fix(scope): selectable-profile predicate on /mcp/p and set_profile with one non-disclosing refusal (Spec 105 PR D, FR-003/004) - #1283

Merged

Dumbris merged 24 commits into

mainfrom

105-d-profiles

Sep 19, 2026

Commits on Sep 17, 2026

test(scope): Spec 105 PR D red phase — selectable-profile predicate on /mcp/p and set_profile (FR-003/004, FR003-G1..G8)

Dumbris
and
claude
committed
e49986d
feat(scope): Spec 105 PR D — selectable-profile predicate on /mcp/p and set_profile (FR-003/004, FR003-G1..G8, D1)

Dumbris
and
claude
committed
d3e436c
fix(scope): PR D critique round 1 — admin set_profile parity, single-snapshot resolver, operator log on profile-URL refusals, fail-closed nil-config auth

Dumbris
and
claude
committed
5a15b14
fix(scope): PR D codex round 1 — constant-traversal selectable-profile predicate

Dumbris
and
claude
committed
e5d2c53
fix(scope): PR D codex round 2 — O(1)-in-the-fleet profile-URL gate

Dumbris
and
claude
committed
7ca51e4
fix(scope): PR D codex round 3 — precomputed per-profile reach, O(1) set_profile refusal, warmed index

Dumbris
and
claude
committed
be86444
fix(scope): PR D review round 4 — reach costs the reader's grant, never the fleet

Dumbris
and
claude
committed
dbea6d7
fix(scope): PR D review round 5 — index every snapshot before publication; two-slot cache no request can roll back

Dumbris
and
claude
committed
0a2f961
fix(scope): PR D review round 6 — requests take the profile index and its snapshot as one pair; observers may register observers

Dumbris
and
claude
committed
d063d69
fix(scope): PR D review round 8 — request-visible profile index tracks the published snapshot, not the one ahead of it

Dumbris
and
claude
committed
146efc9
test(server): let background initialization settle before profile gate tests run

Dumbris
and
claude
committed
2156549
test(server): measure the pin-outcome allocation parity without process-wide noise

Dumbris
and
claude
committed
4f12b8b
fix(scope): PR D review round 9 — set_profile decides with the URL gate's admitted (index, snapshot) pair, and a pin mismatch refuses like any other non-selectable profile

Dumbris
and
claude
committed
d4ee963
fix(scope): PR D review round 11 — acquire the profile-index pair atomically, never a stale read-then-match

Dumbris
and
claude
committed
c2739d9
docs(scope): PR D review round 13 — refute the synchronous observer-cost finding with a file:line trace and measurement

Dumbris
and
claude
committed
5838e97
fix(scope): admitted scoped reads render servers from the profile index, never a fleet walk (Spec 105 PR D review round 14 — MUST-FIX)

Dumbris
and
claude
committed
c8d41d9
fix(scope): resolveActiveProfile decides straight from the admitted pair (Spec 105 PR D review round 15 — MUST-FIX)

Dumbris
and
claude
committed
b23d7a7
fix(scope): cache producer/reader stamp intersects an agent token's own grant with its profile (Spec 105 PR D review round 17 — MUST-FIX)

Dumbris
and
claude
committed
4ba12d3

Commits on Sep 18, 2026

Merge origin/main into 105-d-profiles

Dumbris
and
claude
committed
303f582
fix(scope): merge-driven collisions + cross-model review round 1 fixes

Dumbris
and
claude
committed
f693400
fix(scope): dedupe caller grant before expanding declaredOccurrences

Dumbris
and
claude
committed
65a31d8
fix(scope): resolve only the profile name for set_profile's slug-race fix

Dumbris
and
claude
committed
6744a9c
Merge origin/main into 105-d-profiles (second pass: #1296, #1285 landed)

Dumbris
and
claude
committed
4fc1ce8
Merge origin/main into 105-d-profiles (third pass: #1284 and dependabot bumps landed)

Dumbris
and
claude
committed
5b9851b

Navigation Menu

fix(scope): selectable-profile predicate on /mcp/p and set_profile with one non-disclosing refusal (Spec 105 PR D, FR-003/004) - #1283

fix(scope): selectable-profile predicate on /mcp/p and set_profile with one non-disclosing refusal (Spec 105 PR D, FR-003/004)#1283
Dumbris merged 24 commits into
mainfrom
105-d-profiles

Commits on Sep 17, 2026

test(scope): Spec 105 PR D red phase — selectable-profile predicate on /mcp/p and set_profile (FR-003/004, FR003-G1..G8)

feat(scope): Spec 105 PR D — selectable-profile predicate on /mcp/p and set_profile (FR-003/004, FR003-G1..G8, D1)

fix(scope): PR D critique round 1 — admin set_profile parity, single-snapshot resolver, operator log on profile-URL refusals, fail-closed nil-config auth

fix(scope): PR D codex round 1 — constant-traversal selectable-profile predicate

fix(scope): PR D codex round 2 — O(1)-in-the-fleet profile-URL gate

fix(scope): PR D codex round 3 — precomputed per-profile reach, O(1) set_profile refusal, warmed index

fix(scope): PR D review round 4 — reach costs the reader's grant, never the fleet

fix(scope): PR D review round 5 — index every snapshot before publication; two-slot cache no request can roll back

fix(scope): PR D review round 6 — requests take the profile index and its snapshot as one pair; observers may register observers

fix(scope): PR D review round 8 — request-visible profile index tracks the published snapshot, not the one ahead of it

test(server): let background initialization settle before profile gate tests run

test(server): measure the pin-outcome allocation parity without process-wide noise

fix(scope): PR D review round 9 — set_profile decides with the URL gate's admitted (index, snapshot) pair, and a pin mismatch refuses like any other non-selectable profile

fix(scope): PR D review round 11 — acquire the profile-index pair atomically, never a stale read-then-match

docs(scope): PR D review round 13 — refute the synchronous observer-cost finding with a file:line trace and measurement

fix(scope): admitted scoped reads render servers from the profile index, never a fleet walk (Spec 105 PR D review round 14 — MUST-FIX)

fix(scope): resolveActiveProfile decides straight from the admitted pair (Spec 105 PR D review round 15 — MUST-FIX)

fix(scope): cache producer/reader stamp intersects an agent token's own grant with its profile (Spec 105 PR D review round 17 — MUST-FIX)

Commits on Sep 18, 2026

Merge origin/main into 105-d-profiles

fix(scope): merge-driven collisions + cross-model review round 1 fixes

fix(scope): dedupe caller grant before expanding declaredOccurrences

fix(scope): resolve only the profile name for set_profile's slug-race fix

Merge origin/main into 105-d-profiles (second pass: #1296, #1285 landed)

Merge origin/main into 105-d-profiles (third pass: #1284 and dependabot bumps landed)