test(factory): add fixture-only provenance-bound MCP OAuth scope step-up coverage by Copilot · Pull Request #2014 · groupthinking/EventRelay

Copilot · 2026-09-18T20:48:22Z

Canonical issue

Fixes #2005.

Outcome

This draft adds fixture-only, provenance-bound MCP OAuth scope step-up behavior for Agent Factory/EventRelay. Live authorization remains disabled.

Enforced fixture contract

Validates the JSON-RPC root, params, operation, and target before dynamic scope evaluation.
Covers tools/call, static and templated resources/read, and prompts/get.
Returns a pre-handler HTTP 403 challenge with the minimal complete scope set and canonical resource metadata.
Requires an active, unexpired operator approval bound to approval ID, provenance, operation, target, exact scopes, and metadata URL.
Preserves prior grants on retry and records challenged, prior, effective, and missing scopes separately.
Gives no authority to a challenge, model output, peer-agent GO, Skill content, Video Pack/OCR/canvas text, or workspace files.
Denies malformed input, scope confusion, missing provenance, revoked/expired approvals, target mismatch, metadata mismatch, and incomplete incremental grants.
Protects shared counters and receipt storage with locking and returns immutable receipt snapshots.
Percent-encodes metadata path segments and safely quotes WWW-Authenticate values.
Prevents fixture subprocess pipe deadlock and preserves the receipt policy during regeneration.

Evidence boundary

SDK reference: scope-challenge commit 6032170
Protocol reference: SEP-2350 commit 443f75d
Upstream conformance issue #480 and PR #481 remain open/unmerged.
The committed receipt therefore records official scope-step-up execution as not_executed_by_official_suite. It makes no official conformance or live OAuth claim.

Exact verified head

1134c78ee53ff6de3fa7c6a094266a371eb1fb15

The branch was refreshed onto main 276d738891361bb8a7118afe0785d5b11f3c91b9 before final verification.

Exact-head verification

CI: passed, including Python 3.10/3.11/3.12, production web build, lint, guards, and frontend tests
Security: passed, including repository Trivy, npm audit, Bandit, and Python safety
Security Scan: passed
Coverage: passed
Dependency Review: passed
E2E: passed
CodeQL and gitleaks: passed
All five inline review threads: resolved

Boundary and rollback

This remains an open, draft, unmerged PR. It performs no production activation, deployment, live OAuth exchange, provider spending, messaging, or merge. Rollback is a branch revert of the four fixture/conformance files.

coderabbitai · 2026-09-18T20:48:29Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: groupthinking/EventRelay/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: eb9c4330-1243-48b9-b60c-b36adc5b365c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

Co-authored-by: groupthinking <154503486+groupthinking@users.noreply.github.com>

…p-oauth-scope

vercel · 2026-09-18T21:01:54Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
v0-uvai	Building	Preview, v0	Sep 20, 2026 7:26am UTC

…p-oauth-scope

Copilot

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Pull request overview

Adds fixture-only MCP OAuth scope step-up enforcement and receipt tracking for the official conformance fixture server, along with new unit tests and updated conformance receipt metadata to document upstream/unmerged scope-step-up status.

Changes:

Introduced a scope step-up mode in the fixture server that returns pre-handler 403 challenges with WWW-Authenticate: ... insufficient_scope ... and emits machine-readable receipts.
Added unit tests covering challenge-then-retry, pre-handler enforcement for resources/prompts, and rejection of malformed targets / peer-agent provenance.
Updated the conformance harness + stored receipt JSON to pin scope-step-up SDK commit and track upstream issue/PR as unmerged and excluded from official claims.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

File	Description
tests/unit/test_official_mcp_conformance.py	Adds fixture-server start helper and new tests for scope step-up challenge/receipt behavior.
tests/testing/official_mcp_fixture_server.py	Implements fixture-only scope step-up enforcement, canonical target validation, and receipt emission endpoints.
tests/fixtures/mcp_conformance/official-2026-07-28-receipt.json	Records scope-step-up metadata/policy/exclusions in the stored conformance receipt.
scripts/testing/official_mcp_conformance.py	Extends receipt builder to include scope-step-up commit pin and upstream tracking metadata.

