golem15/summercms
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(08-09): complete the fail-closed Phase 8 final unchanged-MCP gate

Browse Source 
Fills in every scripts/check-phase8.sh stage skeleton with real logic:
disposable Postgres (docker run + pg_isready), the assembled Go app built
and served against it with a throwaway onboarding-seeded gate account,
the real unchanged fonoteka-mcp process started with all three required
environment variables, and the full scripted SDK lifecycle -- discovery
(MCP's own RFC 9728 401 hint, verified separately from authorization
server metadata), DCR, PKCE authorize, JWT login/consent, token, an MCP
tool call, refresh, replay of the spent refresh token, revoke, and a
post-revoke refresh failure -- delegated to the new
scripts/check-phase8-mcp-client.mjs driver, which resolves the MCP SDK's
auth helpers from fonoteka-mcp's own node_modules (no new dependency,
same pattern as parity/capture_clients.mjs). Both repositories'
vet/test/race, the full parity/corpus/secret-scan gate, the existing
check-phase8-ui.mjs --final-gate UI harness, an unchanged-client git-diff
check for both MCP_ROOT and NUXT_ROOT, and a 08-SECURITY-REVIEW.md
status:verified gate close out the stage list.

--contract-self-test validates structure only (stage names/order,
cleanup trap, loopback-only binding, the three MCP env vars, the
redaction helper, no pre-final full-run flag, read-only unchanged-client
references) in well under 30 seconds -- it boots no services. The
--red-contract self-test from Task 1 is preserved unchanged. run_full_gate
(the no-flag invocation) is 08-10 Task 3's sole execution site; 08-09
never invokes it.
This commit is contained in:
Jakub Zych
2026-09-23 23:18:15 +02:00
parent 6cc07a42e2
commit e87346f9e3
2 changed files with 520 additions and 74 deletions
Download Patch File Download Diff File Expand all files Collapse all files

317
scripts/check-phase8-mcp-client.mjs Executable file
View File

@@ -0,0 +1,317 @@
#!/usr/bin/env node
/**
* check-phase8-mcp-client.mjs -- the scripted MCP client D-14 requires:
* discovery, DCR, PKCE authorize, JWT login/consent, token, an MCP tool
* call, refresh, replay, revoke, and post-revoke failure, driven against
* the REAL unchanged fonoteka-mcp process and the assembled Go backend.
* Never modifies fonoteka-mcp or Nuxt source; resolves the MCP SDK's auth
* helpers from fonoteka-mcp's own node_modules exactly like
* parity/capture_clients.mjs does (no new dependency in either repo).
*
* Invoked once per named stage by scripts/check-phase8.sh's stage_*
* functions, each stage reading/writing a small JSON state file so later
* stages (refresh, revoke) can reuse earlier captures (tokens, request
* ids) without re-running the whole sequence. Only 08-10 Task 3 invokes
* this end to end; 08-09 never runs it.
*
* Required env:
* FONOTEKA_API_URL Go app origin (personal-token API, and the
* same origin's JWT-group user/session API).
* FONOTEKA_MCP_PUBLIC_URL The MCP resource server's own base URL.
* FONOTEKA_MCP_AUTH_SERVER The Go authorization server's base URL
* (normally identical to FONOTEKA_API_URL).
* PHASE8_GATE_STATE Path to the JSON state file.
* PHASE8_GATE_EMAIL/PASSWORD Credentials for the JWT login/consent
* steps, seeded by the app-boot stage.
*
* Every raw secret/token/code/verifier this script would otherwise print
* is redacted before it reaches stdout/stderr (T-08-REQUEST-LEAK).
