[jeremi]

Separate the citizen gateway's MCP transport from BReg behavior and add a configurable supporting service with independent provider credentials. Existing BReg deployments keep the released breg-mcp wrapper; the new registry-mcp binary is source-build-only.

Behavior

• Share protected HTTP transport, caller verification, rate limits and durable audit in registry-mcp-edge. Preserve the seven citizen tools, target ownership, draft/revision checks, retry identity and browser submission boundary.
• Configure BReg citizen, Casework staff and experimental Live Adapter read bindings explicitly. Citizen and staff bindings require separate inbound resources; tool arguments cannot select connections, credentials or profiles.
• Add default-off Casework delegated-reader routes for assigned-task listing and context. They require a trusted gateway, issuer-verified represented-human claim, required scopes, bounded token lifetime and current assignment. Reader-policy cursors support client rotation without crossing policies. Model-visible context excludes the internal policy closure.
• Support pinned Adapter GET/read-only POST operations, producer-generated golden contracts, closed input/output schemas, reviewed tool descriptions, typed failures and raw request correlation. Compile only configured reads. Invocation uses the producer's atomic contract precondition; catalog discovery checks authenticated readiness.
• Restore actionable, value-free operational logs, exact configuration diagnostics, partial catalog availability and graceful SIGTERM draining.

Source disclosure

An institution may explicitly grant a trusted BReg standing agent get-review-context, including on submitted Proposals, under an exact requester client and verified actor. This is an independent source service permission. It does not require a task grant or automatically intersect with the represented person's human BReg permissions. The institution must approve the agent profile's disclosure ceiling and reviewer population before enabling it. Submitted mutations and decisions remain refused.

The citizen wrapper retains its configuration and audit identity. Its catalog now sorts tool names alphabetically and acquires authorization per binding. Converting to registry-mcp changes the configuration envelope and generic audit namespaces; the migration guide explains retained-key and retry requirements.

Verification

• MCP, shared Edge and BReg compatibility packages: 267 passed, zero failed. Their 8 ignored native tests are separate prerequisites, not package-test passes.
• Complete Casework library: 96 passed. Synthetic authorization-server feature suite: 27 passed.
• Latest compatible Adapter checkpoint: 6/6 native PostgreSQL cases passed, including actual GET/read-only POST, output closure, drift, journal refusal, redirect/timeout and unsupported-write refusal. Native citizen and staff journeys also passed, for 8 native cases total, with no failed or ignored native cases.
• Strict all-target/all-feature MCP Clippy, formatting, schema synchronization, boundary probes and configuration conventions pass.
• Documentation: 940 tests; editors: 33; CI selection: 185; dependency-boundary tests: 12; identifier catalog: 29.

The final revision CI passed with 52 jobs passed, 11 skipped and zero failures. All 60 executed PR checks passed, including the separate CodeQL findings check; 11 checks were skipped. DCO, Render golden and all three CodeQL language analyses also passed.

The full CI matrix succeeded with 62 jobs passed, 6 skipped and zero failures, including the native staff PostgreSQL lane selected by ci:full. The final follow-ups correct two setup documents, remove four uncompiled duplicate modules, and keep unit-test assertion failure messages value-free. It uses normal protected CI; compiled runtime code is unchanged from that full-matrix proof. The 267 affected MCP package tests passed again after removal. Adapter native tests additionally require a separately built matching producer and owned database; the committed golden compatibility check runs without that producer.

Availability and limits

registry-mcp is not a release asset, installer component or image. The Adapter binding remains experimental while its compatible producer is separate work; integration order remains Adapter first, then MCP after matching proof. dataClass: non-personal is an unchecked operator attestation, and the positive external fixtures use facility data. External personal delegation and writes are outside this increment.

The Adapter prototype reads a machine token once at startup; automatic short-lived credential acquisition/renewal is deferred and token expiry requires replacement/restart. Native drills use synthetic issuers and sources; they do not establish stock or institutional issuer compatibility. No merge, release or deployment is performed by this PR.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-31T12:38:05.729116Z	d7d89e1	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.