sayan-oai 9fcaeb7335 Use MCP owner permissions for Guardian reviews and score reuse (#59489) ...

## Why

An MCP server can belong to a different environment from the turn's primary environment. An early Guardian score based on the issuing context must not bypass review when the server owner's permissions differ.

## What changed

- Capture the owning environment's permissions when preparing an MCP call and retain them for server-initiated approvals tied to that still-running call.
- Use the captured permissions consistently in Guardian review prompts and permission context.
- Require a fresh synchronous review when the captured owner permissions do not match the early score's authorization.

## Testing

Extend regression coverage for MCP score reuse across environments and for follow-up approvals from a local MCP server during a remote-primary turn. Assert that reviews use the owner's denied paths and require a fresh review when permissions differ.

GitOrigin-RevId: eb5eeb1259732c57f39765c38e34148fa0787dae

2026-11-04 20:37:39 +00:00

..

common

Extract agent message board hosting into a dedicated crate (#59473)

2026-11-04 19:10:59 +00:00

remote_env_windows

Bind capability roots to environment selections (#51493)

2026-10-06 22:39:32 +00:00

suite

Use MCP owner permissions for Guardian reviews and score reuse (#59489)

2026-11-04 20:37:39 +00:00

windows_sandbox

Respect filesystem permissions when discovering repository skills (#59280)

2026-11-04 01:15:38 +00:00

all.rs

[codex] Use expect in integration tests (#28441)

2026-06-15 21:53:47 -07:00

code_mode_tracing.rs

Add code-mode output truncation protocol contracts (#57272)

2026-10-26 21:36:35 +00:00

mcp_trace_propagation.rs

Add negotiated network policy metadata support for MCP calls (#56278)

2026-10-22 22:33:07 +00:00

responses_headers.rs

Route response item IDs through a shared generator (#59312)

2026-11-04 04:02:00 +00:00

windows_sandbox.rs

Respect filesystem permissions when discovering repository skills (#59280)

2026-11-04 01:15:38 +00:00