*/
import { createRequire } from 'node:module'
import { pathToFileURL } from 'node:url'
import { readFileSync, writeFileSync, existsSync } from 'node:fs'
const MCP_PKG = '/media/nvme/dev/golem15/fonoteka/fonoteka-mcp/package.json'
function redact(s) {
return String(s)
.replace(/inv_[A-Za-z0-9_-]{8,}/g, '<redacted-inv>')
.replace(/eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g, '<redacted-jwt>')
.replace(/("access_token"|"refresh_token"|"code_verifier"|"client_secret")\s*:\s*"[^"]*"/g, '$1:"<redacted>"')
}
function log(msg) {
process.stderr.write(`[check-phase8-mcp-client] ${redact(msg)}\n`)
}
function fail(msg) {
log(`FAIL: ${msg}`)
process.exit(1)
}
function env(name, required = true) {
const v = process.env[name]
if (required && (!v || !v.trim())) fail(`missing required env ${name}`)
return v
}
function loadState(path) {
if (!existsSync(path)) return {}
return JSON.parse(readFileSync(path, 'utf8'))
}
function saveState(path, state) {
writeFileSync(path, JSON.stringify(state, null, 2), { mode: 0o600 })
}
async function loadAuthHelpers() {
const req = createRequire(MCP_PKG)
const mod = await import(pathToFileURL(req.resolve('@modelcontextprotocol/sdk/client/auth.js')).href)
return mod
}
async function loadClientTransport() {
const req = createRequire(MCP_PKG)
const clientMod = await import(pathToFileURL(req.resolve('@modelcontextprotocol/sdk/client/index.js')).href)
const httpMod = await import(pathToFileURL(req.resolve('@modelcontextprotocol/sdk/client/streamableHttp.js')).href)
return { Client: clientMod.Client, StreamableHTTPClientTransport: httpMod.StreamableHTTPClientTransport }
}
const REDIRECT_URI = 'http://127.0.0.1:8424/oauth/callback'
async function stageDiscovery(state) {
const mcpPublic = env('FONOTEKA_MCP_PUBLIC_URL')
const authServer = env('FONOTEKA_MCP_AUTH_SERVER')
const auth = await loadAuthHelpers()
// The resource server's own 401 hint (RFC 9728), owned by fonoteka-mcp,
// not the backend (D-12) -- verified separately from the backend's own
// exact Basic/no-challenge responses (stage_token below).
const probe = await fetch(new URL('/mcp', mcpPublic), { method: 'GET' })
if (probe.status !== 401) fail(`expected 401 from unauthenticated MCP endpoint, got ${probe.status}`)
const params = auth.extractWWWAuthenticateParams
? auth.extractWWWAuthenticateParams(probe)
: null
if (!params || !params.resourceMetadataUrl) {
fail('MCP 401 response is missing a resource_metadata WWW-Authenticate hint')
}
const resourceMetadata = await auth.discoverOAuthProtectedResourceMetadata(mcpPublic)
const metadata = await auth.discoverAuthorizationServerMetadata(authServer)
if (!metadata) fail('authorization server metadata discovery failed')
state.resourceMetadata = resourceMetadata
state.metadata = metadata
log('discovery OK')
}
async function stageDCR(state) {
const authServer = env('FONOTEKA_MCP_AUTH_SERVER')
const auth = await loadAuthHelpers()
const clientInformation = await auth.registerClient(authServer, {
metadata: state.metadata,
clientMetadata: {
client_name: 'Phase 8 final gate client',
redirect_uris: [REDIRECT_URI],
grant_types: ['authorization_code', 'refresh_token'],
response_types: ['code'],
token_endpoint_auth_method: 'none',
},
})
state.clientInformation = clientInformation
log('dcr OK')
}
async function stagePKCEAuthorize(state) {
const authServer = env('FONOTEKA_MCP_AUTH_SERVER')
const auth = await loadAuthHelpers()
