feat(policy): preserve exact MCP revision allowlists

[shiju-nv]

Summary

OpenShell cannot apply revision-specific MCP rules unless each inspected endpoint carries the exact revisions it allows. This PR adds a nonempty mcp.versions allowlist and preserves its validated value through provider profiles, policy storage and composition, merge checks, hashing, history listing, sandbox configuration, and SDK conversions. Omitted lists become exactly ["2025-11-25"], explicit lists are sorted, and invalid or duplicate entries are rejected so a later registry change cannot widen a stored policy.

Related Issue

Closes #2954.
Part of #2174.

Changes

• Define a closed registry for the supported stable revisions 2025-03-26, 2025-06-18, and 2025-11-25, including the batch-shape facts needed by runtime enforcement. Add an exact mcp.versions allowlist to protobuf, provider profiles, policy YAML, and the Go SDK. Empty lists, duplicates, padded strings, unsupported dates, draft, and latest are rejected. An omitted allowlist materializes as exactly ["2025-11-25"]; the stored default never follows the newest registry entry.
• Preserve the normalized allowlist in provider snapshots, stored revisions, policy composition, coverage checks, deterministic hashes, sandbox configuration, and SDK deep copies.
• Treat policies with disjoint revision allowlists as incompatible for MCP inspection so merge cannot discard either restriction. Reject active policies that name an unsupported revision or attach MCP options to an endpoint that is not inspected as MCP.
• Keep invalid historical rows visible as failed list entries so one legacy record cannot hide the remaining revision history. Resolve a valid global policy before dormant invalid local state so operators retain the existing global-override recovery path and credential-policy protections.
• Preserve forward compatibility for unknown outer endpoint-profile fields, validate the MCP options object strictly, and render conformance policy from the runner-selected supported revision.

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[johntmyers]

gator-agent

PR Review Status

The exact MCP revision allowlist is carried through the intended policy, profile, storage, SDK, and documentation surfaces, but the supervisor's protobuf ingress rejects the newly documented omitted/defaultable representation before it can be canonicalized.

Action required: Canonicalize defaultable MCP policy protobufs at supervisor ingress and add regression coverage before test dispatch.

Blocking findings:

• GATOR-cc9343d3-01: Supervisor protobuf loading rejects omitted or empty MCP version lists instead of materializing the pinned default.

Carried findings:

• None

Gator metadata

• Validation: Project-valid policy feature linked to issue #2954; the operator explicitly requested review and monitoring.
• Docs: Fern policy documentation and architecture guidance are updated.
• Checks: Current-head branch and required gates are green; required E2E has not yet been dispatched.
• E2E: test:e2e is required for policy/gateway/supervisor behavior but waits for blocking review feedback to resolve.
• Head SHA: cc9343d307642b1665144d19e1e731084dd0effb
• Base SHA: c93b2fa7da3a40a6dd6c077973cb13d2755f7e50
• Merge base SHA: 0f0c94bda3a2056bd3413accd13e361488288cc4
• Patch ID: 9c4005b9b01cad006e15c06c59e74b709717c92f
• Gator payload: 8
• Review mode: initial
• Previous reviewed SHA: none
• Review budget exhausted: no
• Maintainer decision required: no
• Next state: gator:in-review

[github-actions]

Label test:e2e applied for c6f1857. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.

[johntmyers]

gator-agent

PR Review Status

The follow-up review confirms that the latest commit canonicalizes defaultable MCP policy protobufs at the supervisor ingress paths and adds regression coverage. The prior blocking finding is resolved, and no new blocking findings were found in the author-only delta.

Blocking findings:

• No blocking findings remain

Carried findings:

• GATOR-cc9343d3-01: resolved by the current head; the Gator-owned thread has been closed.

Gator metadata

• Validation: Project-valid exact MCP revision allowlist feature linked to issue #2954.
• Docs: Fern policy documentation and architecture guidance are updated.
• Checks: Current-head branch checks are still running.
• E2E: test:e2e is applied; the current-head E2E Label Help workflow is still determining the required dispatch action.
• Head SHA: c6f1857c70463ecb8e1cf596945c24c074daf686
• Base SHA: c93b2fa7da3a40a6dd6c077973cb13d2755f7e50
• Merge base SHA: 0f0c94bda3a2056bd3413accd13e361488288cc4
• Patch ID: 3d3f6cee5bf2532265695ed52293e0ebcca2acdc
• Gator payload: 8
• Review mode: follow_up
• Previous reviewed SHA: cc9343d307642b1665144d19e1e731084dd0effb
• Review budget exhausted: no
• Maintainer decision required: no
• Next state: gator:in-review

[johntmyers]

gator-agent

Monitoring Complete

Monitoring is complete because this PR has merged.

Final status: Gator review converged with no blocking findings remaining, maintainer approval was present, and the required Branch Checks, Helm Lint, and E2E gates passed.

I removed the active gator:* label because there is nothing left for gator to monitor on this PR.

Gator metadata

• Head SHA: c6f1857c70463ecb8e1cf596945c24c074daf686
• Gator payload: 8
• Final state: merged