, production adoption, running node/thread/model/login/real credential or
history changes, global package change or public package release.