const { authorizationUrl, codeVerifier } = await auth.startAuthorization(authServer, {
metadata: state.metadata,
clientInformation: state.clientInformation,
redirectUrl: REDIRECT_URI,
scope: 'read write',
state: 'phase8-gate',
})
const res = await fetch(authorizationUrl, { redirect: 'manual' })
if (res.status !== 302 && res.status !== 303 && res.status !== 307) {
fail(`authorize did not redirect (status ${res.status})`)
}
const location = res.headers.get('location')
if (!location) fail('authorize redirect has no Location header')
const requestId = new URL(location).searchParams.get('request')
if (!requestId) fail('authorize redirect is missing ?request=')
state.codeVerifier = codeVerifier
state.requestId = requestId
log('pkce-authorize OK')
}
async function stageJWTLoginConsent(state) {
const apiURL = env('FONOTEKA_API_URL')
const email = env('PHASE8_GATE_EMAIL')
const password = env('PHASE8_GATE_PASSWORD')
const loginRes = await fetch(new URL('/_user/api/v1/login', apiURL), {
method: 'POST',
headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
body: JSON.stringify({ email, password }),
})
if (loginRes.status !== 200) fail(`JWT login failed (status ${loginRes.status})`)
const { token } = await loginRes.json()
if (!token) fail('JWT login response has no token')
const showRes = await fetch(new URL(`/_fonoteka/api/v1/oauth/request/${state.requestId}`, apiURL), {
headers: { Accept: 'application/json', Authorization: `Bearer ${token}` },
})
if (showRes.status !== 200) fail(`consent request lookup failed (status ${showRes.status})`)
const consentRes = await fetch(new URL('/_fonoteka/api/v1/oauth/consent', apiURL), {
method: 'POST',
headers: { 'Content-Type': 'application/json', Accept: 'application/json', Authorization: `Bearer ${token}` },
body: JSON.stringify({ request_id: state.requestId, scopes: ['read', 'write'] }),
})
if (consentRes.status !== 200) fail(`consent failed (status ${consentRes.status})`)
const consentBody = await consentRes.json()
const redirectTo = consentBody?.data?.redirect_to
if (!redirectTo) fail('consent response has no redirect_to')
const code = new URL(redirectTo).searchParams.get('code')
if (!code) fail('consent redirect_to has no code')
state.jwt = token
state.code = code
log('jwt-login-consent OK')
}
async function stageToken(state) {
const authServer = env('FONOTEKA_MCP_AUTH_SERVER')
const auth = await loadAuthHelpers()
const tokens = await auth.exchangeAuthorization(authServer, {
metadata: state.metadata,
clientInformation: state.clientInformation,
authorizationCode: state.code,
codeVerifier: state.codeVerifier,
redirectUri: REDIRECT_URI,
})
if (!tokens.access_token || !tokens.refresh_token) fail('token exchange did not return both tokens')
state.accessToken = tokens.access_token
state.refreshToken = tokens.refresh_token
state.spentRefreshToken = tokens.refresh_token
log('token OK')
}
async function stageToolCall(state) {
const mcpPublic = env('FONOTEKA_MCP_PUBLIC_URL')
const { Client, StreamableHTTPClientTransport } = await loadClientTransport()
const transport = new StreamableHTTPClientTransport(new URL('/mcp', mcpPublic), {
requestInit: { headers: { Authorization: `Bearer ${state.accessToken}` } },
})
const client = new Client({ name: 'phase8-gate', version: '0.0.1' })
await client.connect(transport)
try {
const tools = await client.listTools()
if (!Array.isArray(tools.tools) || tools.tools.length === 0) fail('MCP tool list is empty')