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

github-actions · 2026-09-18T22:19:21Z

🔍 PR Validation

⚠️ Large PR detected (875 lines changed)

github-actions · 2026-09-20T07:19:20Z

✅ E2E Test Results: ALL TESTS PASSED

Metric	Value
Status	🟢 GREEN
Total Tests
Passed	19
Failed
Deployment	https://v0-uvai-2ygu6ziek-garv1.vercel.app

Test Output

dout�[2m | tests/e2e/pipeline.test.ts�[2m > �[22m�[2mEventRelay E2E — Live Deployment�[2m > �[22m�[2mSSE Pipeline Stream�[2m > �[22m�[2mSSE stream emits at least a pipeline_status:running event
�[22m�[39m[E2E] last pipeline_status: complete

 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mSSE Pipeline Stream�[2m > �[22mSSE stream emits at least a pipeline_status:running event�[33m 18073�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mSSE Pipeline Stream�[2m > �[22mSSE stream closes within 90 seconds (no 95% hang)�[33m 18508�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mSSE Pipeline Stream�[2m > �[22mSSE events fire in correct agent order�[33m 15642�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mCloudEvent Schema�[2m > �[22mSSE events contain valid timestamps�[33m 13857�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mCloudEvent Schema�[2m > �[22mterminal pipeline_status includes duration and stage progress�[33m 16539�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mError Handling�[2m > �[22mmissing URL returns 400, not a hang�[32m 253�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mError Handling�[2m > �[22minvalid URL returns error event or completes quickly, not a hang�[33m 10848�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mDashboard�[2m > �[22m/dashboard returns 200�[33m 314�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mDashboard�[2m > �[22m/dashboard contains agent or pipeline visualization markup�[32m 196�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mAPI Health�[2m > �[22mGET /api returns a response (not 404)�[33m 371�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mAPI Health�[2m > �[22mPOST /api/pipeline/stream with no body returns 400�[32m 178�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mStatic Assets�[2m > �[22mhomepage has proper meta tags�[32m 181�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mStatic Assets�[2m > �[22m/features page returns 200�[32m 178�[2mms�[22m�[39m

�[2m Test Files �[22m �[1m�[32m1 passed�[39m�[22m�[90m (1)�[39m
�[2m      Tests �[22m �[1m�[32m19 passed�[39m�[22m�[90m (19)�[39m
�[2m   Start at �[22m 07:17:41
�[2m   Duration �[22m 98.55s�[2m (transform 51ms, setup 0ms, import 67ms, tests 98.35s, environment 0ms)�[22m

github-actions · 2026-09-20T07:28:12Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

github-actions · 2026-09-20T07:30:13Z

✅ E2E Test Results: ALL TESTS PASSED

Metric	Value
Status	🟢 GREEN
Total Tests
Passed	19
Failed
Deployment	https://v0-uvai-n9fubi84i-garv1.vercel.app

Test Output

tdout�[2m | tests/e2e/pipeline.test.ts�[2m > �[22m�[2mEventRelay E2E — Live Deployment�[2m > �[22m�[2mSSE Pipeline Stream�[2m > �[22m�[2mSSE stream emits at least a pipeline_status:running event
�[22m�[39m[E2E] last pipeline_status: complete

 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mSSE Pipeline Stream�[2m > �[22mSSE stream emits at least a pipeline_status:running event�[33m 25159�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mSSE Pipeline Stream�[2m > �[22mSSE stream closes within 90 seconds (no 95% hang)�[33m 19052�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mSSE Pipeline Stream�[2m > �[22mSSE events fire in correct agent order�[33m 19167�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mCloudEvent Schema�[2m > �[22mSSE events contain valid timestamps�[33m 26476�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mCloudEvent Schema�[2m > �[22mterminal pipeline_status includes duration and stage progress�[33m 19215�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mError Handling�[2m > �[22mmissing URL returns 400, not a hang�[32m 68�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mError Handling�[2m > �[22minvalid URL returns error event or completes quickly, not a hang�[33m 13160�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mDashboard�[2m > �[22m/dashboard returns 200�[32m 234�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mDashboard�[2m > �[22m/dashboard contains agent or pipeline visualization markup�[33m 1586�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mAPI Health�[2m > �[22mGET /api returns a response (not 404)�[32m 208�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mAPI Health�[2m > �[22mPOST /api/pipeline/stream with no body returns 400�[32m 56�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mStatic Assets�[2m > �[22mhomepage has proper meta tags�[32m 71�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mStatic Assets�[2m > �[22m/features page returns 200�[32m 88�[2mms�[22m�[39m

