Problem/Motivation

McpBreakGlassTest asserts optional YAML ≡ ALLOWED_PERMISSIONS when the suite runs. A commit that changes only the YAML or only the constant can still merge if PHPUnit is skipped. For a security boundary constant, drift should be hard to ship.

Proposed resolution

  • Keep/strengthen the kernel assertion.
  • Document dual-edit rule in CONTRIBUTING / approval README.
  • Optionally add a cheap CI step beyond full kernel bootstrap.

Related

GitHub: #92. Allowlist seal: d.o #3614163.

Comments

jmcerda created an issue. See original summary.

jmcerda’s picture

jmcerda
Location Boca Raton, FL
commented
Issue summary: View changes
Status: Active » Needs review

Needs review: documented in GitHub PR #95 (companion #92).

Dual-edit rule for ALLOWED_PERMISSIONS ≡ optional role YAML is in the approval README and CONTRIBUTING. Kernel test remains the blocking CI check. Awaiting merge.

jmcerda’s picture

jmcerda
Location Boca Raton, FL
commented
Status: Needs review » Fixed

Fixed in PR #95 (merged to 1.x).

GitHub companion #92 closed as completed.

Dual-edit rule documented; kernel YAML≡constant test remains the CI gate.

Will land in the next tagged release after 2.2.0.

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

jmcerda’s picture

jmcerda
Location Boca Raton, FL
commented
Issue summary: View changes
Status: Fixed » Closed (fixed)

Closed (fixed): dual-edit rule documented (ALLOWED_PERMISSIONS ≡ optional role YAML); kernel contract test remains the blocking check. Shipped on 1.x via GitHub PR #95 (GitHub #92).

https://github.com/Wilkes-Liberty/mcp_sentinel/pull/95
https://github.com/Wilkes-Liberty/mcp_sentinel/issues/92