const listGenres = tools.tools.find((t) => t.name === 'list_genres')
if (!listGenres) fail('list_genres tool not found')
const result = await client.callTool({ name: 'list_genres', arguments: {} })
if (result.isError) fail(`list_genres tool call reported an error: ${JSON.stringify(result)}`)
} finally {
await client.close().catch(() => {})
}
log('tool-call OK')
}
async function stageRefresh(state) {
const authServer = env('FONOTEKA_MCP_AUTH_SERVER')
const auth = await loadAuthHelpers()
const tokens = await auth.refreshAuthorization(authServer, {
metadata: state.metadata,
clientInformation: state.clientInformation,
refreshToken: state.refreshToken,
})
if (!tokens.access_token) fail('refresh did not return a new access token')
state.spentRefreshToken = state.refreshToken
state.accessToken = tokens.access_token
state.refreshToken = tokens.refresh_token || state.refreshToken
log('refresh OK')
}
async function stageReplay(state) {
const authServer = env('FONOTEKA_MCP_AUTH_SERVER')
const auth = await loadAuthHelpers()
let threw = false
try {
await auth.refreshAuthorization(authServer, {
metadata: state.metadata,
clientInformation: state.clientInformation,
refreshToken: state.spentRefreshToken,
})
} catch {
threw = true
}
if (!threw) fail('replaying the spent refresh token unexpectedly succeeded')
log('replay OK (spent refresh token correctly rejected)')
}
async function stageRevoke(state) {
const apiURL = env('FONOTEKA_API_URL')
const listRes = await fetch(new URL('/_fonoteka/api/v1/oauth/connected-apps', apiURL), {
headers: { Accept: 'application/json', Authorization: `Bearer ${state.jwt}` },
})
if (listRes.status !== 200) fail(`connected-apps list failed (status ${listRes.status})`)
const listBody = await listRes.json()
const app = (listBody.data || []).find((a) => a.name === 'Phase 8 final gate client')
if (!app) fail('connected-apps list does not show this gate client')
const delRes = await fetch(new URL(`/_fonoteka/api/v1/oauth/connected-apps/${app.id}`, apiURL), {
method: 'DELETE',
headers: { Accept: 'application/json', Authorization: `Bearer ${state.jwt}` },
})
if (delRes.status !== 200) fail(`connected-apps revoke failed (status ${delRes.status})`)
state.revokedAppId = app.id
log('revoke OK')
}
async function stagePostRevokeFailure(state) {
const authServer = env('FONOTEKA_MCP_AUTH_SERVER')
const auth = await loadAuthHelpers()
let threw = false
try {
await auth.refreshAuthorization(authServer, {
metadata: state.metadata,
clientInformation: state.clientInformation,
refreshToken: state.refreshToken,
})
} catch {
threw = true
}
if (!threw) fail('refreshing after revoke unexpectedly succeeded')
log('post-revoke-failure OK')
}
const STAGES = {
discovery: stageDiscovery,
dcr: stageDCR,
'pkce-authorize': stagePKCEAuthorize,
'jwt-login-consent': stageJWTLoginConsent,
token: stageToken,
'tool-call': stageToolCall,
refresh: stageRefresh,
replay: stageReplay,
revoke: stageRevoke,
'post-revoke-failure': stagePostRevokeFailure,
}
async function main() {
const stageArgIdx = process.argv.indexOf('--stage')
if (stageArgIdx === -1 || !process.argv[stageArgIdx + 1]) {
fail('usage: check-phase8-mcp-client.mjs --stage <name>')
}
const stageName = process.argv[stageArgIdx + 1]
const fn = STAGES[stageName]
if (!fn) fail(`unknown stage ${stageName}`)
const statePath = env('PHASE8_GATE_STATE')
const state = loadState(statePath)
await fn(state)
saveState(statePath, state)
}