�[2m Test Files �[22m �[1m�[32m1 passed�[39m�[22m�[90m (1)�[39m
�[2m      Tests �[22m �[1m�[32m19 passed�[39m�[22m�[90m (19)�[39m
�[2m   Start at �[22m 07:28:06
�[2m   Duration �[22m 126.99s�[2m (transform 57ms, setup 0ms, import 72ms, tests 126.79s, environment 0ms)�[22m

groupthinking · 2026-09-20T07:37:05Z

Execution receipt — fixture-only OAuth scope step-up

Decision: TEST
Canonical issue: #2005
Artifact: PR #2014
Exact verified head: 1134c78ee53ff6de3fa7c6a094266a371eb1fb15

Inputs

TypeScript SDK scope-challenge commit: modelcontextprotocol/typescript-sdk@6032170
SEP-2350: modelcontextprotocol/modelcontextprotocol@443f75d
Proposed official conformance coverage: Add server conformance for SEP-2350 scope challenges modelcontextprotocol/conformance#480 and feat(server): add SEP-2350 scope challenge scenario modelcontextprotocol/conformance#481

Decision and mutation

The earlier PR head was non-draft but did not satisfy the issue’s security contract. I converted the existing canonical PR to draft and corrected it instead of opening competing work.

The corrected branch now:

validates malformed roots, params, operations, and targets before policy evaluation;
binds approval to operator provenance, approval ID, operation, target, exact scopes, metadata URL, active state, and expiry;
proves a challenge alone grants no authority and preserves prior grants on retry;
rejects peer-agent GO, missing provenance, revoked or expired approvals, metadata mismatch, and hierarchy/scope confusion;
emits immutable, lock-protected, machine-readable challenge/decision/retry/outcome receipts;
safely encodes metadata URLs and quoted challenge fields;
avoids subprocess pipe deadlock;
regenerates the complete scope-step-up receipt policy; and
records upstream scope-step-up conformance as unmerged and not executed, so no official or live compatibility claim is made.

The branch was then refreshed onto current main 276d738891361bb8a7118afe0785d5b11f3c91b9 with an explicit merge commit and reverified at the exact head above.

Verification

CI: https://github.com/groupthinking/EventRelay/actions/runs/35496866049 — passed
Security/Trivy/npm audit/Bandit/Python safety: https://github.com/groupthinking/EventRelay/actions/runs/35496866064 — passed
Security Scan: https://github.com/groupthinking/EventRelay/actions/runs/35496866042 — passed
Coverage: https://github.com/groupthinking/EventRelay/actions/runs/35496866037 — passed
Dependency Review: https://github.com/groupthinking/EventRelay/actions/runs/35496866071 — passed
E2E: https://github.com/groupthinking/EventRelay/actions/runs/35496866066 — passed
CodeQL and gitleaks: passed
Review threads: 5/5 resolved
PR state after verification: open, draft, mergeable, unmerged

Boundary and next action

No merge, deployment, live authorization exchange, provider invocation, spending, or production mutation occurred.

Next action is an exact-head human review and explicit approval before merging 1134c78ee53ff6de3fa7c6a094266a371eb1fb15.

