komodo-mcp (typed, redacted, allowlisted) + names-only change records on Updates

[thedancingdeveloper]

Implements Vogt WI-846 (Komodo MCP) and WI-865 (change attribution and names-only diffs). They are split into two commits.

1. feat(core): names-only diffs and the asserted actor on Updates (WI-865)

• New fork-only crate lib/names_diff. It does a Komodo-compatible env parse (including multi-line quoted values), produces sha256:<12hex>/<len> fingerprints, and diffs resource TOML. Values appear only for an allowlist of non-secret fields (default-deny).
• bin/core/src/tdd: Core adds logs to Updates without touching the schema, the API types or the UI:
  • Config diff (names only) on every resource config update (resource::update).
  • Actor (asserted) from X-Komodo-Actor / X-Komodo-Reason, carried through a task_local (router layer on /write and /execute, plus propagate around the spawned write task). The header is asserted, not authenticated, so it serves attribution only.
  • File change (names only) on WriteStackFileContents.
• The hooks are additive, one or two lines each and marked FORK (WI-865). The single modified upstream line wraps the write tokio::spawn in tdd::propagate. The conflict table in docs/tdd/MAINTENANCE.md is updated.
• Core is not redeployed by this PR (operator decision).

2. feat(mcp): bin/mcp / komodo-mcp (WI-846)

A stdio MCP server on the typed komodo_client. Tools:

• Read-only: stack_lookup, get_stack, env_diff, read_stack_file, container_health, container_logs, stack_history.
• Mutating: write_stack_file and deploy_stack.
• Details in bin/mcp/README.md.
• Redaction is default-deny. The stack is projected per field from Komodo's own types, unclassified fields are withheld, and every_stack_field_is_classified fails when a rebase adds a field. A scrubber is the second layer: it replaces every known env value and common token shape in every result, including logs and error text.
• Allowlist. The server is read-only by default (KOMODO_MCP_WRITE_STACKS). *prod* is protected and needs an exact name in KOMODO_MCP_ALLOW_PROTECTED. Rules are matched on the resolved stack name, so passing an id cannot bypass them.
• write_stack_file runs RefreshStackCache first, skips identical content, refuses .env files, and re-refreshes afterwards to verify.
• deploy_stack polls the Update until it completes and returns pass/fail. On failure it adds the failing stage's tail (HTML stripped, scrubbed); on success it adds container health.
• History works without the Core change. stack_history and env_diff {last_successful_deploy} diff the Update prev_toml/current_toml client-side, so they work against today's unpatched Core.
• The binary is also built into scripts/tdd/core-only.Dockerfile at /usr/local/bin/komodo-mcp. CI fmt/test now covers names_diff and komodo_mcp, plus cargo test -p komodo_core tdd::.

Verification

• cargo test -p names_diff passes (11 tests). cargo test -p komodo_mcp passes (26 tests): unit tests, plus mock-Core end-to-end tests through every tool with fake secrets. The mock deserializes each request into Komodo's request types and covers allowlist and id-bypass refusal, write ordering (refresh, write, refresh) and deploy polling.
• cargo test -p komodo_core tdd:: passes (5 tests). The documented checks cargo test -p interpolate -p infisical --locked and cargo check -p komodo_core -p komodo_periphery --locked pass.
• cargo fmt and cargo clippy --all-targets are clean on the fork crates. Upstream files keep their baseline formatting.
• Live read-only smoke against Core 2.2.0, run locally with toolchain 1.98 (CI pins 1.95):
  • All read tools ran on vogt-dev/vogt-prod, and mutations were refused.
  • Every output was checked against the 33 real env values of both stacks, with the public stack names excluded: 0 leaks.
  • stack_history(vogt-prod) shows the 2026-10-02 UpdateStack as names only: 5 keys added (MYDEVENV2_ASSISTANT_*, VOGT_IMAGE, VOGT_STACK_IMAGE) and MYDEVENV2_FCM_SERVICE_ACCOUNT_JSON changed.
  • No actor shows on that Update, because Core is unpatched.

Not done here

• Registering the server through mcp-bootstrap, pointing the komodo skill at the MCP, and retiring the curl recipes are follow-ups.
• Redeploying Core is the operator's call.

🤖 Generated with Claude Code