main().catch((err) => fail(err?.stack || String(err)))

277
scripts/check-phase8.sh
View File

@@ -144,7 +144,7 @@ run_contract_self_test() {
}
echo "==> no pre-final full-run mode is offered"
if grep -qE -- '--pre-security|--pre-final' "$self"; then
if grep -qE -- '^\s*--pre-security\)|^\s*--pre-final\)' "$self"; then
echo "refuse: a pre-final full-run mode is offered" >&2
exit 1
fi
@@ -180,6 +180,7 @@ redact_phase8() {
PHASE8_CLEANUP_PIDS=()
PHASE8_CLEANUP_DIRS=()
PHASE8_CLEANUP_CONTAINERS=()
cleanup_phase8() {
local pid
@@ -188,6 +189,11 @@ cleanup_phase8() {
kill "$pid" 2>/dev/null || true
wait "$pid" 2>/dev/null || true
done
local c
for c in "${PHASE8_CLEANUP_CONTAINERS[@]:-}"; do
[[ -n "$c" ]] || continue
docker stop "$c" >/dev/null 2>&1 || true
done
local dir
for dir in "${PHASE8_CLEANUP_DIRS[@]:-}"; do
[[ -n "$dir" ]] || continue
@@ -215,14 +221,94 @@ stage_docker_preflight() {
}
}
PHASE8_WORKDIR=""
PHASE8_PG_CONTAINER=""
PHASE8_PG_PORT=""
PHASE8_APP_PORT="18423"
PHASE8_APP_URL="http://127.0.0.1:${PHASE8_APP_PORT}"
PHASE8_MCP_PORT="18100"
PHASE8_MCP_URL="http://127.0.0.1:${PHASE8_MCP_PORT}"
PHASE8_GATE_EMAIL="phase8-gate@parity.test"
PHASE8_GATE_PASSWORD="phase8-gate-pass"
PHASE8_MCP_CLIENT="$ROOT/scripts/check-phase8-mcp-client.mjs"
phase8_workdir() {
if [[ -z "$PHASE8_WORKDIR" ]]; then
PHASE8_WORKDIR="$(mktemp -d /tmp/summercms-phase8-XXXXXX)"
PHASE8_CLEANUP_DIRS+=("$PHASE8_WORKDIR")
fi
echo "$PHASE8_WORKDIR"
}
stage_postgres() {
echo "not yet implemented outside 08-10 Task 3" >&2
exit 1
local dir
dir="$(phase8_workdir)"
PHASE8_PG_CONTAINER="phase8-pg-$$"
docker run -d --rm --name "$PHASE8_PG_CONTAINER" \
-e POSTGRES_PASSWORD=phase8 -e POSTGRES_DB=fonoteka_phase8 \
-p 127.0.0.1::5432 postgres:16-alpine >/dev/null
PHASE8_CLEANUP_CONTAINERS+=("$PHASE8_PG_CONTAINER")
PHASE8_PG_PORT="$(docker port "$PHASE8_PG_CONTAINER" 5432/tcp | tail -1 | cut -d: -f2)"
if [[ -z "$PHASE8_PG_PORT" ]]; then
echo "refuse: could not determine disposable Postgres port" >&2
exit 1
fi
local tries=0
until docker exec "$PHASE8_PG_CONTAINER" pg_isready -U postgres >/dev/null 2>&1; do
tries=$((tries + 1))
if (( tries > 60 )); then
echo "refuse: disposable Postgres did not become ready" >&2
exit 1
fi
sleep 1
done
echo "$PHASE8_PG_PORT" >"$dir/pg_port"
}
stage_app_boot() {
echo "not yet implemented outside 08-10 Task 3" >&2
exit 1
local dir
dir="$(phase8_workdir)"
local dsn="postgres://postgres:phase8@127.0.0.1:${PHASE8_PG_PORT}/fonoteka_phase8?sslmode=disable"
(cd "$APP" && go build -o "$dir/fonoteka" .)
(
cd "$APP"
export SUMMER_DATABASE__DSN="$dsn"
export SUMMER_APP__URL="$PHASE8_APP_URL"
export SUMMER_APP__KEY="$(head -c32 /dev/urandom | base64)"
export SUMMER_GOLEM15__USER__JWT__SECRET="phase8-gate-jwt-secret-not-for-production"
"$dir/fonoteka" migrate
)
(
cd "$APP"
export SUMMER_DATABASE__DSN="$dsn"
export SUMMER_APP__URL="$PHASE8_APP_URL"
export SUMMER_APP__KEY="$(head -c32 /dev/urandom | base64)"
export SUMMER_GOLEM15__USER__JWT__SECRET="phase8-gate-jwt-secret-not-for-production"
nohup "$dir/fonoteka" serve --addr "127.0.0.1:${PHASE8_APP_PORT}" >"$dir/app.log" 2>&1 &
echo $! >"$dir/app.pid"
)
PHASE8_CLEANUP_PIDS+=("$(cat "$dir/app.pid")")
local tries=0
until curl -s -o /dev/null "$PHASE8_APP_URL/.well-known/oauth-authorization-server"; do
tries=$((tries + 1))
if (( tries > 60 )); then
echo "refuse: assembled app did not become ready ($(redact_phase8 <"$dir/app.log"))" >&2
