[shiju-nv]

Summary

Agent policy proposals currently lose MCP tool selectors before approval. A proposal intended for one tools/call tool can therefore become broader than the agent requested. This change preserves supported selectors through parsing, review and runtime validation, and rejects fields that cannot be applied.

Related Issue

Part of #4679, acceptance criteria 1–3. Criterion 4, documenting the prover’s MCP limitations, remains a separate follow-up. Resolve that tracking split before landing; this PR does not close the full issue.

Changes

• Use the authored policy schema and shared converters for proposals, preserving MCP tools, params and versions, query selectors, and GraphQL selectors.
• Reject unsupported fields, endpoint path selectors, conflicting tool and params.name, and unloadable rules with actionable validation errors.
• Validate proposals without compiling a runtime engine or emitting runtime configuration events. Keep runtime load errors redacted.
• Show selectors in openshell rule get, escaping control characters so rule content cannot erase or rearrange the approval display. Update the advisor docs and in-sandbox guidance.
• Rebase the six-file change onto current main while preserving its per-instance policy state.

Release Notes

Target the next minor release. Unsupported proposal fields now return a validation error; earlier releases ignored them. Remove those fields and resubmit, or ask an administrator to add policy features reserved for operator-authored policy files.

Testing

• Checks appropriate to the affected code and behavior pass
• Unit tests added/updated
• E2E tests added/updated (not added; hosted E2E is pending for this head)

Focused checks pass: eight proposal-parser cases, three runtime validation cases, the shared MCP conversion case, and the existing CLI formatter case extended with control-character input. Scoped Clippy passes for the network, policy and CLI libraries and their tests.

Two isolated controls confirm the regressions: the proposal tests fail against actual main when only the new test cases are applied, and the formatter assertion fails when display escaping is removed. Formatting, SPDX, whitespace and affected docs checks also pass. test:e2e is applied; no current-head hosted runtime pass is claimed.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (supported proposal fields and migration guidance)

[github-actions]

Compatibility review (advisory)

New or updated breaking changes; see the full report for all findings.

1. api-behavior — No explicit risk acceptance found

POST /v1/proposals changed unsupported fields such as endpoint path from silently ignored during parsing to 400 invalid_proposal.

• Impact: Existing agents that relied on the documented ignore behavior receive no accepted chunk IDs until they remove those fields.
• Action: Keep ignoring unsupported fields in v0.1.5 while retaining newly supported selectors, or defer strict rejection to a minor release with notice and removal guidance.
• PR: fix(policy)!: keep MCP tool selectors in agent proposals #4736

Review details

• Execution: complete
• Candidate: PR #4736 (34b098d8506161d35c549afd3bf868d2119e29d7)
• Baseline: 7417f75384a02a12b30b736cc185bb08b814bd40 (7417f75384a02a12b30b736cc185bb08b814bd40)
• Reviewed: rust-sdk, python-sdk, go-sdk, typescript-sdk, api-behavior, cli, configuration, policy, helm, state

Advisory review; publication gates are unchanged.

Branch check run

[github-actions]

Label test:e2e applied for 513efa8. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway, sandbox, and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.