Initial plan

1d51b3f

Copilot AI assigned Copilot and groupthinking Sep 18, 2026

Copilot started work on behalf of groupthinking September 18, 2026 20:51 View session

Copilot AI linked an issue Sep 18, 2026 that may be closed by this pull request

test(factory): add provenance-bound MCP OAuth scope step-up fixtures #2005

Open

8 tasks

test(mcp): add fixture-only oauth scope step-up coverage

dbb0b13

Co-authored-by: groupthinking <154503486+groupthinking@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Add fixture-only provenance-bound MCP OAuth scope step-up behavior~~ test(factory): add fixture-only provenance-bound MCP OAuth scope step-up coverage Sep 18, 2026

Copilot finished work on behalf of groupthinking September 18, 2026 20:57

Copilot AI requested a review from groupthinking September 18, 2026 20:57

groupthinking marked this pull request as ready for review September 18, 2026 20:59

Copilot AI balanced review requested due to automatic review settings September 18, 2026 20:59

Merge branch 'main' into copilot/test-factory-add-provenance-bound-mc…

9428de4

…p-oauth-scope

vercel Bot reviewed Sep 18, 2026

View reviewed changes

Comment thread scripts/testing/official_mcp_conformance.py

groupthinking approved these changes Sep 18, 2026

View reviewed changes

Merge branch 'main' into copilot/test-factory-add-provenance-bound-mc…

f15d517

…p-oauth-scope

Copilot AI reviewed Sep 18, 2026

View reviewed changes

Comment thread tests/testing/official_mcp_fixture_server.py

Comment thread tests/testing/official_mcp_fixture_server.py

Comment thread tests/testing/official_mcp_fixture_server.py

Comment thread tests/unit/test_official_mcp_conformance.py Outdated

vercel Bot deployed to Preview September 18, 2026 21:40 View deployment

Copilot started reviewing on behalf of groupthinking September 18, 2026 21:50 View session

github-actions Bot added the python label Sep 18, 2026

groupthinking marked this pull request as draft September 20, 2026 07:11

test(factory): harden provenance-bound scope step-up receipts

eccff7a

vercel Bot deployed to Preview September 20, 2026 07:17 View deployment

Merge current main into fixture-only scope-step-up draft

1134c78

vercel Bot deployed to Preview September 20, 2026 07:27 View deployment

Navigation Menu

test(factory): add fixture-only provenance-bound MCP OAuth scope step-up coverage - #2014

test(factory): add fixture-only provenance-bound MCP OAuth scope step-up coverage#2014
groupthinking with Copilot wants to merge 6 commits into
mainfrom
copilot/test-factory-add-provenance-bound-mcp-oauth-scope

Copilot AI commented Sep 18, 2026 •

edited by groupthinking

Loading

Uh oh!

coderabbitai Bot commented Sep 18, 2026 •

edited

Loading

Review skipped

Uh oh!

vercel Bot commented Sep 18, 2026 •

edited

Loading

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Sep 18, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 20, 2026

Uh oh!

github-actions Bot commented Sep 20, 2026

Uh oh!

github-actions Bot commented Sep 20, 2026

Uh oh!

groupthinking commented Sep 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Copilot AI commented Sep 18, 2026 • edited by groupthinking Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Canonical issue

Outcome

Enforced fixture contract

Evidence boundary

Exact verified head

Exact-head verification

Boundary and rollback

Uh oh!

coderabbitai Bot commented Sep 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

vercel Bot commented Sep 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Sep 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 PR Validation

Uh oh!

github-actions Bot commented Sep 20, 2026

✅ E2E Test Results: ALL TESTS PASSED

Uh oh!

github-actions Bot commented Sep 20, 2026

Dependency Review

Scanned Files

Uh oh!

github-actions Bot commented Sep 20, 2026

✅ E2E Test Results: ALL TESTS PASSED

Uh oh!

groupthinking commented Sep 20, 2026

Execution receipt — fixture-only OAuth scope step-up

Inputs

Decision and mutation

Verification

Boundary and next action

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Sep 18, 2026 •

edited by groupthinking

Loading

coderabbitai Bot commented Sep 18, 2026 •

edited

Loading

vercel Bot commented Sep 18, 2026 •

edited

Loading

github-actions Bot commented Sep 18, 2026 •

edited

Loading