exit 1
fi
sleep 1
done
# Seed the gate's own throwaway account via the real onboarding endpoint
# (matching TestOAuthFlows' seeding, but through HTTP since this stage
# drives the real listening app, not an in-process handler).
curl -s -X POST "$PHASE8_APP_URL/_fonoteka/api/v1/onboarding/bootstrap" \
-H "Content-Type: application/json" -H "Accept: application/json" \
-d "{\"org_name\":\"Phase 8 Gate\",\"email\":\"${PHASE8_GATE_EMAIL}\",\"password\":\"${PHASE8_GATE_PASSWORD}\"}" \
>/dev/null
}
stage_real_mcp() {
@@ -230,77 +316,86 @@ stage_real_mcp() {
echo "refuse: MCP_ROOT not found: $MCP_ROOT" >&2
exit 1
fi
# FONOTEKA_API_URL, FONOTEKA_MCP_PUBLIC_URL, FONOTEKA_MCP_AUTH_SERVER are
# exported here (only into the fonoteka-mcp child process, never into the
# gate's own persistent environment) once the app/Postgres stages above
# are live; 127.0.0.1-only.
echo "not yet implemented outside 08-10 Task 3" >&2
exit 1
local dir
dir="$(phase8_workdir)"
(
cd "$MCP_ROOT"
export FONOTEKA_API_URL="$PHASE8_APP_URL"
export FONOTEKA_MCP_PUBLIC_URL="$PHASE8_MCP_URL"
export FONOTEKA_MCP_AUTH_SERVER="$PHASE8_APP_URL"
export FONOTEKA_MCP_PORT="$PHASE8_MCP_PORT"
nohup npx --no-install tsx src/http.ts >"$dir/mcp.log" 2>&1 &
echo $! >"$dir/mcp.pid"
)
PHASE8_CLEANUP_PIDS+=("$(cat "$dir/mcp.pid")")
local tries=0
until curl -s -o /dev/null "$PHASE8_MCP_URL/mcp"; do
tries=$((tries + 1))
if (( tries > 60 )); then
echo "refuse: fonoteka-mcp did not become ready ($(redact_phase8 <"$dir/mcp.log"))" >&2
exit 1
fi
sleep 1
done
}
stage_discovery() {
echo "not yet implemented outside 08-10 Task 3" >&2
exit 1
phase8_mcp_stage() {
local stage="$1"
local dir
dir="$(phase8_workdir)"
(
export FONOTEKA_API_URL="$PHASE8_APP_URL"
export FONOTEKA_MCP_PUBLIC_URL="$PHASE8_MCP_URL"
export FONOTEKA_MCP_AUTH_SERVER="$PHASE8_APP_URL"
export PHASE8_GATE_STATE="$dir/gate-state.json"
export PHASE8_GATE_EMAIL PHASE8_GATE_PASSWORD
node "$PHASE8_MCP_CLIENT" --stage "$stage"
) 2>&1 | redact_phase8
}
stage_dcr() {
echo "not yet implemented outside 08-10 Task 3" >&2
exit 1
}
stage_pkce_authorize() {
echo "not yet implemented outside 08-10 Task 3" >&2
exit 1
}
stage_jwt_login_consent() {
echo "not yet implemented outside 08-10 Task 3" >&2
exit 1
}
stage_token() {
echo "not yet implemented outside 08-10 Task 3" >&2
exit 1
}
stage_tool_call() {
echo "not yet implemented outside 08-10 Task 3" >&2
exit 1
}
stage_refresh() {
echo "not yet implemented outside 08-10 Task 3" >&2
exit 1
}
stage_replay() {
echo "not yet implemented outside 08-10 Task 3" >&2
exit 1
}
stage_revoke() {
echo "not yet implemented outside 08-10 Task 3" >&2
exit 1
}
stage_post_revoke_failure() {
echo "not yet implemented outside 08-10 Task 3" >&2
exit 1
}
stage_discovery() { phase8_mcp_stage discovery; }
stage_dcr() { phase8_mcp_stage dcr; }
stage_pkce_authorize() { phase8_mcp_stage pkce-authorize; }
stage_jwt_login_consent() { phase8_mcp_stage jwt-login-consent; }
stage_token() { phase8_mcp_stage token; }
stage_tool_call() { phase8_mcp_stage tool-call; }
stage_refresh() { phase8_mcp_stage refresh; }
stage_replay() { phase8_mcp_stage replay; }
stage_revoke() { phase8_mcp_stage revoke; }
stage_post_revoke_failure() { phase8_mcp_stage post-revoke-failure; }
stage_vet_test_race() {
echo "not yet implemented outside 08-10 Task 3" >&2
exit 1
local name dir
for name in "$ROOT" "$APP"; do
(
cd "$name"
go vet ./...
go test ./...
go test -race ./...
)
done
}
stage_parity_corpus() {
echo "not yet implemented outside 08-10 Task 3" >&2
exit 1
(
cd "$APP"
go test ./parity -count=1
go run ./parity/check_corpus.go --manifest parity/manifest.yaml --fixtures parity/fixtures \
--require-recorded --require-clients --check-secrets
)
}
stage_secret_scan() {
echo "not yet implemented outside 08-10 Task 3" >&2
exit 1
# check_corpus.go --check-secrets above already scans every fixture;
# this stage additionally scans this gate's own working directory so a
# captured log line never carries a live secret past cleanup.
local dir
dir="$(phase8_workdir)"
if grep -RIlE 'inv_[A-Za-z0-9_-]{8,}|eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+' "$dir" >/dev/null 2>&1; then
echo "refuse: a live credential-shaped value was found in the gate's own working directory" >&2
exit 1
fi
}
stage_ui_harness() {
@@ -308,25 +403,59 @@ stage_ui_harness() {
echo "refuse: NUXT_ROOT not found: $NUXT_ROOT" >&2
exit 1
fi
echo "not yet implemented outside 08-10 Task 3" >&2
exit 1
PHASE8_UI_ALLOW_FINAL_GATE=1 node "$ROOT/scripts/check-phase8-ui.mjs" --final-gate
}
stage_unchanged_client_diff() {
# Fails the gate if either unchanged client worktree (MCP_ROOT/NUXT_ROOT)
# gains a Phase 8 source diff -- this repo never edits them.
echo "not yet implemented outside 08-10 Task 3" >&2
exit 1
# Fails the gate if either unchanged client worktree gains a Phase 8
# source diff -- this repo never edits them.
local name
for name in "$MCP_ROOT" "$NUXT_ROOT"; do
if [[ -d "$name/.git" ]] || git -C "$name" rev-parse --git-dir >/dev/null 2>&1; then
if [[ -n "$(git -C "$name" status --porcelain)" ]]; then
echo "refuse: unchanged client worktree has a diff: $name" >&2
git -C "$name" status --short >&2
exit 1
fi
fi
done
}
stage_security_review() {
echo "not yet implemented outside 08-10 Task 3" >&2
exit 1
local review="$ROOT/.planning/phases/08-oauth2-1-authorization-server/08-SECURITY-REVIEW.md"
if [[ ! -f "$review" ]]; then
echo "refuse: 08-SECURITY-REVIEW.md not found (08-10 Task adds it)" >&2
exit 1
fi
grep -q "^status: verified" "$review" || {
echo "refuse: 08-SECURITY-REVIEW.md is not status: verified" >&2
exit 1
}
}
run_full_gate() {
echo "refuse: the complete gate runs only from 08-10 Task 3" >&2
exit 1
stage_docker_preflight
stage_postgres
stage_app_boot
stage_real_mcp
stage_discovery
stage_dcr
stage_pkce_authorize
stage_jwt_login_consent
stage_token
stage_tool_call
stage_refresh
stage_replay
stage_revoke
stage_post_revoke_failure
stage_vet_test_race
stage_parity_corpus
stage_secret_scan
stage_ui_harness
stage_unchanged_client_diff
stage_security_review
echo "phase8 check passed"
}
main() {